instar 1.3.526 → 1.3.528
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/server.d.ts.map +1 -1
- package/dist/commands/server.js +135 -2
- package/dist/commands/server.js.map +1 -1
- package/dist/config/ConfigDefaults.d.ts.map +1 -1
- package/dist/config/ConfigDefaults.js +27 -0
- package/dist/config/ConfigDefaults.js.map +1 -1
- package/dist/core/CoherenceJournal.d.ts +1 -1
- package/dist/core/CoherenceJournal.d.ts.map +1 -1
- package/dist/core/CoherenceJournal.js +23 -2
- package/dist/core/CoherenceJournal.js.map +1 -1
- package/dist/core/PostUpdateMigrator.d.ts.map +1 -1
- package/dist/core/PostUpdateMigrator.js +43 -1
- package/dist/core/PostUpdateMigrator.js.map +1 -1
- package/dist/core/PreferencesReplicatedStore.d.ts +212 -0
- package/dist/core/PreferencesReplicatedStore.d.ts.map +1 -0
- package/dist/core/PreferencesReplicatedStore.js +330 -0
- package/dist/core/PreferencesReplicatedStore.js.map +1 -0
- package/dist/core/PreferencesSync.d.ts +8 -0
- package/dist/core/PreferencesSync.d.ts.map +1 -1
- package/dist/core/PreferencesSync.js +8 -0
- package/dist/core/PreferencesSync.js.map +1 -1
- package/dist/core/RelationshipManager.d.ts +61 -1
- package/dist/core/RelationshipManager.d.ts.map +1 -1
- package/dist/core/RelationshipManager.js +86 -2
- package/dist/core/RelationshipManager.js.map +1 -1
- package/dist/core/RelationshipsReplicatedStore.d.ts +298 -0
- package/dist/core/RelationshipsReplicatedStore.d.ts.map +1 -0
- package/dist/core/RelationshipsReplicatedStore.js +660 -0
- package/dist/core/RelationshipsReplicatedStore.js.map +1 -0
- package/dist/core/devGatedFeatures.d.ts.map +1 -1
- package/dist/core/devGatedFeatures.js +10 -0
- package/dist/core/devGatedFeatures.js.map +1 -1
- package/dist/scaffold/templates.d.ts.map +1 -1
- package/dist/scaffold/templates.js +3 -1
- package/dist/scaffold/templates.js.map +1 -1
- package/dist/server/AgentServer.d.ts +4 -0
- package/dist/server/AgentServer.d.ts.map +1 -1
- package/dist/server/AgentServer.js +1 -0
- package/dist/server/AgentServer.js.map +1 -1
- package/dist/server/routes.d.ts +7 -0
- package/dist/server/routes.d.ts.map +1 -1
- package/dist/server/routes.js +19 -0
- package/dist/server/routes.js.map +1 -1
- package/package.json +1 -1
- package/src/data/builtin-manifest.json +64 -64
- package/src/scaffold/templates.ts +3 -1
- package/upgrades/1.3.527.md +31 -0
- package/upgrades/1.3.528.md +34 -0
- package/upgrades/side-effects/ws21-preferences-replicated-store.md +91 -0
- package/upgrades/side-effects/ws23-relationships.md +150 -0
|
@@ -0,0 +1,298 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* RelationshipsReplicatedStore — the SECOND concrete consumer of the HLC
|
|
3
|
+
* replicated-store foundation (WS2.3) and the FIRST PII kind. It layers the
|
|
4
|
+
* `relationship-record` replicated kind onto the generic substrate
|
|
5
|
+
* (ReplicatedRecordEnvelope / UnionReader / ConflictStore / RollbackUnmerge /
|
|
6
|
+
* ReplicationBudget / StoreSnapshot) so that a person the agent knows on machine
|
|
7
|
+
* A is known on machine B — ONE relationship graph, not one-per-machine.
|
|
8
|
+
*
|
|
9
|
+
* It is the literal analog of `PreferencesReplicatedStore.ts` (the WS2.1 reference
|
|
10
|
+
* consumer), with the PII-specific hardening the security spec
|
|
11
|
+
* (`ws23-relationships-userregistry-security.md`) demands. THIS IS PURE LOGIC. No
|
|
12
|
+
* fs, no Date directly, no network. It defines:
|
|
13
|
+
*
|
|
14
|
+
* A. The `relationship-record` store schema — a STRICT typed validator that
|
|
15
|
+
* TYPE-CLAMPS every known field (REQ-M3): ISO-8601-only dates, finite-number
|
|
16
|
+
* counts, length-clamped free text. A foreign record is fully attacker-
|
|
17
|
+
* controlled (§2.3 injection), so the clamp is the defense that makes markup
|
|
18
|
+
* un-smuggleable through a field that bypasses sanitize() on render. The
|
|
19
|
+
* schema is a DISCRIMINATED UNION on `op` (gap #8): an `op:'put'` VALUE schema
|
|
20
|
+
* AND an `op:'delete'` TOMBSTONE schema coexist under the one kind, so a
|
|
21
|
+
* tombstone is never marked invalid/suspect by the value schema (REQ-D6).
|
|
22
|
+
*
|
|
23
|
+
* B. The disclosure-minimized PROJECTION (REQ-M4) — `buildRelationshipRecordData`
|
|
24
|
+
* emits ONLY the enumerated resolution + merge-relevant fields, NEVER the raw
|
|
25
|
+
* on-disk blob and NEVER the local UUID `id`. `recordKey` is the cross-machine
|
|
26
|
+
* IDENTITY SURFACE (REQ-D17), derived deterministically from the sorted
|
|
27
|
+
* channel-uids (a person is "the same" across machines by their channels,
|
|
28
|
+
* mirroring resolveByChannel) — never the per-machine `randomUUID()` id.
|
|
29
|
+
*
|
|
30
|
+
* C. The TOMBSTONE builder — `buildRelationshipTombstoneData` emits an
|
|
31
|
+
* `op:'delete'` record `{ recordKey, op, hlc, origin, deletedAt }` (§4.2) so a
|
|
32
|
+
* delete/erasure propagates as a positive signal across an offline-then-
|
|
33
|
+
* rejoining peer (§4.3) instead of a record absence that cannot distinguish
|
|
34
|
+
* "deleted" from "never replicated".
|
|
35
|
+
*
|
|
36
|
+
* D. The union-aware read — `mergeUnionToRelationships` collapses a
|
|
37
|
+
* `Map<recordKey, UnionResult>` (from ReplicatedStoreReader.readAll('relationships'))
|
|
38
|
+
* into the merged relationship view. HIGH-impact (preferences/relationships):
|
|
39
|
+
* an OPEN concurrent conflict is APPEND-BOTH-AND-FLAG — both versions surface,
|
|
40
|
+
* never a silent clobber; the read NEVER writes a foreign record into the local
|
|
41
|
+
* store (REQ-M7 read-only union).
|
|
42
|
+
*
|
|
43
|
+
* E. Foreign-record render safety — `renderForeignRelationshipContext` wraps a
|
|
44
|
+
* replicated record in an explicit `<replicated-untrusted-data origin="…">`
|
|
45
|
+
* envelope (§2.3) and sanitizes EVERY rendered field (the ISO-8601/finite-
|
|
46
|
+
* number type-clamps on apply already make the date/count fields injection-
|
|
47
|
+
* safe; the free-text fields are escaped here). There is no "trusted because
|
|
48
|
+
* machine-set" render slot for a foreign record.
|
|
49
|
+
*
|
|
50
|
+
* SAFETY POSTURE (§14): MECHANISM, dark by default. Nothing here blocks a
|
|
51
|
+
* user-initiated action. The local UUID `id`, the local `channelIndex`/`nameIndex`,
|
|
52
|
+
* and any local-only bookkeeping are NEVER part of the replicated schema and are
|
|
53
|
+
* stripped from every emitted projection (REQ-M4 disclosure minimization).
|
|
54
|
+
*/
|
|
55
|
+
import type { RelationshipRecord, UserChannel } from './types.js';
|
|
56
|
+
import type { StoreFieldSchema, ReplicatedEnvelope } from './ReplicatedRecordEnvelope.js';
|
|
57
|
+
import type { ImpactTier, OriginRecord, UnionResult } from './UnionReader.js';
|
|
58
|
+
import type { ReplicatedKindBounds } from './ReplicationBudget.js';
|
|
59
|
+
import type { HlcTimestamp } from './HybridLogicalClock.js';
|
|
60
|
+
/** The stateSync config sub-key + advert suffix for this store (e.g.
|
|
61
|
+
* `multiMachine.stateSync.relationships.enabled`). Equal to the advert flag key
|
|
62
|
+
* `stateSyncReceive['relationships']`. */
|
|
63
|
+
export declare const RELATIONSHIP_STORE_KEY = "relationships";
|
|
64
|
+
/** The JournalKind string this store rides — the DUAL-REGISTRY's dynamic half.
|
|
65
|
+
* MUST also be present in CoherenceJournal.JOURNAL_KINDS (the static half), or the
|
|
66
|
+
* store advertises receive=true yet serves/applies/pulls nothing (§4 callout). */
|
|
67
|
+
export declare const RELATIONSHIP_RECORD_KIND = "relationship-record";
|
|
68
|
+
/**
|
|
69
|
+
* Relationships are HIGH-impact (security spec §5 REQ-M9 / parent §WS2): a
|
|
70
|
+
* concurrent divergent VALUE edit to the SAME identity surface from different
|
|
71
|
+
* origins goes through APPEND-BOTH-AND-FLAG — both versions preserved, ONE deduped
|
|
72
|
+
* conflict, never a silent overwrite (auto-merging two divergent people could fuse
|
|
73
|
+
* two distinct humans). The CONSUMER read path injects BOTH variants — see
|
|
74
|
+
* mergeUnionToRelationships.
|
|
75
|
+
*/
|
|
76
|
+
export declare const RELATIONSHIP_IMPACT_TIER: ImpactTier;
|
|
77
|
+
/** Mirrors RelationshipManager.MAX_NOTES_LENGTH. */
|
|
78
|
+
export declare const MAX_NOTES_LENGTH = 10000;
|
|
79
|
+
/** Mirrors RelationshipManager.MAX_CHANNELS. */
|
|
80
|
+
export declare const MAX_CHANNELS = 50;
|
|
81
|
+
/** Themes cap (RelationshipManager keeps themes ≤ 20). */
|
|
82
|
+
export declare const MAX_THEMES = 20;
|
|
83
|
+
/** Recent-interactions cap fallback (config `maxRecentInteractions`; the projection
|
|
84
|
+
* clamps to this hard ceiling so a hostile peer can't inflate the count). */
|
|
85
|
+
export declare const MAX_RECENT_INTERACTIONS = 50;
|
|
86
|
+
/** Per-free-text-string clamp for name / arcSummary / communicationStyle / category /
|
|
87
|
+
* each tag / each interaction summary / each channel identifier. */
|
|
88
|
+
export declare const MAX_FREETEXT_LENGTH = 2000;
|
|
89
|
+
/** A channel `type` is a short slug. */
|
|
90
|
+
export declare const MAX_CHANNEL_TYPE_LENGTH = 64;
|
|
91
|
+
/** Tags cap. */
|
|
92
|
+
export declare const MAX_TAGS = 50;
|
|
93
|
+
/**
|
|
94
|
+
* Per-kind replication bounds (§8 / REQ-D1). A PII store is NEVER `rotateKeep: 0`
|
|
95
|
+
* (rotate but never delete) — unbounded PII history is a compliance defect. The
|
|
96
|
+
* relationship store is chatty (recordInteraction fires on every message), so the
|
|
97
|
+
* rate cap COALESCES (latest state per recordKey per interval, REQ-M12). The
|
|
98
|
+
* per-kind maxFileBytes here is the journal-level fallback; the aggregate replicated
|
|
99
|
+
* PII byte ceiling (REQ-D2, 64 MiB) caps the cross-(peer,kind) footprint.
|
|
100
|
+
*/
|
|
101
|
+
export declare const RELATIONSHIP_RECORD_BOUNDS: ReplicatedKindBounds;
|
|
102
|
+
/**
|
|
103
|
+
* Per-entry size cap RAISED to 64KB for this PII kind (REQ-M3, gap #10). The
|
|
104
|
+
* default APPLIER_MAX_ENTRY_BYTES = 8KB is SMALLER than a fat relationship
|
|
105
|
+
* (MAX_NOTES_LENGTH=10_000 alone, PLUS bounded recentInteractions + MAX_CHANNELS),
|
|
106
|
+
* so under it the highest-PII records would never replicate AND would wedge the
|
|
107
|
+
* stream. 64KB is provably above the disclosure-minimized projection's maximum:
|
|
108
|
+
* name(2k) + notes(10k) + 20 themes×2k(40k) is already the dominant term, but
|
|
109
|
+
* themes are SHORT topic slugs in practice and EACH free-text is clamped to 2k —
|
|
110
|
+
* the realistic max (notes 10k + 50 channels×(64+2000) ≈ 103k worst-case) shows
|
|
111
|
+
* why we additionally enforce a HARD post-projection ceiling: a record that STILL
|
|
112
|
+
* exceeds 64KB after projection is REJECTED with a named error (not silent-
|
|
113
|
+
* truncate, not suspect-wedge). See assertProjectionUnderCap.
|
|
114
|
+
*/
|
|
115
|
+
export declare const RELATIONSHIP_MAX_ENTRY_BYTES: number;
|
|
116
|
+
/**
|
|
117
|
+
* The store-specific field names the `relationship-record` VALUE schema OWNS (the
|
|
118
|
+
* unknown-field counter's allowlist). The local UUID `id` is DELIBERATELY ABSENT
|
|
119
|
+
* — it is per-machine and never replicated (REQ-D17 keys on the identity surface,
|
|
120
|
+
* not the id). `recordKey`/`hlc`/`op`/`origin`/`observed` are reserved envelope
|
|
121
|
+
* fields, never store fields.
|
|
122
|
+
*/
|
|
123
|
+
export declare const RELATIONSHIP_STORE_KNOWN_FIELDS: ReadonlyArray<string>;
|
|
124
|
+
/** The tombstone's store-owned fields beyond the reserved envelope set (REQ-D6).
|
|
125
|
+
* `deletedAt` is the only store field a delete carries. */
|
|
126
|
+
export declare const RELATIONSHIP_TOMBSTONE_KNOWN_FIELDS: ReadonlyArray<string>;
|
|
127
|
+
/** Is `v` a valid ISO-8601 date string (and ONLY a date — no trailing markup)? A
|
|
128
|
+
* string that Date.parse rejects, or that round-trips to a different string, is not
|
|
129
|
+
* a clean ISO date and is rejected. */
|
|
130
|
+
export declare function isIso8601(v: unknown): v is string;
|
|
131
|
+
/**
|
|
132
|
+
* The `relationship-record` store schema (§4 / REQ-M3) — a DISCRIMINATED UNION on
|
|
133
|
+
* `op` (gap #8). Strict typed validation on top of the envelope: reject free text
|
|
134
|
+
* beyond the known fields, TYPE-CLAMP every known field, validate the date/number
|
|
135
|
+
* fields so markup cannot smuggle through a render slot that bypasses sanitize().
|
|
136
|
+
* Returns the validated store-specific object (known fields only), or null to reject
|
|
137
|
+
* the WHOLE record. PURE (no I/O, no mutation of `raw`).
|
|
138
|
+
*
|
|
139
|
+
* The `op` discriminator: the envelope validator has ALREADY validated `op` ∈
|
|
140
|
+
* {put,delete} before calling this. We branch on it so a tombstone
|
|
141
|
+
* `{recordKey, op:'delete', hlc, origin, deletedAt}` passes (only `deletedAt` is a
|
|
142
|
+
* legal store field for a delete) WITHOUT being marked invalid by the rich VALUE
|
|
143
|
+
* schema (REQ-D6).
|
|
144
|
+
*/
|
|
145
|
+
export declare const relationshipRecordStoreSchema: StoreFieldSchema;
|
|
146
|
+
/**
|
|
147
|
+
* Normalize one channel into its stable uid form `type:identifier` (lowercased
|
|
148
|
+
* type, trimmed identifier). This is the SAME `${type}:${identifier}` key
|
|
149
|
+
* RelationshipManager.channelIndex uses to collide a person across platforms.
|
|
150
|
+
*/
|
|
151
|
+
export declare function channelUid(channel: UserChannel): string;
|
|
152
|
+
/**
|
|
153
|
+
* Derive the cross-machine-stable recordKey for a relationship (REQ-D17). A person
|
|
154
|
+
* is "the same" across machines by their CHANNEL SET (mirroring resolveByChannel),
|
|
155
|
+
* NOT by the per-machine `randomUUID()` id — VM-A and VM-B mint different UUIDs for
|
|
156
|
+
* the same human, so a UUID-keyed record could never collide them.
|
|
157
|
+
*
|
|
158
|
+
* The key is a deterministic, collision-resistant hash of the SORTED, de-duplicated
|
|
159
|
+
* channel-uids: `sha256(sorted(channelUids).join('\n'))`, hex-truncated to 32 chars
|
|
160
|
+
* (the same shape UnionReader.conflictId uses). Sorting makes it order-independent
|
|
161
|
+
* (the two machines converge to the SAME key for the same channel set); the hash
|
|
162
|
+
* makes it a bounded, non-path-shaped string (the envelope's recordKey jail accepts
|
|
163
|
+
* it). A relationship with NO channels (a degenerate local-only record) is NOT
|
|
164
|
+
* replicable — it has no cross-machine identity surface — and is reported as null so
|
|
165
|
+
* the caller skips emission (it can never collide a stranger by an empty key).
|
|
166
|
+
*
|
|
167
|
+
* COLLISION SAFETY: two DIFFERENT people share a key ONLY if they share the EXACT
|
|
168
|
+
* same full channel set — which is the manager's own definition of "the same
|
|
169
|
+
* person" (resolveByChannel returns one record per channel-uid). SPLIT-IDENTITY
|
|
170
|
+
* SAFETY: the same person derives the SAME key on both machines IFF both hold the
|
|
171
|
+
* same channel set; when their channel sets differ (one machine learned an extra
|
|
172
|
+
* channel) the keys differ — which is correct (they are not yet provably the same
|
|
173
|
+
* person on the machine missing the channel), and the union/erasure intersection
|
|
174
|
+
* logic (REQ-D17) reconciles them by channel-uid overlap, never by key equality.
|
|
175
|
+
*/
|
|
176
|
+
export declare function deriveRelationshipRecordKey(channels: ReadonlyArray<UserChannel>): string | null;
|
|
177
|
+
/** The `data` object a `relationship-record` journal entry carries. */
|
|
178
|
+
export type RelationshipRecordData = Record<string, unknown>;
|
|
179
|
+
/** Input to buildRelationshipRecordData: the record to emit, the freshly-ticked
|
|
180
|
+
* hlc, this machine's origin id, and the observed-witness (the hlc already merged
|
|
181
|
+
* for THIS recordKey before writing, or absent — §7.2). */
|
|
182
|
+
export interface BuildRelationshipRecordInput {
|
|
183
|
+
record: RelationshipRecord;
|
|
184
|
+
hlc: HlcTimestamp;
|
|
185
|
+
origin: string;
|
|
186
|
+
/** The HLC already merged for THIS recordKey before writing, or absent (§7.2). */
|
|
187
|
+
observed?: HlcTimestamp;
|
|
188
|
+
}
|
|
189
|
+
/** The named error a record-over-cap surfaces (REQ-M3): not silent-truncate, not
|
|
190
|
+
* suspect-wedge. */
|
|
191
|
+
export declare class RelationshipRecordTooLargeError extends Error {
|
|
192
|
+
readonly recordKey: string;
|
|
193
|
+
readonly bytes: number;
|
|
194
|
+
constructor(recordKey: string, bytes: number);
|
|
195
|
+
}
|
|
196
|
+
/**
|
|
197
|
+
* Build the disclosure-minimized `relationship-record` envelope `data` for an
|
|
198
|
+
* `op:'put'` (REQ-M4). Emits ONLY the enumerated resolution + merge-relevant
|
|
199
|
+
* fields — NEVER the raw on-disk blob, NEVER the local UUID `id`. recordKey = the
|
|
200
|
+
* derived channel-set identity surface (REQ-D17).
|
|
201
|
+
*
|
|
202
|
+
* Returns null when the record has NO channels (no cross-machine identity surface ⇒
|
|
203
|
+
* not replicable — the caller skips emission). Throws RelationshipRecordTooLargeError
|
|
204
|
+
* when the projection STILL exceeds the 64KB per-entry cap (a record that big is a
|
|
205
|
+
* NAMED, surfaced rejection, REQ-M3 gap #10 — never silent-truncate).
|
|
206
|
+
*/
|
|
207
|
+
export declare function buildRelationshipRecordData(input: BuildRelationshipRecordInput): RelationshipRecordData | null;
|
|
208
|
+
/** Throw RelationshipRecordTooLargeError if the projected data serializes over the
|
|
209
|
+
* per-entry cap (REQ-M3). The cap is set so a legal disclosure-minimized record can
|
|
210
|
+
* never reach it; this is the belt-and-suspenders named rejection. */
|
|
211
|
+
export declare function assertProjectionUnderCap(recordKey: string, data: RelationshipRecordData): void;
|
|
212
|
+
/** Input to buildRelationshipTombstoneData: the channel set of the deleted person
|
|
213
|
+
* (to derive the recordKey identity surface), the freshly-ticked hlc, the origin,
|
|
214
|
+
* and the deletedAt timestamp. */
|
|
215
|
+
export interface BuildRelationshipTombstoneInput {
|
|
216
|
+
channels: ReadonlyArray<UserChannel>;
|
|
217
|
+
hlc: HlcTimestamp;
|
|
218
|
+
origin: string;
|
|
219
|
+
deletedAt: string;
|
|
220
|
+
observed?: HlcTimestamp;
|
|
221
|
+
}
|
|
222
|
+
/**
|
|
223
|
+
* Build an `op:'delete'` TOMBSTONE `data` for a relationship erasure (§4.2 REQ-D4).
|
|
224
|
+
* recordKey = the SAME channel-set identity surface the value records key on, so the
|
|
225
|
+
* tombstone reaches the same human's record on every machine even though the local
|
|
226
|
+
* UUIDs differ. Returns null when the person has no channels (no identity surface to
|
|
227
|
+
* tombstone). The exact field set is `{ recordKey, op:'delete', hlc, origin,
|
|
228
|
+
* deletedAt }` (the REQ-D6 tombstone schema branch).
|
|
229
|
+
*/
|
|
230
|
+
export declare function buildRelationshipTombstoneData(input: BuildRelationshipTombstoneInput): RelationshipRecordData | null;
|
|
231
|
+
/** A merged relationship view entry: the projected record fields PLUS its origin
|
|
232
|
+
* machine id (so a foreign record is rendered inside the untrusted-data envelope).
|
|
233
|
+
* This is READ-ONLY — it is NEVER written back into the local store (REQ-M7). */
|
|
234
|
+
export interface MergedRelationshipView {
|
|
235
|
+
recordKey: string;
|
|
236
|
+
origin: string;
|
|
237
|
+
/** The validated, type-clamped projection fields (the receive-side schema already
|
|
238
|
+
* ran on apply; here `data` is that validated portion). */
|
|
239
|
+
data: Record<string, unknown>;
|
|
240
|
+
/** True when this view entry is one of ≥2 concurrent variants of an OPEN conflict
|
|
241
|
+
* (append-both — both surface; the read NEVER suppresses a usable view). */
|
|
242
|
+
conflicted: boolean;
|
|
243
|
+
}
|
|
244
|
+
/**
|
|
245
|
+
* Collapse a `Map<recordKey, UnionResult>` (from
|
|
246
|
+
* ReplicatedStoreReader.readAll('relationships')) into the merged relationship view.
|
|
247
|
+
* HIGH-impact contract (REQ-M9):
|
|
248
|
+
* - A resolved single value ⇒ that one view entry.
|
|
249
|
+
* - An OPEN concurrent conflict ⇒ BOTH (all) `put` variants as separate entries
|
|
250
|
+
* (append-both — the read NEVER suppresses a usable view waiting on operator
|
|
251
|
+
* resolution). A `delete` variant contributes nothing to display.
|
|
252
|
+
* - A delete-resolved key (every origin's latest is a tombstone) ⇒ nothing.
|
|
253
|
+
* The read is READ-ONLY: a replicated record NEVER clobbers a divergent local
|
|
254
|
+
* record (REQ-M7) — the local store files are never written here.
|
|
255
|
+
*/
|
|
256
|
+
export declare function mergeUnionToRelationships(union: Map<string, UnionResult>): MergedRelationshipView[];
|
|
257
|
+
/**
|
|
258
|
+
* Render a FOREIGN (replicated) relationship record into a session-context block,
|
|
259
|
+
* wrapped in an explicit `<replicated-untrusted-data origin="…">` envelope (§2.3)
|
|
260
|
+
* so the session model treats it as a PEER'S CLAIM to re-ground against, never a
|
|
261
|
+
* directive. EVERY rendered field is escaped — there is no "trusted because machine-
|
|
262
|
+
* set" slot. (The date/count fields were already ISO-8601/finite-number type-clamped
|
|
263
|
+
* on apply, so they cannot carry markup; we escape defensively regardless.)
|
|
264
|
+
*
|
|
265
|
+
* This is the foreign-record analog of RelationshipManager.getContextForPerson — a
|
|
266
|
+
* caller asking "what do my OTHER machines know about this person" gets this block,
|
|
267
|
+
* NEVER the local-authoritative context. A null `data.name` (a malformed view) yields
|
|
268
|
+
* null.
|
|
269
|
+
*/
|
|
270
|
+
export declare function renderForeignRelationshipContext(view: MergedRelationshipView): string | null;
|
|
271
|
+
/**
|
|
272
|
+
* Build an OriginRecord for the OWN relationship store (the single-origin
|
|
273
|
+
* materialization the union reader merges against peer replicas). recordKey =
|
|
274
|
+
* derived channel-set identity surface; the envelope carries a SYNTHETIC own-origin
|
|
275
|
+
* HLC stamp derived deterministically from the record's lastInteraction (physical)
|
|
276
|
+
* so the own record has a well-formed, stable position relative to peer records.
|
|
277
|
+
* Returns null for a channel-less record (no identity surface). The local UUID `id`
|
|
278
|
+
* is NEVER carried into the replicated namespace (REQ-M4 / REQ-D17).
|
|
279
|
+
*/
|
|
280
|
+
export declare function relationshipToOriginRecord(record: RelationshipRecord, origin: string): OriginRecord | null;
|
|
281
|
+
/** The ReplicatedKindRegistry registration for the `relationship-record` store.
|
|
282
|
+
* server.ts registers this onto the shared registry; the dual-registry coupling
|
|
283
|
+
* test asserts `kind` is also present in JOURNAL_KINDS. */
|
|
284
|
+
export declare const RELATIONSHIP_KIND_REGISTRATION: {
|
|
285
|
+
readonly kind: "relationship-record";
|
|
286
|
+
readonly store: "relationships";
|
|
287
|
+
readonly schema: StoreFieldSchema;
|
|
288
|
+
};
|
|
289
|
+
/** Convenience: the store's contributing journal kinds (for rollback-unmerge's
|
|
290
|
+
* kindsForStore('relationships') wiring). */
|
|
291
|
+
export declare function relationshipContributingKinds(): string[];
|
|
292
|
+
/** The store's impact tier resolver, for ReplicatedStoreReader.tierOf. Returns HIGH
|
|
293
|
+
* for the `relationships` store (and HIGH for any unknown store — the conservative
|
|
294
|
+
* append-both-and-flag direction, never a silent clobber). */
|
|
295
|
+
export declare function relationshipTierOf(_store: string): ImpactTier;
|
|
296
|
+
/** Re-export the envelope type for callers building/applying relationship-record envelopes. */
|
|
297
|
+
export type { ReplicatedEnvelope };
|
|
298
|
+
//# sourceMappingURL=RelationshipsReplicatedStore.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"RelationshipsReplicatedStore.d.ts","sourceRoot":"","sources":["../../src/core/RelationshipsReplicatedStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAIH,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EAEZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,gBAAgB,EAEhB,kBAAkB,EAEnB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAM5D;;2CAE2C;AAC3C,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;mFAEmF;AACnF,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAAmB,CAAC;AAM3D,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,gDAAgD;AAChD,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,0DAA0D;AAC1D,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B;8EAC8E;AAC9E,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C;qEACqE;AACrE,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,wCAAwC;AACxC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,gBAAgB;AAChB,eAAO,MAAM,QAAQ,KAAK,CAAC;AAE3B;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,oBAIxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,4BAA4B,QAAY,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAAE,aAAa,CAAC,MAAM,CAchE,CAAC;AAEH;4DAC4D;AAC5D,eAAO,MAAM,mCAAmC,EAAE,aAAa,CAAC,MAAM,CAEpE,CAAC;AAeH;;wCAEwC;AACxC,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAWjD;AA+CD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,EAAE,gBAuG3C,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAIvD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,MAAM,GAAG,IAAI,CAM/F;AAMD,uEAAuE;AACvE,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7D;;4DAE4D;AAC5D,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,GAAG,EAAE,YAAY,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;qBACqB;AACrB,qBAAa,+BAAgC,SAAQ,KAAK;aAC5B,SAAS,EAAE,MAAM;aAAkB,KAAK,EAAE,MAAM;gBAAhD,SAAS,EAAE,MAAM,EAAkB,KAAK,EAAE,MAAM;CAI7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,4BAA4B,GAAG,sBAAsB,GAAG,IAAI,CAsC9G;AAMD;;uEAEuE;AACvE,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAK9F;AAED;;mCAEmC;AACnC,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACrC,GAAG,EAAE,YAAY,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,+BAA+B,GAAG,sBAAsB,GAAG,IAAI,CAWpH;AAMD;;kFAEkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B;iFAC6E;IAC7E,UAAU,EAAE,OAAO,CAAC;CACrB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,sBAAsB,EAAE,CAenG;AAYD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CA+B5F;AAMD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA0B1G;AAMD;;4DAE4D;AAC5D,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX;8CAC8C;AAC9C,wBAAgB,6BAA6B,IAAI,MAAM,EAAE,CAExD;AAED;;+DAE+D;AAC/D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAE7D;AAED,+FAA+F;AAC/F,YAAY,EAAE,kBAAkB,EAAE,CAAC"}
|