@abloatai/ablo 0.36.0 → 0.37.1

package/dist/transaction/transactionLayer.d.ts

@@ -1,82 +0,0 @@
-/**
- * The transaction layer's seam — the surface the sync engine (and any other
- * caller) sits on. ADR 0013's thesis as an interface: the layer defines,
- * orders, settles, and authorizes changes; it holds no materialised state.
- *
- * `observe()` is the whole seam in one method. The sync engine is `observe()`
- * piped into a materializer — deltas → local store → IndexedDB → reactive
- * re-render — plus local optimistic mutations reconciled against `commit()` /
- * `settled()`. Everything reactive is downstream of that method; the
- * transaction layer never calls up into it.
- *
- * `participant` stays the WHO (user | agent | system), never the name of this.
- * The taught verbs map onto the seam directly: `create`/`update`/`delete` are
- * operations inside a `commit()` payload; `claim` is `claim()`; `track` rides
- * the commit payload's `track` field (a durable premise is a zero-operation
- * commit). Presence (`join`) is deliberately absent: it is live observation
- * over a socket, and it joins the seam when its core carrier type exists —
- * see docs/plans/transaction-core-language.md, Tier 3.
- *
- * This is the contract, not a runtime: nothing in this package implements it
- * yet. The first explicit implementation (a headless client, a test harness)
- * gains a compile-time conformance pin against this interface.
- */
-import type { CommitMessage } from './wire/frames.js';
-import type { CommitReceiptWire } from './wire/commit.js';
-import type { Delta, HeldClaim, ClaimTarget, ClaimLeaseOptions } from './types/streams.js';
-import type { ModelData } from './types/modelData.js';
-import type { ModelScope } from './types/index.js';
-/**
- * A commit's durable acceptance — `{ status: 'queued' }` with the correlation
- * the settlement feed later confirms. The wire layer names this
- * {@link CommitReceiptWire}; the seam names it plainly.
- */
-export type CommitReceipt = CommitReceiptWire;
-/**
- * The seam's read grammar for {@link TransactionLayer.list} — filter, order,
- * and page through settled rows. Mirrors the taught list options
- * (`where` / `orderBy` / `limit` / `offset` / `state`) without binding the
- * seam to the client's local-read machinery.
- */
-export interface ListQuery {
-    /** Equality filter on field values. */
-    where?: ModelData;
-    /** Sort order, field → direction. */
-    orderBy?: Record<string, 'asc' | 'desc'>;
-    limit?: number;
-    offset?: number;
-    /** Lifecycle filter; defaults to `'live'`. */
-    state?: `${ModelScope}`;
-}
-/**
- * The transaction layer. Reads return settled state, point-in-time — never a
- * reactive subscription. A write is an intent submitted through `commit()`;
- * durable acceptance is the receipt (`queued`), and `settled()` resolves when
- * the sync log has appended it (`confirmed`).
- */
-export interface TransactionLayer {
-    /** Authentication: mint or renew the short-lived credential (`ek_`). */
-    ready(): Promise<void>;
-    /** Read one settled row by id, or `null` when absent. */
-    get(model: string, id: string): Promise<ModelData | null>;
-    /** Read settled rows matching a {@link ListQuery}. */
-    list(model: string, query?: ListQuery): Promise<ModelData[]>;
-    /**
-     * Submit a batch of operations — with its idempotent `clientTxId`, its
-     * `reads` premise, and any durable `track` registrations — and receive
-     * durable acceptance.
-     */
-    commit(payload: CommitMessage['payload']): Promise<CommitReceipt>;
-    /** Resolve when the receipt's operations have appended to the sync log. */
-    settled(receipt: CommitReceipt): Promise<void>;
-    /**
-     * Take a FIFO lease with a fence token on a target; release through the
-     * handle (`await using` disposes it).
-     */
-    claim(target: ClaimTarget, options?: ClaimLeaseOptions): Promise<HeldClaim>;
-    /**
-     * The authoritative change feed, scoped to one or more sync groups —
-     * omitted, everything the credential can see.
-     */
-    observe(scope?: string | readonly string[]): AsyncIterable<Delta>;
-}

package/dist/transaction/transactionLayer.js

@@ -1,24 +0,0 @@
-/**
- * The transaction layer's seam — the surface the sync engine (and any other
- * caller) sits on. ADR 0013's thesis as an interface: the layer defines,
- * orders, settles, and authorizes changes; it holds no materialised state.
- *
- * `observe()` is the whole seam in one method. The sync engine is `observe()`
- * piped into a materializer — deltas → local store → IndexedDB → reactive
- * re-render — plus local optimistic mutations reconciled against `commit()` /
- * `settled()`. Everything reactive is downstream of that method; the
- * transaction layer never calls up into it.
- *
- * `participant` stays the WHO (user | agent | system), never the name of this.
- * The taught verbs map onto the seam directly: `create`/`update`/`delete` are
- * operations inside a `commit()` payload; `claim` is `claim()`; `track` rides
- * the commit payload's `track` field (a durable premise is a zero-operation
- * commit). Presence (`join`) is deliberately absent: it is live observation
- * over a socket, and it joins the seam when its core carrier type exists —
- * see docs/plans/transaction-core-language.md, Tier 3.
- *
- * This is the contract, not a runtime: nothing in this package implements it
- * yet. The first explicit implementation (a headless client, a test harness)
- * gains a compile-time conformance pin against this interface.
- */
-export {};

package/dist/transaction/transactions/settlement/commitEnvelope.d.ts

@@ -1,143 +0,0 @@
-/**
- * Runtime contracts for retry-safe commits.
- *
- * `commitEnvelopeMemberSchema` is the compact pointer stored on an in-memory
- * transaction. `durableCommitEnvelopeSchema` is the actual outbox record: one
- * atomic IndexedDB value containing the stable request key, exact ordered wire
- * operations, and the source mutations it supersedes.
- */
-import { z } from 'zod';
-export declare const COMMIT_ENVELOPE_VERSION: 1;
-export declare const COMMIT_ENVELOPE_RECORD_PREFIX = "commit-envelope:";
-/** One transaction's position in a commit; this is not the envelope itself. */
-export declare const commitEnvelopeMemberSchema: z.ZodObject<{
-    idempotencyKey: z.core.$ZodBranded<z.ZodString, "IdempotencyKey", "out">;
-    operationIndex: z.ZodNumber;
-    operationCount: z.ZodNumber;
-    sealedAt: z.ZodOptional<z.ZodNumber>;
-    sequence: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>;
-export type CommitEnvelopeMember = z.infer<typeof commitEnvelopeMemberSchema>;
-/** One operation stored exactly as the current commit transport sends it. */
-export declare const durableCommitOperationSchema: z.ZodObject<{
-    type: z.ZodEnum<{
-        CREATE: "CREATE";
-        UPDATE: "UPDATE";
-        DELETE: "DELETE";
-        ARCHIVE: "ARCHIVE";
-        UNARCHIVE: "UNARCHIVE";
-    }>;
-    readAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-    onStale: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
-        reject: "reject";
-        overwrite: "overwrite";
-        notify: "notify";
-    }>>>;
-    fenceToken: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-    model: z.ZodString;
-    id: z.ZodString;
-    input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    transactionId: z.ZodOptional<z.ZodString>;
-    options: z.ZodOptional<z.ZodObject<{
-        idempotencyKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        label: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-}, z.core.$strip>;
-export type DurableCommitOperation = z.infer<typeof durableCommitOperationSchema>;
-export type DurableCommitOperationInput = z.input<typeof durableCommitOperationSchema>;
-export declare const commitOutboxScopeSchema: z.ZodObject<{
-    organizationId: z.ZodString;
-    participantId: z.ZodString;
-    namespace: z.ZodString;
-}, z.core.$strict>;
-export type CommitOutboxScope = z.infer<typeof commitOutboxScopeSchema>;
-/**
- * One crash-durable logical commit. Keeping every operation in one record makes
- * membership and order atomic: recovery can observe the old record or the new
- * record, never half an envelope.
- */
-export declare const durableCommitEnvelopeSchema: z.ZodObject<{
-    id: z.ZodString;
-    type: z.ZodLiteral<"commit_envelope">;
-    storageVersion: z.ZodLiteral<1>;
-    origin: z.ZodEnum<{
-        model_batch: "model_batch";
-        atomic_commit: "atomic_commit";
-    }>;
-    idempotencyKey: z.core.$ZodBranded<z.ZodString, "IdempotencyKey", "out">;
-    operations: z.ZodArray<z.ZodObject<{
-        type: z.ZodEnum<{
-            CREATE: "CREATE";
-            UPDATE: "UPDATE";
-            DELETE: "DELETE";
-            ARCHIVE: "ARCHIVE";
-            UNARCHIVE: "UNARCHIVE";
-        }>;
-        readAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-        onStale: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
-            reject: "reject";
-            overwrite: "overwrite";
-            notify: "notify";
-        }>>>;
-        fenceToken: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-        model: z.ZodString;
-        id: z.ZodString;
-        input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        transactionId: z.ZodOptional<z.ZodString>;
-        options: z.ZodOptional<z.ZodObject<{
-            idempotencyKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            label: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-    }, z.core.$strip>>;
-    sourceMutationIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    commitOptions: z.ZodDefault<z.ZodObject<{
-        reads: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-            model: z.ZodString;
-            id: z.ZodString;
-            readAt: z.ZodNumber;
-            fields: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
-            onStale: z.ZodOptional<z.ZodEnum<{
-                reject: "reject";
-                overwrite: "overwrite";
-                notify: "notify";
-            }>>;
-        }, z.core.$strip>, z.ZodObject<{
-            group: z.ZodString;
-            readAt: z.ZodNumber;
-            onStale: z.ZodOptional<z.ZodEnum<{
-                reject: "reject";
-                overwrite: "overwrite";
-                notify: "notify";
-            }>>;
-        }, z.core.$strip>]>>>>;
-        track: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-            id: z.ZodString;
-            model: z.ZodString;
-            readAt: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strip>, z.ZodObject<{
-            group: z.ZodString;
-            readAt: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strip>]>>>>;
-    }, z.core.$strict>>;
-    scope: z.ZodOptional<z.ZodObject<{
-        organizationId: z.ZodString;
-        participantId: z.ZodString;
-        namespace: z.ZodString;
-    }, z.core.$strict>>;
-    createdAt: z.ZodNumber;
-    sealedAt: z.ZodNumber;
-    acceptedAt: z.ZodOptional<z.ZodNumber>;
-    correlationId: z.ZodOptional<z.ZodString>;
-    sequence: z.ZodOptional<z.ZodNumber>;
-    timestamp: z.ZodNumber;
-}, z.core.$strict>;
-export type DurableCommitEnvelope = z.infer<typeof durableCommitEnvelopeSchema>;
-export declare function commitEnvelopeRecordId(idempotencyKey: string): string;
-/** Constructs validated member metadata when an in-memory batch is formed. */
-export declare function createCommitEnvelopeMember(value: z.input<typeof commitEnvelopeMemberSchema>): CommitEnvelopeMember;
-/**
- * Freezes the exact JSON request that will be persisted and sent. The shared
- * snapshot contract makes framework proxies plain and rejects values that
- * would be lost or corrupted by JSON serialization.
- */
-export declare function createDurableCommitEnvelope(value: Omit<z.input<typeof durableCommitEnvelopeSchema>, 'id' | 'type' | 'storageVersion' | 'timestamp'>): DurableCommitEnvelope;

package/dist/transaction/transactions/settlement/commitEnvelope.js

@@ -1,161 +0,0 @@
-/**
- * Runtime contracts for retry-safe commits.
- *
- * `commitEnvelopeMemberSchema` is the compact pointer stored on an in-memory
- * transaction. `durableCommitEnvelopeSchema` is the actual outbox record: one
- * atomic IndexedDB value containing the stable request key, exact ordered wire
- * operations, and the source mutations it supersedes.
- */
-import { z } from 'zod';
-import { readDependencySchema, trackDependencySchema } from '../../coordination/schema.js';
-import { wireCommitOperationSchema } from '../../wire/frames.js';
-import { correlationIdSchema } from '../../wire/commit.js';
-import { idempotencyKeySchema } from './idempotencyKey.js';
-import { snapshotJsonValue } from '../../utils/json.js';
-export const COMMIT_ENVELOPE_VERSION = 1;
-export const COMMIT_ENVELOPE_RECORD_PREFIX = 'commit-envelope:';
-/** One transaction's position in a commit; this is not the envelope itself. */
-export const commitEnvelopeMemberSchema = z
-    .strictObject({
-    idempotencyKey: idempotencyKeySchema,
-    operationIndex: z.number().int().nonnegative(),
-    operationCount: z.number().int().positive(),
-    sealedAt: z.number().int().nonnegative().optional(),
-    sequence: z.number().int().nonnegative().optional(),
-})
-    .refine(({ operationIndex, operationCount }) => operationIndex < operationCount, { message: 'operationIndex must be smaller than operationCount' });
-/** One operation stored exactly as the current commit transport sends it. */
-export const durableCommitOperationSchema = wireCommitOperationSchema
-    .pick({
-    type: true,
-    model: true,
-    id: true,
-    input: true,
-    transactionId: true,
-    readAt: true,
-    onStale: true,
-    fenceToken: true,
-})
-    .extend({
-    model: z.string().min(1),
-    id: z.string().min(1),
-    input: z.record(z.string(), z.unknown()).optional(),
-    transactionId: z.string().min(1).optional(),
-    options: z
-        .strictObject({
-        idempotencyKey: z.string().min(1).max(255).nullable().optional(),
-        label: z.string().min(1).max(255).optional(),
-    })
-        .optional(),
-});
-const durableCommitOptionsSchema = z.strictObject({
-    reads: z.array(readDependencySchema).nullable().optional(),
-    track: z.array(trackDependencySchema).nullable().optional(),
-});
-export const commitOutboxScopeSchema = z.strictObject({
-    organizationId: z.string().min(1),
-    participantId: z.string().min(1),
-    namespace: z.string().min(1),
-});
-/**
- * One crash-durable logical commit. Keeping every operation in one record makes
- * membership and order atomic: recovery can observe the old record or the new
- * record, never half an envelope.
- */
-export const durableCommitEnvelopeSchema = z
-    .strictObject({
-    id: z.string().startsWith(COMMIT_ENVELOPE_RECORD_PREFIX),
-    type: z.literal('commit_envelope'),
-    storageVersion: z.literal(COMMIT_ENVELOPE_VERSION),
-    origin: z.enum(['model_batch', 'atomic_commit']),
-    idempotencyKey: idempotencyKeySchema,
-    operations: z.array(durableCommitOperationSchema).min(1).max(500),
-    // Bookkeeping cardinality is independent of the 500 wire-operation cap:
-    // hundreds of same-row offline patches may coalesce into one operation.
-    sourceMutationIds: z.array(z.string().min(1)).default([]),
-    commitOptions: durableCommitOptionsSchema.default({}),
-    scope: commitOutboxScopeSchema.optional(),
-    createdAt: z.number().int().nonnegative(),
-    sealedAt: z.number().int().nonnegative(),
-    /**
-     * Monotonic evidence that a connected source accepted this exact request.
-     * Its server and customer idempotency keys are permanent, so an accepted
-     * envelope remains replayable until the WAL echo confirms it.
-     */
-    acceptedAt: z.number().int().nonnegative().optional(),
-    /** Opaque server-derived source-batch identity paired with `acceptedAt`. */
-    correlationId: correlationIdSchema.optional(),
-    /** Monotonic within one client; disambiguates writes sealed in the same ms. */
-    sequence: z.number().int().nonnegative().optional(),
-    timestamp: z.number().int().nonnegative(),
-})
-    .superRefine((envelope, context) => {
-    if (envelope.id !== commitEnvelopeRecordId(envelope.idempotencyKey)) {
-        context.addIssue({
-            code: 'custom',
-            path: ['id'],
-            message: 'Envelope record id must be derived from its idempotency key',
-        });
-    }
-    if (new Set(envelope.sourceMutationIds).size !== envelope.sourceMutationIds.length) {
-        context.addIssue({
-            code: 'custom',
-            path: ['sourceMutationIds'],
-            message: 'Source mutation ids must be unique',
-        });
-    }
-    if ((envelope.acceptedAt === undefined) !== (envelope.correlationId === undefined)) {
-        context.addIssue({
-            code: 'custom',
-            path: ['acceptedAt'],
-            message: 'Accepted commit envelopes require both acceptedAt and correlationId',
-        });
-    }
-    if (envelope.acceptedAt !== undefined &&
-        envelope.acceptedAt < envelope.sealedAt) {
-        context.addIssue({
-            code: 'custom',
-            path: ['acceptedAt'],
-            message: 'Commit envelope cannot be accepted before it is sealed',
-        });
-    }
-    if (envelope.origin === 'model_batch') {
-        const transactionIds = envelope.operations.map((operation) => operation.transactionId);
-        if (transactionIds.some((id) => typeof id !== 'string' || id.length === 0)) {
-            context.addIssue({
-                code: 'custom',
-                path: ['operations'],
-                message: 'Every model-batch operation must carry a transactionId',
-            });
-        }
-        else if (new Set(transactionIds).size !== transactionIds.length) {
-            context.addIssue({
-                code: 'custom',
-                path: ['operations'],
-                message: 'Model-batch transactionIds must be unique',
-            });
-        }
-    }
-});
-export function commitEnvelopeRecordId(idempotencyKey) {
-    return `${COMMIT_ENVELOPE_RECORD_PREFIX}${idempotencyKey}`;
-}
-/** Constructs validated member metadata when an in-memory batch is formed. */
-export function createCommitEnvelopeMember(value) {
-    return commitEnvelopeMemberSchema.parse(value);
-}
-/**
- * Freezes the exact JSON request that will be persisted and sent. The shared
- * snapshot contract makes framework proxies plain and rejects values that
- * would be lost or corrupted by JSON serialization.
- */
-export function createDurableCommitEnvelope(value) {
-    const candidate = {
-        ...value,
-        id: commitEnvelopeRecordId(value.idempotencyKey),
-        type: 'commit_envelope',
-        storageVersion: COMMIT_ENVELOPE_VERSION,
-        timestamp: value.sealedAt,
-    };
-    return durableCommitEnvelopeSchema.parse(snapshotJsonValue(candidate, '$.commitEnvelope'));
-}

package/dist/transaction/transactions/settlement/httpCommitEnvelope.d.ts

@@ -1,53 +0,0 @@
-/** Crash-durable exact HTTP request used by the stateless agent client. */
-import { z } from 'zod';
-export declare const HTTP_COMMIT_ENVELOPE_VERSION: 1;
-export declare const HTTP_COMMIT_ENVELOPE_PREFIX = "http-commit-envelope:";
-/** Stay one hour inside the server's 24-hour idempotency retention window. */
-export declare const HTTP_COMMIT_REPLAY_WINDOW_MS: number;
-/** Snapshot the JSON contract once, then make object-key order canonical. */
-export declare function canonicalHttpCommitBody(value: unknown): string;
-export declare const durableHttpCommitEnvelopeSchema: z.ZodObject<{
-    id: z.ZodString;
-    type: z.ZodLiteral<"http_commit_envelope">;
-    storageVersion: z.ZodLiteral<1>;
-    idempotencyKey: z.core.$ZodBranded<z.ZodString, "IdempotencyKey", "out">;
-    protocolVersion: z.ZodDefault<z.ZodNumber>;
-    request: z.ZodObject<{
-        method: z.ZodEnum<{
-            DELETE: "DELETE";
-            POST: "POST";
-            PATCH: "PATCH";
-        }>;
-        path: z.ZodString;
-        body: z.ZodString;
-    }, z.core.$strict>;
-    scopeNamespace: z.ZodString;
-    createdAt: z.ZodNumber;
-    sealedAt: z.ZodNumber;
-    acceptedAt: z.ZodOptional<z.ZodNumber>;
-    correlationId: z.ZodOptional<z.ZodString>;
-    sequence: z.ZodOptional<z.ZodNumber>;
-    timestamp: z.ZodNumber;
-}, z.core.$strict>;
-export type DurableHttpCommitEnvelope = z.infer<typeof durableHttpCommitEnvelopeSchema>;
-/**
- * The HTTP verbs a durable commit envelope can carry, projected out of the
- * persisted schema above. Callers that build, seal, or dispatch an envelope
- * take this rather than restating the verbs: the envelope is a stored contract,
- * so a verb the schema does not accept must not be constructible.
- */
-export type DurableHttpCommitMethod = DurableHttpCommitEnvelope['request']['method'];
-export declare function httpCommitEnvelopeRecordId(idempotencyKey: string, scopeNamespace?: string): string;
-export declare function createDurableHttpCommitEnvelope(input: {
-    idempotencyKey: string;
-    request: {
-        method: DurableHttpCommitMethod;
-        path: string;
-        body: unknown;
-    };
-    scopeNamespace: string;
-    createdAt?: number;
-    sealedAt?: number;
-    sequence?: number;
-}): DurableHttpCommitEnvelope;
-export declare function isHttpCommitReplayExpired(envelope: Pick<DurableHttpCommitEnvelope, 'sealedAt' | 'acceptedAt'>, now?: number): boolean;

package/dist/transaction/transactions/settlement/httpCommitEnvelope.js

@@ -1,207 +0,0 @@
-/** Crash-durable exact HTTP request used by the stateless agent client. */
-import { z } from 'zod';
-import { v5 as uuidv5 } from 'uuid';
-import { snapshotJsonValue, stableStringify } from '../../utils/json.js';
-import { correlationIdSchema } from '../../wire/commit.js';
-import { PROTOCOL_VERSION } from '../../wire/protocolVersion.js';
-import { idempotencyKeySchema } from './idempotencyKey.js';
-export const HTTP_COMMIT_ENVELOPE_VERSION = 1;
-export const HTTP_COMMIT_ENVELOPE_PREFIX = 'http-commit-envelope:';
-/** Stay one hour inside the server's 24-hour idempotency retention window. */
-export const HTTP_COMMIT_REPLAY_WINDOW_MS = 23 * 60 * 60 * 1000;
-const HTTP_COMMIT_SCOPE_ID_NAMESPACE = '043e8f73-86fc-5f62-af46-935d68fca729';
-const commitPathSchema = z.literal('/v1/commits');
-const modelCollectionPathSchema = z.string().regex(/^\/v1\/models\/[^/]+$/);
-const modelEntityPathSchema = z.string().regex(/^\/v1\/models\/[^/]+\/[^/]+$/);
-function hasSafeModelPathSegments(path) {
-    if (!path.startsWith('/v1/models/'))
-        return true;
-    try {
-        return path
-            .slice('/v1/models/'.length)
-            .split('/')
-            .every((segment) => {
-            const decoded = decodeURIComponent(segment);
-            return (decoded.length > 0 &&
-                decoded !== '.' &&
-                decoded !== '..' &&
-                !decoded.includes('/') &&
-                !decoded.includes('\\'));
-        });
-    }
-    catch {
-        return false;
-    }
-}
-/** Snapshot the JSON contract once, then make object-key order canonical. */
-export function canonicalHttpCommitBody(value) {
-    return stableStringify(snapshotJsonValue(value, '$.body'));
-}
-export const durableHttpCommitEnvelopeSchema = z
-    .strictObject({
-    id: z.string().startsWith(HTTP_COMMIT_ENVELOPE_PREFIX),
-    type: z.literal('http_commit_envelope'),
-    storageVersion: z.literal(HTTP_COMMIT_ENVELOPE_VERSION),
-    idempotencyKey: idempotencyKeySchema,
-    /**
-     * The wire contract used when this exact request was sealed. Entries from
-     * before protocol versioning omitted the field and are v1 by definition.
-     */
-    protocolVersion: z.number().int().positive().default(1),
-    request: z.strictObject({
-        method: z.enum(['POST', 'PATCH', 'DELETE']),
-        path: z.string().startsWith('/'),
-        body: z.string().refine((body) => {
-            try {
-                JSON.parse(body);
-                return true;
-            }
-            catch {
-                return false;
-            }
-        }, 'HTTP commit body must be valid JSON'),
-    }),
-    scopeNamespace: z.string().min(1),
-    createdAt: z.number().int().nonnegative(),
-    sealedAt: z.number().int().nonnegative(),
-    /**
-     * Monotonic evidence that the server accepted this exact request for a
-     * connected source. Such server keys are permanent, so this envelope must
-     * remain replayable past the ordinary hosted 24-hour window until its WAL
-     * echo confirms.
-     */
-    acceptedAt: z.number().int().nonnegative().optional(),
-    /** Opaque server-derived source-batch identity paired with `acceptedAt`. */
-    correlationId: correlationIdSchema.optional(),
-    /** Monotonic within one client; disambiguates writes sealed in the same ms. */
-    sequence: z.number().int().nonnegative().optional(),
-    timestamp: z.number().int().nonnegative(),
-})
-    .superRefine((envelope, context) => {
-    const legacyId = httpCommitEnvelopeRecordId(envelope.idempotencyKey);
-    const scopedId = httpCommitEnvelopeRecordId(envelope.idempotencyKey, envelope.scopeNamespace);
-    if (envelope.id !== legacyId && envelope.id !== scopedId) {
-        context.addIssue({
-            code: 'custom',
-            path: ['id'],
-            message: 'HTTP envelope id must be derived from its idempotency key',
-        });
-    }
-    if (envelope.sealedAt < envelope.createdAt) {
-        context.addIssue({
-            code: 'custom',
-            path: ['sealedAt'],
-            message: 'HTTP envelope cannot be sealed before it is created',
-        });
-    }
-    if ((envelope.acceptedAt === undefined) !== (envelope.correlationId === undefined)) {
-        context.addIssue({
-            code: 'custom',
-            path: ['acceptedAt'],
-            message: 'Accepted HTTP envelopes require both acceptedAt and correlationId',
-        });
-    }
-    if (envelope.acceptedAt !== undefined &&
-        envelope.acceptedAt < envelope.sealedAt) {
-        context.addIssue({
-            code: 'custom',
-            path: ['acceptedAt'],
-            message: 'HTTP envelope cannot be accepted before it is sealed',
-        });
-    }
-    const { method, path } = envelope.request;
-    const allowedPath = method === 'POST'
-        ? commitPathSchema.safeParse(path).success ||
-            modelCollectionPathSchema.safeParse(path).success
-        : modelEntityPathSchema.safeParse(path).success;
-    if (!allowedPath || !hasSafeModelPathSegments(path)) {
-        context.addIssue({
-            code: 'custom',
-            path: ['request', 'path'],
-            message: 'HTTP outbox records may target only commit or model-mutation routes',
-        });
-        return;
-    }
-    let body;
-    try {
-        body = JSON.parse(envelope.request.body);
-    }
-    catch {
-        return; // The field-level JSON refinement reports this.
-    }
-    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
-        context.addIssue({
-            code: 'custom',
-            path: ['request', 'body'],
-            message: 'HTTP commit body must be a JSON object',
-        });
-        return;
-    }
-    const record = body;
-    // `envelope.idempotencyKey` is replayed as the `Idempotency-Key` header.
-    // Older sealed bodies may also carry `idempotencyKey`/`clientTxId`; accept
-    // and replay them byte-for-byte, but current requests do not duplicate the
-    // key in JSON.
-    if (path === '/v1/commits') {
-        if (!Array.isArray(record.operations) || record.operations.length === 0) {
-            context.addIssue({
-                code: 'custom',
-                path: ['request', 'body'],
-                message: 'Commit-route body must carry operations',
-            });
-        }
-    }
-    else if (method === 'POST' && typeof record.id !== 'string') {
-        context.addIssue({
-            code: 'custom',
-            path: ['request', 'body', 'id'],
-            message: 'Model-create body must carry its entity id',
-        });
-    }
-    else if (method === 'PATCH' &&
-        (typeof record.data !== 'object' || record.data === null || Array.isArray(record.data))) {
-        context.addIssue({
-            code: 'custom',
-            path: ['request', 'body', 'data'],
-            message: 'Model-update body must carry a JSON object patch',
-        });
-    }
-});
-export function httpCommitEnvelopeRecordId(idempotencyKey, scopeNamespace) {
-    if (!scopeNamespace) {
-        return `${HTTP_COMMIT_ENVELOPE_PREFIX}${idempotencyKey}`;
-    }
-    const scopeId = uuidv5(scopeNamespace, HTTP_COMMIT_SCOPE_ID_NAMESPACE);
-    return `${HTTP_COMMIT_ENVELOPE_PREFIX}${scopeId}:${idempotencyKey}`;
-}
-export function createDurableHttpCommitEnvelope(input) {
-    const now = Date.now();
-    const createdAt = input.createdAt ?? now;
-    const sealedAt = input.sealedAt ?? now;
-    const body = canonicalHttpCommitBody(input.request.body);
-    return durableHttpCommitEnvelopeSchema.parse({
-        id: httpCommitEnvelopeRecordId(input.idempotencyKey, input.scopeNamespace),
-        type: 'http_commit_envelope',
-        storageVersion: HTTP_COMMIT_ENVELOPE_VERSION,
-        idempotencyKey: input.idempotencyKey,
-        protocolVersion: PROTOCOL_VERSION,
-        request: {
-            method: input.request.method,
-            path: input.request.path,
-            body,
-        },
-        scopeNamespace: input.scopeNamespace,
-        createdAt,
-        sealedAt,
-        ...(input.sequence !== undefined ? { sequence: input.sequence } : {}),
-        timestamp: sealedAt,
-    });
-}
-export function isHttpCommitReplayExpired(envelope, now = Date.now()) {
-    // Connected-source mutation-log and customer idempotency keys are
-    // permanent. Once acceptance is durable, age can no longer make replay
-    // ambiguous; only the matching WAL echo may settle the envelope.
-    if (envelope.acceptedAt !== undefined)
-        return false;
-    return now - envelope.sealedAt >= HTTP_COMMIT_REPLAY_WINDOW_MS;
-}