@tearleads/client-sdk 0.1.60 → 0.1.61

package/Tearleads.d.ts

@@ -1,64 +1,22 @@
 import { ApiRequestMetrics } from "./internal/api-client/index.js";
-import { type BlobStoreFactory, Blobs } from "./client/blobs/index.js";
+import { Blobs } from "./client/blobs/index.js";
 import { type ContainerContents } from "./client/containerContents/index.js";
 import { type DeviceFirst } from "./client/deviceFirst/index.js";
 import { type Documents } from "./client/documents/index.js";
-import { type Logger } from "./client/host/logger.js";
-import { type Identity, type IdentityOptions } from "./client/identity/index.js";
+import { type Identity } from "./client/identity/index.js";
 import { type UserIdentities } from "./client/identity/userIdentities.js";
 import { type Organizations } from "./client/organizations/index.js";
 import { type Root } from "./client/root/index.js";
 import { ApiVersion } from "./client/runtime/apiVersion.js";
-import { Database, type DatabaseOptions } from "./client/runtime/database.js";
+import { Database } from "./client/runtime/database.js";
 import { Events } from "./client/runtime/events.js";
 import { Network } from "./client/runtime/network.js";
-import type { PrincipalHistoryKeyProvider } from "./client/runtime/principalHistoryProtection.js";
 import { SyncBillingGate } from "./client/runtime/syncBillingGate.js";
 import { type Runtime } from "./client/runtime/workflowRuntime.js";
-import { type SecurityIncidentListener, type SecurityIncidents } from "./client/securityIncidents/index.js";
+import { type SecurityIncidents } from "./client/securityIncidents/index.js";
 import type { Session } from "./client/session/sessionTypes.js";
-import type { BlobStore } from "./data/blobs/blobContracts.js";
-import { type DocumentProjectorRegistryInput } from "./data/documents/documentKinds.js";
 import { type DomainScope } from "./data/shared/domainScope.js";
-import type { ProvisionedSystemContainerSpec } from "./workflows/registration/index.js";
-export type ClientDatabaseOptions = Omit<DatabaseOptions, "status">;
-export interface ClientOptions {
-    apiBaseUrl?: string | undefined;
-    /** Reuse a memory-only request counter across client lifetimes. */
-    apiRequestMetrics?: ApiRequestMetrics | undefined;
-    blobStore?: BlobStore | undefined;
-    blobStoreFactory?: BlobStoreFactory | undefined;
-    database?: ClientDatabaseOptions | undefined;
-    documentProjectors?: DocumentProjectorRegistryInput | undefined;
-    events?: ReadonlyArray<unknown> | undefined;
-    identity?: IdentityOptions | undefined;
-    /**
-     * Absolute, host-controlled API namespace for durable user-identity pins.
-     * Required only when apiBaseUrl is relative and no browser origin exists.
-     */
-    identityTrustDomain?: string | undefined;
-    identityProvisioning?: "auto" | "manual" | undefined;
-    logger?: Logger | undefined;
-    online?: boolean | undefined;
-    /** Called after a trust-boundary verification failure is durably recorded. */
-    onSecurityIncident?: SecurityIncidentListener | undefined;
-    /**
-     * Per-pane discriminator so documents in distinct panes derive distinct Loro
-     * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.
-     */
-    peerScope?: string | undefined;
-    /** Private host key for durable history progress; omitted uses disposable session keys. */
-    principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;
-    /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */
-    principalMutationTimeoutMs?: number | undefined;
-    /**
-     * App-owned system containers born with every new organization (both
-     * registration and additional-org creation provision them atomically in the
-     * same server call), e.g. a trash bin. The app owns these because their slot
-     * namespaces are app concepts the SDK stays agnostic to.
-     */
-    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
-}
+import type { TearleadsOptions } from "./TearleadsOptions.js";
 export declare class Tearleads {
     readonly apiVersion: ApiVersion;
     readonly apiRequests: ApiRequestMetrics;
@@ -91,7 +49,9 @@ export declare class Tearleads {
     private pinLocalUserIdentity;
     private primeProvisionedPrincipalHistory;
     private boundUserId;
-    constructor(options?: ClientOptions);
+    constructor(options?: TearleadsOptions);
+    /** Durable incident records in this database, reported to the host's listener. */
+    private createSecurityIncidents;
     /** Trust callbacks reach the workflow runtime, which is created later. */
     private createClientSession;
     private createApiClient;

package/Tearleads.js

@@ -4,7 +4,7 @@ import { createContainerContents, } from "./client/containerContents/index.js";
 import { createDeviceFirst } from "./client/deviceFirst/index.js";
 import { createDocuments } from "./client/documents/index.js";
 import { logErrorToConsole } from "./client/host/logger.js";
-import { createIdentity, } from "./client/identity/index.js";
+import { createIdentity } from "./client/identity/index.js";
 import { createUserIdentities, } from "./client/identity/userIdentities.js";
 import { createOrganizations, } from "./client/organizations/index.js";
 import { createRoot, rootRuntimeOf } from "./client/root/index.js";
@@ -21,21 +21,6 @@ import { createVerifiedManifestCitations } from "./data/persistence/verifiedMani
 import { createDomainScope } from "./data/shared/domainScope.js";
 import { disposeDomainSyncCoordinator } from "./data/sync/syncCoordinator.js";
 import { resolveIdentityTrustDomain } from "./data/trustedUserIdentity/index.js";
-function createClientSecurityIncidentService(input) {
-    const identityTrustDomain = resolveIdentityTrustDomain({
-        apiBaseUrl: input.apiBaseUrl,
-        identityTrustDomain: input.options.identityTrustDomain,
-    });
-    return {
-        identityTrustDomain,
-        service: createSecurityIncidentService({
-            database: input.database,
-            logError: input.logError,
-            onIncident: input.options.onSecurityIncident,
-            trustDomain: identityTrustDomain,
-        }),
-    };
-}
 export class Tearleads {
     apiVersion = new ApiVersion();
     apiRequests;
@@ -85,14 +70,13 @@ export class Tearleads {
         this.events = new Events(options.events, () => this.apiClient.clearWriterProjectionCaches());
         this.logHandler = options.logger?.log ?? (() => undefined);
         this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;
-        const security = createClientSecurityIncidentService({
+        const identityTrustDomain = resolveIdentityTrustDomain({
             apiBaseUrl,
-            database: this.database,
-            logError: this.logError,
-            options,
+            identityTrustDomain: options.identityTrustDomain,
         });
-        this.securityIncidents = security.service.incidents;
-        this.disposeSecurityIncidents = security.service.dispose;
+        const security = this.createSecurityIncidents(identityTrustDomain, options);
+        this.securityIncidents = security.incidents;
+        this.disposeSecurityIncidents = security.dispose;
         this.network = new Network(options.online);
         this.syncBillingGate = new SyncBillingGate();
         let session = null;
@@ -108,9 +92,9 @@ export class Tearleads {
             },
             getUserId: () => session?.userId ?? null,
         });
-        session = this.createClientSession(options, security.service.report);
+        session = this.createClientSession(options, security.report);
         this.session = session;
-        const runtime = this.createWorkflowRuntime(security.identityTrustDomain, options, security.service.report);
+        const runtime = this.createWorkflowRuntime(identityTrustDomain, options, security.report);
         this.bindTrustedIdentityRuntime(runtime);
         this.runtime = runtime.publicRuntime;
         this.documents = createDocuments({
@@ -123,7 +107,7 @@ export class Tearleads {
         this.root = createRoot(rootRuntimeOf(runtime, this.session));
         this.userIdentities = createUserIdentities({
             getOrganizationId: () => this.session.organizationId,
-            reportSecurityIncident: security.service.report,
+            reportSecurityIncident: security.report,
             identityLinks: runtime.identityLinks,
             log: this.log,
             resolveTrustedUserIdentity: (userId) => runtime.workflowInput().resolveTrustedUserIdentity(userId),
@@ -133,6 +117,15 @@ export class Tearleads {
             this.startAutomaticIdentityProvisioning();
         }
     }
+    /** Durable incident records in this database, reported to the host's listener. */
+    createSecurityIncidents(trustDomain, options) {
+        return createSecurityIncidentService({
+            database: this.database,
+            logError: this.logError,
+            onIncident: options.onSecurityIncident,
+            trustDomain,
+        });
+    }
     /** Trust callbacks reach the workflow runtime, which is created later. */
     createClientSession(options, reportSecurityIncident) {
         return createSession({

package/Tearleads.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAyB,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAEL,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAkB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAe,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EACL,cAAc,GAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAwB,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,aAAa,GAGd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,6BAA6B,GAG9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAGL,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE,SAAS,mCAAmC,CAAC,KAK5C;IACC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;KACvD,CAAC,CAAC;IACH,OAAO;QACL,mBAAmB;QACnB,OAAO,EAAE,6BAA6B,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAC5C,WAAW,EAAE,mBAAmB;SACjC,CAAC;KACH,CAAC;AACJ,CAAC;AA4CD,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAAyB,EAAE;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,QAAQ,GAAG,mCAAmC,CAAC;YACnD,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,QAAQ,CAAC,mBAAmB,EAC5B,OAAO,EACP,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YACpD,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAsB,EACtB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport { type BlobStoreFactory, Blobs } from \"./client/blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./client/containerContents\";\nimport { createDeviceFirst, type DeviceFirst } from \"./client/deviceFirst\";\nimport { createDocuments, type Documents } from \"./client/documents\";\nimport { type Logger, logErrorToConsole } from \"./client/host/logger\";\nimport {\n  createIdentity,\n  type Identity,\n  type IdentityOptions,\n} from \"./client/identity\";\nimport {\n  createUserIdentities,\n  type UserIdentities,\n} from \"./client/identity/userIdentities\";\nimport {\n  createOrganizations,\n  type Organizations,\n} from \"./client/organizations\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./client/root\";\nimport { ApiVersion } from \"./client/runtime/apiVersion\";\nimport { Database, type DatabaseOptions } from \"./client/runtime/database\";\nimport { Events } from \"./client/runtime/events\";\nimport { Network } from \"./client/runtime/network\";\nimport type { PrincipalHistoryKeyProvider } from \"./client/runtime/principalHistoryProtection\";\nimport { SyncBillingGate } from \"./client/runtime/syncBillingGate\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./client/runtime/workflowRuntime\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidentListener,\n  type SecurityIncidents,\n} from \"./client/securityIncidents\";\nimport { createSession } from \"./client/session\";\nimport type { Session } from \"./client/session/sessionTypes\";\nimport type { BlobStore } from \"./data/blobs/blobContracts\";\nimport {\n  type DocumentProjectorRegistry,\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"./data/documents/documentKinds\";\nimport { createVerifiedManifestCitations } from \"./data/persistence/verifiedManifestBundlePersistence\";\nimport { createDomainScope, type DomainScope } from \"./data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"./data/shared/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"./data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"./data/trustedUserIdentity\";\nimport type { ProvisionedSystemContainerSpec } from \"./workflows/registration\";\n\nfunction createClientSecurityIncidentService(input: {\n  readonly apiBaseUrl: string;\n  readonly database: Database;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly options: ClientOptions;\n}) {\n  const identityTrustDomain = resolveIdentityTrustDomain({\n    apiBaseUrl: input.apiBaseUrl,\n    identityTrustDomain: input.options.identityTrustDomain,\n  });\n  return {\n    identityTrustDomain,\n    service: createSecurityIncidentService({\n      database: input.database,\n      logError: input.logError,\n      onIncident: input.options.onSecurityIncident,\n      trustDomain: identityTrustDomain,\n    }),\n  };\n}\n\nexport type ClientDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\nexport interface ClientOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: ClientDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: ClientOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const security = createClientSecurityIncidentService({\n      apiBaseUrl,\n      database: this.database,\n      logError: this.logError,\n      options,\n    });\n    this.securityIncidents = security.service.incidents;\n    this.disposeSecurityIncidents = security.service.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.service.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      security.identityTrustDomain,\n      options,\n      security.service.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      getOrganizationId: () => this.session.organizationId,\n      reportSecurityIncident: security.service.report,\n      identityLinks: runtime.identityLinks,\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: ClientOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}
+{"version":3,"file":"Tearleads.js","sourceRoot":"","sources":["Tearleads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAEL,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAkB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAiB,MAAM,mBAAmB,CAAC;AAClE,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,aAAa,GAGd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,6BAA6B,GAE9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAEL,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE,MAAM,OAAO,SAAS;IACX,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAoB;IAC/B,KAAK,CAAQ;IACb,QAAQ,CAAW;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,MAAM,CAAS;IACf,iBAAiB,CAAoB;IACrC,QAAQ,CAAW;IACnB,OAAO,CAAU;IACjB,aAAa,CAAgB;IAC7B,IAAI,CAAO;IACX,OAAO,CAAU;IACjB,iBAAiB,CAAoB;IACrC,OAAO,CAAU;IACjB,eAAe,CAAkB;IACjC,cAAc,CAAiB;IAEvB,SAAS,CAAY;IACrB,kBAAkB,CAA4B;IAC9C,wBAAwB,CAAa;IAC9C,gCAAgC,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACpD,0EAA0E;IAClE,cAAc,GAAkB,IAAI,CAAC;IAC7C,mEAAmE;IAC3D,gBAAgB,GAAgB,iBAAiB,EAAE,CAAC;IAC3C,eAAe,CAGtB;IACO,UAAU,CAA4B;IAC/C,uBAAuB,GAAG,KAAK,CAAC;IAChC,+BAA+B,GAAyB,IAAI,CAAC;IAC7D,0BAA0B,GAA4B,IAAI,CAAC;IACnE,gFAAgF;IACxE,oBAAoB,GAC1B,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IACI,gCAAgC,GACtC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChB,WAAW,GAAmC,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,YAAY,UAA4B,EAAE;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,gCAAgC,CACxD,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,CAAC;QACrE,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;YACrD,UAAU;YACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC5E,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC5C,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAC5B,OAAO,CAAC,QAAQ,EAChB,CAAC,kBAAkB,EAAE,EAAE,CACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EACxD,IAAI,CAAC,GAAG,EACR;YACE,2BAA2B,EAAE,KAAK,IAAI,EAAE;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oDAAoD,CACrD,CAAC;gBACJ,CAAC;gBAED,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC;YAC/C,CAAC;YACD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;SACzC,CACF,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,mBAAmB,EACnB,OAAO,EACP,QAAQ,CAAC,MAAM,CAChB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;YAC/B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YACrD,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC;YACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YACpD,sBAAsB,EAAE,QAAQ,CAAC,MAAM;YACvC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,0BAA0B,EAAE,CAAC,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,aAAa,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,kFAAkF;IAC1E,uBAAuB,CAC7B,WAA0B,EAC1B,OAAyB;QAEzB,OAAO,6BAA6B,CAAC;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,OAAO,CAAC,kBAAkB;YACtC,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAClE,mBAAmB,CACzB,OAAyB,EACzB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,wBAAwB,EAAE,CAAC,qBAAqB,EAAE,EAAE,CAClD,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC;YACzC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9C,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,0BAA0B,CAAC,OAAwB;QACzD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAChD,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,gCAAgC;YACnC,OAAO,CAAC,gCAAgC,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAC3C,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAEO,2BAA2B;QACjC,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,+BAA+B,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,CACrD,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,mBAAkC,EAClC,OAAyB,EACzB,sBAAgD;QAEhD,OAAO,aAAa,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;YAChE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,sBAAsB;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,GAAG,CAAC,OAAuB,EAAE,KAAe,EAAQ,EAAE,CAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAChB,IAAI,CAAC,QAAQ,CAAC,kBAAkB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,OAAO;aAC7C,KAAK,EAAE;aACP,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO;YACP,aAAa,KAAK,IAAI;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CACxC;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,kCAAkC;QACxC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,MAAM,wBAAwB,GAAG,GAAG,EAAE;YACpC,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,sBAAsB,GAAG,GAAG,EAAE;YAClC,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACjE,wBAAwB,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IACE,IAAI,CAAC,+BAA+B;gBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAChC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC,QAAQ;iBACjD,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,wBAAwB,EAAE,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,gFAAgF;gBAClF,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,+BAA+B,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9D,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACF","sourcesContent":["import { ApiClient, ApiRequestMetrics } from \"@tearleads/api-client\";\nimport { Blobs } from \"./client/blobs\";\nimport {\n  type ContainerContents,\n  createContainerContents,\n} from \"./client/containerContents\";\nimport { createDeviceFirst, type DeviceFirst } from \"./client/deviceFirst\";\nimport { createDocuments, type Documents } from \"./client/documents\";\nimport { logErrorToConsole } from \"./client/host/logger\";\nimport { createIdentity, type Identity } from \"./client/identity\";\nimport {\n  createUserIdentities,\n  type UserIdentities,\n} from \"./client/identity/userIdentities\";\nimport {\n  createOrganizations,\n  type Organizations,\n} from \"./client/organizations\";\nimport { createRoot, type Root, rootRuntimeOf } from \"./client/root\";\nimport { ApiVersion } from \"./client/runtime/apiVersion\";\nimport { Database } from \"./client/runtime/database\";\nimport { Events } from \"./client/runtime/events\";\nimport { Network } from \"./client/runtime/network\";\nimport { SyncBillingGate } from \"./client/runtime/syncBillingGate\";\nimport {\n  createRuntime,\n  type InternalRuntime,\n  type Runtime,\n} from \"./client/runtime/workflowRuntime\";\nimport {\n  createSecurityIncidentService,\n  type SecurityIncidents,\n} from \"./client/securityIncidents\";\nimport { createSession } from \"./client/session\";\nimport type { Session } from \"./client/session/sessionTypes\";\nimport {\n  type DocumentProjectorRegistry,\n  resolveDocumentProjectorRegistry,\n} from \"./data/documents/documentKinds\";\nimport { createVerifiedManifestCitations } from \"./data/persistence/verifiedManifestBundlePersistence\";\nimport { createDomainScope, type DomainScope } from \"./data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"./data/shared/securityIncidents\";\nimport { disposeDomainSyncCoordinator } from \"./data/sync/syncCoordinator\";\nimport { resolveIdentityTrustDomain } from \"./data/trustedUserIdentity\";\nimport type { TearleadsOptions } from \"./TearleadsOptions\";\n\nexport class Tearleads {\n  readonly apiVersion = new ApiVersion();\n  readonly apiRequests: ApiRequestMetrics;\n  readonly blobs: Blobs;\n  readonly database: Database;\n  readonly deviceFirst: DeviceFirst;\n  readonly documents: Documents;\n  readonly events: Events;\n  readonly containerContents: ContainerContents;\n  readonly identity: Identity;\n  readonly network: Network;\n  readonly organizations: Organizations;\n  readonly root: Root;\n  readonly runtime: Runtime;\n  readonly securityIncidents: SecurityIncidents;\n  readonly session: Session;\n  readonly syncBillingGate: SyncBillingGate;\n  readonly userIdentities: UserIdentities;\n\n  private readonly apiClient: ApiClient;\n  private readonly documentProjectors: DocumentProjectorRegistry;\n  private readonly disposeSecurityIncidents: () => void;\n  private retirePrincipalHistoryProtection = () => {};\n  // Tracks the storage/identity pair that owns domain-scoped runtime state.\n  private domainScopeKey: string | null = null;\n  // Recreated when the storage database or signing identity changes.\n  private domainScopeValue: DomainScope = createDomainScope();\n  private readonly logErrorHandler: (\n    message: string | Error,\n    cause?: unknown,\n  ) => void;\n  private readonly logHandler: (message: string) => void;\n  private autoIdentityProvisioned = false;\n  private autoIdentityProvisioningPromise: Promise<void> | null = null;\n  private expiredSessionLoginPromise: Promise<boolean> | null = null;\n  // Rebound to the workflow runtime once it exists; the session is created first.\n  private pinLocalUserIdentity: InternalRuntime[\"pinLocalUserIdentity\"] =\n    async () => {\n      throw new Error(\"Trusted user identity runtime is not initialized\");\n    };\n  private primeProvisionedPrincipalHistory: InternalRuntime[\"primeProvisionedPrincipalHistory\"] =\n    async () => undefined;\n  private boundUserId: InternalRuntime[\"boundUserId\"] = async () => {\n    throw new Error(\"Trusted user identity runtime is not initialized\");\n  };\n\n  constructor(options: TearleadsOptions = {}) {\n    const apiBaseUrl = options.apiBaseUrl ?? \"\";\n    this.apiRequests = options.apiRequestMetrics ?? new ApiRequestMetrics();\n    this.apiClient = this.createApiClient(apiBaseUrl);\n    this.blobs = new Blobs(options.blobStore, options.blobStoreFactory);\n    this.database = new Database(options.database);\n    this.documentProjectors = resolveDocumentProjectorRegistry(\n      options.documentProjectors,\n    );\n    this.events = new Events(options.events, () =>\n      this.apiClient.clearWriterProjectionCaches(),\n    );\n    this.logHandler = options.logger?.log ?? (() => undefined);\n    this.logErrorHandler = options.logger?.logError ?? logErrorToConsole;\n    const identityTrustDomain = resolveIdentityTrustDomain({\n      apiBaseUrl,\n      identityTrustDomain: options.identityTrustDomain,\n    });\n    const security = this.createSecurityIncidents(identityTrustDomain, options);\n    this.securityIncidents = security.incidents;\n    this.disposeSecurityIncidents = security.dispose;\n    this.network = new Network(options.online);\n    this.syncBillingGate = new SyncBillingGate();\n    let session: Session | null = null;\n    this.identity = createIdentity(\n      options.identity,\n      (signingFingerprint) =>\n        this.blobs.updateIdentityNamespace(signingFingerprint),\n      this.log,\n      {\n        bootstrapLocalRootContainer: async () => {\n          if (this.database.status !== \"ready\") {\n            throw new Error(\n              \"identity.generate requires a ready SQLite database.\",\n            );\n          }\n          if (!session) {\n            throw new Error(\n              \"identity.generate requires an initialized session.\",\n            );\n          }\n\n          return session.bootstrapLocalRootContainer();\n        },\n        getUserId: () => session?.userId ?? null,\n      },\n    );\n    session = this.createClientSession(options, security.report);\n    this.session = session;\n    const runtime = this.createWorkflowRuntime(\n      identityTrustDomain,\n      options,\n      security.report,\n    );\n    this.bindTrustedIdentityRuntime(runtime);\n    this.runtime = runtime.publicRuntime;\n    this.documents = createDocuments({\n      getDefaultContainerId: () => this.session.containerId,\n      runtime,\n    });\n    this.containerContents = createContainerContents(runtime);\n    this.deviceFirst = createDeviceFirst(runtime, this.containerContents);\n    this.organizations = createOrganizations(runtime, this.containerContents);\n    this.root = createRoot(rootRuntimeOf(runtime, this.session));\n    this.userIdentities = createUserIdentities({\n      getOrganizationId: () => this.session.organizationId,\n      reportSecurityIncident: security.report,\n      identityLinks: runtime.identityLinks,\n      log: this.log,\n      resolveTrustedUserIdentity: (userId) =>\n        runtime.workflowInput().resolveTrustedUserIdentity(userId),\n    });\n\n    this.configureApiClientCallbacks();\n\n    if (options.identityProvisioning === \"auto\") {\n      this.startAutomaticIdentityProvisioning();\n    }\n  }\n\n  /** Durable incident records in this database, reported to the host's listener. */\n  private createSecurityIncidents(\n    trustDomain: string | null,\n    options: TearleadsOptions,\n  ) {\n    return createSecurityIncidentService({\n      database: this.database,\n      logError: this.logError,\n      onIncident: options.onSecurityIncident,\n      trustDomain,\n    });\n  }\n\n  /** Trust callbacks reach the workflow runtime, which is created later. */\n  private createClientSession(\n    options: TearleadsOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): Session {\n    return createSession({\n      api: this.apiClient,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      identity: this.identity,\n      log: this.log,\n      logError: this.logError,\n      boundUserIdForSigningKey: (signingKeyFingerprint) =>\n        this.boundUserId(signingKeyFingerprint),\n      onUserIdentityAvailable: (userId, candidate) =>\n        this.pinLocalUserIdentity(userId, candidate),\n      primeProvisionedPrincipalHistory: (input) =>\n        this.primeProvisionedPrincipalHistory(input),\n      provisionedSystemContainers: options.provisionedSystemContainers,\n      reportSecurityIncident,\n    });\n  }\n\n  private createApiClient(apiBaseUrl: string): ApiClient {\n    return new ApiClient(apiBaseUrl, {\n      metrics: this.apiRequests,\n      getIdentity: () => this.identity.signingFingerprint,\n    });\n  }\n\n  /** Rebinds the session's trust callbacks once the runtime exists. */\n  private bindTrustedIdentityRuntime(runtime: InternalRuntime): void {\n    this.retirePrincipalHistoryProtection =\n      runtime.retirePrincipalHistoryProtection;\n    this.pinLocalUserIdentity = (userId, candidate) =>\n      runtime.pinLocalUserIdentity(userId, candidate);\n    this.primeProvisionedPrincipalHistory =\n      runtime.primeProvisionedPrincipalHistory;\n    this.boundUserId = (signingKeyFingerprint) =>\n      runtime.boundUserId(signingKeyFingerprint);\n  }\n\n  private configureApiClientCallbacks(): void {\n    // Projection reads cite bundles this identity's database already verified.\n    this.apiClient.setVerifiedManifestCitations(\n      createVerifiedManifestCitations(() => this.database.execSql),\n    );\n    this.apiClient.setOnError((message) => this.logError(message));\n    // An authoritative host source owns connectivity. Without one, request\n    // outcomes remain reachability hints. Browser and native app bindings both\n    // install authoritative sources so a backend outage cannot stop retries.\n    this.apiClient.setOnNetworkError(() =>\n      this.network.reportReachability(false),\n    );\n    this.apiClient.setOnNetworkSuccess(() =>\n      this.network.reportReachability(true),\n    );\n    this.apiClient.setOnApiVersion((version) =>\n      this.apiVersion.observe(version),\n    );\n    this.apiClient.setOnSessionExpired(() => this.loginAfterSessionExpired());\n    this.apiClient.setOnPaymentRequired((organizationId) =>\n      this.syncBillingGate.notifyPaymentRequired(organizationId),\n    );\n  }\n\n  private createWorkflowRuntime(\n    identityTrustDomain: string | null,\n    options: TearleadsOptions,\n    reportSecurityIncident: SecurityIncidentReporter,\n  ): InternalRuntime {\n    return createRuntime({\n      api: this.apiClient,\n      blobs: this.blobs,\n      database: this.database,\n      documentProjectors: this.documentProjectors,\n      events: this.events,\n      getDomainScope: () => this.domainScope,\n      identity: this.identity,\n      identityTrustDomain,\n      log: this.log,\n      logError: this.logError,\n      network: this.network,\n      peerScope: options.peerScope ?? null,\n      principalHistoryKeyProvider: options.principalHistoryKeyProvider,\n      principalMutationTimeoutMs: options.principalMutationTimeoutMs,\n      reportSecurityIncident,\n      session: this.session,\n      syncBillingGate: this.syncBillingGate,\n    });\n  }\n\n  log = (message: string): void => {\n    this.logHandler(message);\n  };\n\n  // Preserve the host's return value so best-effort callers can also catch\n  // rejected promises from async loggers accepted by the void callback type.\n  logError = (message: string | Error, cause?: unknown): void =>\n    this.logErrorHandler(message, cause);\n\n  /**\n   * A single-use ticket to authenticate the server-events websocket handshake\n   * (which cannot carry the bearer header): the one login returned for the\n   * first connect of that session, otherwise a freshly minted one. Returns\n   * null when no session is active. The caller appends it to the websocket URL.\n   */\n  requestWebSocketTicket(): Promise<string | null> {\n    return this.apiClient.requestWebSocketTicket();\n  }\n\n  get domainScope(): DomainScope {\n    const nextScopeKey = JSON.stringify([\n      this.database.id,\n      this.identity.signingFingerprint,\n    ]);\n    if (this.domainScopeKey !== nextScopeKey) {\n      this.domainScopeKey = nextScopeKey;\n      this.domainScopeValue = createDomainScope();\n    }\n\n    return this.domainScopeValue;\n  }\n\n  /**\n   * Tear down background work for the active domain scope: stop the reconciler\n   * and force-stop the sync coordinator pump, then drop the coordinator from\n   * its registry. Hosts call this from unmount/cleanup so a pump cannot outlive\n   * the React tree that created it. A later access for the same scope rebuilds\n   * fresh state.\n   */\n  dispose(): void {\n    const domainScope = this.domainScope;\n    this.disposeSecurityIncidents();\n    this.retirePrincipalHistoryProtection();\n    this.deviceFirst.dispose();\n    disposeDomainSyncCoordinator(domainScope);\n  }\n\n  private loginAfterSessionExpired(): Promise<boolean> {\n    if (!this.session.authToken || !this.identity.signingKeyPair) {\n      this.session.logout();\n      return Promise.resolve(false);\n    }\n\n    // The API client replays requests the expired session sent, so a login is\n    // their renewal only when the loaded keys authenticate that known user.\n    const expiredUserId = this.session.userId;\n    this.expiredSessionLoginPromise ??= this.session\n      .login()\n      .then(\n        (renewed) =>\n          renewed &&\n          expiredUserId !== null &&\n          this.session.userId === expiredUserId,\n      )\n      .finally(() => {\n        this.expiredSessionLoginPromise = null;\n      });\n    return this.expiredSessionLoginPromise;\n  }\n\n  private startAutomaticIdentityProvisioning(): void {\n    let unsubscribe: (() => void) | null = null;\n    const stopProvisioningListener = () => {\n      unsubscribe?.();\n      unsubscribe = null;\n    };\n    const maybeProvisionIdentity = () => {\n      if (this.autoIdentityProvisioned || this.identity.signingKeyPair) {\n        stopProvisioningListener();\n        return;\n      }\n\n      if (\n        this.autoIdentityProvisioningPromise ||\n        this.database.status !== \"ready\"\n      ) {\n        return;\n      }\n\n      this.autoIdentityProvisioningPromise = this.identity\n        .generate()\n        .then(() => {\n          this.autoIdentityProvisioned = true;\n          stopProvisioningListener();\n        })\n        .catch((error: unknown) => {\n          try {\n            this.logError(\"Automatic identity provisioning failed\", error);\n          } catch {\n            // Keep background provisioning failures from surfacing as unhandled rejections.\n          }\n        })\n        .finally(() => {\n          this.autoIdentityProvisioningPromise = null;\n        });\n    };\n\n    unsubscribe = this.database.subscribe(maybeProvisionIdentity);\n    void Promise.resolve().then(maybeProvisionIdentity);\n  }\n}\n"]}

package/TearleadsOptions.d.ts

@@ -0,0 +1,49 @@
+import type { ApiRequestMetrics } from "./internal/api-client/index.js";
+import type { BlobStoreFactory } from "./client/blobs/index.js";
+import type { Logger } from "./client/host/logger.js";
+import type { IdentityOptions } from "./client/identity/index.js";
+import type { DatabaseOptions } from "./client/runtime/database.js";
+import type { PrincipalHistoryKeyProvider } from "./client/runtime/principalHistoryProtection.js";
+import type { SecurityIncidentListener } from "./client/securityIncidents/index.js";
+import type { BlobStore } from "./data/blobs/blobContracts.js";
+import type { DocumentProjectorRegistryInput } from "./data/documents/documentKinds.js";
+import type { ProvisionedSystemContainerSpec } from "./workflows/registration/index.js";
+export type TearleadsDatabaseOptions = Omit<DatabaseOptions, "status">;
+/** What a host passes to `new Tearleads(options)`; every field is optional. */
+export interface TearleadsOptions {
+    apiBaseUrl?: string | undefined;
+    /** Reuse a memory-only request counter across client lifetimes. */
+    apiRequestMetrics?: ApiRequestMetrics | undefined;
+    blobStore?: BlobStore | undefined;
+    blobStoreFactory?: BlobStoreFactory | undefined;
+    database?: TearleadsDatabaseOptions | undefined;
+    documentProjectors?: DocumentProjectorRegistryInput | undefined;
+    events?: ReadonlyArray<unknown> | undefined;
+    identity?: IdentityOptions | undefined;
+    /**
+     * Absolute, host-controlled API namespace for durable user-identity pins.
+     * Required only when apiBaseUrl is relative and no browser origin exists.
+     */
+    identityTrustDomain?: string | undefined;
+    identityProvisioning?: "auto" | "manual" | undefined;
+    logger?: Logger | undefined;
+    online?: boolean | undefined;
+    /** Called after a trust-boundary verification failure is durably recorded. */
+    onSecurityIncident?: SecurityIncidentListener | undefined;
+    /**
+     * Per-pane discriminator so documents in distinct panes derive distinct Loro
+     * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.
+     */
+    peerScope?: string | undefined;
+    /** Private host key for durable history progress; omitted uses disposable session keys. */
+    principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;
+    /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */
+    principalMutationTimeoutMs?: number | undefined;
+    /**
+     * App-owned system containers born with every new organization (both
+     * registration and additional-org creation provision them atomically in the
+     * same server call), e.g. a trash bin. The app owns these because their slot
+     * namespaces are app concepts the SDK stays agnostic to.
+     */
+    provisionedSystemContainers?: ReadonlyArray<ProvisionedSystemContainerSpec> | undefined;
+}

package/TearleadsOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=TearleadsOptions.js.map

package/TearleadsOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TearleadsOptions.js","sourceRoot":"","sources":["TearleadsOptions.ts"],"names":[],"mappings":"","sourcesContent":["import type { ApiRequestMetrics } from \"@tearleads/api-client\";\nimport type { BlobStoreFactory } from \"./client/blobs\";\nimport type { Logger } from \"./client/host/logger\";\nimport type { IdentityOptions } from \"./client/identity\";\nimport type { DatabaseOptions } from \"./client/runtime/database\";\nimport type { PrincipalHistoryKeyProvider } from \"./client/runtime/principalHistoryProtection\";\nimport type { SecurityIncidentListener } from \"./client/securityIncidents\";\nimport type { BlobStore } from \"./data/blobs/blobContracts\";\nimport type { DocumentProjectorRegistryInput } from \"./data/documents/documentKinds\";\nimport type { ProvisionedSystemContainerSpec } from \"./workflows/registration\";\n\nexport type TearleadsDatabaseOptions = Omit<DatabaseOptions, \"status\">;\n\n/** What a host passes to `new Tearleads(options)`; every field is optional. */\nexport interface TearleadsOptions {\n  apiBaseUrl?: string | undefined;\n  /** Reuse a memory-only request counter across client lifetimes. */\n  apiRequestMetrics?: ApiRequestMetrics | undefined;\n  blobStore?: BlobStore | undefined;\n  blobStoreFactory?: BlobStoreFactory | undefined;\n  database?: TearleadsDatabaseOptions | undefined;\n  documentProjectors?: DocumentProjectorRegistryInput | undefined;\n  events?: ReadonlyArray<unknown> | undefined;\n  identity?: IdentityOptions | undefined;\n  /**\n   * Absolute, host-controlled API namespace for durable user-identity pins.\n   * Required only when apiBaseUrl is relative and no browser origin exists.\n   */\n  identityTrustDomain?: string | undefined;\n  identityProvisioning?: \"auto\" | \"manual\" | undefined;\n  logger?: Logger | undefined;\n  online?: boolean | undefined;\n  /** Called after a trust-boundary verification failure is durably recorded. */\n  onSecurityIncident?: SecurityIncidentListener | undefined;\n  /**\n   * Per-pane discriminator so documents in distinct panes derive distinct Loro\n   * peer ids (e.g. the pane's local identity namespace). Omit for single-pane.\n   */\n  peerScope?: string | undefined;\n  /** Private host key for durable history progress; omitted uses disposable session keys. */\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  /** Compound policy dispatch/recovery deadline in milliseconds; defaults to 60 seconds. */\n  principalMutationTimeoutMs?: number | undefined;\n  /**\n   * App-owned system containers born with every new organization (both\n   * registration and additional-org creation provision them atomically in the\n   * same server call), e.g. a trash bin. The app owns these because their slot\n   * namespaces are app concepts the SDK stays agnostic to.\n   */\n  provisionedSystemContainers?:\n    | ReadonlyArray<ProvisionedSystemContainerSpec>\n    | undefined;\n}\n"]}

package/client/root/index.d.ts

@@ -1,6 +1,6 @@
 import type { OrganizationDataUsageResponse } from "../../internal/validators/response/index.js";
 import { type RootDataUsageApi, type RootDataUsageReportPage, type RootIdentitiesApi, type RootIdentitiesPage, type RootIdentitiesQueryInput, type RootIdentityDetail, type RootIdentityOrganization, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, type RootRequestOutcome } from "../../workflows/root/index.js";
-import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput } from "../../workflows/runtimeInput.js";
+import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput } from "../../workflows/shared/runtimeInput.js";
 import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 import type { Session } from "../session/sessionTypes.js";
 /**

package/client/root/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAe9B,MAAM,sBAAsB,CAAC;AA4D9B,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,OAAiE,EACjE,OAAmC;IAEnC,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAA8B;IAC/C,OAAO,EAAE,iDAAiD;IAC1D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,eAAe,GAA8B;IACjD,OAAO,EAAE,sDAAsD;IAC/D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,cAA2B;IACpD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YACpC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;IAC/C,IAAI,gBAAgB,GAClB,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE;QAC5B,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,aAAa,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC;QACtD,MAAM,OAAO,GACX,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACzC,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC/B,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,GAAmB,EAAE;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe;YACjC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAC5B,gBAAgB,KAAK,IAAI;YACzB,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB;YACtD,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,OAA4D,EACzB,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,EAAE,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,WAAW;YACb,OAAO,SAAS,EAAE,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,yBAAyB,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5C,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,gBAAgB,EAAE,CAAC,cAAc,EAAE,EAAE,CACnC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7D,0BAA0B,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CACpD,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,8BAA8B,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAC3D;QACH,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3E,yBAAyB,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC","sourcesContent":["import type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootRequestOutcome,\n} from \"../../workflows/root\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n} from \"../../workflows/runtimeInput\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport type { Session } from \"../session/sessionTypes\";\n\n/**\n * Platform-operator lookups. Every call is refused locally unless the session\n * is authenticated and the server reported it as root at login; the API still\n * enforces root access on its own, so this gate only avoids doomed requests.\n */\ntype RootApi = RootIdentitiesApi & RootOrganizationsApi & RootDataUsageApi;\n\nexport interface Root {\n  loadOrganizationDataUsage(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;\n  listDataUsageReport(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootDataUsageReportPage>>;\n  listOrganizations(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationsPage>>;\n  loadOrganization(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<RootOrganizationDetail>>;\n  listOrganizationIdentities(\n    organizationId: string,\n    query?: RootOrganizationPageQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;\n  /** Whether the current session may use the root surface at all. */\n  readonly isAvailable: boolean;\n  listIdentities(\n    query?: RootIdentitiesQueryInput,\n  ): Promise<RootRequestOutcome<RootIdentitiesPage>>;\n  listIdentityOrganizations(\n    userId: string,\n  ): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;\n  loadIdentity(userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;\n}\n\n/**\n * What the facade needs from the runtime: change notifications, the current\n * auth snapshot, the signing identity (which can change or vanish without\n * touching the session), and the api client. Narrower than the full runtime\n * so tests can drive it with a fake.\n */\nexport interface RootRuntime {\n  /** The session's current auth token; a new one marks a fresh login. */\n  authToken(): string | null;\n  subscribe(listener: () => void): () => void;\n  workflowInput(): {\n    readonly apiClient: RootApi;\n    readonly auth: WorkflowRuntimeAuthInput;\n    readonly crypto: Pick<WorkflowRuntimeCryptoInput, \"signingFingerprint\">;\n  };\n}\n\n/** The SDK's internal runtime, narrowed to what the root facade observes. */\nexport function rootRuntimeOf(\n  runtime: Pick<InternalRuntime, \"publicRuntime\" | \"workflowInput\">,\n  session: Pick<Session, \"authToken\">,\n): RootRuntime {\n  return {\n    authToken: () => session.authToken,\n    subscribe: (listener) => runtime.publicRuntime.subscribe(listener),\n    workflowInput: () => runtime.workflowInput(),\n  };\n}\n\nconst NOT_AVAILABLE: RootRequestOutcome<never> = {\n  message: \"The current session is not a platform operator.\",\n  ok: false,\n  status: null,\n};\n\nconst SESSION_CHANGED: RootRequestOutcome<never> = {\n  message: \"The session changed while the request was in flight.\",\n  ok: false,\n  status: null,\n};\n\nexport function createRoot(runtimeService: RootRuntime): Root {\n  const principal = () => {\n    const runtime = runtimeService.workflowInput();\n    return {\n      fingerprint: runtime.crypto.signingFingerprint,\n      isAuthenticated: runtime.auth.isAuthenticated,\n      isRoot: runtime.auth.isRoot === true,\n      userId: runtime.auth.userId,\n    };\n  };\n\n  // Root standing belongs to the signing identity that authenticated, not to\n  // whichever key pair is loaded now. The fingerprint is bound whenever a\n  // login completes, which is observable as a new auth token carrying the\n  // server's verdict, or when the session first becomes root. A principal\n  // change without a new token (a key swap while the old token lingers)\n  // unbinds root until the next login. Every principal change is also\n  // counted as it happens, so a round trip such as logout then login, or a\n  // switch to another identity and back, is still two changes even though\n  // the endpoints match; a token renewal alone changes no principal, so a\n  // retried lookup is still returned.\n  let observed = principal();\n  let observedToken = runtimeService.authToken();\n  let boundFingerprint: string | null =\n    observed.isAuthenticated && observed.isRoot ? observed.fingerprint : null;\n  let lifecycle = 0;\n  runtimeService.subscribe(() => {\n    const next = principal();\n    const token = runtimeService.authToken();\n    const freshToken = token !== null && token !== observedToken;\n    const wasRoot = observed.isAuthenticated && observed.isRoot;\n    const isRootNow = next.isAuthenticated && next.isRoot;\n    const changed =\n      next.fingerprint !== observed.fingerprint ||\n      next.isAuthenticated !== observed.isAuthenticated ||\n      next.isRoot !== observed.isRoot ||\n      next.userId !== observed.userId;\n    if (changed) {\n      lifecycle += 1;\n    }\n    if (!isRootNow) {\n      boundFingerprint = null;\n    } else if (freshToken || !wasRoot) {\n      boundFingerprint = next.fingerprint;\n    } else if (changed) {\n      boundFingerprint = null;\n    }\n    observed = next;\n    observedToken = token;\n  });\n\n  const activeApi = (): RootApi | null => {\n    const runtime = runtimeService.workflowInput();\n    return runtime.auth.isAuthenticated &&\n      runtime.auth.isRoot === true &&\n      boundFingerprint !== null &&\n      runtime.crypto.signingFingerprint === boundFingerprint\n      ? runtime.apiClient\n      : null;\n  };\n\n  const guarded = async <Data>(\n    request: (api: RootApi) => Promise<RootRequestOutcome<Data>>,\n  ): Promise<RootRequestOutcome<Data>> => {\n    const api = activeApi();\n    if (!api) {\n      return NOT_AVAILABLE;\n    }\n    const startedIn = lifecycle;\n    const outcome = await request(api);\n    if (activeApi() === null || lifecycle !== startedIn) {\n      return SESSION_CHANGED;\n    }\n    return outcome;\n  };\n\n  return {\n    get isAvailable() {\n      return activeApi() !== null;\n    },\n    loadOrganizationDataUsage: (organizationId) =>\n      guarded((api) => loadRootOrganizationDataUsage(api, organizationId)),\n    listDataUsageReport: (query) =>\n      guarded((api) => listRootDataUsageReport(api, query)),\n    listOrganizations: (query) =>\n      guarded((api) => listRootOrganizations(api, query)),\n    loadOrganization: (organizationId) =>\n      guarded((api) => loadRootOrganization(api, organizationId)),\n    listOrganizationIdentities: (organizationId, query) =>\n      guarded((api) =>\n        listRootOrganizationIdentities(api, organizationId, query),\n      ),\n    listIdentities: (query) => guarded((api) => listRootIdentities(api, query)),\n    listIdentityOrganizations: (userId) =>\n      guarded((api) => listRootIdentityOrganizations(api, userId)),\n    loadIdentity: (userId) => guarded((api) => loadRootIdentity(api, userId)),\n  };\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAe9B,MAAM,sBAAsB,CAAC;AA4D9B,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,OAAiE,EACjE,OAAmC;IAEnC,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAA8B;IAC/C,OAAO,EAAE,iDAAiD;IAC1D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,eAAe,GAA8B;IACjD,OAAO,EAAE,sDAAsD;IAC/D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,cAA2B;IACpD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YACpC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;IAC/C,IAAI,gBAAgB,GAClB,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE;QAC5B,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,aAAa,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC;QACtD,MAAM,OAAO,GACX,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACzC,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC/B,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,GAAmB,EAAE;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe;YACjC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAC5B,gBAAgB,KAAK,IAAI;YACzB,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB;YACtD,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,OAA4D,EACzB,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,EAAE,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,WAAW;YACb,OAAO,SAAS,EAAE,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,yBAAyB,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5C,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,gBAAgB,EAAE,CAAC,cAAc,EAAE,EAAE,CACnC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7D,0BAA0B,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CACpD,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,8BAA8B,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAC3D;QACH,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3E,yBAAyB,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC","sourcesContent":["import type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootRequestOutcome,\n} from \"../../workflows/root\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport type { Session } from \"../session/sessionTypes\";\n\n/**\n * Platform-operator lookups. Every call is refused locally unless the session\n * is authenticated and the server reported it as root at login; the API still\n * enforces root access on its own, so this gate only avoids doomed requests.\n */\ntype RootApi = RootIdentitiesApi & RootOrganizationsApi & RootDataUsageApi;\n\nexport interface Root {\n  loadOrganizationDataUsage(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;\n  listDataUsageReport(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootDataUsageReportPage>>;\n  listOrganizations(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationsPage>>;\n  loadOrganization(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<RootOrganizationDetail>>;\n  listOrganizationIdentities(\n    organizationId: string,\n    query?: RootOrganizationPageQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;\n  /** Whether the current session may use the root surface at all. */\n  readonly isAvailable: boolean;\n  listIdentities(\n    query?: RootIdentitiesQueryInput,\n  ): Promise<RootRequestOutcome<RootIdentitiesPage>>;\n  listIdentityOrganizations(\n    userId: string,\n  ): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;\n  loadIdentity(userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;\n}\n\n/**\n * What the facade needs from the runtime: change notifications, the current\n * auth snapshot, the signing identity (which can change or vanish without\n * touching the session), and the api client. Narrower than the full runtime\n * so tests can drive it with a fake.\n */\nexport interface RootRuntime {\n  /** The session's current auth token; a new one marks a fresh login. */\n  authToken(): string | null;\n  subscribe(listener: () => void): () => void;\n  workflowInput(): {\n    readonly apiClient: RootApi;\n    readonly auth: WorkflowRuntimeAuthInput;\n    readonly crypto: Pick<WorkflowRuntimeCryptoInput, \"signingFingerprint\">;\n  };\n}\n\n/** The SDK's internal runtime, narrowed to what the root facade observes. */\nexport function rootRuntimeOf(\n  runtime: Pick<InternalRuntime, \"publicRuntime\" | \"workflowInput\">,\n  session: Pick<Session, \"authToken\">,\n): RootRuntime {\n  return {\n    authToken: () => session.authToken,\n    subscribe: (listener) => runtime.publicRuntime.subscribe(listener),\n    workflowInput: () => runtime.workflowInput(),\n  };\n}\n\nconst NOT_AVAILABLE: RootRequestOutcome<never> = {\n  message: \"The current session is not a platform operator.\",\n  ok: false,\n  status: null,\n};\n\nconst SESSION_CHANGED: RootRequestOutcome<never> = {\n  message: \"The session changed while the request was in flight.\",\n  ok: false,\n  status: null,\n};\n\nexport function createRoot(runtimeService: RootRuntime): Root {\n  const principal = () => {\n    const runtime = runtimeService.workflowInput();\n    return {\n      fingerprint: runtime.crypto.signingFingerprint,\n      isAuthenticated: runtime.auth.isAuthenticated,\n      isRoot: runtime.auth.isRoot === true,\n      userId: runtime.auth.userId,\n    };\n  };\n\n  // Root standing belongs to the signing identity that authenticated, not to\n  // whichever key pair is loaded now. The fingerprint is bound whenever a\n  // login completes, which is observable as a new auth token carrying the\n  // server's verdict, or when the session first becomes root. A principal\n  // change without a new token (a key swap while the old token lingers)\n  // unbinds root until the next login. Every principal change is also\n  // counted as it happens, so a round trip such as logout then login, or a\n  // switch to another identity and back, is still two changes even though\n  // the endpoints match; a token renewal alone changes no principal, so a\n  // retried lookup is still returned.\n  let observed = principal();\n  let observedToken = runtimeService.authToken();\n  let boundFingerprint: string | null =\n    observed.isAuthenticated && observed.isRoot ? observed.fingerprint : null;\n  let lifecycle = 0;\n  runtimeService.subscribe(() => {\n    const next = principal();\n    const token = runtimeService.authToken();\n    const freshToken = token !== null && token !== observedToken;\n    const wasRoot = observed.isAuthenticated && observed.isRoot;\n    const isRootNow = next.isAuthenticated && next.isRoot;\n    const changed =\n      next.fingerprint !== observed.fingerprint ||\n      next.isAuthenticated !== observed.isAuthenticated ||\n      next.isRoot !== observed.isRoot ||\n      next.userId !== observed.userId;\n    if (changed) {\n      lifecycle += 1;\n    }\n    if (!isRootNow) {\n      boundFingerprint = null;\n    } else if (freshToken || !wasRoot) {\n      boundFingerprint = next.fingerprint;\n    } else if (changed) {\n      boundFingerprint = null;\n    }\n    observed = next;\n    observedToken = token;\n  });\n\n  const activeApi = (): RootApi | null => {\n    const runtime = runtimeService.workflowInput();\n    return runtime.auth.isAuthenticated &&\n      runtime.auth.isRoot === true &&\n      boundFingerprint !== null &&\n      runtime.crypto.signingFingerprint === boundFingerprint\n      ? runtime.apiClient\n      : null;\n  };\n\n  const guarded = async <Data>(\n    request: (api: RootApi) => Promise<RootRequestOutcome<Data>>,\n  ): Promise<RootRequestOutcome<Data>> => {\n    const api = activeApi();\n    if (!api) {\n      return NOT_AVAILABLE;\n    }\n    const startedIn = lifecycle;\n    const outcome = await request(api);\n    if (activeApi() === null || lifecycle !== startedIn) {\n      return SESSION_CHANGED;\n    }\n    return outcome;\n  };\n\n  return {\n    get isAvailable() {\n      return activeApi() !== null;\n    },\n    loadOrganizationDataUsage: (organizationId) =>\n      guarded((api) => loadRootOrganizationDataUsage(api, organizationId)),\n    listDataUsageReport: (query) =>\n      guarded((api) => listRootDataUsageReport(api, query)),\n    listOrganizations: (query) =>\n      guarded((api) => listRootOrganizations(api, query)),\n    loadOrganization: (organizationId) =>\n      guarded((api) => loadRootOrganization(api, organizationId)),\n    listOrganizationIdentities: (organizationId, query) =>\n      guarded((api) =>\n        listRootOrganizationIdentities(api, organizationId, query),\n      ),\n    listIdentities: (query) => guarded((api) => listRootIdentities(api, query)),\n    listIdentityOrganizations: (userId) =>\n      guarded((api) => listRootIdentityOrganizations(api, userId)),\n    loadIdentity: (userId) => guarded((api) => loadRootIdentity(api, userId)),\n  };\n}\n"]}

package/client/runtime/workflowRuntime.d.ts

@@ -6,7 +6,7 @@ import type { SecurityIncidentReporter } from "../../data/shared/securityInciden
 import { type LocalUserIdentityCandidate, type TrustedUserIdentityResolver, type TrustedUserIdentityService } from "../../data/trustedUserIdentity/index.js";
 import type { ContainerContentsRootAdopter } from "../../workflows/container-contents/runtime.js";
 import { type ProvisionedPrincipalHistoryPrimer } from "../../workflows/registration/provisionedPrincipalHistory.js";
-import type { WorkflowRuntimeGroups, WorkflowRuntimeUtilInput } from "../../workflows/runtimeInput.js";
+import type { WorkflowRuntimeGroups, WorkflowRuntimeUtilInput } from "../../workflows/shared/runtimeInput.js";
 import type { Blobs } from "../blobs/index.js";
 import type { Identity } from "../identity/index.js";
 import type { Session } from "../session/sessionTypes.js";

package/client/runtime/workflowRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,EAAgB,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uCAAuC,GAExC,MAAM,0DAA0D,CAAC;AAWlE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAqEpE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../../data/documents/documentKinds\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../../workflows/container-contents/runtime\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../../workflows/runtimeInput\";\nimport type { Blobs } from \"../blobs\";\nimport type { Identity } from \"../identity\";\nimport { acknowledgedSessionRoot } from \"../session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"../session/sessionTypes\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    \"createLink\" | \"verifyLink\" | \"resolvePinned\"\n  >;\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    identityLinks: trustedUserIdentityService,\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}
+{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,EAAgB,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uCAAuC,GAExC,MAAM,0DAA0D,CAAC;AAWlE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAqEpE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../../data/documents/documentKinds\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../../workflows/container-contents/runtime\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { Blobs } from \"../blobs\";\nimport type { Identity } from \"../identity\";\nimport { acknowledgedSessionRoot } from \"../session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"../session/sessionTypes\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    \"createLink\" | \"verifyLink\" | \"resolvePinned\"\n  >;\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    identityLinks: trustedUserIdentityService,\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}

package/index.d.ts

@@ -9,7 +9,8 @@ export type { ContainerContentsSnapshot, ContainerContentsStoreRuntime, Containe
 export { createContainerContentsStore, createContainerContentsStoreState, createContainerContentsStoreSyncAgent, getOrCreateContainerContentsStore, isSystemContainerNode, requestContainerContentsDocumentPriming, subscribeToContainerContentsStore, updateContainerContentsSnapshot, updateContainerContentsStoreRuntime, } from "./stores/container-contents/index.js";
 export type { DocumentSnapshot, DocumentStoreFacade, DocumentStoreOpenOptions, DocumentStoreRelinkInput, DocumentStructuredFieldPatch, } from "./stores/documents/index.js";
 export { createDocumentStore, discardRegisteredDocumentLocalState, getOrCreateDocumentStore, openDocumentStore, requestDomainDocumentSync, subscribeToPersistedDocuments, } from "./stores/documents/index.js";
-export { type ClientDatabaseOptions, type ClientOptions, Tearleads, } from "./Tearleads.js";
+export { Tearleads } from "./Tearleads.js";
+export type { TearleadsDatabaseOptions, TearleadsOptions, } from "./TearleadsOptions.js";
 export type { BlobByteSource, BlobByteSourceInput, BlobBytes, BlobStore, EncryptedBlobStoreCipher, EncryptedBlobStoreKey, EncryptedBlobStoreOptions, WrapEncryptedBlobStoreOptions, } from "./workflows/blobs/index.js";
 export { blobByteSourceInputLength, createBlobByteSource, createBlobStore, createEncryptedBlobStore, createLazyEncryptedBlobStore, createMemoryBlobStore, decryptDocumentAttachmentBlob, hydrateDocumentAttachmentBlobs, purgeOpfsBlobStore, readBlobByteSource, uploadDocumentAttachment, wrapEncryptedBlobStore, } from "./workflows/blobs/index.js";
 export type { ContainerContentsRootAdopter, ContainerContentsRootAdoptionInput, ContainerContentsStoreWorkflowRuntime, ContainerContentsWorkflowRuntime, ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput, ContainerSystemSlotDefinition, PendingDownloadQueueItem, RecoveryFolder, } from "./workflows/container-contents/index.js";

package/index.js

@@ -6,7 +6,7 @@ export { Blobs, createBrowserLocalKeyring, createBrowserLocalKeyringManifestStor
 export { addDocumentAttachments, createDocumentProjectorRegistry, createDocumentSignerDeviceId, DEFAULT_DOCUMENT_ACCESS_EPOCH, DEFAULT_DOCUMENT_KIND, defaultDocumentProjectorRegistry, deriveStoredDocumentTitle, ensureDocumentAttachmentStructure, getDocumentAttachments, getDocumentClientProjectionTables, getStoredDocumentTypeLabel, getUntitledDocumentTitle, initializeStoredDocumentKind, projectStoredDocumentState, readStoredDocumentState, readStringDocumentField, resolveOpIdAttribution, sameDocumentAttachments, summarizeDocumentContributors, writerByPeerId, writeStoredDocumentFields, } from "./data/documents/index.js";
 export { createContainerContentsStore, createContainerContentsStoreState, createContainerContentsStoreSyncAgent, getOrCreateContainerContentsStore, isSystemContainerNode, requestContainerContentsDocumentPriming, subscribeToContainerContentsStore, updateContainerContentsSnapshot, updateContainerContentsStoreRuntime, } from "./stores/container-contents/index.js";
 export { createDocumentStore, discardRegisteredDocumentLocalState, getOrCreateDocumentStore, openDocumentStore, requestDomainDocumentSync, subscribeToPersistedDocuments, } from "./stores/documents/index.js";
-export { Tearleads, } from "./Tearleads.js";
+export { Tearleads } from "./Tearleads.js";
 export { blobByteSourceInputLength, createBlobByteSource, createBlobStore, createEncryptedBlobStore, createLazyEncryptedBlobStore, createMemoryBlobStore, decryptDocumentAttachmentBlob, hydrateDocumentAttachmentBlobs, purgeOpfsBlobStore, readBlobByteSource, uploadDocumentAttachment, wrapEncryptedBlobStore, } from "./workflows/blobs/index.js";
 export { createContainerContentsDocumentsRuntime, createContainerContentsProjectionUserKeyResolver, createContainerContentsStoreWorkflowRuntime, createContainerContentsSyncLane, createContainerContentsWorkflowRuntime, createContainerParentSyncLane, createInitializedContainerMetadataDocument, defaultContainerContentsPersistence, deriveContainerSystemSlot, initializeDocumentLinksSchema, listBlobInfo, listDocumentLinkedContainerIds, loadContainerInfo, loadContainerSyncWatermark, loadDocumentAttributionRanges, loadDocumentInfo, replaceDocumentLinks, saveContainerSyncWatermark, syncedContainerDocumentObjectSyncState, } from "./workflows/container-contents/index.js";
 export { buildMaterializedContainerRekeyPlan, buildRootContainerCreatePlan, ContainerAuthorAccessError, ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, ContainerKeyringOverrideStaleError, ContainerPathTooDeepError, classifyContainerWriteRefusal, containerWriterProjectionFromRekeyPlan, createRemoteContainer, fetchContainerKekLog, GroupShareNameMismatchError, HistoricalWrapUnavailableError, isProjectionVerificationCancelledError, moveRemoteContainer, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, rekeyRemoteContainer, revokeRemoteContainer, rootContainerWriterProjectionFromCreatePlan, shareRemoteContainer, shareRemoteContainerWithGroup, } from "./workflows/containers/index.js";

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAkK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,SAAS,GACV,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport {\n  type ClientDatabaseOptions,\n  type ClientOptions,\n  Tearleads,\n} from \"./Tearleads\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  GroupShareNameMismatchError,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAkK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport { Tearleads } from \"./Tearleads\";\nexport type {\n  TearleadsDatabaseOptions,\n  TearleadsOptions,\n} from \"./TearleadsOptions\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  GroupShareNameMismatchError,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n  shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.60",
+  "version": "0.1.61",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/container-contents/metadataIncomingUpdateIsolation.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadataIncomingUpdateIsolation.js","sourceRoot":"","sources":["metadataIncomingUpdateIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AAEjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAC/F,OAAO,EAEL,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAIzF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAStD;IACC,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QACpE,MAAM,iCAAiC,CAAC,aAAa,CAAC,CAAC,kBAAkB,CACvE,KAAK,IAAI,EAAE;YACT,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;gBAAE,OAAO;YAC1C,MAAM,yBAAyB,CAC7B,aAAa,EACb,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;QACJ,CAAC,EACD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,eAA8C,EAC9C,MAA0D;IAE1D,kCAAkC,CAAC,eAAe,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAM/C;IACC,OAAO;QACL,gCAAgC,EAAE,KAAK,EACrC,OAAyC,EACzC,EAAE;YACF,MAAM,gCAAgC,CAAC;gBACrC,GAAG,KAAK;gBACR,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;gBAAE,OAAO;YAC1C,4BAA4B,CAC1B,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,QAAQ,EACd,OAAO,CACR,CAAC;QACJ,CAAC;QACD,uBAAuB,EAAE,CACvB,MAAuE,EACvE,EAAE,CACF,iCAAiC,CAAC;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;SACzC,CAAC;KACL,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type DocumentSyncUpdateIsolationError,\n  importDecryptedDocumentSyncUpdates,\n  validateDocumentSyncUpdateImports,\n} from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport type { SyncRemoteDocumentResult } from \"../../data/documents/shared/types\";\nimport { recordDocumentSyncFailure } from \"../../data/sqlite/documentPersistence\";\nimport { getClientSQLitePersistenceRuntime } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport {\n  type ExecSql,\n  runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\nimport { reportDocumentSyncQuarantine } from \"../documents/reportDocumentSyncQuarantine\";\nimport type { WorkflowRuntimeUtilInput } from \"../runtimeInput\";\nimport type { ContainerMetadataState } from \"./metadataTypes\";\n\nexport async function recordCurrentMetadataSyncFailure(input: {\n  execSql: ExecSql;\n  failure: {\n    readonly attemptedAt: string;\n    readonly message: string;\n    readonly status: number | null;\n  };\n  isCurrent?: (() => boolean) | undefined;\n  metadataScope: { appKind: string; localId: string };\n}): Promise<void> {\n  await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {\n    await getClientSQLitePersistenceRuntime(lockedExecSql).guardedTransaction(\n      async () => {\n        if (input.isCurrent?.() === false) return;\n        await recordDocumentSyncFailure(\n          lockedExecSql,\n          input.metadataScope,\n          input.failure,\n        );\n      },\n      () => input.isCurrent?.() !== false,\n    );\n  });\n}\n\nexport function applyIncomingContainerMetadataUpdates(\n  currentDocument: ContainerMetadataState[\"doc\"],\n  result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\">,\n): void {\n  importDecryptedDocumentSyncUpdates(currentDocument, result.decryptedUpdates);\n}\n\nexport function metadataIncomingUpdateIsolation(input: {\n  currentDocument: ContainerMetadataState[\"doc\"];\n  execSql: ExecSql;\n  isCurrent?: (() => boolean) | undefined;\n  logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n  metadataScope: { appKind: string; localId: string };\n}) {\n  return {\n    onIncomingUpdateIsolationFailure: async (\n      failure: DocumentSyncUpdateIsolationError,\n    ) => {\n      await recordCurrentMetadataSyncFailure({\n        ...input,\n        failure: {\n          attemptedAt: new Date().toISOString(),\n          message: failure.message,\n          status: null,\n        },\n      });\n      if (input.isCurrent?.() === false) return;\n      reportDocumentSyncQuarantine(\n        input.currentDocument,\n        input.logError,\n        failure,\n      );\n    },\n    validateIncomingUpdates: (\n      result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\" | \"response\">,\n    ) =>\n      validateDocumentSyncUpdateImports({\n        currentDocument: input.currentDocument,\n        decryptedUpdates: result.decryptedUpdates,\n        responseUpdates: result.response.updates,\n      }),\n  };\n}\n"]}
+{"version":3,"file":"metadataIncomingUpdateIsolation.js","sourceRoot":"","sources":["metadataIncomingUpdateIsolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AAEjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAC/F,OAAO,EAEL,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAIzF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAStD;IACC,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;QACpE,MAAM,iCAAiC,CAAC,aAAa,CAAC,CAAC,kBAAkB,CACvE,KAAK,IAAI,EAAE;YACT,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;gBAAE,OAAO;YAC1C,MAAM,yBAAyB,CAC7B,aAAa,EACb,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;QACJ,CAAC,EACD,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,eAA8C,EAC9C,MAA0D;IAE1D,kCAAkC,CAAC,eAAe,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAM/C;IACC,OAAO;QACL,gCAAgC,EAAE,KAAK,EACrC,OAAyC,EACzC,EAAE;YACF,MAAM,gCAAgC,CAAC;gBACrC,GAAG,KAAK;gBACR,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;gBAAE,OAAO;YAC1C,4BAA4B,CAC1B,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,QAAQ,EACd,OAAO,CACR,CAAC;QACJ,CAAC;QACD,uBAAuB,EAAE,CACvB,MAAuE,EACvE,EAAE,CACF,iCAAiC,CAAC;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;SACzC,CAAC;KACL,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type DocumentSyncUpdateIsolationError,\n  importDecryptedDocumentSyncUpdates,\n  validateDocumentSyncUpdateImports,\n} from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport type { SyncRemoteDocumentResult } from \"../../data/documents/shared/types\";\nimport { recordDocumentSyncFailure } from \"../../data/sqlite/documentPersistence\";\nimport { getClientSQLitePersistenceRuntime } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport {\n  type ExecSql,\n  runSerializedSqlMutation,\n} from \"../../data/sqlite/sqlSchema\";\nimport { reportDocumentSyncQuarantine } from \"../documents/reportDocumentSyncQuarantine\";\nimport type { WorkflowRuntimeUtilInput } from \"../shared/runtimeInput\";\nimport type { ContainerMetadataState } from \"./metadataTypes\";\n\nexport async function recordCurrentMetadataSyncFailure(input: {\n  execSql: ExecSql;\n  failure: {\n    readonly attemptedAt: string;\n    readonly message: string;\n    readonly status: number | null;\n  };\n  isCurrent?: (() => boolean) | undefined;\n  metadataScope: { appKind: string; localId: string };\n}): Promise<void> {\n  await runSerializedSqlMutation(input.execSql, async (lockedExecSql) => {\n    await getClientSQLitePersistenceRuntime(lockedExecSql).guardedTransaction(\n      async () => {\n        if (input.isCurrent?.() === false) return;\n        await recordDocumentSyncFailure(\n          lockedExecSql,\n          input.metadataScope,\n          input.failure,\n        );\n      },\n      () => input.isCurrent?.() !== false,\n    );\n  });\n}\n\nexport function applyIncomingContainerMetadataUpdates(\n  currentDocument: ContainerMetadataState[\"doc\"],\n  result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\">,\n): void {\n  importDecryptedDocumentSyncUpdates(currentDocument, result.decryptedUpdates);\n}\n\nexport function metadataIncomingUpdateIsolation(input: {\n  currentDocument: ContainerMetadataState[\"doc\"];\n  execSql: ExecSql;\n  isCurrent?: (() => boolean) | undefined;\n  logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n  metadataScope: { appKind: string; localId: string };\n}) {\n  return {\n    onIncomingUpdateIsolationFailure: async (\n      failure: DocumentSyncUpdateIsolationError,\n    ) => {\n      await recordCurrentMetadataSyncFailure({\n        ...input,\n        failure: {\n          attemptedAt: new Date().toISOString(),\n          message: failure.message,\n          status: null,\n        },\n      });\n      if (input.isCurrent?.() === false) return;\n      reportDocumentSyncQuarantine(\n        input.currentDocument,\n        input.logError,\n        failure,\n      );\n    },\n    validateIncomingUpdates: (\n      result: Pick<SyncRemoteDocumentResult, \"decryptedUpdates\" | \"response\">,\n    ) =>\n      validateDocumentSyncUpdateImports({\n        currentDocument: input.currentDocument,\n        decryptedUpdates: result.decryptedUpdates,\n        responseUpdates: result.response.updates,\n      }),\n  };\n}\n"]}

package/workflows/container-contents/projectionKeys.d.ts

@@ -1,6 +1,6 @@
 import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
 import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
-import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeStateInput } from "../runtimeInput.js";
+import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeStateInput } from "../shared/runtimeInput.js";
 export type ContainerContentsProjectionUserKeyResolver = ProjectionUserKeyResolver;
 type ProjectionKeyRuntime = Parameters<typeof createProjectionUserKeyResolver>[0];
 export interface ContainerContentsProjectionKeyRuntime {

package/workflows/container-contents/projectionKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectionKeys.js","sourceRoot":"","sources":["projectionKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAoB1G,MAAM,UAAU,gDAAgD,CAC9D,OAA8C;IAE9C,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,wDAAwD,CACtE,OAA8C;IAE9C,OAAO,gDAAgD,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,eAAsD,EACtD,WAAkD;IAElD,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,wDAAwD;IACxD,OAAO,CACL,eAAe,CAAC,0BAA0B;QACxC,WAAW,CAAC,0BAA0B;QACxC,eAAe,CAAC,IAAI,CAAC,eAAe,KAAK,WAAW,CAAC,IAAI,CAAC,eAAe;QACzE,eAAe,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM;QACvD,eAAe,CAAC,MAAM,CAAC,oBAAoB;YACzC,WAAW,CAAC,MAAM,CAAC,oBAAoB;QACzC,eAAe,CAAC,MAAM,CAAC,kBAAkB;YACvC,WAAW,CAAC,MAAM,CAAC,kBAAkB;QACvC,eAAe,CAAC,MAAM,CAAC,cAAc;YACnC,WAAW,CAAC,MAAM,CAAC,cAAc;QACnC,eAAe,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,WAAW,CACpE,CAAC;AACJ,CAAC","sourcesContent":["import type { ProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeStateInput,\n} from \"../runtimeInput\";\n\nexport type ContainerContentsProjectionUserKeyResolver =\n  ProjectionUserKeyResolver;\ntype ProjectionKeyRuntime = Parameters<\n  typeof createProjectionUserKeyResolver\n>[0];\n\nexport interface ContainerContentsProjectionKeyRuntime {\n  readonly auth: Pick<WorkflowRuntimeAuthInput, \"isAuthenticated\" | \"userId\">;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly resolveTrustedUserIdentity: ProjectionKeyRuntime[\"resolveTrustedUserIdentity\"];\n  readonly state: Pick<WorkflowRuntimeStateInput, \"domainScope\">;\n}\n\nexport function createContainerContentsProjectionUserKeyResolver(\n  runtime: ContainerContentsProjectionKeyRuntime,\n): ContainerContentsProjectionUserKeyResolver {\n  return createProjectionUserKeyResolver(runtime);\n}\n\nexport function createContainerContentsDocumentProjectionUserKeyResolver(\n  runtime: ContainerContentsProjectionKeyRuntime,\n): ContainerContentsProjectionUserKeyResolver {\n  return createContainerContentsProjectionUserKeyResolver(runtime);\n}\n\nexport function didContainerContentsProjectionKeyRuntimeChange(\n  previousRuntime: ContainerContentsProjectionKeyRuntime,\n  nextRuntime: ContainerContentsProjectionKeyRuntime,\n): boolean {\n  // The SDK-owned resolver is stable for the lifetime of Tearleads, but reads\n  // mutable session, identity, and database dependencies. The projection\n  // resolver adds its own per-user cache, so compare that trust context rather\n  // than relying only on the resolver function reference.\n  return (\n    previousRuntime.resolveTrustedUserIdentity !==\n      nextRuntime.resolveTrustedUserIdentity ||\n    previousRuntime.auth.isAuthenticated !== nextRuntime.auth.isAuthenticated ||\n    previousRuntime.auth.userId !== nextRuntime.auth.userId ||\n    previousRuntime.crypto.encapsulationKeyPair !==\n      nextRuntime.crypto.encapsulationKeyPair ||\n    previousRuntime.crypto.signingFingerprint !==\n      nextRuntime.crypto.signingFingerprint ||\n    previousRuntime.crypto.signingKeyPair !==\n      nextRuntime.crypto.signingKeyPair ||\n    previousRuntime.state.domainScope !== nextRuntime.state.domainScope\n  );\n}\n"]}
+{"version":3,"file":"projectionKeys.js","sourceRoot":"","sources":["projectionKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAoB1G,MAAM,UAAU,gDAAgD,CAC9D,OAA8C;IAE9C,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,wDAAwD,CACtE,OAA8C;IAE9C,OAAO,gDAAgD,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,eAAsD,EACtD,WAAkD;IAElD,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,wDAAwD;IACxD,OAAO,CACL,eAAe,CAAC,0BAA0B;QACxC,WAAW,CAAC,0BAA0B;QACxC,eAAe,CAAC,IAAI,CAAC,eAAe,KAAK,WAAW,CAAC,IAAI,CAAC,eAAe;QACzE,eAAe,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM;QACvD,eAAe,CAAC,MAAM,CAAC,oBAAoB;YACzC,WAAW,CAAC,MAAM,CAAC,oBAAoB;QACzC,eAAe,CAAC,MAAM,CAAC,kBAAkB;YACvC,WAAW,CAAC,MAAM,CAAC,kBAAkB;QACvC,eAAe,CAAC,MAAM,CAAC,cAAc;YACnC,WAAW,CAAC,MAAM,CAAC,cAAc;QACnC,eAAe,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,WAAW,CACpE,CAAC;AACJ,CAAC","sourcesContent":["import type { ProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeStateInput,\n} from \"../shared/runtimeInput\";\n\nexport type ContainerContentsProjectionUserKeyResolver =\n  ProjectionUserKeyResolver;\ntype ProjectionKeyRuntime = Parameters<\n  typeof createProjectionUserKeyResolver\n>[0];\n\nexport interface ContainerContentsProjectionKeyRuntime {\n  readonly auth: Pick<WorkflowRuntimeAuthInput, \"isAuthenticated\" | \"userId\">;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly resolveTrustedUserIdentity: ProjectionKeyRuntime[\"resolveTrustedUserIdentity\"];\n  readonly state: Pick<WorkflowRuntimeStateInput, \"domainScope\">;\n}\n\nexport function createContainerContentsProjectionUserKeyResolver(\n  runtime: ContainerContentsProjectionKeyRuntime,\n): ContainerContentsProjectionUserKeyResolver {\n  return createProjectionUserKeyResolver(runtime);\n}\n\nexport function createContainerContentsDocumentProjectionUserKeyResolver(\n  runtime: ContainerContentsProjectionKeyRuntime,\n): ContainerContentsProjectionUserKeyResolver {\n  return createContainerContentsProjectionUserKeyResolver(runtime);\n}\n\nexport function didContainerContentsProjectionKeyRuntimeChange(\n  previousRuntime: ContainerContentsProjectionKeyRuntime,\n  nextRuntime: ContainerContentsProjectionKeyRuntime,\n): boolean {\n  // The SDK-owned resolver is stable for the lifetime of Tearleads, but reads\n  // mutable session, identity, and database dependencies. The projection\n  // resolver adds its own per-user cache, so compare that trust context rather\n  // than relying only on the resolver function reference.\n  return (\n    previousRuntime.resolveTrustedUserIdentity !==\n      nextRuntime.resolveTrustedUserIdentity ||\n    previousRuntime.auth.isAuthenticated !== nextRuntime.auth.isAuthenticated ||\n    previousRuntime.auth.userId !== nextRuntime.auth.userId ||\n    previousRuntime.crypto.encapsulationKeyPair !==\n      nextRuntime.crypto.encapsulationKeyPair ||\n    previousRuntime.crypto.signingFingerprint !==\n      nextRuntime.crypto.signingFingerprint ||\n    previousRuntime.crypto.signingKeyPair !==\n      nextRuntime.crypto.signingKeyPair ||\n    previousRuntime.state.domainScope !== nextRuntime.state.domainScope\n  );\n}\n"]}

package/workflows/container-contents/runtime.d.ts

@@ -4,7 +4,7 @@ import type { PrincipalHistoryProtectionLease } from "../../data/principals/prin
 import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 import { type TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
 import { createDocumentsWorkflowRuntime, type DocumentsWorkflowRuntime } from "../documents/index.js";
-import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeInfraInput, WorkflowRuntimeStateInput, WorkflowRuntimeUtilInput } from "../runtimeInput.js";
+import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeInfraInput, WorkflowRuntimeStateInput, WorkflowRuntimeUtilInput } from "../shared/runtimeInput.js";
 type DocumentsWorkflowRuntimeInput = Parameters<typeof createDocumentsWorkflowRuntime>[0];
 type ContainerContentsWorkflowApi = ApiClient & DocumentsWorkflowRuntimeInput["apiClient"];
 export interface ContainerContentsWorkflowRuntimeAuth extends WorkflowRuntimeAuthInput {

package/workflows/container-contents/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAElG,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,8BAA8B,GAE/B,MAAM,cAAc,CAAC;AAqGtB,SAAS,qBAAqB,CAC5B,OAAyC,EACzC,WAA0B;IAE1B,OAAO,iCAAiC,CAAC,OAAO,EAAE;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,OAAyC,EACzC,WAA0B;IAE1B,OAAO,8BAA8B,CACnC,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,qDAAqD,CAC5D,KAA4C,EAC5C,kBAA6D;IAE7D,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,KAAK;QACd,kBAAkB;KACnB,CAAC;IAEF,OAAO,iCAAiC,CAAC,KAAK,EAAE;QAC9C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,0BAA0B,EAAE,kCAAkC,CAC5D,KAAK,CAAC,0BAA0B,CACjC;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAA4C;IAE5C,OAAO,qDAAqD,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,2CAA2C,CACzD,KAA4C,EAC5C,kBAAgD;IAEhD,OAAO,iCAAiC,CAAC,KAAK,EAAE;QAC9C,GAAG,qDAAqD,CACtD,KAAK,EACL,kBAAkB,CACnB;QACD,kBAAkB;KACnB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { inheritPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport {\n  createDocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntime,\n} from \"../documents\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../runtimeInput\";\n\ntype DocumentsWorkflowRuntimeInput = Parameters<\n  typeof createDocumentsWorkflowRuntime\n>[0];\n\ntype ContainerContentsWorkflowApi = ApiClient &\n  DocumentsWorkflowRuntimeInput[\"apiClient\"];\n\nexport interface ContainerContentsWorkflowRuntimeAuth\n  extends WorkflowRuntimeAuthInput {}\n\nexport interface ContainerContentsWorkflowRuntimeCrypto\n  extends WorkflowRuntimeCryptoInput {}\n\nexport interface ContainerContentsWorkflowRuntimeInfra\n  extends Omit<WorkflowRuntimeInfraInput, \"dbStatus\"> {\n  readonly dbStatus: string;\n}\n\ninterface ContainerContentsWorkflowRuntimeInputInfra\n  extends Omit<ContainerContentsWorkflowRuntimeInfra, \"documentProjectors\"> {\n  readonly documentProjectors: DocumentProjectorRegistryInput;\n}\n\nexport interface ContainerContentsWorkflowRuntimeState\n  extends WorkflowRuntimeStateInput {}\n\nexport interface ContainerContentsWorkflowRuntimeUtil\n  extends Omit<WorkflowRuntimeUtilInput, \"logError\"> {\n  // Store recovery is best-effort, so hosts may retain the causal error without\n  // making structured error logging mandatory for general workflow runtimes.\n  readonly logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n}\n\nexport interface ContainerContentsRootAdoptionInput {\n  readonly domainScope: ContainerContentsWorkflowRuntimeState[\"domainScope\"];\n  readonly expectedContainerId: string;\n  readonly nextContainerId: string;\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nexport type ContainerContentsRootAdopter = (\n  input: ContainerContentsRootAdoptionInput,\n) => boolean | \"already-adopted\";\n\nexport interface ContainerContentsWorkflowRuntimeGroups {\n  readonly auth: ContainerContentsWorkflowRuntimeAuth;\n  readonly crypto: ContainerContentsWorkflowRuntimeCrypto;\n  readonly infra: ContainerContentsWorkflowRuntimeInfra;\n  readonly state: ContainerContentsWorkflowRuntimeState;\n  readonly util: ContainerContentsWorkflowRuntimeUtil;\n}\n\nexport interface ContainerContentsWorkflowRuntimeInputGroups {\n  readonly auth: ContainerContentsWorkflowRuntimeAuth;\n  readonly crypto: ContainerContentsWorkflowRuntimeCrypto;\n  readonly infra: ContainerContentsWorkflowRuntimeInputInfra;\n  readonly state: ContainerContentsWorkflowRuntimeState;\n  readonly util: ContainerContentsWorkflowRuntimeUtil;\n}\n\nexport interface ContainerContentsWorkflowRuntimeInput\n  extends ContainerContentsWorkflowRuntimeInputGroups {\n  /** Private host custody, inherited by container and derived document runtimes. */\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n  readonly apiClient: ContainerContentsWorkflowApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface ContainerContentsWorkflowRuntime\n  extends ContainerContentsWorkflowRuntimeGroups,\n    Pick<ContainerContentsWorkflowRuntimeInput, \"apiClient\"> {\n  readonly adoptRootContainer?: ContainerContentsRootAdopter | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface ContainerContentsStoreWorkflowRuntime\n  extends ContainerContentsWorkflowRuntime {\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n}\n\nexport interface ContainerContentsWorkflowSqlRuntime {\n  readonly auth?: {\n    readonly organizationId?: string | null | undefined;\n  };\n  readonly infra: {\n    readonly execSql: ExecSql;\n  };\n}\n\nfunction documentsRuntimeInput(\n  runtime: ContainerContentsWorkflowRuntime,\n  containerId: string | null,\n): DocumentsWorkflowRuntimeInput {\n  return inheritPrincipalHistoryProtection(runtime, {\n    apiClient: runtime.apiClient,\n    auth: runtime.auth,\n    crypto: runtime.crypto,\n    infra: runtime.infra,\n    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n    state: { ...runtime.state, containerId },\n    util: runtime.util,\n  });\n}\n\nexport function createContainerContentsDocumentsRuntime(\n  runtime: ContainerContentsWorkflowRuntime,\n  containerId: string | null,\n): DocumentsWorkflowRuntime {\n  return createDocumentsWorkflowRuntime(\n    documentsRuntimeInput(runtime, containerId),\n  );\n}\n\nfunction createContainerContentsWorkflowRuntimeWithRootAdopter(\n  input: ContainerContentsWorkflowRuntimeInput,\n  adoptRootContainer?: ContainerContentsRootAdopter | undefined,\n): ContainerContentsWorkflowRuntime {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.infra.documentProjectors,\n  );\n  const infra = {\n    ...input.infra,\n    documentProjectors,\n  };\n\n  return inheritPrincipalHistoryProtection(input, {\n    ...(adoptRootContainer ? { adoptRootContainer } : {}),\n    apiClient: input.apiClient,\n    auth: input.auth,\n    crypto: input.crypto,\n    infra,\n    resolveTrustedUserIdentity: requireTrustedUserIdentityResolver(\n      input.resolveTrustedUserIdentity,\n    ),\n    state: input.state,\n    util: input.util,\n  });\n}\n\nexport function createContainerContentsWorkflowRuntime(\n  input: ContainerContentsWorkflowRuntimeInput,\n): ContainerContentsWorkflowRuntime {\n  return createContainerContentsWorkflowRuntimeWithRootAdopter(input);\n}\n\n/** Internal store runtime with the session-root adoption capability wired. */\nexport function createContainerContentsStoreWorkflowRuntime(\n  input: ContainerContentsWorkflowRuntimeInput,\n  adoptRootContainer: ContainerContentsRootAdopter,\n): ContainerContentsStoreWorkflowRuntime {\n  return inheritPrincipalHistoryProtection(input, {\n    ...createContainerContentsWorkflowRuntimeWithRootAdopter(\n      input,\n      adoptRootContainer,\n    ),\n    adoptRootContainer,\n  });\n}\n"]}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAElG,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,8BAA8B,GAE/B,MAAM,cAAc,CAAC;AAqGtB,SAAS,qBAAqB,CAC5B,OAAyC,EACzC,WAA0B;IAE1B,OAAO,iCAAiC,CAAC,OAAO,EAAE;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,OAAyC,EACzC,WAA0B;IAE1B,OAAO,8BAA8B,CACnC,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,qDAAqD,CAC5D,KAA4C,EAC5C,kBAA6D;IAE7D,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,KAAK;QACd,kBAAkB;KACnB,CAAC;IAEF,OAAO,iCAAiC,CAAC,KAAK,EAAE;QAC9C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,0BAA0B,EAAE,kCAAkC,CAC5D,KAAK,CAAC,0BAA0B,CACjC;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAA4C;IAE5C,OAAO,qDAAqD,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,2CAA2C,CACzD,KAA4C,EAC5C,kBAAgD;IAEhD,OAAO,iCAAiC,CAAC,KAAK,EAAE;QAC9C,GAAG,qDAAqD,CACtD,KAAK,EACL,kBAAkB,CACnB;QACD,kBAAkB;KACnB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { inheritPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport {\n  createDocumentsWorkflowRuntime,\n  type DocumentsWorkflowRuntime,\n} from \"../documents\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../shared/runtimeInput\";\n\ntype DocumentsWorkflowRuntimeInput = Parameters<\n  typeof createDocumentsWorkflowRuntime\n>[0];\n\ntype ContainerContentsWorkflowApi = ApiClient &\n  DocumentsWorkflowRuntimeInput[\"apiClient\"];\n\nexport interface ContainerContentsWorkflowRuntimeAuth\n  extends WorkflowRuntimeAuthInput {}\n\nexport interface ContainerContentsWorkflowRuntimeCrypto\n  extends WorkflowRuntimeCryptoInput {}\n\nexport interface ContainerContentsWorkflowRuntimeInfra\n  extends Omit<WorkflowRuntimeInfraInput, \"dbStatus\"> {\n  readonly dbStatus: string;\n}\n\ninterface ContainerContentsWorkflowRuntimeInputInfra\n  extends Omit<ContainerContentsWorkflowRuntimeInfra, \"documentProjectors\"> {\n  readonly documentProjectors: DocumentProjectorRegistryInput;\n}\n\nexport interface ContainerContentsWorkflowRuntimeState\n  extends WorkflowRuntimeStateInput {}\n\nexport interface ContainerContentsWorkflowRuntimeUtil\n  extends Omit<WorkflowRuntimeUtilInput, \"logError\"> {\n  // Store recovery is best-effort, so hosts may retain the causal error without\n  // making structured error logging mandatory for general workflow runtimes.\n  readonly logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n}\n\nexport interface ContainerContentsRootAdoptionInput {\n  readonly domainScope: ContainerContentsWorkflowRuntimeState[\"domainScope\"];\n  readonly expectedContainerId: string;\n  readonly nextContainerId: string;\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nexport type ContainerContentsRootAdopter = (\n  input: ContainerContentsRootAdoptionInput,\n) => boolean | \"already-adopted\";\n\nexport interface ContainerContentsWorkflowRuntimeGroups {\n  readonly auth: ContainerContentsWorkflowRuntimeAuth;\n  readonly crypto: ContainerContentsWorkflowRuntimeCrypto;\n  readonly infra: ContainerContentsWorkflowRuntimeInfra;\n  readonly state: ContainerContentsWorkflowRuntimeState;\n  readonly util: ContainerContentsWorkflowRuntimeUtil;\n}\n\nexport interface ContainerContentsWorkflowRuntimeInputGroups {\n  readonly auth: ContainerContentsWorkflowRuntimeAuth;\n  readonly crypto: ContainerContentsWorkflowRuntimeCrypto;\n  readonly infra: ContainerContentsWorkflowRuntimeInputInfra;\n  readonly state: ContainerContentsWorkflowRuntimeState;\n  readonly util: ContainerContentsWorkflowRuntimeUtil;\n}\n\nexport interface ContainerContentsWorkflowRuntimeInput\n  extends ContainerContentsWorkflowRuntimeInputGroups {\n  /** Private host custody, inherited by container and derived document runtimes. */\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n  readonly apiClient: ContainerContentsWorkflowApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface ContainerContentsWorkflowRuntime\n  extends ContainerContentsWorkflowRuntimeGroups,\n    Pick<ContainerContentsWorkflowRuntimeInput, \"apiClient\"> {\n  readonly adoptRootContainer?: ContainerContentsRootAdopter | undefined;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface ContainerContentsStoreWorkflowRuntime\n  extends ContainerContentsWorkflowRuntime {\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n}\n\nexport interface ContainerContentsWorkflowSqlRuntime {\n  readonly auth?: {\n    readonly organizationId?: string | null | undefined;\n  };\n  readonly infra: {\n    readonly execSql: ExecSql;\n  };\n}\n\nfunction documentsRuntimeInput(\n  runtime: ContainerContentsWorkflowRuntime,\n  containerId: string | null,\n): DocumentsWorkflowRuntimeInput {\n  return inheritPrincipalHistoryProtection(runtime, {\n    apiClient: runtime.apiClient,\n    auth: runtime.auth,\n    crypto: runtime.crypto,\n    infra: runtime.infra,\n    resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n    state: { ...runtime.state, containerId },\n    util: runtime.util,\n  });\n}\n\nexport function createContainerContentsDocumentsRuntime(\n  runtime: ContainerContentsWorkflowRuntime,\n  containerId: string | null,\n): DocumentsWorkflowRuntime {\n  return createDocumentsWorkflowRuntime(\n    documentsRuntimeInput(runtime, containerId),\n  );\n}\n\nfunction createContainerContentsWorkflowRuntimeWithRootAdopter(\n  input: ContainerContentsWorkflowRuntimeInput,\n  adoptRootContainer?: ContainerContentsRootAdopter | undefined,\n): ContainerContentsWorkflowRuntime {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.infra.documentProjectors,\n  );\n  const infra = {\n    ...input.infra,\n    documentProjectors,\n  };\n\n  return inheritPrincipalHistoryProtection(input, {\n    ...(adoptRootContainer ? { adoptRootContainer } : {}),\n    apiClient: input.apiClient,\n    auth: input.auth,\n    crypto: input.crypto,\n    infra,\n    resolveTrustedUserIdentity: requireTrustedUserIdentityResolver(\n      input.resolveTrustedUserIdentity,\n    ),\n    state: input.state,\n    util: input.util,\n  });\n}\n\nexport function createContainerContentsWorkflowRuntime(\n  input: ContainerContentsWorkflowRuntimeInput,\n): ContainerContentsWorkflowRuntime {\n  return createContainerContentsWorkflowRuntimeWithRootAdopter(input);\n}\n\n/** Internal store runtime with the session-root adoption capability wired. */\nexport function createContainerContentsStoreWorkflowRuntime(\n  input: ContainerContentsWorkflowRuntimeInput,\n  adoptRootContainer: ContainerContentsRootAdopter,\n): ContainerContentsStoreWorkflowRuntime {\n  return inheritPrincipalHistoryProtection(input, {\n    ...createContainerContentsWorkflowRuntimeWithRootAdopter(\n      input,\n      adoptRootContainer,\n    ),\n    adoptRootContainer,\n  });\n}\n"]}

package/workflows/documents/projectionKeys.d.ts

@@ -1,6 +1,6 @@
 import type { ProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/index.js";
 import { createProjectionUserKeyResolver } from "../../data/keyingProjectionVerification/userKeyResolver.js";
-import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeStateInput } from "../runtimeInput.js";
+import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeStateInput } from "../shared/runtimeInput.js";
 export type DocumentProjectionUserKeyResolver = ProjectionUserKeyResolver;
 type ProjectionKeyRuntime = Parameters<typeof createProjectionUserKeyResolver>[0];
 export interface DocumentProjectionKeyRuntime {

package/workflows/documents/projectionKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectionKeys.js","sourceRoot":"","sources":["projectionKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAmB1G,MAAM,UAAU,uCAAuC,CACrD,OAAqC;IAErC,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,eAA6C,EAC7C,WAAyC;IAEzC,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,wDAAwD;IACxD,OAAO,CACL,eAAe,CAAC,0BAA0B;QACxC,WAAW,CAAC,0BAA0B;QACxC,eAAe,CAAC,IAAI,CAAC,eAAe,KAAK,WAAW,CAAC,IAAI,CAAC,eAAe;QACzE,eAAe,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM;QACvD,eAAe,CAAC,MAAM,CAAC,oBAAoB;YACzC,WAAW,CAAC,MAAM,CAAC,oBAAoB;QACzC,eAAe,CAAC,MAAM,CAAC,kBAAkB;YACvC,WAAW,CAAC,MAAM,CAAC,kBAAkB;QACvC,eAAe,CAAC,MAAM,CAAC,cAAc;YACnC,WAAW,CAAC,MAAM,CAAC,cAAc;QACnC,eAAe,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,WAAW,CACpE,CAAC;AACJ,CAAC","sourcesContent":["import type { ProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeStateInput,\n} from \"../runtimeInput\";\n\nexport type DocumentProjectionUserKeyResolver = ProjectionUserKeyResolver;\ntype ProjectionKeyRuntime = Parameters<\n  typeof createProjectionUserKeyResolver\n>[0];\n\nexport interface DocumentProjectionKeyRuntime {\n  readonly auth: Pick<WorkflowRuntimeAuthInput, \"isAuthenticated\" | \"userId\">;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly resolveTrustedUserIdentity: ProjectionKeyRuntime[\"resolveTrustedUserIdentity\"];\n  readonly state: Pick<WorkflowRuntimeStateInput, \"domainScope\">;\n}\n\nexport function createDocumentProjectionUserKeyResolver(\n  runtime: DocumentProjectionKeyRuntime,\n): DocumentProjectionUserKeyResolver {\n  return createProjectionUserKeyResolver(runtime);\n}\n\nexport function didDocumentProjectionKeyRuntimeChange(\n  previousRuntime: DocumentProjectionKeyRuntime,\n  nextRuntime: DocumentProjectionKeyRuntime,\n): boolean {\n  // The SDK-owned resolver is stable for the lifetime of Tearleads, but reads\n  // mutable session, identity, and database dependencies. The projection\n  // resolver adds its own per-user cache, so compare that trust context rather\n  // than relying only on the resolver function reference.\n  return (\n    previousRuntime.resolveTrustedUserIdentity !==\n      nextRuntime.resolveTrustedUserIdentity ||\n    previousRuntime.auth.isAuthenticated !== nextRuntime.auth.isAuthenticated ||\n    previousRuntime.auth.userId !== nextRuntime.auth.userId ||\n    previousRuntime.crypto.encapsulationKeyPair !==\n      nextRuntime.crypto.encapsulationKeyPair ||\n    previousRuntime.crypto.signingFingerprint !==\n      nextRuntime.crypto.signingFingerprint ||\n    previousRuntime.crypto.signingKeyPair !==\n      nextRuntime.crypto.signingKeyPair ||\n    previousRuntime.state.domainScope !== nextRuntime.state.domainScope\n  );\n}\n"]}
+{"version":3,"file":"projectionKeys.js","sourceRoot":"","sources":["projectionKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAmB1G,MAAM,UAAU,uCAAuC,CACrD,OAAqC;IAErC,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,eAA6C,EAC7C,WAAyC;IAEzC,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,wDAAwD;IACxD,OAAO,CACL,eAAe,CAAC,0BAA0B;QACxC,WAAW,CAAC,0BAA0B;QACxC,eAAe,CAAC,IAAI,CAAC,eAAe,KAAK,WAAW,CAAC,IAAI,CAAC,eAAe;QACzE,eAAe,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM;QACvD,eAAe,CAAC,MAAM,CAAC,oBAAoB;YACzC,WAAW,CAAC,MAAM,CAAC,oBAAoB;QACzC,eAAe,CAAC,MAAM,CAAC,kBAAkB;YACvC,WAAW,CAAC,MAAM,CAAC,kBAAkB;QACvC,eAAe,CAAC,MAAM,CAAC,cAAc;YACnC,WAAW,CAAC,MAAM,CAAC,cAAc;QACnC,eAAe,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,WAAW,CACpE,CAAC;AACJ,CAAC","sourcesContent":["import type { ProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { createProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification/userKeyResolver\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeStateInput,\n} from \"../shared/runtimeInput\";\n\nexport type DocumentProjectionUserKeyResolver = ProjectionUserKeyResolver;\ntype ProjectionKeyRuntime = Parameters<\n  typeof createProjectionUserKeyResolver\n>[0];\n\nexport interface DocumentProjectionKeyRuntime {\n  readonly auth: Pick<WorkflowRuntimeAuthInput, \"isAuthenticated\" | \"userId\">;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly resolveTrustedUserIdentity: ProjectionKeyRuntime[\"resolveTrustedUserIdentity\"];\n  readonly state: Pick<WorkflowRuntimeStateInput, \"domainScope\">;\n}\n\nexport function createDocumentProjectionUserKeyResolver(\n  runtime: DocumentProjectionKeyRuntime,\n): DocumentProjectionUserKeyResolver {\n  return createProjectionUserKeyResolver(runtime);\n}\n\nexport function didDocumentProjectionKeyRuntimeChange(\n  previousRuntime: DocumentProjectionKeyRuntime,\n  nextRuntime: DocumentProjectionKeyRuntime,\n): boolean {\n  // The SDK-owned resolver is stable for the lifetime of Tearleads, but reads\n  // mutable session, identity, and database dependencies. The projection\n  // resolver adds its own per-user cache, so compare that trust context rather\n  // than relying only on the resolver function reference.\n  return (\n    previousRuntime.resolveTrustedUserIdentity !==\n      nextRuntime.resolveTrustedUserIdentity ||\n    previousRuntime.auth.isAuthenticated !== nextRuntime.auth.isAuthenticated ||\n    previousRuntime.auth.userId !== nextRuntime.auth.userId ||\n    previousRuntime.crypto.encapsulationKeyPair !==\n      nextRuntime.crypto.encapsulationKeyPair ||\n    previousRuntime.crypto.signingFingerprint !==\n      nextRuntime.crypto.signingFingerprint ||\n    previousRuntime.crypto.signingKeyPair !==\n      nextRuntime.crypto.signingKeyPair ||\n    previousRuntime.state.domainScope !== nextRuntime.state.domainScope\n  );\n}\n"]}

package/workflows/documents/reportDocumentSyncQuarantine.js.map

@@ -1 +1 @@
-{"version":3,"file":"reportDocumentSyncQuarantine.js","sourceRoot":"","sources":["reportDocumentSyncQuarantine.ts"],"names":[],"mappings":"AAGA,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAAkB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,UAAU,4BAA4B,CAC1C,KAAa,EACb,QAA0D,EAC1D,OAAyC;IAEzC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5E,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS;QAAE,OAAO;IAC3D,4EAA4E;IAC5E,yEAAyE;IACzE,qBAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,KAAK,OAAO,CAAC,OAAO,CAClB,QAAQ,CAAC,qCAAqC,EAAE,OAAO,CAAC,CACzD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC","sourcesContent":["import type { DocumentSyncUpdateIsolationError } from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport type { WorkflowRuntimeUtilInput } from \"../runtimeInput\";\n\nconst lastQuarantineByScope = new WeakMap<object, string>();\n\n/** Keep host diagnostics failures from replacing the durable quarantine. */\nexport function reportDocumentSyncQuarantine(\n  scope: object,\n  logError: WorkflowRuntimeUtilInput[\"logError\"] | undefined,\n  failure: DocumentSyncUpdateIsolationError,\n): void {\n  if (!logError) return;\n  const signature = JSON.stringify([failure.message, failure.batchUpdateIds]);\n  if (lastQuarantineByScope.get(scope) === signature) return;\n  // Suppress repeats before the host appends local logs and breadcrumbs. Keep\n  // only the last failure, and let discarded document scopes be collected.\n  lastQuarantineByScope.set(scope, signature);\n  try {\n    void Promise.resolve(\n      logError(\"Documents: sync updates quarantined\", failure),\n    ).catch(() => undefined);\n  } catch {\n    // Hosts may throw synchronously or return a rejected promise.\n  }\n}\n"]}
+{"version":3,"file":"reportDocumentSyncQuarantine.js","sourceRoot":"","sources":["reportDocumentSyncQuarantine.ts"],"names":[],"mappings":"AAGA,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAAkB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,UAAU,4BAA4B,CAC1C,KAAa,EACb,QAA0D,EAC1D,OAAyC;IAEzC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5E,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS;QAAE,OAAO;IAC3D,4EAA4E;IAC5E,yEAAyE;IACzE,qBAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,KAAK,OAAO,CAAC,OAAO,CAClB,QAAQ,CAAC,qCAAqC,EAAE,OAAO,CAAC,CACzD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC","sourcesContent":["import type { DocumentSyncUpdateIsolationError } from \"../../data/documents/shared/documentSyncUpdateIsolation\";\nimport type { WorkflowRuntimeUtilInput } from \"../shared/runtimeInput\";\n\nconst lastQuarantineByScope = new WeakMap<object, string>();\n\n/** Keep host diagnostics failures from replacing the durable quarantine. */\nexport function reportDocumentSyncQuarantine(\n  scope: object,\n  logError: WorkflowRuntimeUtilInput[\"logError\"] | undefined,\n  failure: DocumentSyncUpdateIsolationError,\n): void {\n  if (!logError) return;\n  const signature = JSON.stringify([failure.message, failure.batchUpdateIds]);\n  if (lastQuarantineByScope.get(scope) === signature) return;\n  // Suppress repeats before the host appends local logs and breadcrumbs. Keep\n  // only the last failure, and let discarded document scopes be collected.\n  lastQuarantineByScope.set(scope, signature);\n  try {\n    void Promise.resolve(\n      logError(\"Documents: sync updates quarantined\", failure),\n    ).catch(() => undefined);\n  } catch {\n    // Hosts may throw synchronously or return a rejected promise.\n  }\n}\n"]}

package/workflows/documents/runtime.d.ts

@@ -2,7 +2,7 @@ import type { ApiClient } from "../../internal/api-client/index.js";
 import { type DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
 import type { PrincipalHistoryProtectionLease } from "../../data/principals/principalHistoryProtection.js";
 import { type TrustedUserIdentityResolver } from "../../data/trustedUserIdentity/index.js";
-import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeInfraInput, WorkflowRuntimeStateInput, WorkflowRuntimeUtilInput } from "../runtimeInput.js";
+import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput, WorkflowRuntimeInfraInput, WorkflowRuntimeStateInput, WorkflowRuntimeUtilInput } from "../shared/runtimeInput.js";
 interface DocumentsWorkflowRuntimeUtilInput extends Omit<WorkflowRuntimeUtilInput, "logError"> {
     /** Receives handled quarantine errors without converting them to strings. */
     readonly logError?: WorkflowRuntimeUtilInput["logError"] | undefined;

package/workflows/documents/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAyDxC,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,KAAK;QACd,kBAAkB;KACnB,CAAC;IAEF,OAAO,iCAAiC,CAAC,KAAK,EAAE;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,0BAA0B,EAAE,kCAAkC,CAC5D,KAAK,CAAC,0BAA0B,CACjC;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { inheritPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../runtimeInput\";\n\ninterface DocumentsWorkflowRuntimeUtilInput\n  extends Omit<WorkflowRuntimeUtilInput, \"logError\"> {\n  /** Receives handled quarantine errors without converting them to strings. */\n  readonly logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n}\n\nexport interface DocumentsWorkflowRuntimeInfra\n  extends Omit<WorkflowRuntimeInfraInput, \"dbStatus\"> {\n  readonly dbStatus: string;\n}\n\ninterface DocumentsWorkflowRuntimeInputInfra\n  extends Omit<DocumentsWorkflowRuntimeInfra, \"documentProjectors\"> {\n  readonly documentProjectors: DocumentProjectorRegistryInput;\n}\n\nexport interface DocumentsWorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInputGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInputInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInput\n  extends DocumentsWorkflowRuntimeInputGroups {\n  /** Private host custody, inherited without exposing it on runtime views. */\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface DocumentsWorkflowRuntime\n  extends DocumentsWorkflowRuntimeGroups {\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createDocumentsWorkflowRuntime(\n  input: DocumentsWorkflowRuntimeInput,\n): DocumentsWorkflowRuntime {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.infra.documentProjectors,\n  );\n  const infra = {\n    ...input.infra,\n    documentProjectors,\n  };\n\n  return inheritPrincipalHistoryProtection(input, {\n    apiClient: input.apiClient,\n    auth: input.auth,\n    crypto: input.crypto,\n    infra,\n    resolveTrustedUserIdentity: requireTrustedUserIdentityResolver(\n      input.resolveTrustedUserIdentity,\n    ),\n    state: input.state,\n    util: input.util,\n  });\n}\n"]}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAyDxC,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,kBAAkB,GAAG,gCAAgC,CACzD,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,KAAK;QACd,kBAAkB;KACnB,CAAC;IAEF,OAAO,iCAAiC,CAAC,KAAK,EAAE;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,0BAA0B,EAAE,kCAAkC,CAC5D,KAAK,CAAC,0BAA0B,CACjC;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport {\n  type DocumentProjectorRegistryInput,\n  resolveDocumentProjectorRegistry,\n} from \"../../data/documents/documentKinds\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport { inheritPrincipalHistoryProtection } from \"../../data/principals/principalHistoryRuntime\";\nimport {\n  requireTrustedUserIdentityResolver,\n  type TrustedUserIdentityResolver,\n} from \"../../data/trustedUserIdentity\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../shared/runtimeInput\";\n\ninterface DocumentsWorkflowRuntimeUtilInput\n  extends Omit<WorkflowRuntimeUtilInput, \"logError\"> {\n  /** Receives handled quarantine errors without converting them to strings. */\n  readonly logError?: WorkflowRuntimeUtilInput[\"logError\"] | undefined;\n}\n\nexport interface DocumentsWorkflowRuntimeInfra\n  extends Omit<WorkflowRuntimeInfraInput, \"dbStatus\"> {\n  readonly dbStatus: string;\n}\n\ninterface DocumentsWorkflowRuntimeInputInfra\n  extends Omit<DocumentsWorkflowRuntimeInfra, \"documentProjectors\"> {\n  readonly documentProjectors: DocumentProjectorRegistryInput;\n}\n\nexport interface DocumentsWorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInputGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: DocumentsWorkflowRuntimeInputInfra;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: DocumentsWorkflowRuntimeUtilInput;\n}\n\nexport interface DocumentsWorkflowRuntimeInput\n  extends DocumentsWorkflowRuntimeInputGroups {\n  /** Private host custody, inherited without exposing it on runtime views. */\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport interface DocumentsWorkflowRuntime\n  extends DocumentsWorkflowRuntimeGroups {\n  readonly apiClient: ApiClient;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nexport function createDocumentsWorkflowRuntime(\n  input: DocumentsWorkflowRuntimeInput,\n): DocumentsWorkflowRuntime {\n  const documentProjectors = resolveDocumentProjectorRegistry(\n    input.infra.documentProjectors,\n  );\n  const infra = {\n    ...input.infra,\n    documentProjectors,\n  };\n\n  return inheritPrincipalHistoryProtection(input, {\n    apiClient: input.apiClient,\n    auth: input.auth,\n    crypto: input.crypto,\n    infra,\n    resolveTrustedUserIdentity: requireTrustedUserIdentityResolver(\n      input.resolveTrustedUserIdentity,\n    ),\n    state: input.state,\n    util: input.util,\n  });\n}\n"]}

package/workflows/{runtimeInput.d.ts → shared/runtimeInput.d.ts}

@@ -1,9 +1,9 @@
-import type { EncapsulationKeyPair, SigningKeyPair } from "../internal/crypto/index.js";
-import type { BlobStore } from "../data/blobs/blobContracts.js";
-import type { DocumentProjectorRegistry } from "../data/documents/documentKinds.js";
-import type { DomainScope } from "../data/shared/domainScope.js";
-import type { SecurityIncidentReporter } from "../data/shared/securityIncidents.js";
-import type { ExecSql } from "../data/sqlite/sqlSchema.js";
+import type { EncapsulationKeyPair, SigningKeyPair } from "../../internal/crypto/index.js";
+import type { BlobStore } from "../../data/blobs/blobContracts.js";
+import type { DocumentProjectorRegistry } from "../../data/documents/documentKinds.js";
+import type { DomainScope } from "../../data/shared/domainScope.js";
+import type { SecurityIncidentReporter } from "../../data/shared/securityIncidents.js";
+import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
 export type WorkflowRuntimeDatabaseStatus = "idle" | "ready" | "error" | "terminated";
 export interface WorkflowRuntimeAuthInput {
     /** Server-backed personal organization; independent of organizationId. */

package/workflows/shared/runtimeInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeInput.js","sourceRoot":"","sources":["runtimeInput.ts"],"names":[],"mappings":"","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport type { BlobStore } from \"../../data/blobs/blobContracts\";\nimport type { DocumentProjectorRegistry } from \"../../data/documents/documentKinds\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport type WorkflowRuntimeDatabaseStatus =\n  | \"idle\"\n  | \"ready\"\n  | \"error\"\n  | \"terminated\";\n\nexport interface WorkflowRuntimeAuthInput {\n  /** Server-backed personal organization; independent of organizationId. */\n  readonly defaultOrganizationId?: string | null;\n  /** Session root identity, independent of a document/pane target. */\n  readonly rootContainerId?: string | null | undefined;\n  readonly isAuthenticated: boolean;\n  /** Platform-operator flag from the server; the API enforces root access. */\n  readonly isRoot?: boolean | undefined;\n  readonly organizationId: string | null;\n  readonly userId: string | null;\n}\n\nexport interface WorkflowRuntimeCryptoInput {\n  readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  readonly signingFingerprint: string | null;\n  readonly signingKeyPair: SigningKeyPair | null;\n}\n\nexport interface WorkflowRuntimeStateInput {\n  readonly containerId: string | null;\n  readonly domainScope: DomainScope;\n  readonly events: ReadonlyArray<unknown>;\n  readonly online: boolean;\n  /**\n   * Increments after each acknowledged server-events interest declaration.\n   * Unlike a boolean connection edge, this survives coalesced runtime\n   * notifications and document stores retained while their host provider is\n   * unmounted.\n   */\n  readonly serverEventsConnectionGeneration?: number | undefined;\n  /**\n   * Per-pane CRDT peer-seed discriminator (e.g. the pane's local identity\n   * namespace). Documents in distinct panes must derive distinct Loro peer ids;\n   * absent/`null` means single-pane (bare scope). The document runtime factory\n   * always populates it; other runtimes and test fixtures may omit it.\n   */\n  readonly peerScope?: string | null;\n}\n\nexport interface WorkflowRuntimeInfraInput {\n  readonly blobStore: BlobStore;\n  readonly dbStatus: WorkflowRuntimeDatabaseStatus;\n  readonly documentProjectors: DocumentProjectorRegistry;\n  readonly execSql: ExecSql;\n}\n\nexport interface WorkflowRuntimeUtilInput {\n  readonly isRemoteSyncBlocked?:\n    | ((organizationId: string) => boolean)\n    | undefined;\n  readonly log: (message: string) => void;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n}\n\nexport interface WorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: WorkflowRuntimeInfraInput;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: WorkflowRuntimeUtilInput;\n}\n"]}

package/workflows/runtimeInput.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtimeInput.js","sourceRoot":"","sources":["runtimeInput.ts"],"names":[],"mappings":"","sourcesContent":["import type { EncapsulationKeyPair, SigningKeyPair } from \"@tearleads/crypto\";\nimport type { BlobStore } from \"../data/blobs/blobContracts\";\nimport type { DocumentProjectorRegistry } from \"../data/documents/documentKinds\";\nimport type { DomainScope } from \"../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../data/sqlite/sqlSchema\";\n\nexport type WorkflowRuntimeDatabaseStatus =\n  | \"idle\"\n  | \"ready\"\n  | \"error\"\n  | \"terminated\";\n\nexport interface WorkflowRuntimeAuthInput {\n  /** Server-backed personal organization; independent of organizationId. */\n  readonly defaultOrganizationId?: string | null;\n  /** Session root identity, independent of a document/pane target. */\n  readonly rootContainerId?: string | null | undefined;\n  readonly isAuthenticated: boolean;\n  /** Platform-operator flag from the server; the API enforces root access. */\n  readonly isRoot?: boolean | undefined;\n  readonly organizationId: string | null;\n  readonly userId: string | null;\n}\n\nexport interface WorkflowRuntimeCryptoInput {\n  readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  readonly signingFingerprint: string | null;\n  readonly signingKeyPair: SigningKeyPair | null;\n}\n\nexport interface WorkflowRuntimeStateInput {\n  readonly containerId: string | null;\n  readonly domainScope: DomainScope;\n  readonly events: ReadonlyArray<unknown>;\n  readonly online: boolean;\n  /**\n   * Increments after each acknowledged server-events interest declaration.\n   * Unlike a boolean connection edge, this survives coalesced runtime\n   * notifications and document stores retained while their host provider is\n   * unmounted.\n   */\n  readonly serverEventsConnectionGeneration?: number | undefined;\n  /**\n   * Per-pane CRDT peer-seed discriminator (e.g. the pane's local identity\n   * namespace). Documents in distinct panes must derive distinct Loro peer ids;\n   * absent/`null` means single-pane (bare scope). The document runtime factory\n   * always populates it; other runtimes and test fixtures may omit it.\n   */\n  readonly peerScope?: string | null;\n}\n\nexport interface WorkflowRuntimeInfraInput {\n  readonly blobStore: BlobStore;\n  readonly dbStatus: WorkflowRuntimeDatabaseStatus;\n  readonly documentProjectors: DocumentProjectorRegistry;\n  readonly execSql: ExecSql;\n}\n\nexport interface WorkflowRuntimeUtilInput {\n  readonly isRemoteSyncBlocked?:\n    | ((organizationId: string) => boolean)\n    | undefined;\n  readonly log: (message: string) => void;\n  readonly logError: (message: string | Error, cause?: unknown) => void;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n}\n\nexport interface WorkflowRuntimeGroups {\n  readonly auth: WorkflowRuntimeAuthInput;\n  readonly crypto: WorkflowRuntimeCryptoInput;\n  readonly infra: WorkflowRuntimeInfraInput;\n  readonly state: WorkflowRuntimeStateInput;\n  readonly util: WorkflowRuntimeUtilInput;\n}\n"]}