@tearleads/client-sdk 0.1.58 → 0.1.59

package/workflows/runtimeInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeInput.js","sourceRoot":"","sources":["runtimeInput.ts"],"names":[],"mappings":"","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport type { BlobStore } from \"../data/blobContracts\";\nimport type { DocumentProjectorRegistry } from \"../data/documents/documentKinds\";\nimport type { DomainScope } from \"../data/domainScope\";\nimport type { SecurityIncidentReporter } from \"../data/securityIncidents\";\nimport type { ExecSql } from \"../data/sqlite/sqlSchema\";\n\nexport type WorkflowRuntimeDatabaseStatus =\n  | \"idle\"\n  | \"ready\"\n  | \"error\"\n  | \"terminated\";\n\nexport interface WorkflowRuntimeAuthInput {\n  /** Server-backed personal organization; independent of organizationId. */\n  readonly defaultOrganizationId?: string | null;\n  /** Session root identity, independent of a document/pane target. */\n  readonly rootContainerId?: string | null | undefined;\n  readonly isAuthenticated: boolean;\n  /** Platform-operator flag from the server; the API enforces root access. */\n  readonly isRoot?: boolean | undefined;\n  readonly organizationId: string | null;\n  readonly userId: string | null;\n}\n\nexport interface WorkflowRuntimeCryptoInput {\n  readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  readonly signingFingerprint: string | null;\n  readonly signingKeyPair: SigningKeyPair | null;\n}\n\nexport interface WorkflowRuntimeStateInput {\n  readonly containerId: string | null;\n  readonly domainScope: DomainScope;\n  readonly events: ReadonlyArray<unknown>;\n  readonly online: boolean;\n  /**\n   * Increments after each acknowledged server-events interest declaration.\n   * Unlike a boolean connection edge, this survives coalesced runtime\n   * notifications and document stores retained while their host provider is\n   * unmounted.\n   */\n  readonly serverEventsConnectionGeneration?: number | undefined;\n  /**\n   * Per-pane CRDT peer-seed discriminator (e.g. the pane's local identity\n   * namespace). Documents in distinct panes must derive distinct Loro peer ids;\n   * absent/`null` means single-pane (bare scope). The document runtime factory\n   * always populates it; other runtimes and test fixtures may omit it.\n   */\n  readonly peerScope?: string | null;\n}\n\nexport interface WorkflowRuntimeInfraInput {\n  readonly blobStore: BlobStore;\n  readonly dbStatus: WorkflowRuntimeDatabaseStatus;\n  readonly documentProjectors: DocumentProjectorRegistry;\n  readonly execSql: ExecSql;\n}\n\nexport interface WorkflowRuntimeUtilInput {\n  readonly isRemoteSyncBlocked?:\n    | ((organizationId: string) => boolean)\n    | undefined;\n  readonly log: (message: string) => void;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n}\n\nexport interface WorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: WorkflowRuntimeInfraInput;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: WorkflowRuntimeUtilInput;\n}\n"]}
+{"version":3,"file":"runtimeInput.js","sourceRoot":"","sources":["runtimeInput.ts"],"names":[],"mappings":"","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport type { BlobStore } from \"../data/blobs/blobContracts\";\nimport type { DocumentProjectorRegistry } from \"../data/documents/documentKinds\";\nimport type { DomainScope } from \"../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../data/sqlite/sqlSchema\";\n\nexport type WorkflowRuntimeDatabaseStatus =\n  | \"idle\"\n  | \"ready\"\n  | \"error\"\n  | \"terminated\";\n\nexport interface WorkflowRuntimeAuthInput {\n  /** Server-backed personal organization; independent of organizationId. */\n  readonly defaultOrganizationId?: string | null;\n  /** Session root identity, independent of a document/pane target. */\n  readonly rootContainerId?: string | null | undefined;\n  readonly isAuthenticated: boolean;\n  /** Platform-operator flag from the server; the API enforces root access. */\n  readonly isRoot?: boolean | undefined;\n  readonly organizationId: string | null;\n  readonly userId: string | null;\n}\n\nexport interface WorkflowRuntimeCryptoInput {\n  readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  readonly signingFingerprint: string | null;\n  readonly signingKeyPair: SigningKeyPair | null;\n}\n\nexport interface WorkflowRuntimeStateInput {\n  readonly containerId: string | null;\n  readonly domainScope: DomainScope;\n  readonly events: ReadonlyArray<unknown>;\n  readonly online: boolean;\n  /**\n   * Increments after each acknowledged server-events interest declaration.\n   * Unlike a boolean connection edge, this survives coalesced runtime\n   * notifications and document stores retained while their host provider is\n   * unmounted.\n   */\n  readonly serverEventsConnectionGeneration?: number | undefined;\n  /**\n   * Per-pane CRDT peer-seed discriminator (e.g. the pane's local identity\n   * namespace). Documents in distinct panes must derive distinct Loro peer ids;\n   * absent/`null` means single-pane (bare scope). The document runtime factory\n   * always populates it; other runtimes and test fixtures may omit it.\n   */\n  readonly peerScope?: string | null;\n}\n\nexport interface WorkflowRuntimeInfraInput {\n  readonly blobStore: BlobStore;\n  readonly dbStatus: WorkflowRuntimeDatabaseStatus;\n  readonly documentProjectors: DocumentProjectorRegistry;\n  readonly execSql: ExecSql;\n}\n\nexport interface WorkflowRuntimeUtilInput {\n  readonly isRemoteSyncBlocked?:\n    | ((organizationId: string) => boolean)\n    | undefined;\n  readonly log: (message: string) => void;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n}\n\nexport interface WorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: WorkflowRuntimeInfraInput;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: WorkflowRuntimeUtilInput;\n}\n"]}

package/workflows/sync/index.d.ts

@@ -1,4 +1,5 @@
-export { createDomainScope, type DomainScope, } from "../../data/domainScope.js";
+export { createDomainScope, type DomainScope, } from "../../data/shared/domainScope.js";
+export { getRuntimePeerSeed } from "../../data/sync/crdtPeerSeed.js";
 export { markOriginatedDocuments } from "../../data/sync/originatedDocuments.js";
 export type { DomainSyncCoordinator, DomainSyncSnapshot, SyncIdleOptions, SyncLane, SyncLaneConfig, SyncLaneLastAction, SyncLanePhase, SyncLaneProgress, SyncLaneSnapshot, SyncLaneStatus, UploadSyncLane, UploadSyncLaneOptions, } from "../../data/sync/syncCoordinator.js";
 export { beginDomainSyncUploadLane, getDomainSyncCoordinatorSnapshot, getOrCreateDomainSyncCoordinator, hasDomainSyncCoordinatorPendingWork, requestAllDomainSyncLanes, subscribeToDomainSyncCoordinator, waitForDomainSyncCoordinatorToSettle, } from "../../data/sync/syncCoordinator.js";

package/workflows/sync/index.js

@@ -1,4 +1,5 @@
-export { createDomainScope, } from "../../data/domainScope.js";
+export { createDomainScope, } from "../../data/shared/domainScope.js";
+export { getRuntimePeerSeed } from "../../data/sync/crdtPeerSeed.js";
 export { markOriginatedDocuments } from "../../data/sync/originatedDocuments.js";
 export { beginDomainSyncUploadLane, getDomainSyncCoordinatorSnapshot, getOrCreateDomainSyncCoordinator, hasDomainSyncCoordinatorPendingWork, requestAllDomainSyncLanes, subscribeToDomainSyncCoordinator, waitForDomainSyncCoordinatorToSettle, } from "../../data/sync/syncCoordinator.js";
 export { clearRemoteSyncState, } from "./remoteReset.js";

package/workflows/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAe9E,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,oBAAoB,GAGrB,MAAM,eAAe,CAAC","sourcesContent":["export {\n  createDomainScope,\n  type DomainScope,\n} from \"../../data/domainScope\";\nexport { markOriginatedDocuments } from \"../../data/sync/originatedDocuments\";\nexport type {\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneProgress,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n  UploadSyncLane,\n  UploadSyncLaneOptions,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  beginDomainSyncUploadLane,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  type ClearRemoteSyncStateResult,\n  clearRemoteSyncState,\n  type RemoteResetInput,\n  type RemoteResetReplacement,\n} from \"./remoteReset\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAe9E,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,oBAAoB,GAGrB,MAAM,eAAe,CAAC","sourcesContent":["export {\n  createDomainScope,\n  type DomainScope,\n} from \"../../data/shared/domainScope\";\nexport { getRuntimePeerSeed } from \"../../data/sync/crdtPeerSeed\";\nexport { markOriginatedDocuments } from \"../../data/sync/originatedDocuments\";\nexport type {\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneProgress,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n  UploadSyncLane,\n  UploadSyncLaneOptions,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  beginDomainSyncUploadLane,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"../../data/sync/syncCoordinator\";\nexport {\n  type ClearRemoteSyncStateResult,\n  clearRemoteSyncState,\n  type RemoteResetInput,\n  type RemoteResetReplacement,\n} from \"./remoteReset\";\n"]}

package/data/keyingCanonicalJson.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyingCanonicalJson.js","sourceRoot":"","sources":["keyingCanonicalJson.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAOpE,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS;QAC1B,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,MAAuB,EACvB,OAA6B;IAE7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;IAErC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAA0B,EAC1B,KAAa;IAEb,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACjC,mBAAmB,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,KAAa;IAEb,OAAO,4BAA4B,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import type { KeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { isPlainObject } from \"@tearleads/validators/isPlainObject\";\n\ninterface CanonicalJsonFrame {\n  leave?: object;\n  value?: unknown;\n}\n\nfunction isCanonicalJsonScalar(value: unknown): boolean {\n  return (\n    value === null ||\n    typeof value === \"string\" ||\n    typeof value === \"boolean\" ||\n    (typeof value === \"number\" && Number.isFinite(value))\n  );\n}\n\nfunction pushCanonicalJsonChildren(\n  value: unknown,\n  active: WeakSet<object>,\n  pending: CanonicalJsonFrame[],\n): boolean {\n  if (Array.isArray(value)) {\n    if (active.has(value)) {\n      return false;\n    }\n    active.add(value);\n    pending.push({ leave: value });\n    for (let index = 0; index < value.length; index += 1) {\n      if (!(index in value)) {\n        return false;\n      }\n      pending.push({ value: value[index] });\n    }\n    return true;\n  }\n\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  if (active.has(value)) {\n    return false;\n  }\n  active.add(value);\n  pending.push({ leave: value });\n  for (const key of Object.keys(value)) {\n    pending.push({ value: Reflect.get(value, key) });\n  }\n  return true;\n}\n\nfunction isCanonicalJson(value: unknown): value is KeyingCanonicalJson {\n  const pending: CanonicalJsonFrame[] = [{ value }];\n  const active = new WeakSet<object>();\n\n  while (pending.length > 0) {\n    const frame = pending.pop();\n    if (!frame) {\n      break;\n    }\n    if (frame.leave) {\n      active.delete(frame.leave);\n      continue;\n    }\n\n    const item = frame.value;\n    if (isCanonicalJsonScalar(item)) {\n      continue;\n    }\n    if (!pushCanonicalJsonChildren(item, active, pending)) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\nexport function readCanonicalJson(\n  value: unknown,\n  label: string,\n): KeyingCanonicalJson {\n  if (!isCanonicalJson(value)) {\n    throw new Error(`${label} must be canonical JSON`);\n  }\n  return value;\n}\n\nexport function readCanonicalRecord(\n  value: unknown,\n  label: string,\n): Record<string, unknown> {\n  if (!isPlainObject(value)) {\n    throw new Error(`${label} must be an object`);\n  }\n  readCanonicalJson(value, label);\n  return value;\n}\n\nexport function readCanonicalRecords(\n  values: readonly unknown[],\n  label: string,\n): Record<string, unknown>[] {\n  return values.map((value, index) =>\n    readCanonicalRecord(value, `${label}[${index}]`),\n  );\n}\n\n/**\n * Canonicalize-then-serialize, the one string form every keying equality\n * check compares. Both halves are shared already; composing them per-file\n * invited the composition itself to drift.\n */\nexport function canonicalKeyingJsonString(\n  value: unknown,\n  label: string,\n): string {\n  return serializeKeyingCanonicalJson(readCanonicalJson(value, label));\n}\n"]}

package/data/keyingProjectionVerification.d.ts

@@ -1,9 +0,0 @@
-import type { ProjectionUserKeyResolver } from "./keyingProjectionVerification/types.js";
-export { resolveEventContainerPaths } from "./keyingProjectionVerification/documentDependencyPaths.js";
-export { readAccessEvent, readRecordString, readRequiredRecordValue, } from "./keyingProjectionVerification/readers.js";
-export type { PrincipalPolicyCache, ProjectionUserKey, ProjectionUserKeyResolver, ReferencedPrincipalPolicyWarmer, } from "./keyingProjectionVerification/types.js";
-export { isProjectionVerificationCancelledError, nullOnProjectionVerificationCancellation, } from "./keyingProjectionVerification/types.js";
-export declare function requireProjectionUserKeyResolver(resolveProjectionUserKey: ProjectionUserKeyResolver | null | undefined, label: string): ProjectionUserKeyResolver;
-export { collectContainerWriterProjectionPrincipalPolicies, verifyContainerWriterProjection, } from "./keyingProjectionVerification/containerProjectionVerification.js";
-export { type DocumentWriterProjectionAuthorization, verifyDocumentWriterProjection, verifyDocumentWriterProjectionAuthorization, } from "./keyingProjectionVerification/documentProjectionVerification.js";
-export { verifyDocumentPurgeProof, verifyDocumentPurgeProofBaseline, } from "./keyingProjectionVerification/documentPurgeProofVerification.js";

package/data/keyingProjectionVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyingProjectionVerification.js","sourceRoot":"","sources":["keyingProjectionVerification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAQhD,OAAO,EACL,sCAAsC,EACtC,wCAAwC,GACzC,MAAM,sCAAsC,CAAC;AAE9C,MAAM,UAAU,gCAAgC,CAC9C,wBAAsE,EACtE,KAAa;IAEb,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IACnE,CAAC;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,kCAAkC,CAAC,wBAAwB,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EACL,iDAAiD,EACjD,+BAA+B,GAChC,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAEL,8BAA8B,EAC9B,2CAA2C,GAC5C,MAAM,+DAA+D,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,+DAA+D,CAAC","sourcesContent":["import type { ProjectionUserKeyResolver } from \"./keyingProjectionVerification/types\";\nimport { requireTrustedUserIdentityResolver } from \"./trustedUserIdentity/requiredResolver\";\n\nexport { resolveEventContainerPaths } from \"./keyingProjectionVerification/documentDependencyPaths\";\nexport {\n  readAccessEvent,\n  readRecordString,\n  readRequiredRecordValue,\n} from \"./keyingProjectionVerification/readers\";\n\nexport type {\n  PrincipalPolicyCache,\n  ProjectionUserKey,\n  ProjectionUserKeyResolver,\n  ReferencedPrincipalPolicyWarmer,\n} from \"./keyingProjectionVerification/types\";\nexport {\n  isProjectionVerificationCancelledError,\n  nullOnProjectionVerificationCancellation,\n} from \"./keyingProjectionVerification/types\";\n\nexport function requireProjectionUserKeyResolver(\n  resolveProjectionUserKey: ProjectionUserKeyResolver | null | undefined,\n  label: string,\n): ProjectionUserKeyResolver {\n  if (!resolveProjectionUserKey) {\n    throw new Error(`${label} requires projection key verification`);\n  }\n\n  // A ProjectionUserKey is a TrustedUserIdentity, so the shared adapter\n  // provides the untrusted-shape and wrong-user guards (with identity caching).\n  return requireTrustedUserIdentityResolver(resolveProjectionUserKey);\n}\n\nexport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  verifyContainerWriterProjection,\n} from \"./keyingProjectionVerification/containerProjectionVerification\";\nexport {\n  type DocumentWriterProjectionAuthorization,\n  verifyDocumentWriterProjection,\n  verifyDocumentWriterProjectionAuthorization,\n} from \"./keyingProjectionVerification/documentProjectionVerification\";\nexport {\n  verifyDocumentPurgeProof,\n  verifyDocumentPurgeProofBaseline,\n} from \"./keyingProjectionVerification/documentPurgeProofVerification\";\n"]}