@tearleads/client-sdk 0.1.57 → 0.1.59

package/Tearleads.d.ts

@@ -17,9 +17,9 @@ import type { Session } from "./client/session/sessionTypes.js";
 import { SyncBillingGate } from "./client/syncBillingGate.js";
 import { type UserIdentities } from "./client/userIdentities.js";
 import { type Runtime } from "./client/workflowRuntime.js";
-import type { BlobStore } from "./data/blobContracts.js";
+import type { BlobStore } from "./data/blobs/blobContracts.js";
 import { type DocumentProjectorRegistryInput } from "./data/documents/documentKinds.js";
-import { type DomainScope } from "./data/domainScope.js";
+import { type DomainScope } from "./data/shared/domainScope.js";
 import type { ProvisionedSystemContainerSpec } from "./workflows/registration/index.js";
 export type ClientDatabaseOptions = Omit<DatabaseOptions, "status">;
 export interface ClientOptions {

package/Tearleads.js

@@ -17,8 +17,8 @@ import { SyncBillingGate } from "./client/syncBillingGate.js";
 import { createUserIdentities, } from "./client/userIdentities.js";
 import { createRuntime, } from "./client/workflowRuntime.js";
 import { resolveDocumentProjectorRegistry, } from "./data/documents/documentKinds.js";
-import { createDomainScope } from "./data/domainScope.js";
 import { createVerifiedManifestCitations } from "./data/persistence/verifiedManifestBundlePersistence.js";
+import { createDomainScope } from "./data/shared/domainScope.js";
 import { disposeDomainSyncCoordinator } from "./data/sync/syncCoordinator.js";
 import { resolveIdentityTrustDomain } from "./data/trustedUserIdentity/index.js";
 function createClientSecurityIncidentService(input) {

package/Tearleads.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAyB,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAEL,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAwB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAkB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,cAAc,GAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAe,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EACL,6BAA6B,GAG9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,GAGd,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AAEvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE,SAAS,mCAAmC,CAAC,KAK5C;IACC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;KACvD,CAAC,CAAC;IACH,OAAO;QACL,mBAAmB;QACnB,OAAO,EAAE,6BAA6B,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAC5C,WAAW,EAAE,mBAAmB;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AA4CD,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAAyB,EAAE;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,QAAQ,GAAG,mCAAmC,CAAC;YACnD,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,QAAQ,CAAC,mBAAmB,EAC5B,OAAO,EACP,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YACpD,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport { ApiVersion } from \"./client/apiVersion\";\nimport { type BlobStoreFactory, Blobs } from \"./client/blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./client/containerContents\";\nimport { Database, type DatabaseOptions } from \"./client/database\";\nimport { createDeviceFirst, type DeviceFirst } from \"./client/deviceFirst\";\nimport { createDocuments, type Documents } from \"./client/documents\";\nimport { Events } from \"./client/events\";\nimport {\n  createIdentity,\n  type Identity,\n  type IdentityOptions,\n} from \"./client/identity\";\nimport { type Logger, logErrorToConsole } from \"./client/logger\";\nimport { Network } from \"./client/network\";\nimport {\n  createOrganizations,\n  type Organizations,\n} from \"./client/organizations\";\nimport type { PrincipalHistoryKeyProvider } from \"./client/principalHistoryProtection\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./client/root\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidentListener,\n  type SecurityIncidents,\n} from \"./client/securityIncidents\";\nimport { createSession } from \"./client/session\";\nimport type { Session } from \"./client/session/sessionTypes\";\nimport { SyncBillingGate } from \"./client/syncBillingGate\";\nimport {\n  createUserIdentities,\n  type UserIdentities,\n} from \"./client/userIdentities\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./client/workflowRuntime\";\nimport type { BlobStore } from \"./data/blobContracts\";\nimport {\n  type DocumentProjectorRegistry,\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"./data/documents/documentKinds\";\nimport { createDomainScope, type DomainScope } from \"./data/domainScope\";\nimport { createVerifiedManifestCitations } from \"./data/persistence/verifiedManifestBundlePersistence\";\nimport type { SecurityIncidentReporter } from \"./data/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"./data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"./data/trustedUserIdentity\";\nimport type { ProvisionedSystemContainerSpec } from \"./workflows/registration\";\n\nfunction createClientSecurityIncidentService(input: {\n  readonly apiBaseUrl: string;\n  readonly database: Database;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly options: ClientOptions;\n}) {\n  const identityTrustDomain = resolveIdentityTrustDomain({\n    apiBaseUrl: input.apiBaseUrl,\n    identityTrustDomain: input.options.identityTrustDomain,\n  });\n  return {\n    identityTrustDomain,\n    service: createSecurityIncidentService({\n      database: input.database,\n      logError: input.logError,\n      onIncident: input.options.onSecurityIncident,\n      trustDomain: identityTrustDomain,\n    }),\n  };\n}\n\nexport type ClientDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\nexport interface ClientOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: ClientDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: ClientOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const security = createClientSecurityIncidentService({\n      apiBaseUrl,\n      database: this.database,\n      logError: this.logError,\n      options,\n    });\n    this.securityIncidents = security.service.incidents;\n    this.disposeSecurityIncidents = security.service.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.service.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      security.identityTrustDomain,\n      options,\n      security.service.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      getOrganizationId: () => this.session.organizationId,\n      reportSecurityIncident: security.service.report,\n      identityLinks: runtime.identityLinks,\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}
+{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAyB,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAEL,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAwB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAkB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,cAAc,GAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAe,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EACL,6BAA6B,GAG9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,GAGd,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE,SAAS,mCAAmC,CAAC,KAK5C;IACC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;KACvD,CAAC,CAAC;IACH,OAAO;QACL,mBAAmB;QACnB,OAAO,EAAE,6BAA6B,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAC5C,WAAW,EAAE,mBAAmB;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AA4CD,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAAyB,EAAE;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,QAAQ,GAAG,mCAAmC,CAAC;YACnD,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,QAAQ,CAAC,mBAAmB,EAC5B,OAAO,EACP,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YACpD,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport { ApiVersion } from \"./client/apiVersion\";\nimport { type BlobStoreFactory, Blobs } from \"./client/blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./client/containerContents\";\nimport { Database, type DatabaseOptions } from \"./client/database\";\nimport { createDeviceFirst, type DeviceFirst } from \"./client/deviceFirst\";\nimport { createDocuments, type Documents } from \"./client/documents\";\nimport { Events } from \"./client/events\";\nimport {\n  createIdentity,\n  type Identity,\n  type IdentityOptions,\n} from \"./client/identity\";\nimport { type Logger, logErrorToConsole } from \"./client/logger\";\nimport { Network } from \"./client/network\";\nimport {\n  createOrganizations,\n  type Organizations,\n} from \"./client/organizations\";\nimport type { PrincipalHistoryKeyProvider } from \"./client/principalHistoryProtection\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./client/root\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidentListener,\n  type SecurityIncidents,\n} from \"./client/securityIncidents\";\nimport { createSession } from \"./client/session\";\nimport type { Session } from \"./client/session/sessionTypes\";\nimport { SyncBillingGate } from \"./client/syncBillingGate\";\nimport {\n  createUserIdentities,\n  type UserIdentities,\n} from \"./client/userIdentities\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./client/workflowRuntime\";\nimport type { BlobStore } from \"./data/blobs/blobContracts\";\nimport {\n  type DocumentProjectorRegistry,\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"./data/documents/documentKinds\";\nimport { createVerifiedManifestCitations } from \"./data/persistence/verifiedManifestBundlePersistence\";\nimport { createDomainScope, type DomainScope } from \"./data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"./data/shared/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"./data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"./data/trustedUserIdentity\";\nimport type { ProvisionedSystemContainerSpec } from \"./workflows/registration\";\n\nfunction createClientSecurityIncidentService(input: {\n  readonly apiBaseUrl: string;\n  readonly database: Database;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly options: ClientOptions;\n}) {\n  const identityTrustDomain = resolveIdentityTrustDomain({\n    apiBaseUrl: input.apiBaseUrl,\n    identityTrustDomain: input.options.identityTrustDomain,\n  });\n  return {\n    identityTrustDomain,\n    service: createSecurityIncidentService({\n      database: input.database,\n      logError: input.logError,\n      onIncident: input.options.onSecurityIncident,\n      trustDomain: identityTrustDomain,\n    }),\n  };\n}\n\nexport type ClientDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\nexport interface ClientOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: ClientDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: ClientOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const security = createClientSecurityIncidentService({\n      apiBaseUrl,\n      database: this.database,\n      logError: this.logError,\n      options,\n    });\n    this.securityIncidents = security.service.incidents;\n    this.disposeSecurityIncidents = security.service.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.service.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      security.identityTrustDomain,\n      options,\n      security.service.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      getOrganizationId: () => this.session.organizationId,\n      reportSecurityIncident: security.service.report,\n      identityLinks: runtime.identityLinks,\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}

package/client/blobs.d.ts

@@ -1,4 +1,4 @@
-import type { BlobStore } from "../data/blobContracts.js";
+import type { BlobStore } from "../data/blobs/blobContracts.js";
 export type BlobStoreFactory = (namespace: string) => BlobStore;
 export declare class Blobs {
     private readonly ephemeralStore;

package/client/blobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"blobs.js","sourceRoot":"","sources":["blobs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAItE,MAAM,OAAO,KAAK;IACC,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAClD,cAAc,GAAG,KAAK,CAAC;IACd,mBAAmB,CAAmB;IAC/C,UAAU,CAAY;IAE9B,YACE,KAA6B,EAC7B,sBAAwC,eAAe;QAEvD,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC;IACjD,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC;IACxC,CAAC;IAED,oBAAoB,CAAC,kBAA0B;QAC7C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAED,uBAAuB,CAAC,kBAAiC;QACvD,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YACnE,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;CACF","sourcesContent":["import type { BlobStore } from \"../data/blobContracts\";\nimport { createBlobStore } from \"../data/blobs/createBlobStore\";\nimport { createMemoryBlobStore } from \"../data/blobs/memoryBlobStore\";\n\nexport type BlobStoreFactory = (namespace: string) => BlobStore;\n\nexport class Blobs {\n  private readonly ephemeralStore = createMemoryBlobStore();\n  private identityScoped = false;\n  private readonly createIdentityStore: BlobStoreFactory;\n  private storeValue: BlobStore;\n\n  constructor(\n    store?: BlobStore | undefined,\n    createIdentityStore: BlobStoreFactory = createBlobStore,\n  ) {\n    this.createIdentityStore = createIdentityStore;\n    this.storeValue = store ?? this.ephemeralStore;\n  }\n\n  get store(): BlobStore {\n    return this.storeValue;\n  }\n\n  useEphemeralStore(): void {\n    this.identityScoped = false;\n    this.storeValue = this.ephemeralStore;\n  }\n\n  useIdentityNamespace(signingFingerprint: string): void {\n    this.identityScoped = true;\n    this.storeValue = this.createIdentityStore(signingFingerprint);\n  }\n\n  updateIdentityNamespace(signingFingerprint: string | null): void {\n    if (this.identityScoped || this.storeValue === this.ephemeralStore) {\n      if (signingFingerprint) {\n        this.useIdentityNamespace(signingFingerprint);\n        return;\n      }\n\n      this.useEphemeralStore();\n    }\n  }\n}\n"]}
+{"version":3,"file":"blobs.js","sourceRoot":"","sources":["blobs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAItE,MAAM,OAAO,KAAK;IACC,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAClD,cAAc,GAAG,KAAK,CAAC;IACd,mBAAmB,CAAmB;IAC/C,UAAU,CAAY;IAE9B,YACE,KAA6B,EAC7B,sBAAwC,eAAe;QAEvD,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC;IACjD,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC;IACxC,CAAC;IAED,oBAAoB,CAAC,kBAA0B;QAC7C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAED,uBAAuB,CAAC,kBAAiC;QACvD,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YACnE,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;CACF","sourcesContent":["import type { BlobStore } from \"../data/blobs/blobContracts\";\nimport { createBlobStore } from \"../data/blobs/createBlobStore\";\nimport { createMemoryBlobStore } from \"../data/blobs/memoryBlobStore\";\n\nexport type BlobStoreFactory = (namespace: string) => BlobStore;\n\nexport class Blobs {\n  private readonly ephemeralStore = createMemoryBlobStore();\n  private identityScoped = false;\n  private readonly createIdentityStore: BlobStoreFactory;\n  private storeValue: BlobStore;\n\n  constructor(\n    store?: BlobStore | undefined,\n    createIdentityStore: BlobStoreFactory = createBlobStore,\n  ) {\n    this.createIdentityStore = createIdentityStore;\n    this.storeValue = store ?? this.ephemeralStore;\n  }\n\n  get store(): BlobStore {\n    return this.storeValue;\n  }\n\n  useEphemeralStore(): void {\n    this.identityScoped = false;\n    this.storeValue = this.ephemeralStore;\n  }\n\n  useIdentityNamespace(signingFingerprint: string): void {\n    this.identityScoped = true;\n    this.storeValue = this.createIdentityStore(signingFingerprint);\n  }\n\n  updateIdentityNamespace(signingFingerprint: string | null): void {\n    if (this.identityScoped || this.storeValue === this.ephemeralStore) {\n      if (signingFingerprint) {\n        this.useIdentityNamespace(signingFingerprint);\n        return;\n      }\n\n      this.useEphemeralStore();\n    }\n  }\n}\n"]}

package/client/deviceFirst.js.map

@@ -1 +1 @@
-{"version":3,"file":"deviceFirst.js","sourceRoot":"","sources":["deviceFirst.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,mCAAmC,EACnC,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAG3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0DAA0D,CAAC;AAC9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,wDAAwD,CAAC;AAC9G,OAAO,EAEL,uCAAuC,EACvC,2CAA2C,GAC5C,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAE,wCAAwC,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,iCAAiC,CAAC;AAiCxF,MAAM,UAAU,iBAAiB,CAC/B,cAA+B,EAC/B,iBAAoC;IAEpC,OAAO,IAAI,kBAAkB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AASD,SAAS,8BAA8B,CACrC,cAA+B,EAC/B,WAA8C;IAO9C,OAAO;QACL,wBAAwB,EAAE,CAAC,WAAW,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAC;YACjE,OAAO,kCAAkC,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW;gBACX,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QACD,+BAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/C,MAAM,OAAO,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAC;YACjE,OAAO,oCAAoC,CAAC;gBAC1C,GAAG,KAAK;gBACR,IAAI,EAAE;oBACJ,uBAAuB,EAAE,CAAC,WAAW,EAAE,EAAE,CACvC,uCAAuC,CAAC,OAAO,EAAE,WAAW,CAAC;oBAC/D,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,iBAAiB,CACf,WAAW,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,UAAU,CAClB;iBACJ;gBACD,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QACD,kCAAkC,EAAE,CAAC,cAAc,EAAE,EAAE;YACrD,cAAc;iBACX,aAAa,EAAE;iBACf,IAAI,CAAC,GAAG,CACP,8CAA8C,cAAc,QAAQ,CACrE,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB;IAWH;IACA;IAXnB,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6DAA6D;IAC5C,cAAc,GAAG,IAAI,GAAG,EAGtC,CAAC;IAEJ,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAEJ,IAAI,CACF,OAAmD;QAEnD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACjD,CAAC;IAED,OAAO;QACL,oEAAoE;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,wCAAwC;QACxC,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACjC,KAAK,CAAC,gCAAgC,EAAE,CAAC;YACzC,KAAK,CAAC,qCAAqC,EAAE,CAAC;YAC9C,KAAK,CAAC,6BAA6B,EAAE,CAAC;YACtC,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAEO,eAAe;QACrB,OAAO,gCAAgC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;IAEO,gBAAgB,CACtB,OAAmD;QAEnD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC;YAC5C,WAAW;YACX,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,2BAA2B,CACzC,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,WAAW,CAAC,CAClD,CAAC;QACF,MAAM,gCAAgC,GAAG,6BAA6B,CAAC;YACrE,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,MAAM,qCAAqC,GACzC,qCAAqC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;YAC7D,KAAK,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,MAAM,6BAA6B,GAAG,6BAA6B,CACjE,WAAW,EACX,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CACnB,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CACpE,CAAC;QACF,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,MAAM,IAAI,GAAwB;YAChC,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;YAClD,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE,CAClC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC;YACvC,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC;SACjE,CAAC;QAEF,MAAM,KAAK,GAA0B;YACnC,QAAQ,EAAE;gBACR,cAAc,EAAE,KAAK,CAAC,iBAAiB,EAAE;gBACzC,UAAU,EAAE,OAAO;gBACnB,IAAI;aACL;YACD,gCAAgC;YAChC,qCAAqC;YACrC,6BAA6B;SAC9B,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,wBAAwB,CAC9B,KAA2B,EAC3B,WAA8C;QAE9C,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACjD,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;YACvE,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,KAAK;iBACF,WAAW,EAAE;iBACb,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,IAAI;YACzE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,iBAAiB,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC9C,mCAAmC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAC3D,mCAAmC,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC;SACxE,CAAC,CAAC;QACH,MAAM,6BAA6B,GAAG,CAAC,WAAmB,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,KAAK;iBACpB,WAAW,EAAE;iBACb,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,CAAC,CAAC;QACF,MAAM,qBAAqB,GAAG,GAAG,EAAE;YACjC,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,8BAA8B;YAC9B,MAAM,kBAAkB,GACtB,cAAc,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;YACrD,OAAO,KAAK;iBACT,WAAW,EAAE;iBACb,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,2BAA2B,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBACnD,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACX,CAAC,CAAC,EAAE,CACP,CAAC;QACN,CAAC,CAAC;QACF,MAAM,oCAAoC,GAAG,GAAG,EAAE;YAChD,MAAM,kBAAkB,GACtB,cAAc,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;YACrD,OAAO,KAAK;iBACT,WAAW,EAAE;iBACb,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,mCAAmC,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAC3D,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACX,CAAC,CAAC,EAAE,CACP,CAAC;QACN,CAAC,CAAC;QACF,OAAO;YACL,KAAK,EAAE,yBAAyB;YAChC,WAAW;YACX,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC;YACzE,6BAA6B;YAC7B,gBAAgB,EAAE,GAAG,EAAE;gBACrB,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;gBAC7C,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;oBAC9B,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;oBAC3C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;iBAC3B,CAAC;YACJ,CAAC;YACD,qBAAqB;YACrB,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,oCAAoC;YACpC,0BAA0B,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAClD,wCAAwC,CAAC;gBACvC,SAAS;gBACT,QAAQ;gBACR,cAAc;aACf,CAAC;YACJ,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE,CAClC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC;YACvC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC;YACxD,0BAA0B;YAC1B,GAAG,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC;YAC9D,WAAW,EAAE,KAAK,IAAI,EAAE;gBACtB,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE,CAAC;YACpD,CAAC;YACD,gBAAgB,EAAE,0BAA0B;YAC5C,qEAAqE;YACrE,wEAAwE;YACxE,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC3B,wBAAwB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC;SACnE,CAAC;IACJ,CAAC;CACF;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,wBAAwB,CAC/B,OAA8C,EAC9C,OAAe,EACf,KAAc;IAEd,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA+B;IAE/B,OAAO,2CAA2C,CAChD,cAAc,CAAC,aAAa,EAAE,EAC9B,cAAc,CAAC,kBAAkB,CAClC,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../data/domainScope\";\nimport {\n  disposeDomainSyncCoordinator,\n  getOrCreateDomainSyncCoordinator,\n  isDatabaseUnavailableError,\n} from \"../data/sync/syncCoordinator\";\nimport {\n  type ContainerContentsStore,\n  type ContainerContentsStoreOptions,\n  isAutomaticRootCatchupContainerNode,\n  isReconcilableContainerNode,\n  isRemoteBackedContainerNode,\n} from \"../stores/container-contents\";\nimport { openDocumentStore } from \"../stores/documents\";\nimport {\n  requestRegisteredDocumentRemoteSync,\n  subscribeToPersistedDocumentDeletions,\n  subscribeToPersistedDocuments,\n} from \"../stores/documents/registry\";\nimport {\n  getOrCreateLocalProjectionStore,\n  type LocalProjectionStore,\n  type LocalProjectionView,\n} from \"../stores/local-projection\";\nimport {\n  connectReconciliationTriggers,\n  createReconciliationService,\n  type ReconciliationHost,\n  type ReconciliationService,\n  systemReconciliationClock,\n} from \"../sync/reconciliation\";\nimport { listAllContainerDocumentIdsFromApi } from \"../workflows/container-contents/containerDocumentListing\";\nimport { probeUndiscoveredRemoteDocumentBatch } from \"../workflows/container-contents/documentHydrationProbe\";\nimport {\n  type ContainerContentsStoreWorkflowRuntime,\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsStoreWorkflowRuntime,\n} from \"../workflows/container-contents/runtime\";\nimport type { ContainerContents } from \"./containerContents\";\nimport { discoverContainerDocumentLanesForRuntime } from \"./containerDocumentDiscovery\";\nimport { createReconciledDocumentContentPuller } from \"./reconciledDocumentContentPull\";\nimport type { InternalRuntime } from \"./workflowRuntime\";\n\nexport type { LocalProjectionView } from \"../stores/local-projection\";\n\n/** One domain scope's local read, local-write, and reconciliation handles. */\nexport interface DeviceFirstContainerContents {\n  /**\n   * Locally durable container tree and mutation store. Ordinary tree writes\n   * update this store after local persistence and queue remote convergence in\n   * the background; security-sensitive remote operations keep their explicit\n   * online requirements.\n   */\n  readonly containerStore: ContainerContentsStore;\n  /** Background remote reconciliation; never awaited for first paint. */\n  readonly reconciler: ReconciliationService;\n  /** Synchronously readable container/document projection. */\n  readonly view: LocalProjectionView;\n}\n\n/**\n * Device-first facade. Opens a shared scope that pairs immediate local reads\n * and locally durable writes with background remote convergence.\n */\nexport interface DeviceFirst {\n  /** Open all device-first handles for the current domain scope. */\n  open(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): DeviceFirstContainerContents;\n  /** Stop the current scope's reconciler (if one was created) on teardown. */\n  dispose(): void;\n}\n\nexport function createDeviceFirst(\n  runtimeService: InternalRuntime,\n  containerContents: ContainerContents,\n): DeviceFirst {\n  return new DeviceFirstService(runtimeService, containerContents);\n}\n\ninterface DeviceFirstScopeEntry {\n  contents: DeviceFirstContainerContents;\n  disconnectReconciliationTriggers: () => void;\n  unsubscribePersistedDocumentDeletions: () => void;\n  unsubscribePersistedDocuments: () => void;\n}\n\nfunction createInitialDocumentProbeHost(\n  runtimeService: InternalRuntime,\n  domainScope: ReconciliationHost[\"domainScope\"],\n): Pick<\n  ReconciliationHost,\n  | \"listContainerDocumentIds\"\n  | \"probeUndiscoveredDocumentsBatch\"\n  | \"reportInitialDocumentProbeComplete\"\n> {\n  return {\n    listContainerDocumentIds: (containerId) => {\n      const runtime = createDeviceFirstWorkflowRuntime(runtimeService);\n      return listAllContainerDocumentIdsFromApi({\n        apiClient: runtime.apiClient,\n        containerId,\n        reportErrors: false,\n      });\n    },\n    probeUndiscoveredDocumentsBatch: async (input) => {\n      const runtime = createDeviceFirstWorkflowRuntime(runtimeService);\n      return probeUndiscoveredRemoteDocumentBatch({\n        ...input,\n        host: {\n          documentWorkflowRuntime: (containerId) =>\n            createContainerContentsDocumentsRuntime(runtime, containerId),\n          openDocumentStore: (target) =>\n            openDocumentStore(\n              domainScope,\n              target.localId,\n              target.runtime,\n              target.documentId,\n            ),\n        },\n        runtime,\n      });\n    },\n    reportInitialDocumentProbeComplete: (requestedCount) => {\n      runtimeService\n        .workflowInput()\n        .util.log(\n          `Initial document hydration probe requested ${requestedCount} syncs`,\n        );\n    },\n  };\n}\n\nclass DeviceFirstService implements DeviceFirst {\n  // A real Map (not WeakMap) so dispose() can iterate every scope seen this\n  // session. A running reconciler holds event subscriptions that keep an idle,\n  // stale-scope service (and its scope) reachable anyway, so WeakMap bought no\n  // GC here; the entries are released explicitly on dispose().\n  private readonly entriesByScope = new Map<\n    DomainScope,\n    DeviceFirstScopeEntry\n  >();\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n  ) {}\n\n  open(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): DeviceFirstContainerContents {\n    return this.getOrCreateEntry(options).contents;\n  }\n\n  dispose(): void {\n    // Stop every reconciler created this session — not just the current\n    // scope's. A scope change (e.g. anonymous -> authenticated) leaves the old\n    // scope's reconciler subscribed and its coordinator pump live; tear them\n    // all down. Force-stop each scope's coordinator (which runs the reconciler\n    // lane) alongside stopping the service.\n    for (const [domainScope, entry] of this.entriesByScope) {\n      entry.contents.reconciler.stop();\n      entry.disconnectReconciliationTriggers();\n      entry.unsubscribePersistedDocumentDeletions();\n      entry.unsubscribePersistedDocuments();\n      disposeDomainSyncCoordinator(domainScope);\n    }\n    this.entriesByScope.clear();\n  }\n\n  private workflowRuntime(): ContainerContentsStoreWorkflowRuntime {\n    return createDeviceFirstWorkflowRuntime(this.runtimeService);\n  }\n\n  private getOrCreateEntry(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): DeviceFirstScopeEntry {\n    const runtime = this.workflowRuntime();\n    const domainScope = runtime.state.domainScope;\n    const existing = this.entriesByScope.get(domainScope);\n    if (existing) {\n      // Do not call updateRuntime here: facade selectors run during React\n      // render, and updateRuntime emits synchronously. Hosts drive runtime\n      // updates through view.updateRuntime() from an effect instead.\n      return existing;\n    }\n\n    const store = getOrCreateLocalProjectionStore({\n      domainScope,\n      runtime,\n      options,\n    });\n    const service = createReconciliationService(\n      this.createReconciliationHost(store, domainScope),\n    );\n    const disconnectReconciliationTriggers = connectReconciliationTriggers({\n      service,\n      store,\n    });\n    const unsubscribePersistedDocumentDeletions =\n      subscribeToPersistedDocumentDeletions(domainScope, (localId) => {\n        store.removePersistedDocument(localId);\n      });\n    const unsubscribePersistedDocuments = subscribeToPersistedDocuments(\n      domainScope,\n      (document, change) =>\n        store.refreshPersistedDocument(document, change.placementChanged),\n    );\n    service.start();\n\n    const view: LocalProjectionView = {\n      getSnapshot: () => store.getSnapshot(),\n      subscribe: (listener) => store.subscribe(listener),\n      setActiveContainer: (containerId) =>\n        store.setActiveContainer(containerId),\n      updateRuntime: (nextRuntime) => store.updateRuntime(nextRuntime),\n    };\n\n    const entry: DeviceFirstScopeEntry = {\n      contents: {\n        containerStore: store.getContainerStore(),\n        reconciler: service,\n        view,\n      },\n      disconnectReconciliationTriggers,\n      unsubscribePersistedDocumentDeletions,\n      unsubscribePersistedDocuments,\n    };\n    this.entriesByScope.set(domainScope, entry);\n    return entry;\n  }\n\n  private createReconciliationHost(\n    store: LocalProjectionStore,\n    domainScope: ReconciliationHost[\"domainScope\"],\n  ): ReconciliationHost {\n    const runtimeService = this.runtimeService;\n    const containerContents = this.containerContents;\n    const requestDocumentContentPull = createReconciledDocumentContentPuller({\n      getContainer: (containerId) =>\n        store\n          .getSnapshot()\n          .containers.find((container) => container.id === containerId) ?? null,\n      pullDocumentContent: (input) =>\n        containerContents.pullDocumentContent(input),\n      requestRegisteredDocumentRemoteSync: (localId, documentId) =>\n        requestRegisteredDocumentRemoteSync(domainScope, localId, documentId),\n    });\n    const canDiscoverContainerDocuments = (containerId: string) => {\n      const container = store\n        .getSnapshot()\n        .containers.find((node) => node.id === containerId);\n      return container ? isRemoteBackedContainerNode(container) : false;\n    };\n    const listKnownContainerIds = () => {\n      // A local-first id is not listable yet and may still be racing its create\n      // request. Once remote-backed, it participates normally; system contents\n      // are especially important during rematerialization because this device\n      // may not have authored them.\n      const homeOrganizationId =\n        runtimeService.workflowInput().auth.organizationId;\n      return store\n        .getSnapshot()\n        .containers.flatMap((node) =>\n          isReconcilableContainerNode(node, homeOrganizationId)\n            ? [node.id]\n            : [],\n        );\n    };\n    const listAutomaticRootCatchupContainerIds = () => {\n      const homeOrganizationId =\n        runtimeService.workflowInput().auth.organizationId;\n      return store\n        .getSnapshot()\n        .containers.flatMap((node) =>\n          isAutomaticRootCatchupContainerNode(node, homeOrganizationId)\n            ? [node.id]\n            : [],\n        );\n    };\n    return {\n      clock: systemReconciliationClock,\n      domainScope,\n      registerLane: (key, config) =>\n        getOrCreateDomainSyncCoordinator(domainScope).registerLane(key, config),\n      canDiscoverContainerDocuments,\n      getRuntimeStatus: () => {\n        const input = runtimeService.workflowInput();\n        return {\n          dbStatus: input.infra.dbStatus,\n          isAuthenticated: input.auth.isAuthenticated,\n          online: input.state.online,\n        };\n      },\n      listKnownContainerIds,\n      // Root discovery can surface directly granted non-root containers, so\n      // retain every regular container. Exclude only this identity's own system\n      // children; cold/auth backfill and explicit full Refresh cover those.\n      listAutomaticRootCatchupContainerIds,\n      discoverContainerDocuments: (requests, onOutcome) =>\n        discoverContainerDocumentLanesForRuntime({\n          onOutcome,\n          requests,\n          runtimeService,\n        }),\n      loadContainerDelta: (containerId) =>\n        store.loadContainerDelta(containerId),\n      applyReconciled: (delta) => store.applyReconciled(delta),\n      requestDocumentContentPull,\n      ...createInitialDocumentProbeHost(runtimeService, domainScope),\n      refreshTree: async () => {\n        await store.getContainerStore().refresh();\n      },\n      refreshRootTree: async () => {\n        await store.getContainerStore().refreshRootLane();\n      },\n      isIgnorableError: isDatabaseUnavailableError,\n      // Resolve the runtime per call: it is rebuilt as the active identity\n      // changes, and a reference captured here would report into a dead host.\n      logError: (message, error) =>\n        logReconciliationFailure(this.workflowRuntime(), message, error),\n    };\n  }\n}\n\n// Returns the host's result: both callbacks are declared `=> void` but may be\n// async, and the lane reporter only catches a rejection it is handed.\nfunction logReconciliationFailure(\n  runtime: ContainerContentsStoreWorkflowRuntime,\n  message: string,\n  error: unknown,\n): unknown {\n  const { log, logError } = runtime.util;\n  return logError ? logError(message, error) : log(message);\n}\n\nexport function createDeviceFirstWorkflowRuntime(\n  runtimeService: InternalRuntime,\n): ContainerContentsStoreWorkflowRuntime {\n  return createContainerContentsStoreWorkflowRuntime(\n    runtimeService.workflowInput(),\n    runtimeService.adoptRootContainer,\n  );\n}\n"]}
+{"version":3,"file":"deviceFirst.js","sourceRoot":"","sources":["deviceFirst.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,mCAAmC,EACnC,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAG3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0DAA0D,CAAC;AAC9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,wDAAwD,CAAC;AAC9G,OAAO,EAEL,uCAAuC,EACvC,2CAA2C,GAC5C,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAE,wCAAwC,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,iCAAiC,CAAC;AAiCxF,MAAM,UAAU,iBAAiB,CAC/B,cAA+B,EAC/B,iBAAoC;IAEpC,OAAO,IAAI,kBAAkB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AASD,SAAS,8BAA8B,CACrC,cAA+B,EAC/B,WAA8C;IAO9C,OAAO;QACL,wBAAwB,EAAE,CAAC,WAAW,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAC;YACjE,OAAO,kCAAkC,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW;gBACX,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QACD,+BAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/C,MAAM,OAAO,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAC;YACjE,OAAO,oCAAoC,CAAC;gBAC1C,GAAG,KAAK;gBACR,IAAI,EAAE;oBACJ,uBAAuB,EAAE,CAAC,WAAW,EAAE,EAAE,CACvC,uCAAuC,CAAC,OAAO,EAAE,WAAW,CAAC;oBAC/D,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,iBAAiB,CACf,WAAW,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,UAAU,CAClB;iBACJ;gBACD,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QACD,kCAAkC,EAAE,CAAC,cAAc,EAAE,EAAE;YACrD,cAAc;iBACX,aAAa,EAAE;iBACf,IAAI,CAAC,GAAG,CACP,8CAA8C,cAAc,QAAQ,CACrE,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB;IAWH;IACA;IAXnB,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6DAA6D;IAC5C,cAAc,GAAG,IAAI,GAAG,EAGtC,CAAC;IAEJ,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAEJ,IAAI,CACF,OAAmD;QAEnD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACjD,CAAC;IAED,OAAO;QACL,oEAAoE;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,wCAAwC;QACxC,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACjC,KAAK,CAAC,gCAAgC,EAAE,CAAC;YACzC,KAAK,CAAC,qCAAqC,EAAE,CAAC;YAC9C,KAAK,CAAC,6BAA6B,EAAE,CAAC;YACtC,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAEO,eAAe;QACrB,OAAO,gCAAgC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;IAEO,gBAAgB,CACtB,OAAmD;QAEnD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC;YAC5C,WAAW;YACX,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,2BAA2B,CACzC,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,WAAW,CAAC,CAClD,CAAC;QACF,MAAM,gCAAgC,GAAG,6BAA6B,CAAC;YACrE,OAAO;YACP,KAAK;SACN,CAAC,CAAC;QACH,MAAM,qCAAqC,GACzC,qCAAqC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;YAC7D,KAAK,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,MAAM,6BAA6B,GAAG,6BAA6B,CACjE,WAAW,EACX,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CACnB,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CACpE,CAAC;QACF,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,MAAM,IAAI,GAAwB;YAChC,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;YAClD,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE,CAClC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC;YACvC,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC;SACjE,CAAC;QAEF,MAAM,KAAK,GAA0B;YACnC,QAAQ,EAAE;gBACR,cAAc,EAAE,KAAK,CAAC,iBAAiB,EAAE;gBACzC,UAAU,EAAE,OAAO;gBACnB,IAAI;aACL;YACD,gCAAgC;YAChC,qCAAqC;YACrC,6BAA6B;SAC9B,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,wBAAwB,CAC9B,KAA2B,EAC3B,WAA8C;QAE9C,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACjD,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;YACvE,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,KAAK;iBACF,WAAW,EAAE;iBACb,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,IAAI;YACzE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,iBAAiB,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC9C,mCAAmC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAC3D,mCAAmC,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC;SACxE,CAAC,CAAC;QACH,MAAM,6BAA6B,GAAG,CAAC,WAAmB,EAAE,EAAE;YAC5D,MAAM,SAAS,GAAG,KAAK;iBACpB,WAAW,EAAE;iBACb,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,CAAC,CAAC;QACF,MAAM,qBAAqB,GAAG,GAAG,EAAE;YACjC,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,8BAA8B;YAC9B,MAAM,kBAAkB,GACtB,cAAc,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;YACrD,OAAO,KAAK;iBACT,WAAW,EAAE;iBACb,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,2BAA2B,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBACnD,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACX,CAAC,CAAC,EAAE,CACP,CAAC;QACN,CAAC,CAAC;QACF,MAAM,oCAAoC,GAAG,GAAG,EAAE;YAChD,MAAM,kBAAkB,GACtB,cAAc,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;YACrD,OAAO,KAAK;iBACT,WAAW,EAAE;iBACb,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,mCAAmC,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAC3D,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACX,CAAC,CAAC,EAAE,CACP,CAAC;QACN,CAAC,CAAC;QACF,OAAO;YACL,KAAK,EAAE,yBAAyB;YAChC,WAAW;YACX,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC;YACzE,6BAA6B;YAC7B,gBAAgB,EAAE,GAAG,EAAE;gBACrB,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;gBAC7C,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;oBAC9B,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;oBAC3C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;iBAC3B,CAAC;YACJ,CAAC;YACD,qBAAqB;YACrB,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,oCAAoC;YACpC,0BAA0B,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAClD,wCAAwC,CAAC;gBACvC,SAAS;gBACT,QAAQ;gBACR,cAAc;aACf,CAAC;YACJ,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE,CAClC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC;YACvC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC;YACxD,0BAA0B;YAC1B,GAAG,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC;YAC9D,WAAW,EAAE,KAAK,IAAI,EAAE;gBACtB,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE,CAAC;YACpD,CAAC;YACD,gBAAgB,EAAE,0BAA0B;YAC5C,qEAAqE;YACrE,wEAAwE;YACxE,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC3B,wBAAwB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC;SACnE,CAAC;IACJ,CAAC;CACF;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,SAAS,wBAAwB,CAC/B,OAA8C,EAC9C,OAAe,EACf,KAAc;IAEd,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA+B;IAE/B,OAAO,2CAA2C,CAChD,cAAc,CAAC,aAAa,EAAE,EAC9B,cAAc,CAAC,kBAAkB,CAClC,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../data/shared/domainScope\";\nimport {\n  disposeDomainSyncCoordinator,\n  getOrCreateDomainSyncCoordinator,\n  isDatabaseUnavailableError,\n} from \"../data/sync/syncCoordinator\";\nimport {\n  type ContainerContentsStore,\n  type ContainerContentsStoreOptions,\n  isAutomaticRootCatchupContainerNode,\n  isReconcilableContainerNode,\n  isRemoteBackedContainerNode,\n} from \"../stores/container-contents\";\nimport { openDocumentStore } from \"../stores/documents\";\nimport {\n  requestRegisteredDocumentRemoteSync,\n  subscribeToPersistedDocumentDeletions,\n  subscribeToPersistedDocuments,\n} from \"../stores/documents/registry\";\nimport {\n  getOrCreateLocalProjectionStore,\n  type LocalProjectionStore,\n  type LocalProjectionView,\n} from \"../stores/local-projection\";\nimport {\n  connectReconciliationTriggers,\n  createReconciliationService,\n  type ReconciliationHost,\n  type ReconciliationService,\n  systemReconciliationClock,\n} from \"../sync/reconciliation\";\nimport { listAllContainerDocumentIdsFromApi } from \"../workflows/container-contents/containerDocumentListing\";\nimport { probeUndiscoveredRemoteDocumentBatch } from \"../workflows/container-contents/documentHydrationProbe\";\nimport {\n  type ContainerContentsStoreWorkflowRuntime,\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsStoreWorkflowRuntime,\n} from \"../workflows/container-contents/runtime\";\nimport type { ContainerContents } from \"./containerContents\";\nimport { discoverContainerDocumentLanesForRuntime } from \"./containerDocumentDiscovery\";\nimport { createReconciledDocumentContentPuller } from \"./reconciledDocumentContentPull\";\nimport type { InternalRuntime } from \"./workflowRuntime\";\n\nexport type { LocalProjectionView } from \"../stores/local-projection\";\n\n/** One domain scope's local read, local-write, and reconciliation handles. */\nexport interface DeviceFirstContainerContents {\n  /**\n   * Locally durable container tree and mutation store. Ordinary tree writes\n   * update this store after local persistence and queue remote convergence in\n   * the background; security-sensitive remote operations keep their explicit\n   * online requirements.\n   */\n  readonly containerStore: ContainerContentsStore;\n  /** Background remote reconciliation; never awaited for first paint. */\n  readonly reconciler: ReconciliationService;\n  /** Synchronously readable container/document projection. */\n  readonly view: LocalProjectionView;\n}\n\n/**\n * Device-first facade. Opens a shared scope that pairs immediate local reads\n * and locally durable writes with background remote convergence.\n */\nexport interface DeviceFirst {\n  /** Open all device-first handles for the current domain scope. */\n  open(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): DeviceFirstContainerContents;\n  /** Stop the current scope's reconciler (if one was created) on teardown. */\n  dispose(): void;\n}\n\nexport function createDeviceFirst(\n  runtimeService: InternalRuntime,\n  containerContents: ContainerContents,\n): DeviceFirst {\n  return new DeviceFirstService(runtimeService, containerContents);\n}\n\ninterface DeviceFirstScopeEntry {\n  contents: DeviceFirstContainerContents;\n  disconnectReconciliationTriggers: () => void;\n  unsubscribePersistedDocumentDeletions: () => void;\n  unsubscribePersistedDocuments: () => void;\n}\n\nfunction createInitialDocumentProbeHost(\n  runtimeService: InternalRuntime,\n  domainScope: ReconciliationHost[\"domainScope\"],\n): Pick<\n  ReconciliationHost,\n  | \"listContainerDocumentIds\"\n  | \"probeUndiscoveredDocumentsBatch\"\n  | \"reportInitialDocumentProbeComplete\"\n> {\n  return {\n    listContainerDocumentIds: (containerId) => {\n      const runtime = createDeviceFirstWorkflowRuntime(runtimeService);\n      return listAllContainerDocumentIdsFromApi({\n        apiClient: runtime.apiClient,\n        containerId,\n        reportErrors: false,\n      });\n    },\n    probeUndiscoveredDocumentsBatch: async (input) => {\n      const runtime = createDeviceFirstWorkflowRuntime(runtimeService);\n      return probeUndiscoveredRemoteDocumentBatch({\n        ...input,\n        host: {\n          documentWorkflowRuntime: (containerId) =>\n            createContainerContentsDocumentsRuntime(runtime, containerId),\n          openDocumentStore: (target) =>\n            openDocumentStore(\n              domainScope,\n              target.localId,\n              target.runtime,\n              target.documentId,\n            ),\n        },\n        runtime,\n      });\n    },\n    reportInitialDocumentProbeComplete: (requestedCount) => {\n      runtimeService\n        .workflowInput()\n        .util.log(\n          `Initial document hydration probe requested ${requestedCount} syncs`,\n        );\n    },\n  };\n}\n\nclass DeviceFirstService implements DeviceFirst {\n  // A real Map (not WeakMap) so dispose() can iterate every scope seen this\n  // session. A running reconciler holds event subscriptions that keep an idle,\n  // stale-scope service (and its scope) reachable anyway, so WeakMap bought no\n  // GC here; the entries are released explicitly on dispose().\n  private readonly entriesByScope = new Map<\n    DomainScope,\n    DeviceFirstScopeEntry\n  >();\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n  ) {}\n\n  open(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): DeviceFirstContainerContents {\n    return this.getOrCreateEntry(options).contents;\n  }\n\n  dispose(): void {\n    // Stop every reconciler created this session — not just the current\n    // scope's. A scope change (e.g. anonymous -> authenticated) leaves the old\n    // scope's reconciler subscribed and its coordinator pump live; tear them\n    // all down. Force-stop each scope's coordinator (which runs the reconciler\n    // lane) alongside stopping the service.\n    for (const [domainScope, entry] of this.entriesByScope) {\n      entry.contents.reconciler.stop();\n      entry.disconnectReconciliationTriggers();\n      entry.unsubscribePersistedDocumentDeletions();\n      entry.unsubscribePersistedDocuments();\n      disposeDomainSyncCoordinator(domainScope);\n    }\n    this.entriesByScope.clear();\n  }\n\n  private workflowRuntime(): ContainerContentsStoreWorkflowRuntime {\n    return createDeviceFirstWorkflowRuntime(this.runtimeService);\n  }\n\n  private getOrCreateEntry(\n    options?: ContainerContentsStoreOptions | undefined,\n  ): DeviceFirstScopeEntry {\n    const runtime = this.workflowRuntime();\n    const domainScope = runtime.state.domainScope;\n    const existing = this.entriesByScope.get(domainScope);\n    if (existing) {\n      // Do not call updateRuntime here: facade selectors run during React\n      // render, and updateRuntime emits synchronously. Hosts drive runtime\n      // updates through view.updateRuntime() from an effect instead.\n      return existing;\n    }\n\n    const store = getOrCreateLocalProjectionStore({\n      domainScope,\n      runtime,\n      options,\n    });\n    const service = createReconciliationService(\n      this.createReconciliationHost(store, domainScope),\n    );\n    const disconnectReconciliationTriggers = connectReconciliationTriggers({\n      service,\n      store,\n    });\n    const unsubscribePersistedDocumentDeletions =\n      subscribeToPersistedDocumentDeletions(domainScope, (localId) => {\n        store.removePersistedDocument(localId);\n      });\n    const unsubscribePersistedDocuments = subscribeToPersistedDocuments(\n      domainScope,\n      (document, change) =>\n        store.refreshPersistedDocument(document, change.placementChanged),\n    );\n    service.start();\n\n    const view: LocalProjectionView = {\n      getSnapshot: () => store.getSnapshot(),\n      subscribe: (listener) => store.subscribe(listener),\n      setActiveContainer: (containerId) =>\n        store.setActiveContainer(containerId),\n      updateRuntime: (nextRuntime) => store.updateRuntime(nextRuntime),\n    };\n\n    const entry: DeviceFirstScopeEntry = {\n      contents: {\n        containerStore: store.getContainerStore(),\n        reconciler: service,\n        view,\n      },\n      disconnectReconciliationTriggers,\n      unsubscribePersistedDocumentDeletions,\n      unsubscribePersistedDocuments,\n    };\n    this.entriesByScope.set(domainScope, entry);\n    return entry;\n  }\n\n  private createReconciliationHost(\n    store: LocalProjectionStore,\n    domainScope: ReconciliationHost[\"domainScope\"],\n  ): ReconciliationHost {\n    const runtimeService = this.runtimeService;\n    const containerContents = this.containerContents;\n    const requestDocumentContentPull = createReconciledDocumentContentPuller({\n      getContainer: (containerId) =>\n        store\n          .getSnapshot()\n          .containers.find((container) => container.id === containerId) ?? null,\n      pullDocumentContent: (input) =>\n        containerContents.pullDocumentContent(input),\n      requestRegisteredDocumentRemoteSync: (localId, documentId) =>\n        requestRegisteredDocumentRemoteSync(domainScope, localId, documentId),\n    });\n    const canDiscoverContainerDocuments = (containerId: string) => {\n      const container = store\n        .getSnapshot()\n        .containers.find((node) => node.id === containerId);\n      return container ? isRemoteBackedContainerNode(container) : false;\n    };\n    const listKnownContainerIds = () => {\n      // A local-first id is not listable yet and may still be racing its create\n      // request. Once remote-backed, it participates normally; system contents\n      // are especially important during rematerialization because this device\n      // may not have authored them.\n      const homeOrganizationId =\n        runtimeService.workflowInput().auth.organizationId;\n      return store\n        .getSnapshot()\n        .containers.flatMap((node) =>\n          isReconcilableContainerNode(node, homeOrganizationId)\n            ? [node.id]\n            : [],\n        );\n    };\n    const listAutomaticRootCatchupContainerIds = () => {\n      const homeOrganizationId =\n        runtimeService.workflowInput().auth.organizationId;\n      return store\n        .getSnapshot()\n        .containers.flatMap((node) =>\n          isAutomaticRootCatchupContainerNode(node, homeOrganizationId)\n            ? [node.id]\n            : [],\n        );\n    };\n    return {\n      clock: systemReconciliationClock,\n      domainScope,\n      registerLane: (key, config) =>\n        getOrCreateDomainSyncCoordinator(domainScope).registerLane(key, config),\n      canDiscoverContainerDocuments,\n      getRuntimeStatus: () => {\n        const input = runtimeService.workflowInput();\n        return {\n          dbStatus: input.infra.dbStatus,\n          isAuthenticated: input.auth.isAuthenticated,\n          online: input.state.online,\n        };\n      },\n      listKnownContainerIds,\n      // Root discovery can surface directly granted non-root containers, so\n      // retain every regular container. Exclude only this identity's own system\n      // children; cold/auth backfill and explicit full Refresh cover those.\n      listAutomaticRootCatchupContainerIds,\n      discoverContainerDocuments: (requests, onOutcome) =>\n        discoverContainerDocumentLanesForRuntime({\n          onOutcome,\n          requests,\n          runtimeService,\n        }),\n      loadContainerDelta: (containerId) =>\n        store.loadContainerDelta(containerId),\n      applyReconciled: (delta) => store.applyReconciled(delta),\n      requestDocumentContentPull,\n      ...createInitialDocumentProbeHost(runtimeService, domainScope),\n      refreshTree: async () => {\n        await store.getContainerStore().refresh();\n      },\n      refreshRootTree: async () => {\n        await store.getContainerStore().refreshRootLane();\n      },\n      isIgnorableError: isDatabaseUnavailableError,\n      // Resolve the runtime per call: it is rebuilt as the active identity\n      // changes, and a reference captured here would report into a dead host.\n      logError: (message, error) =>\n        logReconciliationFailure(this.workflowRuntime(), message, error),\n    };\n  }\n}\n\n// Returns the host's result: both callbacks are declared `=> void` but may be\n// async, and the lane reporter only catches a rejection it is handed.\nfunction logReconciliationFailure(\n  runtime: ContainerContentsStoreWorkflowRuntime,\n  message: string,\n  error: unknown,\n): unknown {\n  const { log, logError } = runtime.util;\n  return logError ? logError(message, error) : log(message);\n}\n\nexport function createDeviceFirstWorkflowRuntime(\n  runtimeService: InternalRuntime,\n): ContainerContentsStoreWorkflowRuntime {\n  return createContainerContentsStoreWorkflowRuntime(\n    runtimeService.workflowInput(),\n    runtimeService.adoptRootContainer,\n  );\n}\n"]}

package/client/identity.js

@@ -1,5 +1,5 @@
 import { createIdentitySeedPhrase, generateIdentityKeyPairsFromSeedPhrase, toFingerprint, } from "../internal/crypto/index.js";
-import { errorMessage } from "../data/errorMessage.js";
+import { errorMessage } from "../data/shared/errorMessage.js";
 import { createIdentityKeyPackage, parseIdentityKeyPackage, } from "./identityKeyPackage.js";
 import { createListenerSet } from "./listenerSet.js";
 export function createIdentity(options = {}, onIdentityChanged, log, runtimeHooks = {}) {

package/client/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAExB,sCAAsC,EAEtC,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,wBAAwB,EAExB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AA2DlD,MAAM,UAAU,cAAc,CAC5B,UAA2B,EAAE,EAC7B,iBAA8D,EAC9D,GAA8B,EAC9B,eAAqC,EAAE;IAEvC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,eAAe;IAUA;IAGA;IACA;IAbX,yBAAyB,CAA8B;IAC9C,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACzC,eAAe,CAAgB;IAC/B,uBAAuB,CAAgB;IACvC,mBAAmB,CAAwB;IAC3C,aAAa,CAAmB;IAExC,YACE,UAA2B,EAAE,EACZ,iBAER,EACQ,GAA8B,EAC9B,YAAkC;QAJlC,sBAAiB,GAAjB,iBAAiB,CAEzB;QACQ,QAAG,GAAH,GAAG,CAA2B;QAC9B,iBAAY,GAAZ,YAAY,CAAsB;QAEnD,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAClE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,yBAAyB,CAAC;IACxC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACtC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACpC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjC,CAAC;IAED,gBAAgB;QACd,OAAO,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC9C,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAC5C,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,cAAc,CAAC,gBAAgB,CAChC,CAAC;QACF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/D,IAAI,CAAC,mBAAmB,GAAG,cAAc,CAAC;QAC1C,IAAI,CAAC,yBAAyB,GAAG,oBAAoB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;QAClC,IAAI,CAAC,uBAAuB,GAAG,kBAAkB,CAAC;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC/B,OAAO;YACL,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,iBAAiB;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC;QACjD,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACjE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,MAAM,OAAO,GAAG,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;QAC1C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,MAAM,aAAa,CAChD,OAAO,CAAC,cAAc,CAAC,gBAAgB,CACxC,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,qBAAqB,CAAC,SAAS,GAAG,gBAAgB;QAChD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACpC,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,uBAAuB,GAAG,MAAM,aAAa,CAChD,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAC1C,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAKjB;QACC,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAElE,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,SAAS,GAAG,CAAC,QAA0B,EAAgB,EAAE,CACvD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE7B,cAAc;QACpB,OAAO;YACL,oBAAoB,EAAE,IAAI,CAAC,yBAAyB;YACpD,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB;YAChD,cAAc,EAAE,IAAI,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,IAAI,CAAC;YACH,MAAM,2BAA2B,GAC/B,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;YAChD,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,EAAE,CAAC;YAE1D,OAAO;gBACL,oBAAoB,EAAE,aAAa,CAAC,OAAO;gBAC3C,eAAe,EAAE,aAAa,CAAC,WAAW;gBAC1C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI;aAChD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC;QAC5C,IACE,gBAAgB,CAAC,oBAAoB;YACnC,YAAY,CAAC,oBAAoB;YACnC,gBAAgB,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU;YACvD,gBAAgB,CAAC,kBAAkB,KAAK,YAAY,CAAC,kBAAkB;YACvE,gBAAgB,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc,EAC/D,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF","sourcesContent":["import {\n  createIdentitySeedPhrase,\n  type EncapsulationKeyPair,\n  generateIdentityKeyPairsFromSeedPhrase,\n  type SigningKeyPair,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { errorMessage } from \"../data/errorMessage\";\nimport {\n  createIdentityKeyPackage,\n  type IdentityKeyPackage,\n  parseIdentityKeyPackage,\n} from \"./identityKeyPackage\";\nimport { createListenerSet } from \"./listenerSet\";\n\nexport interface IdentityOptions {\n  encapsulationKeyPair?: EncapsulationKeyPair | null | undefined;\n  seedPhrase?: string | null | undefined;\n  signingFingerprint?: string | null | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n}\n\nexport interface IdentitySnapshot {\n  encapsulationKeyPair: EncapsulationKeyPair | null;\n  seedPhrase: string | null;\n  signingFingerprint: string | null;\n  signingKeyPair: SigningKeyPair | null;\n}\n\nexport interface IdentityGenerationResult extends IdentitySnapshot {\n  rootContainerCreated: boolean;\n  rootContainerId: string;\n  userId: string | null;\n}\n\nexport type IdentityListener = () => void;\n\nexport interface Identity {\n  readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  readonly seedPhrase: string | null;\n  readonly signingFingerprint: string | null;\n  readonly signingKeyPair: SigningKeyPair | null;\n  readonly snapshot: IdentitySnapshot;\n  destroy(): void;\n  exportKeyPackage(): Promise<IdentityKeyPackage>;\n  generate(): Promise<IdentityGenerationResult>;\n  importKeyPackage(keyPackage: unknown): Promise<IdentitySnapshot>;\n  importSeedPhrase(seedPhrase: string): Promise<IdentitySnapshot>;\n  requireSigningKeyPair(operation?: string): SigningKeyPair;\n  refreshSigningFingerprint(): Promise<string | null>;\n  setKeyPairs(options: {\n    encapsulationKeyPair: EncapsulationKeyPair | null;\n    seedPhrase?: string | null | undefined;\n    signingFingerprint?: string | null | undefined;\n    signingKeyPair: SigningKeyPair | null;\n  }): Promise<IdentitySnapshot>;\n  subscribe(listener: IdentityListener): () => void;\n}\n\ninterface IdentityGenerationContext {\n  rootContainerCreated: boolean;\n  rootContainerId: string;\n  userId: string | null;\n}\n\ninterface IdentityRuntimeHooks {\n  bootstrapLocalRootContainer?:\n    | (() => Promise<{ containerId: string; created: boolean }>)\n    | undefined;\n  getUserId?: (() => string | null) | undefined;\n}\n\nexport function createIdentity(\n  options: IdentityOptions = {},\n  onIdentityChanged: (signingFingerprint: string | null) => void,\n  log: (message: string) => void,\n  runtimeHooks: IdentityRuntimeHooks = {},\n): Identity {\n  return new IdentityService(options, onIdentityChanged, log, runtimeHooks);\n}\n\nclass IdentityService implements Identity {\n  private encapsulationKeyPairValue: EncapsulationKeyPair | null;\n  private readonly listeners = createListenerSet();\n  private seedPhraseValue: string | null;\n  private signingFingerprintValue: string | null;\n  private signingKeyPairValue: SigningKeyPair | null;\n  private snapshotValue: IdentitySnapshot;\n\n  constructor(\n    options: IdentityOptions = {},\n    private readonly onIdentityChanged: (\n      signingFingerprint: string | null,\n    ) => void,\n    private readonly log: (message: string) => void,\n    private readonly runtimeHooks: IdentityRuntimeHooks,\n  ) {\n    this.encapsulationKeyPairValue = options.encapsulationKeyPair ?? null;\n    this.seedPhraseValue = options.seedPhrase ?? null;\n    this.signingFingerprintValue = options.signingFingerprint ?? null;\n    this.signingKeyPairValue = options.signingKeyPair ?? null;\n    this.snapshotValue = this.createSnapshot();\n    this.onIdentityChanged(this.signingFingerprintValue);\n  }\n\n  get encapsulationKeyPair(): EncapsulationKeyPair | null {\n    return this.encapsulationKeyPairValue;\n  }\n\n  get seedPhrase(): string | null {\n    return this.seedPhraseValue;\n  }\n\n  get signingFingerprint(): string | null {\n    return this.signingFingerprintValue;\n  }\n\n  get signingKeyPair(): SigningKeyPair | null {\n    return this.signingKeyPairValue;\n  }\n\n  get snapshot(): IdentitySnapshot {\n    return this.snapshotValue;\n  }\n\n  destroy(): void {\n    this.encapsulationKeyPairValue = null;\n    this.seedPhraseValue = null;\n    this.signingFingerprintValue = null;\n    this.signingKeyPairValue = null;\n    this.publishSnapshot();\n    this.log(\"Key pair destroyed\");\n  }\n\n  exportKeyPackage(): Promise<IdentityKeyPackage> {\n    return createIdentityKeyPackage(this.snapshot);\n  }\n\n  async generate(): Promise<IdentityGenerationResult> {\n    const seedPhrase = createIdentitySeedPhrase();\n    const { encapsulationKeyPair, signingKeyPair } =\n      generateIdentityKeyPairsFromSeedPhrase(seedPhrase);\n    const signingFingerprint = await toFingerprint(\n      signingKeyPair.signingPublicKey,\n    );\n    const generationContext = await this.createGenerationContext();\n\n    this.signingKeyPairValue = signingKeyPair;\n    this.encapsulationKeyPairValue = encapsulationKeyPair;\n    this.seedPhraseValue = seedPhrase;\n    this.signingFingerprintValue = signingFingerprint;\n    this.publishSnapshot();\n    this.log(\"Key pair generated\");\n    return {\n      ...this.snapshot,\n      ...generationContext,\n    };\n  }\n\n  async importKeyPackage(keyPackage: unknown): Promise<IdentitySnapshot> {\n    const parsed = await parseIdentityKeyPackage(keyPackage);\n    this.encapsulationKeyPairValue = parsed.encapsulationKeyPair;\n    this.seedPhraseValue = parsed.package.seedPhrase ?? null;\n    this.signingKeyPairValue = parsed.signingKeyPair;\n    this.signingFingerprintValue = parsed.package.signingFingerprint;\n    this.publishSnapshot();\n    this.log(\"Key package imported\");\n    return this.snapshot;\n  }\n\n  async importSeedPhrase(seedPhrase: string): Promise<IdentitySnapshot> {\n    const derived = generateIdentityKeyPairsFromSeedPhrase(seedPhrase);\n    this.encapsulationKeyPairValue = derived.encapsulationKeyPair;\n    this.seedPhraseValue = derived.seedPhrase;\n    this.signingKeyPairValue = derived.signingKeyPair;\n    this.signingFingerprintValue = await toFingerprint(\n      derived.signingKeyPair.signingPublicKey,\n    );\n    this.publishSnapshot();\n    this.log(\"Seed phrase imported\");\n    return this.snapshot;\n  }\n\n  requireSigningKeyPair(operation = \"This operation\"): SigningKeyPair {\n    if (!this.signingKeyPairValue) {\n      throw new Error(`${operation} requires a signing key pair.`);\n    }\n\n    return this.signingKeyPairValue;\n  }\n\n  async refreshSigningFingerprint(): Promise<string | null> {\n    if (!this.signingKeyPairValue) {\n      this.signingFingerprintValue = null;\n      this.publishSnapshot();\n      return null;\n    }\n\n    this.signingFingerprintValue = await toFingerprint(\n      this.signingKeyPairValue.signingPublicKey,\n    );\n    this.publishSnapshot();\n    return this.signingFingerprintValue;\n  }\n\n  async setKeyPairs(options: {\n    encapsulationKeyPair: EncapsulationKeyPair | null;\n    seedPhrase?: string | null | undefined;\n    signingFingerprint?: string | null | undefined;\n    signingKeyPair: SigningKeyPair | null;\n  }): Promise<IdentitySnapshot> {\n    this.encapsulationKeyPairValue = options.encapsulationKeyPair;\n    this.seedPhraseValue = options.seedPhrase ?? null;\n    this.signingKeyPairValue = options.signingKeyPair;\n    this.signingFingerprintValue = options.signingFingerprint ?? null;\n\n    if (!this.signingFingerprintValue) {\n      await this.refreshSigningFingerprint();\n    } else {\n      this.publishSnapshot();\n    }\n\n    return this.snapshot;\n  }\n\n  subscribe = (listener: IdentityListener): (() => void) =>\n    this.listeners.subscribe(listener);\n\n  private createSnapshot(): IdentitySnapshot {\n    return {\n      encapsulationKeyPair: this.encapsulationKeyPairValue,\n      seedPhrase: this.seedPhraseValue,\n      signingFingerprint: this.signingFingerprintValue,\n      signingKeyPair: this.signingKeyPairValue,\n    };\n  }\n\n  private async createGenerationContext(): Promise<IdentityGenerationContext> {\n    try {\n      const bootstrapLocalRootContainer =\n        this.runtimeHooks.bootstrapLocalRootContainer;\n      if (!bootstrapLocalRootContainer) {\n        throw new Error(\n          \"identity.generate requires local root container bootstrap.\",\n        );\n      }\n\n      const rootContainer = await bootstrapLocalRootContainer();\n\n      return {\n        rootContainerCreated: rootContainer.created,\n        rootContainerId: rootContainer.containerId,\n        userId: this.runtimeHooks.getUserId?.() ?? null,\n      };\n    } catch (error: unknown) {\n      const message = errorMessage(error);\n      this.log(`Root container bootstrap failed: ${message}`);\n      throw error;\n    }\n  }\n\n  private publishSnapshot(): void {\n    const nextSnapshot = this.createSnapshot();\n    const previousSnapshot = this.snapshotValue;\n    if (\n      previousSnapshot.encapsulationKeyPair ===\n        nextSnapshot.encapsulationKeyPair &&\n      previousSnapshot.seedPhrase === nextSnapshot.seedPhrase &&\n      previousSnapshot.signingFingerprint === nextSnapshot.signingFingerprint &&\n      previousSnapshot.signingKeyPair === nextSnapshot.signingKeyPair\n    ) {\n      return;\n    }\n\n    this.snapshotValue = nextSnapshot;\n    this.onIdentityChanged(nextSnapshot.signingFingerprint);\n    this.listeners.notify();\n  }\n}\n"]}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAExB,sCAAsC,EAEtC,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EACL,wBAAwB,EAExB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AA2DlD,MAAM,UAAU,cAAc,CAC5B,UAA2B,EAAE,EAC7B,iBAA8D,EAC9D,GAA8B,EAC9B,eAAqC,EAAE;IAEvC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,eAAe;IAUA;IAGA;IACA;IAbX,yBAAyB,CAA8B;IAC9C,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACzC,eAAe,CAAgB;IAC/B,uBAAuB,CAAgB;IACvC,mBAAmB,CAAwB;IAC3C,aAAa,CAAmB;IAExC,YACE,UAA2B,EAAE,EACZ,iBAER,EACQ,GAA8B,EAC9B,YAAkC;QAJlC,sBAAiB,GAAjB,iBAAiB,CAEzB;QACQ,QAAG,GAAH,GAAG,CAA2B;QAC9B,iBAAY,GAAZ,YAAY,CAAsB;QAEnD,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAClE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,yBAAyB,CAAC;IACxC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACtC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACpC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjC,CAAC;IAED,gBAAgB;QACd,OAAO,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC9C,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAC5C,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,cAAc,CAAC,gBAAgB,CAChC,CAAC;QACF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/D,IAAI,CAAC,mBAAmB,GAAG,cAAc,CAAC;QAC1C,IAAI,CAAC,yBAAyB,GAAG,oBAAoB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;QAClC,IAAI,CAAC,uBAAuB,GAAG,kBAAkB,CAAC;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC/B,OAAO;YACL,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,iBAAiB;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC;QACjD,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACjE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,MAAM,OAAO,GAAG,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;QAC1C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,MAAM,aAAa,CAChD,OAAO,CAAC,cAAc,CAAC,gBAAgB,CACxC,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,qBAAqB,CAAC,SAAS,GAAG,gBAAgB;QAChD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACpC,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,uBAAuB,GAAG,MAAM,aAAa,CAChD,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAC1C,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAKjB;QACC,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAElE,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,SAAS,GAAG,CAAC,QAA0B,EAAgB,EAAE,CACvD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE7B,cAAc;QACpB,OAAO;YACL,oBAAoB,EAAE,IAAI,CAAC,yBAAyB;YACpD,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB;YAChD,cAAc,EAAE,IAAI,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,IAAI,CAAC;YACH,MAAM,2BAA2B,GAC/B,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;YAChD,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,EAAE,CAAC;YAE1D,OAAO;gBACL,oBAAoB,EAAE,aAAa,CAAC,OAAO;gBAC3C,eAAe,EAAE,aAAa,CAAC,WAAW;gBAC1C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI;aAChD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC;QAC5C,IACE,gBAAgB,CAAC,oBAAoB;YACnC,YAAY,CAAC,oBAAoB;YACnC,gBAAgB,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU;YACvD,gBAAgB,CAAC,kBAAkB,KAAK,YAAY,CAAC,kBAAkB;YACvE,gBAAgB,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc,EAC/D,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF","sourcesContent":["import {\n  createIdentitySeedPhrase,\n  type EncapsulationKeyPair,\n  generateIdentityKeyPairsFromSeedPhrase,\n  type SigningKeyPair,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { errorMessage } from \"../data/shared/errorMessage\";\nimport {\n  createIdentityKeyPackage,\n  type IdentityKeyPackage,\n  parseIdentityKeyPackage,\n} from \"./identityKeyPackage\";\nimport { createListenerSet } from \"./listenerSet\";\n\nexport interface IdentityOptions {\n  encapsulationKeyPair?: EncapsulationKeyPair | null | undefined;\n  seedPhrase?: string | null | undefined;\n  signingFingerprint?: string | null | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n}\n\nexport interface IdentitySnapshot {\n  encapsulationKeyPair: EncapsulationKeyPair | null;\n  seedPhrase: string | null;\n  signingFingerprint: string | null;\n  signingKeyPair: SigningKeyPair | null;\n}\n\nexport interface IdentityGenerationResult extends IdentitySnapshot {\n  rootContainerCreated: boolean;\n  rootContainerId: string;\n  userId: string | null;\n}\n\nexport type IdentityListener = () => void;\n\nexport interface Identity {\n  readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  readonly seedPhrase: string | null;\n  readonly signingFingerprint: string | null;\n  readonly signingKeyPair: SigningKeyPair | null;\n  readonly snapshot: IdentitySnapshot;\n  destroy(): void;\n  exportKeyPackage(): Promise<IdentityKeyPackage>;\n  generate(): Promise<IdentityGenerationResult>;\n  importKeyPackage(keyPackage: unknown): Promise<IdentitySnapshot>;\n  importSeedPhrase(seedPhrase: string): Promise<IdentitySnapshot>;\n  requireSigningKeyPair(operation?: string): SigningKeyPair;\n  refreshSigningFingerprint(): Promise<string | null>;\n  setKeyPairs(options: {\n    encapsulationKeyPair: EncapsulationKeyPair | null;\n    seedPhrase?: string | null | undefined;\n    signingFingerprint?: string | null | undefined;\n    signingKeyPair: SigningKeyPair | null;\n  }): Promise<IdentitySnapshot>;\n  subscribe(listener: IdentityListener): () => void;\n}\n\ninterface IdentityGenerationContext {\n  rootContainerCreated: boolean;\n  rootContainerId: string;\n  userId: string | null;\n}\n\ninterface IdentityRuntimeHooks {\n  bootstrapLocalRootContainer?:\n    | (() => Promise<{ containerId: string; created: boolean }>)\n    | undefined;\n  getUserId?: (() => string | null) | undefined;\n}\n\nexport function createIdentity(\n  options: IdentityOptions = {},\n  onIdentityChanged: (signingFingerprint: string | null) => void,\n  log: (message: string) => void,\n  runtimeHooks: IdentityRuntimeHooks = {},\n): Identity {\n  return new IdentityService(options, onIdentityChanged, log, runtimeHooks);\n}\n\nclass IdentityService implements Identity {\n  private encapsulationKeyPairValue: EncapsulationKeyPair | null;\n  private readonly listeners = createListenerSet();\n  private seedPhraseValue: string | null;\n  private signingFingerprintValue: string | null;\n  private signingKeyPairValue: SigningKeyPair | null;\n  private snapshotValue: IdentitySnapshot;\n\n  constructor(\n    options: IdentityOptions = {},\n    private readonly onIdentityChanged: (\n      signingFingerprint: string | null,\n    ) => void,\n    private readonly log: (message: string) => void,\n    private readonly runtimeHooks: IdentityRuntimeHooks,\n  ) {\n    this.encapsulationKeyPairValue = options.encapsulationKeyPair ?? null;\n    this.seedPhraseValue = options.seedPhrase ?? null;\n    this.signingFingerprintValue = options.signingFingerprint ?? null;\n    this.signingKeyPairValue = options.signingKeyPair ?? null;\n    this.snapshotValue = this.createSnapshot();\n    this.onIdentityChanged(this.signingFingerprintValue);\n  }\n\n  get encapsulationKeyPair(): EncapsulationKeyPair | null {\n    return this.encapsulationKeyPairValue;\n  }\n\n  get seedPhrase(): string | null {\n    return this.seedPhraseValue;\n  }\n\n  get signingFingerprint(): string | null {\n    return this.signingFingerprintValue;\n  }\n\n  get signingKeyPair(): SigningKeyPair | null {\n    return this.signingKeyPairValue;\n  }\n\n  get snapshot(): IdentitySnapshot {\n    return this.snapshotValue;\n  }\n\n  destroy(): void {\n    this.encapsulationKeyPairValue = null;\n    this.seedPhraseValue = null;\n    this.signingFingerprintValue = null;\n    this.signingKeyPairValue = null;\n    this.publishSnapshot();\n    this.log(\"Key pair destroyed\");\n  }\n\n  exportKeyPackage(): Promise<IdentityKeyPackage> {\n    return createIdentityKeyPackage(this.snapshot);\n  }\n\n  async generate(): Promise<IdentityGenerationResult> {\n    const seedPhrase = createIdentitySeedPhrase();\n    const { encapsulationKeyPair, signingKeyPair } =\n      generateIdentityKeyPairsFromSeedPhrase(seedPhrase);\n    const signingFingerprint = await toFingerprint(\n      signingKeyPair.signingPublicKey,\n    );\n    const generationContext = await this.createGenerationContext();\n\n    this.signingKeyPairValue = signingKeyPair;\n    this.encapsulationKeyPairValue = encapsulationKeyPair;\n    this.seedPhraseValue = seedPhrase;\n    this.signingFingerprintValue = signingFingerprint;\n    this.publishSnapshot();\n    this.log(\"Key pair generated\");\n    return {\n      ...this.snapshot,\n      ...generationContext,\n    };\n  }\n\n  async importKeyPackage(keyPackage: unknown): Promise<IdentitySnapshot> {\n    const parsed = await parseIdentityKeyPackage(keyPackage);\n    this.encapsulationKeyPairValue = parsed.encapsulationKeyPair;\n    this.seedPhraseValue = parsed.package.seedPhrase ?? null;\n    this.signingKeyPairValue = parsed.signingKeyPair;\n    this.signingFingerprintValue = parsed.package.signingFingerprint;\n    this.publishSnapshot();\n    this.log(\"Key package imported\");\n    return this.snapshot;\n  }\n\n  async importSeedPhrase(seedPhrase: string): Promise<IdentitySnapshot> {\n    const derived = generateIdentityKeyPairsFromSeedPhrase(seedPhrase);\n    this.encapsulationKeyPairValue = derived.encapsulationKeyPair;\n    this.seedPhraseValue = derived.seedPhrase;\n    this.signingKeyPairValue = derived.signingKeyPair;\n    this.signingFingerprintValue = await toFingerprint(\n      derived.signingKeyPair.signingPublicKey,\n    );\n    this.publishSnapshot();\n    this.log(\"Seed phrase imported\");\n    return this.snapshot;\n  }\n\n  requireSigningKeyPair(operation = \"This operation\"): SigningKeyPair {\n    if (!this.signingKeyPairValue) {\n      throw new Error(`${operation} requires a signing key pair.`);\n    }\n\n    return this.signingKeyPairValue;\n  }\n\n  async refreshSigningFingerprint(): Promise<string | null> {\n    if (!this.signingKeyPairValue) {\n      this.signingFingerprintValue = null;\n      this.publishSnapshot();\n      return null;\n    }\n\n    this.signingFingerprintValue = await toFingerprint(\n      this.signingKeyPairValue.signingPublicKey,\n    );\n    this.publishSnapshot();\n    return this.signingFingerprintValue;\n  }\n\n  async setKeyPairs(options: {\n    encapsulationKeyPair: EncapsulationKeyPair | null;\n    seedPhrase?: string | null | undefined;\n    signingFingerprint?: string | null | undefined;\n    signingKeyPair: SigningKeyPair | null;\n  }): Promise<IdentitySnapshot> {\n    this.encapsulationKeyPairValue = options.encapsulationKeyPair;\n    this.seedPhraseValue = options.seedPhrase ?? null;\n    this.signingKeyPairValue = options.signingKeyPair;\n    this.signingFingerprintValue = options.signingFingerprint ?? null;\n\n    if (!this.signingFingerprintValue) {\n      await this.refreshSigningFingerprint();\n    } else {\n      this.publishSnapshot();\n    }\n\n    return this.snapshot;\n  }\n\n  subscribe = (listener: IdentityListener): (() => void) =>\n    this.listeners.subscribe(listener);\n\n  private createSnapshot(): IdentitySnapshot {\n    return {\n      encapsulationKeyPair: this.encapsulationKeyPairValue,\n      seedPhrase: this.seedPhraseValue,\n      signingFingerprint: this.signingFingerprintValue,\n      signingKeyPair: this.signingKeyPairValue,\n    };\n  }\n\n  private async createGenerationContext(): Promise<IdentityGenerationContext> {\n    try {\n      const bootstrapLocalRootContainer =\n        this.runtimeHooks.bootstrapLocalRootContainer;\n      if (!bootstrapLocalRootContainer) {\n        throw new Error(\n          \"identity.generate requires local root container bootstrap.\",\n        );\n      }\n\n      const rootContainer = await bootstrapLocalRootContainer();\n\n      return {\n        rootContainerCreated: rootContainer.created,\n        rootContainerId: rootContainer.containerId,\n        userId: this.runtimeHooks.getUserId?.() ?? null,\n      };\n    } catch (error: unknown) {\n      const message = errorMessage(error);\n      this.log(`Root container bootstrap failed: ${message}`);\n      throw error;\n    }\n  }\n\n  private publishSnapshot(): void {\n    const nextSnapshot = this.createSnapshot();\n    const previousSnapshot = this.snapshotValue;\n    if (\n      previousSnapshot.encapsulationKeyPair ===\n        nextSnapshot.encapsulationKeyPair &&\n      previousSnapshot.seedPhrase === nextSnapshot.seedPhrase &&\n      previousSnapshot.signingFingerprint === nextSnapshot.signingFingerprint &&\n      previousSnapshot.signingKeyPair === nextSnapshot.signingKeyPair\n    ) {\n      return;\n    }\n\n    this.snapshotValue = nextSnapshot;\n    this.onIdentityChanged(nextSnapshot.signingFingerprint);\n    this.listeners.notify();\n  }\n}\n"]}

package/client/index.d.ts

@@ -1,4 +1,4 @@
-export { createDomainScope, type DomainScope } from "../data/domainScope.js";
+export { createDomainScope, type DomainScope, } from "../data/shared/domainScope.js";
 export type { LocalProjectionReconciledDelta, LocalProjectionSnapshot, } from "../stores/local-projection/index.js";
 export { enqueueReconciliationForEvents, type ReconciliationService, } from "../sync/reconciliation/index.js";
 export { createUnavailableDirectCheckout, type DirectCheckoutAppearance, type DirectCheckoutCapability, type DirectCheckoutConfirmation, type DirectCheckoutSession, DirectCheckoutUnavailableError, } from "./billing/directCheckout.js";

package/client/index.js

@@ -1,4 +1,4 @@
-export { createDomainScope } from "../data/domainScope.js";
+export { createDomainScope, } from "../data/shared/domainScope.js";
 export { enqueueReconciliationForEvents, } from "../sync/reconciliation/index.js";
 export { createUnavailableDirectCheckout, DirectCheckoutUnavailableError, } from "./billing/directCheckout.js";
 export { createRevenueCatPurchases, createUnavailablePurchases, PurchaseAbortedError, PurchaseAlreadyOwnedError, PurchaseCancelledError, PurchaseIdentityPendingError, PurchaseProviderStalledError, PurchasesUnavailableError, } from "./billing/purchases.js";

package/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAK1E,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAK/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,GAO1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AAgDvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,GAKT,MAAM,YAAY,CAAC;AAuBpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,MAAM,GAGP,MAAM,UAAU,CAAC;AASlB,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAyB9B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,gCAAgC,EAChC,OAAO,GAIR,MAAM,WAAW,CAAC;AA8CnB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAajG,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC","sourcesContent":["export { createDomainScope, type DomainScope } from \"../data/domainScope\";\nexport type {\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n} from \"../stores/local-projection\";\nexport {\n  enqueueReconciliationForEvents,\n  type ReconciliationService,\n} from \"../sync/reconciliation\";\nexport {\n  createUnavailableDirectCheckout,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n} from \"./billing/directCheckout\";\nexport {\n  createRevenueCatPurchases,\n  createUnavailablePurchases,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n} from \"./billing/purchases\";\nexport { type BlobStoreFactory, Blobs } from \"./blobs\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentInfo,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n} from \"./containerContents\";\nexport { createContainerDocumentObjectSyncState } from \"./containerContents\";\nexport {\n  Database,\n  type DatabaseListener,\n  type DatabaseOptions,\n  type DatabaseSnapshot,\n  type DatabaseStatus,\n} from \"./database\";\nexport type {\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  LocalProjectionView,\n} from \"./deviceFirst\";\nexport type {\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentContextValue,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  ListDocumentsInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  PersistedDocumentListener,\n} from \"./documents\";\nexport { DEFAULT_DOCUMENT_ID } from \"./documents\";\nexport {\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n} from \"./events\";\nexport type { FileSaver, SaveFileRequest } from \"./fileSaver\";\nexport type {\n  Identity,\n  IdentityGenerationResult,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n} from \"./identity\";\nexport {\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  type IdentityKeyPackage,\n} from \"./identityKeyPackage\";\nexport type {\n  BrowserLocalKeyringOptions,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./localKeyring\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createWebViewLocalKeyring,\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./localKeyring\";\nexport type {\n  LocalKeyringPinCode,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n} from \"./localKeyring/localKeyringPinCode\";\nexport {\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  isPinCodeWrappedLocalSecretEnvelope,\n} from \"./localKeyring/localKeyringPinCode\";\nexport type { Logger } from \"./logger\";\nexport {\n  createBrowserNetworkStatusSource,\n  Network,\n  type NetworkListener,\n  type NetworkMode,\n  type NetworkStatusSource,\n} from \"./network\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  RemoveOrganizationGroupUserInput,\n} from \"./organizations\";\nexport type {\n  PrincipalHistoryKeyProvider,\n  PrincipalHistoryKeyScope,\n} from \"./principalHistoryProtection\";\nexport type {\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n} from \"./securityIncidents\";\nexport { PurgedOrganizationRecoveryBillingRequiredError } from \"./session/sessionRecoveryErrors\";\nexport type {\n  CreateOrganizationOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./session/sessionTypes\";\nexport {\n  SyncBillingGate,\n  type SyncBillingGateListener,\n} from \"./syncBillingGate\";\nexport type {\n  ResolvedUserIdentity,\n  UserIdentities,\n} from \"./userIdentities\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAK/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,GAO1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AAgDvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,GAKT,MAAM,YAAY,CAAC;AAuBpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,MAAM,GAGP,MAAM,UAAU,CAAC;AASlB,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAyB9B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,gCAAgC,EAChC,OAAO,GAIR,MAAM,WAAW,CAAC;AA8CnB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAajG,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC","sourcesContent":["export {\n  createDomainScope,\n  type DomainScope,\n} from \"../data/shared/domainScope\";\nexport type {\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n} from \"../stores/local-projection\";\nexport {\n  enqueueReconciliationForEvents,\n  type ReconciliationService,\n} from \"../sync/reconciliation\";\nexport {\n  createUnavailableDirectCheckout,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n} from \"./billing/directCheckout\";\nexport {\n  createRevenueCatPurchases,\n  createUnavailablePurchases,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n} from \"./billing/purchases\";\nexport { type BlobStoreFactory, Blobs } from \"./blobs\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentInfo,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n} from \"./containerContents\";\nexport { createContainerDocumentObjectSyncState } from \"./containerContents\";\nexport {\n  Database,\n  type DatabaseListener,\n  type DatabaseOptions,\n  type DatabaseSnapshot,\n  type DatabaseStatus,\n} from \"./database\";\nexport type {\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  LocalProjectionView,\n} from \"./deviceFirst\";\nexport type {\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentContextValue,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  ListDocumentsInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  PersistedDocumentListener,\n} from \"./documents\";\nexport { DEFAULT_DOCUMENT_ID } from \"./documents\";\nexport {\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n} from \"./events\";\nexport type { FileSaver, SaveFileRequest } from \"./fileSaver\";\nexport type {\n  Identity,\n  IdentityGenerationResult,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n} from \"./identity\";\nexport {\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  type IdentityKeyPackage,\n} from \"./identityKeyPackage\";\nexport type {\n  BrowserLocalKeyringOptions,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./localKeyring\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createWebViewLocalKeyring,\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./localKeyring\";\nexport type {\n  LocalKeyringPinCode,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n} from \"./localKeyring/localKeyringPinCode\";\nexport {\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  isPinCodeWrappedLocalSecretEnvelope,\n} from \"./localKeyring/localKeyringPinCode\";\nexport type { Logger } from \"./logger\";\nexport {\n  createBrowserNetworkStatusSource,\n  Network,\n  type NetworkListener,\n  type NetworkMode,\n  type NetworkStatusSource,\n} from \"./network\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  RemoveOrganizationGroupUserInput,\n} from \"./organizations\";\nexport type {\n  PrincipalHistoryKeyProvider,\n  PrincipalHistoryKeyScope,\n} from \"./principalHistoryProtection\";\nexport type {\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n} from \"./securityIncidents\";\nexport { PurgedOrganizationRecoveryBillingRequiredError } from \"./session/sessionRecoveryErrors\";\nexport type {\n  CreateOrganizationOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./session/sessionTypes\";\nexport {\n  SyncBillingGate,\n  type SyncBillingGateListener,\n} from \"./syncBillingGate\";\nexport type {\n  ResolvedUserIdentity,\n  UserIdentities,\n} from \"./userIdentities\";\n"]}

package/client/organizations/organizationAccessRestoration.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationAccessRestoration.js","sourceRoot":"","sources":["organizationAccessRestoration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yEAAyE,CAAC;AAC3H,OAAO,EAAE,uCAAuC,EAAE,MAAM,gEAAgE,CAAC;AACzH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAG/F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,gCAAgC;IAChC,IACE,CAAC,CAAC,MAAM,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC,MAAM,gCAAgC,CAAC,oBAAoB,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC,CAAC;QACL,YAAY,EAAE,EACd,CAAC;QACD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAC3D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC;QACF,IAAI,YAAY,EAAE;YAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,sEAAsE;IACtE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,0BAA0B,GAC9B,MAAM,uCAAuC,CAC3C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B;YACE,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CACF,CAAC;QACJ,IAAI,0BAA0B,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;YACrD,qBAAqB,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport { sqlDocumentMoveIntentPersistence } from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { requestDormantMetadataRestorationSweeps } from \"../../data/persistence/container-contents/dormantMetadataSweep\";\nimport { hasRecordedTerminalSyncFailures } from \"../../data/sqlite/documentPersistence\";\nimport {\n  requestAllDomainSyncLanes,\n  requestDomainSyncLane,\n} from \"../../data/sync/syncCoordinator\";\nimport { CONTAINER_CONTENTS_SYNC_LANE_KEY } from \"../../workflows/container-contents/syncLane\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** Recover parked work before optional presentation hydration can fail. */\nexport async function recoverOrganizationAccess(input: {\n  readonly active: ActiveOrganizationDataRuntime;\n  readonly domainScope: DomainScope;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const { active, domainScope, stillCurrent } = input;\n  if (!stillCurrent()) return;\n  // The evidence gate: re-arm only when some queued write actually\n  // recorded a terminal failure. A transient denial during bootstrap\n  // (e.g. a read-model 403 before grants propagate) also flips the\n  // denied flag, and re-arming then would race the startup sync passes.\n  // A failed pass (`undefined`) proves nothing about restored access,\n  // so it must not re-arm either.\n  if (\n    ((await hasRecordedTerminalSyncFailures(active.runtime.infra.execSql)) ||\n      (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(\n        active.runtime.infra.execSql,\n        { organizationId: active.organizationId },\n      ))) &&\n    stillCurrent()\n  ) {\n    // Parked permission-denied moves (row 7) only replay once flipped\n    // back to pending; restore them before re-arming the lanes.\n    await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(\n      active.runtime.infra.execSql,\n      { organizationId: active.organizationId },\n    );\n    if (stillCurrent()) requestAllDomainSyncLanes(domainScope);\n  }\n  // Keep dormant cleanup independent from the write-lane evidence gate,\n  // but run it afterward so a SQLite failure cannot suppress the\n  // pre-existing denied-write and move-intent recovery signal.\n  if (stillCurrent()) {\n    const requestedDormantSweepCount =\n      await requestDormantMetadataRestorationSweeps(\n        active.runtime.infra.execSql,\n        {\n          requesterUserId: active.userId,\n        },\n      );\n    if (requestedDormantSweepCount > 0 && stillCurrent()) {\n      requestDomainSyncLane(domainScope, CONTAINER_CONTENTS_SYNC_LANE_KEY);\n    }\n  }\n}\n"]}
+{"version":3,"file":"organizationAccessRestoration.js","sourceRoot":"","sources":["organizationAccessRestoration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yEAAyE,CAAC;AAC3H,OAAO,EAAE,uCAAuC,EAAE,MAAM,gEAAgE,CAAC;AAEzH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAG/F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,gCAAgC;IAChC,IACE,CAAC,CAAC,MAAM,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC,MAAM,gCAAgC,CAAC,oBAAoB,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC,CAAC;QACL,YAAY,EAAE,EACd,CAAC;QACD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAC3D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC;QACF,IAAI,YAAY,EAAE;YAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,sEAAsE;IACtE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,0BAA0B,GAC9B,MAAM,uCAAuC,CAC3C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B;YACE,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CACF,CAAC;QACJ,IAAI,0BAA0B,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;YACrD,qBAAqB,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { sqlDocumentMoveIntentPersistence } from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { requestDormantMetadataRestorationSweeps } from \"../../data/persistence/container-contents/dormantMetadataSweep\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport { hasRecordedTerminalSyncFailures } from \"../../data/sqlite/documentPersistence\";\nimport {\n  requestAllDomainSyncLanes,\n  requestDomainSyncLane,\n} from \"../../data/sync/syncCoordinator\";\nimport { CONTAINER_CONTENTS_SYNC_LANE_KEY } from \"../../workflows/container-contents/syncLane\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** Recover parked work before optional presentation hydration can fail. */\nexport async function recoverOrganizationAccess(input: {\n  readonly active: ActiveOrganizationDataRuntime;\n  readonly domainScope: DomainScope;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const { active, domainScope, stillCurrent } = input;\n  if (!stillCurrent()) return;\n  // The evidence gate: re-arm only when some queued write actually\n  // recorded a terminal failure. A transient denial during bootstrap\n  // (e.g. a read-model 403 before grants propagate) also flips the\n  // denied flag, and re-arming then would race the startup sync passes.\n  // A failed pass (`undefined`) proves nothing about restored access,\n  // so it must not re-arm either.\n  if (\n    ((await hasRecordedTerminalSyncFailures(active.runtime.infra.execSql)) ||\n      (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(\n        active.runtime.infra.execSql,\n        { organizationId: active.organizationId },\n      ))) &&\n    stillCurrent()\n  ) {\n    // Parked permission-denied moves (row 7) only replay once flipped\n    // back to pending; restore them before re-arming the lanes.\n    await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(\n      active.runtime.infra.execSql,\n      { organizationId: active.organizationId },\n    );\n    if (stillCurrent()) requestAllDomainSyncLanes(domainScope);\n  }\n  // Keep dormant cleanup independent from the write-lane evidence gate,\n  // but run it afterward so a SQLite failure cannot suppress the\n  // pre-existing denied-write and move-intent recovery signal.\n  if (stillCurrent()) {\n    const requestedDormantSweepCount =\n      await requestDormantMetadataRestorationSweeps(\n        active.runtime.infra.execSql,\n        {\n          requesterUserId: active.userId,\n        },\n      );\n    if (requestedDormantSweepCount > 0 && stillCurrent()) {\n      requestDomainSyncLane(domainScope, CONTAINER_CONTENTS_SYNC_LANE_KEY);\n    }\n  }\n}\n"]}

package/client/organizations/organizationDataUsage.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mEAAmE,CAAC;AAE/G,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n  loadLocalOrganizationDataUsage,\n  type OrganizationDataUsage,\n  reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null>;\n  /** Undefined means no authoritative result was available for this runtime. */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null | undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n  implements OrganizationDataUsageCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDataUsage | null | undefined>>\n  >();\n\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n\n    try {\n      return await loadLocalOrganizationDataUsage({\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      });\n    } catch (error) {\n      active.runtime.util.logError(\n        \"Failed to load local organization data usage\",\n        error,\n      );\n      return null;\n    }\n  }\n\n  reconcile(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return Promise.resolve(undefined);\n    }\n    if (!active.runtime.state.online) {\n      return this.loadLocal(active.organizationId).then(\n        (local) => local ?? undefined,\n      );\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    const reconciliation = reconcileOrganizationDataUsage({\n      apiClient: active.runtime.apiClient,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n      requesterUserId: active.userId,\n    }).finally(() => {\n      if (byKey.get(key) === reconciliation) {\n        byKey.delete(key);\n      }\n    });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}
+{"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mEAAmE,CAAC;AAE/G,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  loadLocalOrganizationDataUsage,\n  type OrganizationDataUsage,\n  reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null>;\n  /** Undefined means no authoritative result was available for this runtime. */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null | undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n  implements OrganizationDataUsageCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDataUsage | null | undefined>>\n  >();\n\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n\n    try {\n      return await loadLocalOrganizationDataUsage({\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      });\n    } catch (error) {\n      active.runtime.util.logError(\n        \"Failed to load local organization data usage\",\n        error,\n      );\n      return null;\n    }\n  }\n\n  reconcile(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return Promise.resolve(undefined);\n    }\n    if (!active.runtime.state.online) {\n      return this.loadLocal(active.organizationId).then(\n        (local) => local ?? undefined,\n      );\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    const reconciliation = reconcileOrganizationDataUsage({\n      apiClient: active.runtime.apiClient,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n      requesterUserId: active.userId,\n    }).finally(() => {\n      if (byKey.get(key) === reconciliation) {\n        byKey.delete(key);\n      }\n    });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}

package/client/organizations/organizationGroupNameHydration.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n  directoryAndGroups: OrganizationDirectoryAndGroups | null | undefined,\n) {\n  if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n    // Labels and their metadata root belong to this one reconciliation view.\n    const currentRecovery = {\n      resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n        active.runtime,\n      ),\n      recoveryBatch: {},\n    };\n    return hydrateOrganizationGroupNames({\n      apiClient: active.runtime.apiClient,\n      directory: directoryAndGroups,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n        currentUserId: active.userId,\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        principalId: active.organizationId,\n        principalType: \"organization\",\n      }),\n      reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n      createCurrentNameReader: (authority) =>\n        createRuntimeGroupMetadataAccess(\n          active.runtime,\n          active.organizationId,\n          stillCurrent,\n          createSelectedCurrentGroupMetadataContainerVerifier({\n            authority,\n            organizationId: active.organizationId,\n            stillCurrent,\n          }),\n        ).readName,\n      readEncryptedName: createRuntimeGroupMetadataAccess(\n        active.runtime,\n        active.organizationId,\n        stillCurrent,\n        undefined,\n        currentRecovery,\n      ).readName,\n      resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n      ...currentRecovery,\n      stillCurrent,\n    });\n  }\n  return directoryAndGroups;\n}\n"]}
+{"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n  directoryAndGroups: OrganizationDirectoryAndGroups | null | undefined,\n) {\n  if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n    // Labels and their metadata root belong to this one reconciliation view.\n    const currentRecovery = {\n      resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n        active.runtime,\n      ),\n      recoveryBatch: {},\n    };\n    return hydrateOrganizationGroupNames({\n      apiClient: active.runtime.apiClient,\n      directory: directoryAndGroups,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n        currentUserId: active.userId,\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        principalId: active.organizationId,\n        principalType: \"organization\",\n      }),\n      reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n      createCurrentNameReader: (authority) =>\n        createRuntimeGroupMetadataAccess(\n          active.runtime,\n          active.organizationId,\n          stillCurrent,\n          createSelectedCurrentGroupMetadataContainerVerifier({\n            authority,\n            organizationId: active.organizationId,\n            stillCurrent,\n          }),\n        ).readName,\n      readEncryptedName: createRuntimeGroupMetadataAccess(\n        active.runtime,\n        active.organizationId,\n        stillCurrent,\n        undefined,\n        currentRecovery,\n      ).readName,\n      resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n      ...currentRecovery,\n      stillCurrent,\n    });\n  }\n  return directoryAndGroups;\n}\n"]}

package/client/organizations/organizationMetadataProfileSync.js

@@ -1,4 +1,4 @@
-import { errorMessage } from "../../data/errorMessage.js";
+import { errorMessage } from "../../data/shared/errorMessage.js";
 import { getOrganizationProfileDocumentLocalId } from "../../workflows/organizations/organizationProfile.js";
 import { deriveOrganizationMetadataContainerSystemSlot } from "../../workflows/organizations/rosterProfileContainer.js";
 /**

package/client/organizations/organizationMetadataProfileSync.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationMetadataProfileSync.js","sourceRoot":"","sources":["organizationMetadataProfileSync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,6CAA6C,EAAE,MAAM,sDAAsD,CAAC;AAGrH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,6CAA6C,CAAC;YACrE,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,IAAI;aACD,WAAW,EAAE;aACb,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,GAAG,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CACP,+DAA+D,KAAK,CAAC,cAAc,wBAAwB,CAC5G,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,OAAO,EAAE,qCAAqC,CAAC;gBAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,CACP,uEAAuE,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { errorMessage } from \"../../data/errorMessage\";\nimport { getOrganizationProfileDocumentLocalId } from \"../../workflows/organizations/organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../../workflows/organizations/rosterProfileContainer\";\nimport type { ContainerContents } from \"../containerContents\";\n\n/**\n * Push the locally-authored organization profile after Members changes. Key\n * rematerialization is already part of the policy transaction; this is only an\n * idempotent content sync and never creates or changes a grant.\n */\nexport async function syncOrganizationMetadataProfile(input: {\n  readonly containerContents: ContainerContents;\n  readonly log: (message: string) => void;\n  readonly organizationId: string;\n}): Promise<void> {\n  try {\n    const systemSlot = await deriveOrganizationMetadataContainerSystemSlot({\n      organizationId: input.organizationId,\n    });\n    const tree = input.containerContents.openTree();\n    const findNode = () =>\n      tree\n        .getSnapshot()\n        .nodes.find((candidate) => candidate.systemSlot === systemSlot);\n    let node = findNode();\n    if (!node) {\n      await tree.refresh();\n      node = findNode();\n    }\n    if (!node) {\n      input.log(\n        `Organizations: org metadata container not reachable for org ${input.organizationId}; skipped profile sync`,\n      );\n      return;\n    }\n\n    input.containerContents.pullDocumentContent({\n      containerId: node.id,\n      localId: getOrganizationProfileDocumentLocalId({\n        organizationId: input.organizationId,\n      }),\n    });\n  } catch (error) {\n    input.log(\n      `Organizations: best-effort org metadata profile sync failed for org ${input.organizationId}: ${errorMessage(error)}`,\n    );\n  }\n}\n"]}
+{"version":3,"file":"organizationMetadataProfileSync.js","sourceRoot":"","sources":["organizationMetadataProfileSync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,6CAA6C,EAAE,MAAM,sDAAsD,CAAC;AAGrH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,6CAA6C,CAAC;YACrE,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,IAAI;aACD,WAAW,EAAE;aACb,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,GAAG,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CACP,+DAA+D,KAAK,CAAC,cAAc,wBAAwB,CAC5G,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,OAAO,EAAE,qCAAqC,CAAC;gBAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,CACP,uEAAuE,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { errorMessage } from \"../../data/shared/errorMessage\";\nimport { getOrganizationProfileDocumentLocalId } from \"../../workflows/organizations/organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../../workflows/organizations/rosterProfileContainer\";\nimport type { ContainerContents } from \"../containerContents\";\n\n/**\n * Push the locally-authored organization profile after Members changes. Key\n * rematerialization is already part of the policy transaction; this is only an\n * idempotent content sync and never creates or changes a grant.\n */\nexport async function syncOrganizationMetadataProfile(input: {\n  readonly containerContents: ContainerContents;\n  readonly log: (message: string) => void;\n  readonly organizationId: string;\n}): Promise<void> {\n  try {\n    const systemSlot = await deriveOrganizationMetadataContainerSystemSlot({\n      organizationId: input.organizationId,\n    });\n    const tree = input.containerContents.openTree();\n    const findNode = () =>\n      tree\n        .getSnapshot()\n        .nodes.find((candidate) => candidate.systemSlot === systemSlot);\n    let node = findNode();\n    if (!node) {\n      await tree.refresh();\n      node = findNode();\n    }\n    if (!node) {\n      input.log(\n        `Organizations: org metadata container not reachable for org ${input.organizationId}; skipped profile sync`,\n      );\n      return;\n    }\n\n    input.containerContents.pullDocumentContent({\n      containerId: node.id,\n      localId: getOrganizationProfileDocumentLocalId({\n        organizationId: input.organizationId,\n      }),\n    });\n  } catch (error) {\n    input.log(\n      `Organizations: best-effort org metadata profile sync failed for org ${input.organizationId}: ${errorMessage(error)}`,\n    );\n  }\n}\n"]}