@agimon-ai/doompi-session 0.0.1-alpha.2 → 0.0.1-alpha.21

package/dist/sessionDelivery-DNq4a8LB.mjs

@@ -0,0 +1,799 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { DatabaseSync } from "node:sqlite";
+//#region src/services/peerTransport/index.ts
+const PEER_CONFIG_VERSION = 1;
+const PEER_CONFIG_FILE = "peers.json";
+const PEER_ROUTE = "/api/plugins/session-peer/inbox";
+const PEER_HEADER = "x-doompi-session-peer";
+const TIMESTAMP_HEADER = "x-doompi-session-timestamp";
+const SIGNATURE_HEADER = "x-doompi-session-signature";
+const MAX_CLOCK_SKEW_MS = 3e5;
+const MAX_REPLAY_ENTRIES = 1e4;
+const REPLAY_DATABASE_FILE = "peer-replay.sqlite";
+function validId(value) {
+	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value);
+}
+function peerOf(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	if (!validId(record.hostId) || typeof record.url !== "string" || typeof record.secret !== "string") return void 0;
+	let url;
+	try {
+		url = new URL(record.url);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return void 0;
+	const allowedSessionIds = Array.isArray(record.allowedSessionIds) && record.allowedSessionIds.every(validId) ? record.allowedSessionIds : void 0;
+	const allowedVoiceSessionIds = Array.isArray(record.allowedVoiceSessionIds) && record.allowedVoiceSessionIds.every(validId) ? record.allowedVoiceSessionIds : [];
+	if (allowedSessionIds === void 0 || record.secret.length < 32) return void 0;
+	return {
+		hostId: record.hostId,
+		url: url.toString(),
+		secret: record.secret,
+		allowedSessionIds,
+		allowedVoiceSessionIds
+	};
+}
+function sessionPeerConfigPath(homeDirectory) {
+	return path.join(homeDirectory, ".pi", ".doom", "session", PEER_CONFIG_FILE);
+}
+/** Reads operator-provisioned peers. Invalid or unreadable config fails closed. */
+function readSessionPeerConfig(homeDirectory) {
+	let parsed;
+	try {
+		const file = sessionPeerConfigPath(homeDirectory);
+		if ((fs.statSync(file).mode & 63) !== 0) return void 0;
+		parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const record = parsed;
+	if (record.version !== PEER_CONFIG_VERSION || !validId(record.hostId) || !Array.isArray(record.peers)) return void 0;
+	const peers = record.peers.map(peerOf);
+	if (peers.some((peer) => peer === void 0)) return void 0;
+	const resolved = peers;
+	if (new Set(resolved.map((peer) => peer.hostId)).size !== resolved.length || resolved.some((peer) => peer.hostId === record.hostId)) return void 0;
+	return {
+		version: PEER_CONFIG_VERSION,
+		hostId: record.hostId,
+		peers: resolved
+	};
+}
+/** `peer/<host-id>/<session-id>` is the only remote target spelling. */
+function parseRemoteSessionReference(value) {
+	const match = /^peer\/([^/]+)\/([^/]+)$/u.exec(value);
+	return match && validId(match[1]) && validId(match[2]) ? {
+		hostId: match[1],
+		sessionId: match[2]
+	} : void 0;
+}
+function peerSessionReference(hostId, sessionId) {
+	if (!validId(hostId) || !validId(sessionId)) throw new TypeError("Remote host and session identifiers must be safe opaque IDs.");
+	return `peer/${hostId}/${sessionId}`;
+}
+function signature(secret, method, pathname, timestamp, body) {
+	const digest = createHash("sha256").update(body).digest("base64url");
+	return createHmac("sha256", secret).update(`${method}\n${pathname}\n${timestamp}\n${digest}`).digest("base64url");
+}
+function peerRequestHeaders(sourceHostId, peer, method, pathname, body, now = Date.now()) {
+	if (!validId(sourceHostId)) throw new TypeError("Source host identity must be a safe opaque ID.");
+	const timestamp = String(now);
+	return new Headers({
+		"content-type": "application/json",
+		[PEER_HEADER]: sourceHostId,
+		[TIMESTAMP_HEADER]: timestamp,
+		[SIGNATURE_HEADER]: signature(peer.secret, method, pathname, timestamp, body)
+	});
+}
+/** Persists accepted peer signatures so a valid request cannot be replayed within its clock-skew window. */
+function createPeerReplayGuard(homeDirectory) {
+	const directory = path.dirname(sessionPeerConfigPath(homeDirectory));
+	fs.mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const database = new DatabaseSync(path.join(directory, REPLAY_DATABASE_FILE));
+	database.exec(`
+    PRAGMA journal_mode = WAL;
+    CREATE TABLE IF NOT EXISTS peer_request_replays (
+      signature TEXT PRIMARY KEY,
+      expires_at INTEGER NOT NULL
+    );
+  `);
+	const removeExpired = database.prepare("DELETE FROM peer_request_replays WHERE expires_at < ?");
+	const insert = database.prepare("INSERT OR IGNORE INTO peer_request_replays (signature, expires_at) VALUES (?, ?)");
+	const count = database.prepare("SELECT COUNT(*) AS count FROM peer_request_replays");
+	const trim = database.prepare(`
+    DELETE FROM peer_request_replays
+    WHERE signature IN (
+      SELECT signature FROM peer_request_replays ORDER BY expires_at ASC, signature ASC LIMIT ?
+    )
+  `);
+	return {
+		admit(request, now = Date.now()) {
+			const supplied = request.headers.get(SIGNATURE_HEADER);
+			if (!supplied) return false;
+			database.exec("BEGIN IMMEDIATE");
+			try {
+				removeExpired.run(now);
+				const accepted = insert.run(supplied, now + MAX_CLOCK_SKEW_MS).changes === 1;
+				const total = Number(count.get().count);
+				if (total > MAX_REPLAY_ENTRIES) trim.run(total - MAX_REPLAY_ENTRIES);
+				database.exec("COMMIT");
+				return accepted;
+			} catch (cause) {
+				database.exec("ROLLBACK");
+				throw cause;
+			}
+		},
+		close: () => database.close()
+	};
+}
+function verifyPeerRequest(config, request, body, now = Date.now()) {
+	const hostId = request.headers.get(PEER_HEADER);
+	const timestamp = request.headers.get(TIMESTAMP_HEADER);
+	const supplied = request.headers.get(SIGNATURE_HEADER);
+	if (!hostId || !timestamp || !supplied || !/^\d{1,16}$/u.test(timestamp)) return void 0;
+	const sentAt = Number(timestamp);
+	if (!Number.isSafeInteger(sentAt) || Math.abs(now - sentAt) > MAX_CLOCK_SKEW_MS) return void 0;
+	const peer = config.peers.find((candidate) => candidate.hostId === hostId);
+	if (!peer) return void 0;
+	const expected = Buffer.from(signature(peer.secret, request.method, new URL(request.url).pathname, timestamp, body));
+	const actual = Buffer.from(supplied);
+	return actual.byteLength === expected.byteLength && timingSafeEqual(actual, expected) ? peer : void 0;
+}
+function envelopeOf$1(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	return validId(record.sourceSessionId) && validId(record.targetSessionId) && typeof record.type === "string" && record.type !== "" ? {
+		sourceSessionId: record.sourceSessionId,
+		targetSessionId: record.targetSessionId,
+		type: record.type,
+		payload: record.payload
+	} : void 0;
+}
+function parseSessionPeerEnvelope(value) {
+	return envelopeOf$1(value);
+}
+/** Adds asynchronous tunnel publication to a host-bound local communication endpoint. */
+function createPeerCommunication(options) {
+	const config = readSessionPeerConfig(options.homeDirectory);
+	const send = options.fetch ?? fetch;
+	return {
+		sessionId: options.local.sessionId,
+		publish(target, type, payload) {
+			const remote = parseRemoteSessionReference(target);
+			if (!remote) return options.local.publish(target, type, payload);
+			const peer = config?.peers.find((candidate) => candidate.hostId === remote.hostId);
+			if (!config || !peer || !peer.allowedSessionIds.includes(remote.sessionId)) return false;
+			const body = JSON.stringify({
+				sourceSessionId: options.local.sessionId,
+				targetSessionId: remote.sessionId,
+				type,
+				payload
+			});
+			const url = new URL(PEER_ROUTE, peer.url);
+			send(url, {
+				method: "POST",
+				headers: peerRequestHeaders(config.hostId, peer, "POST", "/inbox", body),
+				body
+			}).catch(() => void 0);
+			return true;
+		},
+		subscribe: (type, listener) => options.local.subscribe(type, listener),
+		onPeerReady: (listener) => options.local.onPeerReady(listener),
+		close: () => options.local.close()
+	};
+}
+//#endregion
+//#region src/services/sessionDirectory/index.ts
+const UNKNOWN_FACTS = Object.freeze({
+	reachability: "unknown",
+	runtime: "unknown",
+	activity: "unknown",
+	voice: Object.freeze({
+		eligible: "unknown",
+		readiness: "unknown"
+	})
+});
+function keyOf(observation) {
+	return peerSessionReference(observation.hostId, observation.sessionId);
+}
+function publicEntry(observation, now, label, capabilities) {
+	const freshUntil = observation.observedAt + observation.staleAfterMs;
+	const fresh = now <= freshUntil;
+	const facts = fresh ? observation : UNKNOWN_FACTS;
+	return Object.freeze({
+		reference: keyOf(observation),
+		...label === void 0 ? {} : { label },
+		capabilities: Object.freeze([...capabilities]),
+		hostIncarnation: observation.hostIncarnation,
+		sessionIncarnation: observation.sessionIncarnation,
+		sequence: observation.sequence,
+		observedAt: observation.observedAt,
+		freshUntil,
+		fresh,
+		reachability: facts.reachability,
+		runtime: facts.runtime,
+		activity: facts.activity,
+		voice: Object.freeze({ ...facts.voice })
+	});
+}
+/** In-memory authenticated presence cache. Restart deliberately forgets every observation. */
+function createSessionDirectory(options) {
+	const now = options.now ?? Date.now;
+	const observations = /* @__PURE__ */ new Map();
+	const snapshotRequired = /* @__PURE__ */ new Set();
+	const subscribers = /* @__PURE__ */ new Set();
+	const discover = (callerReference, allowedReferences) => {
+		const result = [];
+		for (const observation of observations.values()) {
+			const reference = keyOf(observation);
+			if (allowedReferences && !allowedReferences.has(reference)) continue;
+			const grant = options.authorizeDiscovery(callerReference, observation);
+			if (!grant) continue;
+			result.push(publicEntry(observation, now(), grant.label ?? observation.label, grant.capabilities));
+		}
+		return result.sort((left, right) => left.reference.localeCompare(right.reference));
+	};
+	const notify = () => {
+		for (const subscriber of subscribers) subscriber.listener(discover(subscriber.callerReference));
+	};
+	return {
+		observe(observation) {
+			const key = keyOf(observation);
+			const current = observations.get(key);
+			if (snapshotRequired.has(observation.hostId)) return false;
+			if (current?.hostIncarnation === observation.hostIncarnation) {
+				if (current.sessionIncarnation === observation.sessionIncarnation && observation.sequence <= current.sequence) return false;
+				if (observation.sequence !== current.sequence + 1) {
+					snapshotRequired.add(observation.hostId);
+					for (const [reference, candidate] of observations) if (candidate.hostId === observation.hostId) observations.set(reference, {
+						...candidate,
+						...UNKNOWN_FACTS,
+						observedAt: now(),
+						staleAfterMs: 0
+					});
+					notify();
+					return false;
+				}
+			}
+			observations.set(key, Object.freeze({
+				...observation,
+				voice: Object.freeze({ ...observation.voice })
+			}));
+			notify();
+			return true;
+		},
+		replaceHostSnapshot(hostId, hostIncarnation, replacements) {
+			if (replacements.some((observation) => observation.hostId !== hostId || observation.hostIncarnation !== hostIncarnation)) throw new TypeError("A presence snapshot must contain only the declared host incarnation.");
+			for (const [reference, observation] of observations) if (observation.hostId === hostId) observations.delete(reference);
+			for (const observation of replacements) observations.set(keyOf(observation), Object.freeze({
+				...observation,
+				voice: Object.freeze({ ...observation.voice })
+			}));
+			snapshotRequired.delete(hostId);
+			notify();
+		},
+		hostDisconnected(hostId) {
+			for (const [reference, observation] of observations) {
+				if (observation.hostId !== hostId) continue;
+				observations.set(reference, {
+					...observation,
+					reachability: "unreachable"
+				});
+			}
+			notify();
+		},
+		discover,
+		resolveDeliveryTarget(callerReference, reference) {
+			const observation = observations.get(reference);
+			return observation && options.authorizeDiscovery(callerReference, observation) ? observation.deliveryTarget : void 0;
+		},
+		subscribe(callerReference, listener) {
+			const subscriber = {
+				callerReference,
+				listener
+			};
+			subscribers.add(subscriber);
+			listener(discover(callerReference));
+			return () => subscribers.delete(subscriber);
+		}
+	};
+}
+//#endregion
+//#region src/services/sessionGroups/type.ts
+var SessionGroupRevisionError = class extends Error {
+	constructor(groupId, expected, actual) {
+		super(`Session group '${groupId}' revision conflict: expected ${expected}, current ${actual}.`);
+		this.name = "SessionGroupRevisionError";
+	}
+};
+//#endregion
+//#region src/services/sessionGroups/index.ts
+const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const REFERENCE_PATTERN = /^peer\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+function validateGroupId(value) {
+	if (!ID_PATTERN.test(value)) throw new TypeError("Session group IDs must be safe opaque IDs.");
+}
+function validateReference(value) {
+	if (!REFERENCE_PATTERN.test(value)) throw new TypeError(`Session group member '${value}' is not a qualified reference.`);
+}
+/** Opens a revisioned SQLite registry for communication-only group membership. */
+function createSessionGroupStore(options) {
+	const database = new DatabaseSync(options.databasePath);
+	database.exec(`
+    PRAGMA journal_mode = WAL;
+    PRAGMA foreign_keys = ON;
+    CREATE TABLE IF NOT EXISTS session_groups (
+      group_id TEXT PRIMARY KEY,
+      owner_authority TEXT NOT NULL,
+      revision INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS session_group_members (
+      group_id TEXT NOT NULL REFERENCES session_groups(group_id) ON DELETE CASCADE,
+      member_reference TEXT NOT NULL,
+      PRIMARY KEY (group_id, member_reference)
+    );
+  `);
+	const read = (groupId) => {
+		const row = database.prepare("SELECT * FROM session_groups WHERE group_id = ?").get(groupId);
+		if (!row) return void 0;
+		const members = database.prepare("SELECT member_reference FROM session_group_members WHERE group_id = ? ORDER BY member_reference").all(groupId);
+		return Object.freeze({
+			id: row.group_id,
+			ownerAuthority: row.owner_authority,
+			revision: row.revision,
+			members: Object.freeze(members.map((member) => member.member_reference))
+		});
+	};
+	const enroll = (groupId, members) => {
+		const insert = database.prepare("INSERT OR IGNORE INTO session_group_members (group_id, member_reference) VALUES (?, ?)");
+		for (const member of new Set(members)) {
+			validateReference(member);
+			if (options.validateEnrollment?.(groupId, member) === false) throw new Error(`Session group enrollment policy rejected '${member}'.`);
+			insert.run(groupId, member);
+		}
+	};
+	return {
+		create(groupId, ownerAuthority, members) {
+			validateGroupId(groupId);
+			if (!ownerAuthority.trim()) throw new TypeError("Session group owner authority is required.");
+			database.exec("BEGIN IMMEDIATE");
+			try {
+				database.prepare("INSERT INTO session_groups (group_id, owner_authority, revision) VALUES (?, ?, 1)").run(groupId, ownerAuthority);
+				enroll(groupId, members);
+				database.exec("COMMIT");
+			} catch (cause) {
+				database.exec("ROLLBACK");
+				throw cause;
+			}
+			return read(groupId);
+		},
+		mutate(mutation) {
+			database.exec("BEGIN IMMEDIATE");
+			try {
+				const current = read(mutation.groupId);
+				if (!current) throw new Error(`Session group '${mutation.groupId}' does not exist.`);
+				if (mutation.authority !== current.ownerAuthority && options.authorizeManagement?.(mutation.authority, current) !== true) throw new Error(`Authority '${mutation.authority}' cannot manage Session group '${mutation.groupId}'.`);
+				if (mutation.expectedRevision !== current.revision) throw new SessionGroupRevisionError(mutation.groupId, mutation.expectedRevision, current.revision);
+				enroll(mutation.groupId, mutation.add ?? []);
+				const remove = database.prepare("DELETE FROM session_group_members WHERE group_id = ? AND member_reference = ?");
+				for (const member of new Set(mutation.remove ?? [])) {
+					validateReference(member);
+					remove.run(mutation.groupId, member);
+				}
+				database.prepare("UPDATE session_groups SET revision = revision + 1 WHERE group_id = ? AND revision = ?").run(mutation.groupId, current.revision);
+				database.exec("COMMIT");
+			} catch (cause) {
+				database.exec("ROLLBACK");
+				throw cause;
+			}
+			return read(mutation.groupId);
+		},
+		get: read,
+		groupsFor(memberReference) {
+			validateReference(memberReference);
+			return database.prepare(`SELECT g.group_id FROM session_groups g
+           INNER JOIN session_group_members m ON m.group_id = g.group_id
+           WHERE m.member_reference = ? ORDER BY g.group_id`).all(memberReference).map((row) => read(row.group_id));
+		},
+		canMessage(groupId, sourceReference, targetReference) {
+			validateReference(sourceReference);
+			validateReference(targetReference);
+			const row = database.prepare(`SELECT COUNT(*) AS count FROM session_group_members
+           WHERE group_id = ? AND member_reference IN (?, ?)`).get(groupId, sourceReference, targetReference);
+			return Number(row.count) === (sourceReference === targetReference ? 1 : 2);
+		},
+		close: () => database.close()
+	};
+}
+//#endregion
+//#region src/services/sessionIntercom/type.ts
+const DOOM_SESSION_INTERCOM_SERVICE = "doom/session-intercom";
+function readSessionIntercom(context) {
+	return context.get(DOOM_SESSION_INTERCOM_SERVICE);
+}
+function requireSessionIntercom(context) {
+	const service = readSessionIntercom(context);
+	if (!service) throw new Error("Session intercom is unavailable. Activate Session with a configured persistent host identity.");
+	return service;
+}
+//#endregion
+//#region src/services/sessionIntercom/index.ts
+const MESSAGE_KIND = "session-message";
+const REPORT_KIND = "session-report";
+function metadataFor(options, request, reportStatus) {
+	const group = options.groups.get(request.groupId);
+	if (!group || !options.groups.canMessage(request.groupId, options.selfReference, request.targetReference)) throw new Error(`Session group '${request.groupId}' does not authorize this message.`);
+	return {
+		sourceReference: options.selfReference,
+		targetReference: request.targetReference,
+		groupId: request.groupId,
+		groupRevision: String(group.revision),
+		...request.correlationId === void 0 ? {} : { correlationId: request.correlationId },
+		...reportStatus === void 0 ? {} : { reportStatus }
+	};
+}
+/** Agent-facing intercom operations. A composition may acquire this service without gaining session controls. */
+function createSessionIntercom(options) {
+	const deliver = async (request, kind, status) => {
+		const recipientKey = options.directory.resolveDeliveryTarget(options.selfReference, request.targetReference);
+		if (!recipientKey) throw new Error(`Session '${request.targetReference}' is not discoverable.`);
+		const metadata = metadataFor(options, request, status);
+		return options.delivery.deliver({
+			...request.deliveryId === void 0 ? {} : { deliveryId: request.deliveryId },
+			recipientKey,
+			kind,
+			prompt: `[Session ${status === void 0 ? "message" : `report: ${status}`} from ${options.selfReference}] ${request.text}`,
+			metadata
+		});
+	};
+	return Object.freeze({
+		discover() {
+			const members = new Set(options.groups.groupsFor(options.selfReference).flatMap((group) => group.members).filter((reference) => reference !== options.selfReference));
+			return options.directory.discover(options.selfReference, members);
+		},
+		send: (request) => deliver(request, MESSAGE_KIND),
+		report: (request) => deliver(request, REPORT_KIND, request.status),
+		messages() {
+			return options.delivery.inbox().filter((entry) => entry.kind === MESSAGE_KIND || entry.kind === REPORT_KIND).filter((entry) => {
+				const groupId = entry.metadata.groupId;
+				return groupId !== void 0 && options.groups.get(groupId)?.members.includes(options.selfReference) === true;
+			}).flatMap((entry) => {
+				const sourceReference = entry.metadata.sourceReference;
+				const targetReference = entry.metadata.targetReference;
+				const groupId = entry.metadata.groupId;
+				if (!sourceReference || !targetReference || !groupId) return [];
+				const reportStatus = entry.metadata.reportStatus;
+				return [{
+					deliveryId: entry.deliveryId,
+					sourceReference,
+					targetReference,
+					groupId,
+					...entry.metadata.correlationId === void 0 ? {} : { correlationId: entry.metadata.correlationId },
+					text: entry.prompt,
+					...reportStatus === "done" || reportStatus === "blocked" || reportStatus === "failed" ? { reportStatus } : {},
+					state: entry.state,
+					consumed: entry.consumed
+				}];
+			});
+		},
+		delivery(deliveryId) {
+			const entry = options.delivery.outbox(deliveryId);
+			const groupId = entry?.metadata.groupId;
+			return entry && groupId !== void 0 && options.groups.get(groupId)?.members.includes(options.selfReference) === true ? entry : void 0;
+		}
+	});
+}
+/** Builds the dynamic delivery check used before every send, retry, and recipient acceptance. */
+function createSessionGroupDeliveryAuthorizer(options) {
+	return (peerKey, metadata) => {
+		const sourceReference = metadata?.sourceReference;
+		const targetReference = metadata?.targetReference;
+		const groupId = metadata?.groupId;
+		if (sourceReference && targetReference && groupId) {
+			const peerReference = options.peerReference(peerKey);
+			if (!peerReference) return false;
+			return (sourceReference === options.selfReference && targetReference === peerReference || targetReference === options.selfReference && sourceReference === peerReference) && options.groups.canMessage(groupId, sourceReference, targetReference);
+		}
+		return options.fallback?.(peerKey, metadata) === true;
+	};
+}
+//#endregion
+//#region src/services/sessionDelivery/type.ts
+const DOOM_SESSION_DELIVERY_SERVICE = "doom/session-delivery";
+/** Reads the currently active provider each time, without retaining a stale binding. */
+function readDoomSessionDelivery(context) {
+	return context.get(DOOM_SESSION_DELIVERY_SERVICE);
+}
+//#endregion
+//#region src/services/sessionDelivery/index.ts
+const DELIVERY_EVENT = "doom/session-delivery/envelope";
+const ACK_EVENT = "doom/session-delivery/ack";
+const DEFAULT_DELIVERY = "prompt";
+const INBOX_STATES = /* @__PURE__ */ new Set([
+	"accepted",
+	"admitting",
+	"admitted",
+	"recovery_required"
+]);
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMode(value) {
+	return value === "prompt" || value === "steer" || value === "followUp";
+}
+function metadataOf(value) {
+	if (!isRecord(value)) return void 0;
+	const metadata = {};
+	for (const [key, item] of Object.entries(value)) {
+		if (typeof item !== "string") return void 0;
+		metadata[key] = item;
+	}
+	return metadata;
+}
+function envelopeOf(value) {
+	if (!isRecord(value)) return void 0;
+	const metadata = metadataOf(value.metadata);
+	if (typeof value.deliveryId !== "string" || !value.deliveryId || typeof value.kind !== "string" || !value.kind || typeof value.prompt !== "string" || !isMode(value.delivery) || metadata === void 0) return;
+	return {
+		deliveryId: value.deliveryId,
+		kind: value.kind,
+		prompt: value.prompt,
+		delivery: value.delivery,
+		metadata
+	};
+}
+function ackOf(value) {
+	if (!isRecord(value)) return void 0;
+	if (typeof value.deliveryId !== "string" || typeof value.state !== "string" || !INBOX_STATES.has(value.state)) return;
+	return value;
+}
+function normalizedMetadata(metadata) {
+	const normalized = {};
+	for (const [key, value] of Object.entries(metadata ?? {})) if (value !== void 0) normalized[key] = value;
+	return normalized;
+}
+function matchesMetadata(entry, query) {
+	return Object.entries(query ?? {}).every(([key, value]) => value === void 0 || entry[key] === value);
+}
+function sameMetadata(left, right) {
+	return matchesMetadata(left, right) && matchesMetadata(right, left);
+}
+/** Opens and starts one durable delivery endpoint. */
+function createSessionDeliveryService(options) {
+	if (!options.recipientKey.trim() || options.recipientKey !== options.recipientKey.trim()) throw new TypeError("Session delivery requires a trimmed, non-empty recipient key.");
+	const database = new DatabaseSync(options.databasePath);
+	database.exec(`
+    PRAGMA journal_mode = WAL;
+    CREATE TABLE IF NOT EXISTS session_delivery_outbox (
+      delivery_id TEXT PRIMARY KEY,
+      recipient_key TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      prompt TEXT NOT NULL,
+      delivery_mode TEXT NOT NULL,
+      metadata_json TEXT NOT NULL,
+      state TEXT NOT NULL,
+      recipient_state TEXT,
+      created_at INTEGER NOT NULL,
+      acknowledged_at INTEGER
+    );
+    CREATE TABLE IF NOT EXISTS session_delivery_inbox (
+      delivery_id TEXT PRIMARY KEY,
+      sender_key TEXT NOT NULL,
+      recipient_key TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      prompt TEXT NOT NULL,
+      delivery_mode TEXT NOT NULL,
+      metadata_json TEXT NOT NULL,
+      state TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      consumed_at INTEGER
+    );
+  `);
+	database.prepare("UPDATE session_delivery_inbox SET state = 'recovery_required', updated_at = ? WHERE state = 'admitting'").run(Date.now());
+	let closed = false;
+	const scheduled = /* @__PURE__ */ new Set();
+	let admissionQueue = Promise.resolve();
+	const publishAck = (deliveryId, senderKey, state) => {
+		options.communication.publish(senderKey, ACK_EVENT, {
+			deliveryId,
+			state
+		});
+	};
+	const readInboxRow = (deliveryId) => database.prepare("SELECT * FROM session_delivery_inbox WHERE delivery_id = ?").get(deliveryId);
+	const scheduleAdmission = (deliveryId) => {
+		if (closed || scheduled.has(deliveryId)) return;
+		scheduled.add(deliveryId);
+		admissionQueue = admissionQueue.then(async () => {
+			try {
+				if (closed) return;
+				const row = readInboxRow(deliveryId);
+				if (!row || row.state !== "accepted") return;
+				database.prepare("UPDATE session_delivery_inbox SET state = 'admitting', updated_at = ? WHERE delivery_id = ?").run(Date.now(), deliveryId);
+				publishAck(deliveryId, row.sender_key, "admitting");
+				try {
+					await options.admitPrompt(row.prompt, row.delivery_mode);
+				} catch {
+					database.prepare("UPDATE session_delivery_inbox SET state = 'recovery_required', updated_at = ? WHERE delivery_id = ?").run(Date.now(), deliveryId);
+					publishAck(deliveryId, row.sender_key, "recovery_required");
+					return;
+				}
+				database.prepare("UPDATE session_delivery_inbox SET state = 'admitted', updated_at = ? WHERE delivery_id = ?").run(Date.now(), deliveryId);
+				publishAck(deliveryId, row.sender_key, "admitted");
+			} finally {
+				scheduled.delete(deliveryId);
+			}
+		}).catch(() => {
+			scheduled.delete(deliveryId);
+			try {
+				const row = readInboxRow(deliveryId);
+				if (row?.state !== "admitting") return;
+				database.prepare("UPDATE session_delivery_inbox SET state = 'recovery_required', updated_at = ? WHERE delivery_id = ?").run(Date.now(), deliveryId);
+				try {
+					publishAck(deliveryId, row.sender_key, "recovery_required");
+				} catch {}
+			} catch {}
+		});
+	};
+	const receiveEnvelope = (senderKey, value) => {
+		if (closed) return void 0;
+		const envelope = envelopeOf(value);
+		if (!envelope || !options.authorizePeer(senderKey, envelope.metadata)) return void 0;
+		database.prepare(`INSERT OR IGNORE INTO session_delivery_inbox
+         (delivery_id, sender_key, recipient_key, kind, prompt, delivery_mode, metadata_json, state, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, 'accepted', ?, ?)`).run(envelope.deliveryId, senderKey, options.recipientKey, envelope.kind, envelope.prompt, envelope.delivery, JSON.stringify(envelope.metadata), Date.now(), Date.now());
+		const current = readInboxRow(envelope.deliveryId);
+		if (!current) return void 0;
+		if (!(current.sender_key === senderKey && current.recipient_key === options.recipientKey && current.kind === envelope.kind && current.prompt === envelope.prompt && current.delivery_mode === envelope.delivery && sameMetadata(JSON.parse(current.metadata_json), envelope.metadata))) return void 0;
+		publishAck(envelope.deliveryId, current.sender_key, current.state);
+		if (current.state === "accepted") scheduleAdmission(envelope.deliveryId);
+		return current.state;
+	};
+	const receiveAck = (recipientKey, value) => {
+		const ack = ackOf(value);
+		if (closed || !ack) return;
+		database.prepare(`UPDATE session_delivery_outbox
+         SET state = 'acknowledged', recipient_state = ?, acknowledged_at = ?
+         WHERE delivery_id = ? AND recipient_key = ?
+           AND (recipient_state IS NULL
+             OR (recipient_state = 'accepted' AND ? != 'accepted')
+             OR (recipient_state = 'admitting' AND ? IN ('admitted', 'recovery_required')))`).run(ack.state, Date.now(), ack.deliveryId, recipientKey, ack.state, ack.state);
+	};
+	const publishOutbox = (deliveryId) => {
+		const row = database.prepare("SELECT * FROM session_delivery_outbox WHERE delivery_id = ? AND (recipient_state IS NULL OR recipient_state NOT IN ('admitted', 'recovery_required'))").get(deliveryId);
+		if (!row) return;
+		const metadata = JSON.parse(row.metadata_json);
+		if (!options.authorizePeer(row.recipient_key, metadata)) return;
+		options.communication.publish(row.recipient_key, DELIVERY_EVENT, {
+			deliveryId: row.delivery_id,
+			kind: row.kind,
+			prompt: row.prompt,
+			delivery: row.delivery_mode,
+			metadata
+		});
+	};
+	const publishQueued = (recipientKey) => {
+		for (const row of database.prepare("SELECT delivery_id FROM session_delivery_outbox WHERE recipient_key = ? AND (recipient_state IS NULL OR recipient_state NOT IN ('admitted', 'recovery_required'))").all(recipientKey)) publishOutbox(row.delivery_id);
+	};
+	const publishAllQueued = () => {
+		for (const row of database.prepare("SELECT delivery_id FROM session_delivery_outbox WHERE recipient_state IS NULL OR recipient_state NOT IN ('admitted', 'recovery_required')").all()) publishOutbox(row.delivery_id);
+	};
+	const releaseEnvelope = options.communication.subscribe(DELIVERY_EVENT, receiveEnvelope);
+	const releaseAck = options.communication.subscribe(ACK_EVENT, receiveAck);
+	const releaseReady = options.communication.onPeerReady(publishQueued);
+	for (const row of database.prepare("SELECT delivery_id, sender_key FROM session_delivery_inbox WHERE state = 'recovery_required'").all()) publishAck(row.delivery_id, row.sender_key, "recovery_required");
+	for (const row of database.prepare("SELECT delivery_id FROM session_delivery_inbox WHERE state = 'accepted'").all()) scheduleAdmission(row.delivery_id);
+	publishAllQueued();
+	const retryTimer = setInterval(publishAllQueued, 1e3);
+	retryTimer.unref();
+	return Object.freeze({
+		recipientKey: options.recipientKey,
+		async deliver(request) {
+			if (closed) throw new Error("Session delivery service is closed.");
+			const deliveryId = request.deliveryId ?? crypto.randomUUID();
+			const mode = request.delivery ?? DEFAULT_DELIVERY;
+			if (!deliveryId.trim() || !request.recipientKey.trim() || !request.kind.trim() || !isMode(mode)) throw new TypeError("Delivery id, recipient key, kind, and mode must be valid.");
+			if (!options.authorizePeer(request.recipientKey, request.metadata)) throw new Error(`Session '${request.recipientKey}' is not an authorized communication peer.`);
+			const metadata = normalizedMetadata(request.metadata);
+			database.prepare(`INSERT OR IGNORE INTO session_delivery_outbox
+           (delivery_id, recipient_key, kind, prompt, delivery_mode, metadata_json, state, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, 'queued', ?)`).run(deliveryId, request.recipientKey, request.kind, request.prompt, mode, JSON.stringify(metadata), Date.now());
+			const current = database.prepare("SELECT * FROM session_delivery_outbox WHERE delivery_id = ?").get(deliveryId);
+			if (!current || current.recipient_key !== request.recipientKey || current.kind !== request.kind || current.prompt !== request.prompt || current.delivery_mode !== mode || !sameMetadata(JSON.parse(current.metadata_json), metadata)) throw new TypeError(`Delivery id '${deliveryId}' is already bound to another envelope.`);
+			publishOutbox(deliveryId);
+			return { deliveryId };
+		},
+		async waitForAdmission(deliveryId, timeoutMs = 5e3) {
+			const deadline = Date.now() + Math.max(0, timeoutMs);
+			let state;
+			do {
+				state = database.prepare("SELECT recipient_state FROM session_delivery_outbox WHERE delivery_id = ?").get(deliveryId)?.recipient_state ?? void 0;
+				if (state === "admitted" || state === "recovery_required") return state;
+				if (Date.now() >= deadline) return state;
+				await new Promise((resolve) => setTimeout(resolve, Math.min(10, deadline - Date.now())));
+			} while (!closed);
+			return state;
+		},
+		receive(senderKey, kind, payload) {
+			if (kind === DELIVERY_EVENT) return receiveEnvelope(senderKey, payload);
+			if (kind === ACK_EVENT) {
+				receiveAck(senderKey, payload);
+				return "accepted";
+			}
+		},
+		inbox(query = {}) {
+			return database.prepare("SELECT * FROM session_delivery_inbox ORDER BY created_at, delivery_id").all().map((row) => {
+				const metadata = JSON.parse(row.metadata_json);
+				return {
+					deliveryId: row.delivery_id,
+					senderKey: row.sender_key,
+					recipientKey: row.recipient_key,
+					kind: row.kind,
+					prompt: row.prompt,
+					delivery: row.delivery_mode,
+					metadata,
+					state: row.state,
+					consumed: row.consumed_at !== null
+				};
+			}).filter((entry) => (query.kind === void 0 || entry.kind === query.kind) && (query.state === void 0 || entry.state === query.state) && (query.consumed === void 0 || entry.consumed === query.consumed) && matchesMetadata(entry.metadata, query.metadata));
+		},
+		consume(deliveryId) {
+			return database.prepare("UPDATE session_delivery_inbox SET consumed_at = ? WHERE delivery_id = ? AND state IN ('admitted', 'recovery_required') AND consumed_at IS NULL").run(Date.now(), deliveryId).changes === 1;
+		},
+		outbox(deliveryId) {
+			const row = database.prepare("SELECT delivery_id, recipient_key, kind, metadata_json, state, recipient_state FROM session_delivery_outbox WHERE delivery_id = ?").get(deliveryId);
+			if (!row) return void 0;
+			return {
+				deliveryId: row.delivery_id,
+				recipientKey: row.recipient_key,
+				kind: row.kind,
+				metadata: JSON.parse(row.metadata_json),
+				state: row.state,
+				...row.recipient_state === null ? {} : { recipientState: row.recipient_state }
+			};
+		},
+		async close() {
+			if (closed) return;
+			closed = true;
+			clearInterval(retryTimer);
+			releaseEnvelope();
+			releaseAck();
+			releaseReady();
+			try {
+				await admissionQueue;
+			} finally {
+				database.close();
+			}
+		}
+	});
+}
+/**
+* Installs a provider-owned endpoint in the current Cordis context.
+*
+* Returns the instance because a provider cannot read its own service back out:
+* `ctx.get` is strict and hides an implementation while its providing fiber is
+* LOADING, which is the whole of that fiber's own callback.
+*/
+function provideSessionDeliveryService(context, options) {
+	const service = createSessionDeliveryService(options);
+	const unprovide = context.provide(DOOM_SESSION_DELIVERY_SERVICE, service);
+	context.effect(() => () => service.close(), "session delivery database");
+	return {
+		service,
+		close: async () => {
+			unprovide();
+			await service.close();
+		}
+	};
+}
+//#endregion
+export { peerRequestHeaders as _, createSessionGroupDeliveryAuthorizer as a, sessionPeerConfigPath as b, readSessionIntercom as c, SessionGroupRevisionError as d, createSessionDirectory as f, parseSessionPeerEnvelope as g, parseRemoteSessionReference as h, readDoomSessionDelivery as i, requireSessionIntercom as l, createPeerReplayGuard as m, provideSessionDeliveryService as n, createSessionIntercom as o, createPeerCommunication as p, DOOM_SESSION_DELIVERY_SERVICE as r, DOOM_SESSION_INTERCOM_SERVICE as s, createSessionDeliveryService as t, createSessionGroupStore as u, peerSessionReference as v, verifyPeerRequest as x, readSessionPeerConfig as y };
+
+//# sourceMappingURL=sessionDelivery-DNq4a8LB.mjs.map