@amalgm/live 0.1.0

package/dist/contracts/frames/gateway.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Gateway state socket — browser ⇄ Fly gateway
+ * (local-live-protocol.md §4).
+ *
+ * The barrier rule: in bootstrap mode the gateway MUST NOT send
+ * `state.connected` before `state.snapshot`. A browser treats
+ * `state.connected` as "delivery confirmed from here on" — and it is
+ * re-sent on every transport change, so `transport: 'poll'` is how the
+ * client learns it is degraded. Polling is a degraded state, never a
+ * destination: a polling session retries the runtime stream and promotes
+ * back.
+ */
+import { type Checked } from '../validate.js';
+import type { StateEvent } from '../events.js';
+import type { ResourceName } from '../resources.js';
+/** A client uses socket commands only when `state.connected.capabilities` advertises this. */
+export declare const CAPABILITY_STATE_COMMAND = "state.command.v1";
+/** Commands are a small allowlist, validated and bounded — never an arbitrary method/path. */
+export declare const COMMAND_LIMITS: {
+    readonly maxBodyBytes: number;
+    readonly maxInFlight: 16;
+};
+export declare const HEARTBEAT_INTERVAL_MS = 25000;
+/** A polling session retries the runtime stream at this cadence (env AMALGM_STATE_STREAM_PROMOTE_MS). */
+export declare const POLL_PROMOTE_INTERVAL_MS = 30000;
+export declare const POLL_INTERVAL_MS = 1000;
+export type GatewayToBrowser = 
+/** Relayed bootstrap snapshot; always precedes state.connected in bootstrap mode. */
+{
+    readonly type: 'state.snapshot';
+    readonly seq: number;
+    readonly resources: Readonly<Record<ResourceName, unknown>>;
+}
+/**
+ * The delivery barrier: sent only when the runtime stream is confirmed
+ * (or poll fallback engaged). Version fields exist only on this
+ * gateway/WebSocket path against v2 servers; the client keeps last-known
+ * values across reconnects until the next confirmation overwrites them.
+ */
+ | {
+    readonly type: 'state.connected';
+    readonly seq: number;
+    readonly transport: 'stream' | 'poll';
+    readonly runtimeVersion?: string;
+    readonly runtimeInstanceId?: string;
+    readonly gatewayVersion?: string;
+    readonly capabilities?: readonly string[];
+} | {
+    readonly type: 'state.event';
+    readonly event: StateEvent;
+} | {
+    readonly type: 'state.events';
+    readonly events: readonly StateEvent[];
+} | {
+    readonly type: 'state.heartbeat';
+    readonly t: number;
+}
+/** The client must re-snapshot. */
+ | {
+    readonly type: 'state.reset';
+}
+/** Advisory, not terminal by itself: the socket stays open unless the gateway follows with a close. */
+ | {
+    readonly type: 'state.error';
+    readonly status?: number;
+    readonly message: string;
+}
+/** Acknowledgement from the real runtime handler for a browser command. */
+ | {
+    readonly type: 'state.command.result';
+    readonly requestId: string;
+    readonly status: number;
+    readonly body: unknown;
+};
+export type BrowserToGateway = {
+    readonly type: 'state.command';
+    readonly requestId: string;
+    /** First command: `doc.update` with `{ path, updates: [base64Yjs] }`. A repeated Yjs update is idempotent, so retrying a lost ack cannot duplicate text. */
+    readonly command: string;
+    readonly payload: unknown;
+};
+export declare function checkCommand(input: unknown): Checked<BrowserToGateway>;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/contracts/frames/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../src/contracts/frames/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,OAAO,EAA+C,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,8FAA8F;AAC9F,eAAO,MAAM,cAAc;;;CAA8D,CAAC;AAE1F,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,yGAAyG;AACzG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAC/C,eAAO,MAAM,gBAAgB,OAAQ,CAAC;AAEtC,MAAM,MAAM,gBAAgB;AAC1B,qFAAqF;AACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE;AACxH;;;;;GAKG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CAAE;AAC1D,mCAAmC;GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE;AAClC,uGAAuG;GACrG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACtF,2EAA2E;GACzE;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3H,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4JAA4J;IAC5J,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AAIF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWtE"}

package/dist/contracts/frames/gateway.js

@@ -0,0 +1,35 @@
+/**
+ * Gateway state socket — browser ⇄ Fly gateway
+ * (local-live-protocol.md §4).
+ *
+ * The barrier rule: in bootstrap mode the gateway MUST NOT send
+ * `state.connected` before `state.snapshot`. A browser treats
+ * `state.connected` as "delivery confirmed from here on" — and it is
+ * re-sent on every transport change, so `transport: 'poll'` is how the
+ * client learns it is degraded. Polling is a degraded state, never a
+ * destination: a polling session retries the runtime stream and promotes
+ * back.
+ */
+import { pass, failShape, isRecord, isNonEmptyString } from '../validate.js';
+/** A client uses socket commands only when `state.connected.capabilities` advertises this. */
+export const CAPABILITY_STATE_COMMAND = 'state.command.v1';
+/** Commands are a small allowlist, validated and bounded — never an arbitrary method/path. */
+export const COMMAND_LIMITS = { maxBodyBytes: 4 * 1024 * 1024, maxInFlight: 16 };
+export const HEARTBEAT_INTERVAL_MS = 25_000;
+/** A polling session retries the runtime stream at this cadence (env AMALGM_STATE_STREAM_PROMOTE_MS). */
+export const POLL_PROMOTE_INTERVAL_MS = 30_000;
+export const POLL_INTERVAL_MS = 1_000;
+const COMMAND_EXAMPLE = '{ type: "state.command", requestId: "r1", command: "doc.update", payload: { path, updates } }';
+export function checkCommand(input) {
+    if (!isRecord(input) || input.type !== 'state.command') {
+        return failShape(COMMAND_EXAMPLE, `type was ${isRecord(input) ? JSON.stringify(input.type) : typeof input}`);
+    }
+    if (!isNonEmptyString(input.requestId)) {
+        return failShape(COMMAND_EXAMPLE, `requestId was ${JSON.stringify(input.requestId)}, not a non-empty string`);
+    }
+    if (!isNonEmptyString(input.command)) {
+        return failShape(COMMAND_EXAMPLE, `command was ${JSON.stringify(input.command)}, not a non-empty string`);
+    }
+    return pass(input);
+}
+//# sourceMappingURL=gateway.js.map

package/dist/contracts/frames/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../../src/contracts/frames/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgB,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAI3F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAW,CAAC;AAE1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,yGAAyG;AACzG,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAsCtC,MAAM,eAAe,GAAG,+FAA+F,CAAC;AAExH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC,eAAe,EAAE,YAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC,eAAe,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC,eAAe,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,IAAI,CAAC,KAAoC,CAAC,CAAC;AACpD,CAAC"}

package/dist/contracts/frames/stream.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Runtime SSE stream frames — `GET /state/stream`
+ * (local-live-protocol.md §3).
+ *
+ * Two modes share one endpoint. Legacy: hello comment → backlog replay →
+ * live events, with the snapshot fetched separately (the race that creates
+ * is closed client-side by the full-snapshot barrier). Ordered-bootstrap
+ * (`bootstrap=1&resources=…`): the server registers the listener FIRST,
+ * then sends the snapshot as the first data frame, then flushes buffered
+ * events past its seq — the snapshot-buries-event race is impossible by
+ * construction because everything travels ordered on one channel.
+ */
+import type { StateEvent } from '../events.js';
+import type { PresenceFrame } from '../presence.js';
+import type { ResourceName } from '../resources.js';
+export interface StreamRequest {
+    /** Replay events with seq > after, then go live. Ignored in bootstrap mode — the snapshot IS the resume point. */
+    readonly after?: number;
+    /** Bootstrap snapshot scope. */
+    readonly resources?: readonly ResourceName[];
+    readonly bootstrap?: boolean;
+    /** Ties this connection to a presence binding session: teardown evicts its presence everywhere. */
+    readonly session?: string;
+}
+/** Sent every 25 seconds. */
+export declare const PING_INTERVAL_MS = 25000;
+/** A bootstrap client falls back to the legacy path when no snapshot frame arrives in time. */
+export declare const BOOTSTRAP_SNAPSHOT_TIMEOUT_MS = 5000;
+export type StreamFrame = 
+/** First data frame in bootstrap mode; `{ seq, resources }`. */
+{
+    readonly type: 'snapshot';
+    readonly seq: number;
+    readonly resources: Readonly<Record<ResourceName, unknown>>;
+    readonly stable?: boolean;
+}
+/** One event per frame. */
+ | {
+    readonly type: 'state';
+    readonly event: StateEvent;
+} | {
+    readonly type: 'ping';
+}
+/** Replay window exceeded — the client must re-snapshot. */
+ | {
+    readonly type: 'reset';
+}
+/** Bootstrap snapshot build failed; the stream ends and the client falls back to the REST path. */
+ | {
+    readonly type: 'error';
+    readonly status?: number;
+    readonly error?: string;
+}
+/** Ephemeral peer state — no seq, ignored by legacy clients by construction. */
+ | {
+    readonly type: 'presence';
+    readonly frame: PresenceFrame;
+};
+//# sourceMappingURL=stream.d.ts.map

package/dist/contracts/frames/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../src/contracts/frames/stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC5B,kHAAkH;IAClH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,6BAA6B;AAC7B,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAEnD,MAAM,MAAM,WAAW;AACrB,gEAAgE;AAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE;AAC7I,2BAA2B;GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3B,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5B,mGAAmG;GACjG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAC/E,gFAAgF;GAC9E;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC"}

package/dist/contracts/frames/stream.js

@@ -0,0 +1,17 @@
+/**
+ * Runtime SSE stream frames — `GET /state/stream`
+ * (local-live-protocol.md §3).
+ *
+ * Two modes share one endpoint. Legacy: hello comment → backlog replay →
+ * live events, with the snapshot fetched separately (the race that creates
+ * is closed client-side by the full-snapshot barrier). Ordered-bootstrap
+ * (`bootstrap=1&resources=…`): the server registers the listener FIRST,
+ * then sends the snapshot as the first data frame, then flushes buffered
+ * events past its seq — the snapshot-buries-event race is impossible by
+ * construction because everything travels ordered on one channel.
+ */
+/** Sent every 25 seconds. */
+export const PING_INTERVAL_MS = 25_000;
+/** A bootstrap client falls back to the legacy path when no snapshot frame arrives in time. */
+export const BOOTSTRAP_SNAPSHOT_TIMEOUT_MS = 5_000;
+//# sourceMappingURL=stream.js.map

package/dist/contracts/frames/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../../src/contracts/frames/stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC"}

package/dist/contracts/frames/tunnel.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Tunnel frames — runtime ⇄ gateway, protocol v2
+ * (local-live-protocol.md §5).
+ *
+ * One outbound WebSocket per runtime. v2 is negotiated per connection: the
+ * runtime's hello carries `protocol_version: 2`; no `hello_ack` means the
+ * peer is v1 and only v1 frames may be sent. Slot arbitration is
+ * hello-driven and identity-based — the decision function itself lives in
+ * `machines/arbitration.ts`; this file owns the wire shapes and constants
+ * both sides must agree on.
+ */
+import { type Checked } from '../validate.js';
+export declare const PROTOCOL_VERSION = 2;
+/** Sent on connect and every 15s. */
+export declare const HELLO_INTERVAL_MS = 15000;
+/** Advertised in hello acks; only then do upgraded runtimes use additive shared.resource.* / shared.mutation.* frames. */
+export declare const CAPABILITY_SHARED_MUTATION = "shared.mutation.v1";
+export declare const CLOSE_CODES: {
+    /** The newcomer won the slot; the old connection is fenced before this close. */
+    readonly replaced: 4000;
+    /** Refused: an older or equal boot_ts lost arbitration. Retry slowly, never stop. */
+    readonly supersededInstance: 4009;
+    readonly unauthorized: 4401;
+};
+export declare const BACKPRESSURE: {
+    /** Frames above this queue behind bufferedAmount; control frames always send immediately. */
+    readonly controlMaxBytes: number;
+    /** High-water mark on the socket buffer (AMALGM_TUNNEL_HWM_BYTES). */
+    readonly highWaterMarkBytes: number;
+    /** Bounded bulk queue (AMALGM_TUNNEL_BULK_MAX_BYTES); overflow drops the response as a 503 res frame — never a silent hang. */
+    readonly bulkMaxBytes: number;
+};
+export declare const CHUNKING: {
+    /** Raw bodies above this are chunked to v2 peers. */
+    readonly thresholdBytes: number;
+    /** ≤256KB raw per chunk, 0-based indexes. */
+    readonly chunkMaxBytes: number;
+};
+/** Identity fields are per PROCESS: instance_id is minted once at init, boot_ts is the init timestamp. */
+export interface TunnelHello {
+    readonly type: 'hello';
+    readonly instance_id: string;
+    readonly boot_ts: number;
+    readonly runtime_version: string;
+    readonly protocol_version: number;
+    readonly runtime_label: string;
+    readonly branch?: string;
+    /** Tunnel-forwarded HTTP targets this port; the MCP port is the fallback when absent. */
+    readonly runtime_gateway_port?: number;
+}
+export interface TunnelHelloAck {
+    readonly type: 'hello_ack';
+    readonly protocol_version: number;
+    readonly capabilities?: readonly string[];
+}
+/** Chunked response train: res_start → res_chunk* → res_end. Control frames may interleave — that is the point. */
+export type ChunkedResponseFrame = {
+    readonly type: 'res_start';
+    readonly req_id: string;
+    readonly status: number;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body_bytes: number;
+} | {
+    readonly type: 'res_chunk';
+    readonly req_id: string;
+    readonly index: number;
+    readonly body_b64: string;
+}
+/** `chunks` must match the count received, else the whole response is a 502. */
+ | {
+    readonly type: 'res_end';
+    readonly req_id: string;
+    readonly chunks: number;
+};
+export declare function checkHello(input: unknown): Checked<TunnelHello>;
+/** Usable identity for arbitration: both fields present and well-formed. Missing/unusable identity falls back to legacy last-connect-wins. */
+export declare const hasUsableIdentity: (hello: Partial<TunnelHello>) => boolean;
+//# sourceMappingURL=tunnel.d.ts.map

package/dist/contracts/frames/tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../../src/contracts/frames/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,OAAO,EAA+C,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,qCAAqC;AACrC,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC,0HAA0H;AAC1H,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,eAAO,MAAM,WAAW;IACtB,iFAAiF;;IAEjF,qFAAqF;;;CAG7E,CAAC;AAEX,eAAO,MAAM,YAAY;IACvB,6FAA6F;;IAE7F,sEAAsE;;IAEtE,+HAA+H;;CAEvH,CAAC;AAEX,eAAO,MAAM,QAAQ;IACnB,qDAAqD;;IAErD,6CAA6C;;CAErC,CAAC;AAEX,0GAA0G;AAC1G,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,mHAAmH;AACnH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjK;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC5G,gFAAgF;GAC9E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAKnF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAS/D;AAED,8IAA8I;AAC9I,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,CAAC,WAAW,CAAC,KAAG,OAIhC,CAAC"}

package/dist/contracts/frames/tunnel.js

@@ -0,0 +1,55 @@
+/**
+ * Tunnel frames — runtime ⇄ gateway, protocol v2
+ * (local-live-protocol.md §5).
+ *
+ * One outbound WebSocket per runtime. v2 is negotiated per connection: the
+ * runtime's hello carries `protocol_version: 2`; no `hello_ack` means the
+ * peer is v1 and only v1 frames may be sent. Slot arbitration is
+ * hello-driven and identity-based — the decision function itself lives in
+ * `machines/arbitration.ts`; this file owns the wire shapes and constants
+ * both sides must agree on.
+ */
+import { pass, failShape, isRecord, isNonEmptyString } from '../validate.js';
+export const PROTOCOL_VERSION = 2;
+/** Sent on connect and every 15s. */
+export const HELLO_INTERVAL_MS = 15_000;
+/** Advertised in hello acks; only then do upgraded runtimes use additive shared.resource.* / shared.mutation.* frames. */
+export const CAPABILITY_SHARED_MUTATION = 'shared.mutation.v1';
+export const CLOSE_CODES = {
+    /** The newcomer won the slot; the old connection is fenced before this close. */
+    replaced: 4000,
+    /** Refused: an older or equal boot_ts lost arbitration. Retry slowly, never stop. */
+    supersededInstance: 4009,
+    unauthorized: 4401,
+};
+export const BACKPRESSURE = {
+    /** Frames above this queue behind bufferedAmount; control frames always send immediately. */
+    controlMaxBytes: 32 * 1024,
+    /** High-water mark on the socket buffer (AMALGM_TUNNEL_HWM_BYTES). */
+    highWaterMarkBytes: 1024 * 1024,
+    /** Bounded bulk queue (AMALGM_TUNNEL_BULK_MAX_BYTES); overflow drops the response as a 503 res frame — never a silent hang. */
+    bulkMaxBytes: 64 * 1024 * 1024,
+};
+export const CHUNKING = {
+    /** Raw bodies above this are chunked to v2 peers. */
+    thresholdBytes: 256 * 1024,
+    /** ≤256KB raw per chunk, 0-based indexes. */
+    chunkMaxBytes: 256 * 1024,
+};
+const HELLO_EXAMPLE = '{ type: "hello", instance_id: "a1b2c3d4e5f60718", boot_ts: 1719000000000, runtime_version: "0.1.157", protocol_version: 2, runtime_label: "main" }';
+export function checkHello(input) {
+    if (!isRecord(input) || input.type !== 'hello') {
+        return failShape(HELLO_EXAMPLE, `type was ${isRecord(input) ? JSON.stringify(input.type) : typeof input}`);
+    }
+    if (!isNonEmptyString(input.runtime_label)) {
+        return failShape(HELLO_EXAMPLE, `runtime_label was ${JSON.stringify(input.runtime_label)}, not a non-empty string`);
+    }
+    // Identity fields are additive v2: a v1 hello without them is still a valid hello.
+    return pass(input);
+}
+/** Usable identity for arbitration: both fields present and well-formed. Missing/unusable identity falls back to legacy last-connect-wins. */
+export const hasUsableIdentity = (hello) => typeof hello.instance_id === 'string' &&
+    /^[0-9a-f]{16}$/.test(hello.instance_id) &&
+    typeof hello.boot_ts === 'number' &&
+    Number.isFinite(hello.boot_ts);
+//# sourceMappingURL=tunnel.js.map

package/dist/contracts/frames/tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../../src/contracts/frames/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAgB,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,0HAA0H;AAC1H,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iFAAiF;IACjF,QAAQ,EAAE,IAAI;IACd,qFAAqF;IACrF,kBAAkB,EAAE,IAAI;IACxB,YAAY,EAAE,IAAI;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,6FAA6F;IAC7F,eAAe,EAAE,EAAE,GAAG,IAAI;IAC1B,sEAAsE;IACtE,kBAAkB,EAAE,IAAI,GAAG,IAAI;IAC/B,+HAA+H;IAC/H,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;CACtB,CAAC;AAEX,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,qDAAqD;IACrD,cAAc,EAAE,GAAG,GAAG,IAAI;IAC1B,6CAA6C;IAC7C,aAAa,EAAE,GAAG,GAAG,IAAI;CACjB,CAAC;AA4BX,MAAM,aAAa,GACjB,oJAAoJ,CAAC;AAEvJ,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC,aAAa,EAAE,YAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC,aAAa,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC;IACtH,CAAC;IACD,mFAAmF;IACnF,OAAO,IAAI,CAAC,KAA+B,CAAC,CAAC;AAC/C,CAAC;AAED,8IAA8I;AAC9I,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA2B,EAAW,EAAE,CACxE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;IACrC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC"}

package/dist/contracts/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The contracts layer: every wire shape, identity rule, and vocabulary the
+ * protocol documents define — as types, guards, and validators. Nothing in
+ * here performs I/O or holds state; the state machines live in
+ * `../machines`, and the ports a host injects live in `../adapters`.
+ */
+export * from './validate.js';
+export * from './resources.js';
+export * from './events.js';
+export * from './snapshot.js';
+export * from './mutation.js';
+export * from './binding.js';
+export * from './presence.js';
+export * from './docs.js';
+export * from './content.js';
+export * from './frames/stream.js';
+export * from './frames/gateway.js';
+export * from './frames/tunnel.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/contracts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/contracts/index.js

@@ -0,0 +1,19 @@
+/**
+ * The contracts layer: every wire shape, identity rule, and vocabulary the
+ * protocol documents define — as types, guards, and validators. Nothing in
+ * here performs I/O or holds state; the state machines live in
+ * `../machines`, and the ports a host injects live in `../adapters`.
+ */
+export * from './validate.js';
+export * from './resources.js';
+export * from './events.js';
+export * from './snapshot.js';
+export * from './mutation.js';
+export * from './binding.js';
+export * from './presence.js';
+export * from './docs.js';
+export * from './content.js';
+export * from './frames/stream.js';
+export * from './frames/gateway.js';
+export * from './frames/tunnel.js';
+//# sourceMappingURL=index.js.map

package/dist/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/contracts/mutation.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Durable mutations — one edit, one identity, forever.
+ *
+ * The hard product invariant (realtime-sdk.md §4, §5): one surface edit
+ * creates one logical mutation with one `mutationId`, stable across every
+ * retry, journaled before local materialization, and deduplicated by
+ * `(resourceId, mutationId)` at every door. Transport may pack, compress,
+ * or chunk envelopes — it may never merge identities.
+ *
+ * After acceptance the authority adds server-derived fields. A
+ * client-supplied actor, role, official version, or commit time is never
+ * trusted (realtime-sdk.md §5).
+ */
+import { type Checked } from './validate.js';
+export interface LiveMutation<Operation = unknown> {
+    readonly resourceId: string;
+    /** Fences writes across authority handoffs: a stale epoch is refused. */
+    readonly authorityEpoch: number;
+    /** Stable across retries. A retry never manufactures a second edit. */
+    readonly mutationId: string;
+    readonly deviceId: string;
+    /** The official per-resource version this edit was built against. */
+    readonly baseVersion: number;
+    /** Data contract of the operation, e.g. "text-yjs@1". */
+    readonly contract: string;
+    readonly operation: Operation;
+}
+/** Server-derived facts stamped by the authority on acceptance. */
+export interface AcceptedMutation<Operation = unknown> extends LiveMutation<Operation> {
+    readonly actorId: string;
+    /** Official per-resource version assigned by the authority. */
+    readonly version: number;
+    readonly committedAt: number;
+}
+/**
+ * Durable mutation state, separate from connection state
+ * (realtime-sdk.md §7). Terminal states preserve local work: `rejected`
+ * and `conflicted` never discard the losing side (axiom: never a silent
+ * winner).
+ */
+export declare const MUTATION_STATES: readonly ["saving-local", "saved-local", "syncing", "synced", "rejected", "conflicted"];
+export type MutationState = (typeof MUTATION_STATES)[number];
+/**
+ * The cloud dedupes both entry doors on this key; repeating an accepted
+ * mutation returns the original ack. NUL-separated: ids may contain any
+ * printable character, so a printable separator could collide two
+ * different identities.
+ */
+export declare const mutationKey: (m: Pick<LiveMutation, "resourceId" | "mutationId">) => string;
+export declare function checkLiveMutation(input: unknown): Checked<LiveMutation>;
+//# sourceMappingURL=mutation.d.ts.map

package/dist/contracts/mutation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutation.d.ts","sourceRoot":"","sources":["../../src/contracts/mutation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,OAAO,EAAsD,MAAM,eAAe,CAAC;AAEjG,MAAM,WAAW,YAAY,CAAC,SAAS,GAAG,OAAO;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB,CAAC,SAAS,GAAG,OAAO,CAAE,SAAQ,YAAY,CAAC,SAAS,CAAC;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,yFAOlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,YAAY,CAAC,KAAG,MACzC,CAAC;AAKzC,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAevE"}

package/dist/contracts/mutation.js

@@ -0,0 +1,55 @@
+/**
+ * Durable mutations — one edit, one identity, forever.
+ *
+ * The hard product invariant (realtime-sdk.md §4, §5): one surface edit
+ * creates one logical mutation with one `mutationId`, stable across every
+ * retry, journaled before local materialization, and deduplicated by
+ * `(resourceId, mutationId)` at every door. Transport may pack, compress,
+ * or chunk envelopes — it may never merge identities.
+ *
+ * After acceptance the authority adds server-derived fields. A
+ * client-supplied actor, role, official version, or commit time is never
+ * trusted (realtime-sdk.md §5).
+ */
+import { pass, failShape, isRecord, isNonEmptyString, isSeq } from './validate.js';
+/**
+ * Durable mutation state, separate from connection state
+ * (realtime-sdk.md §7). Terminal states preserve local work: `rejected`
+ * and `conflicted` never discard the losing side (axiom: never a silent
+ * winner).
+ */
+export const MUTATION_STATES = [
+    'saving-local', // selected journal is persisting the edit
+    'saved-local', // journal contains it; runtime-routed edits are also materialized
+    'syncing', // leased/pending in the outbox view
+    'synced', // cloud accepted and assigned the official version
+    'rejected', // cloud refused (permission/schema); local work preserved
+    'conflicted', // contract requires an explicit merge decision; both sides survive
+];
+/**
+ * The cloud dedupes both entry doors on this key; repeating an accepted
+ * mutation returns the original ack. NUL-separated: ids may contain any
+ * printable character, so a printable separator could collide two
+ * different identities.
+ */
+export const mutationKey = (m) => `${m.resourceId}\u0000${m.mutationId}`;
+const EXAMPLE = '{ resourceId: "r1", authorityEpoch: 1, mutationId: "m-7", deviceId: "d1", baseVersion: 12, contract: "text-yjs@1", operation: {...} }';
+export function checkLiveMutation(input) {
+    if (!isRecord(input))
+        return failShape(EXAMPLE, `got ${input === null ? 'null' : typeof input}`);
+    for (const field of ['resourceId', 'mutationId', 'deviceId', 'contract']) {
+        if (!isNonEmptyString(input[field])) {
+            return failShape(EXAMPLE, `${field} was ${JSON.stringify(input[field])}, not a non-empty string`);
+        }
+    }
+    if (!isSeq(input.authorityEpoch)) {
+        return failShape(EXAMPLE, `authorityEpoch was ${JSON.stringify(input.authorityEpoch)}, not a non-negative integer`);
+    }
+    if (!isSeq(input.baseVersion)) {
+        return failShape(EXAMPLE, `baseVersion was ${JSON.stringify(input.baseVersion)}, not a non-negative integer`);
+    }
+    if (!('operation' in input))
+        return failShape(EXAMPLE, 'operation was missing');
+    return pass(input);
+}
+//# sourceMappingURL=mutation.js.map

package/dist/contracts/mutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutation.js","sourceRoot":"","sources":["../../src/contracts/mutation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAgB,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAwBjG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc,EAAE,0CAA0C;IAC1D,aAAa,EAAE,kEAAkE;IACjF,SAAS,EAAE,oCAAoC;IAC/C,QAAQ,EAAE,mDAAmD;IAC7D,UAAU,EAAE,0DAA0D;IACtE,YAAY,EAAE,mEAAmE;CACzE,CAAC;AAGX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAkD,EAAU,EAAE,CACxF,GAAG,CAAC,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;AAEzC,MAAM,OAAO,GACX,uIAAuI,CAAC;AAE1I,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACjG,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAU,EAAE,CAAC;QAClF,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,0BAA0B,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC,OAAO,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,8BAA8B,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,OAAO,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,KAAgC,CAAC,CAAC;AAChD,CAAC"}

package/dist/contracts/presence.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Ephemeral presence — the lane that is allowed to lose data.
+ *
+ * Presence is authenticated and permission-gated but best-effort
+ * (local-live-protocol.md §2, realtime-sdk.md §6): TTL-bound, never
+ * journaled, never replayed after a gap, safe to drop under backpressure.
+ * Re-publishing IS the heartbeat; absence is the default that publishing
+ * re-earns. Identity (`user`) is stamped server-side from the enrolled
+ * account and never read from the client body.
+ */
+import { type Checked } from './validate.js';
+/** Clients re-publish while bound and on every position change. */
+export declare const PUBLISH_INTERVAL_MS = 10000;
+/** The server expires any entry not re-published within this window (10s sweep). */
+export declare const SERVER_TTL_MS = 30000;
+/** The surface-defined opaque position blob is capped at 8KB. */
+export declare const MAX_BLOB_BYTES: number;
+/** `POST /state/presence` body. `session` is a client-minted binding id; `leave: true` is the clean goodbye. */
+export interface PresencePublish {
+    readonly resource: string;
+    readonly session: string;
+    /** Surface-defined opaque position: a text caret, canvas x/y… */
+    readonly blob?: unknown;
+    readonly active?: boolean;
+    readonly leave?: boolean;
+}
+export interface PresencePeer {
+    readonly session: string;
+    /** Stamped server-side; never client-supplied. */
+    readonly user: string;
+    readonly blob?: unknown;
+    readonly at: number;
+    readonly activeAt?: number;
+}
+/**
+ * The `presence` stream frame: the FULL peer list for one resource.
+ * Receivers replace, never merge — removal is implicit (a peer absent from
+ * the list is gone). Presence frames carry no seq and never enter the
+ * event log, snapshots, or backfill.
+ */
+export interface PresenceFrame {
+    readonly resource: string;
+    readonly peers: readonly PresencePeer[];
+}
+export declare function checkPresenceFrame(input: unknown): Checked<PresenceFrame>;
+//# sourceMappingURL=presence.d.ts.map

package/dist/contracts/presence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presence.d.ts","sourceRoot":"","sources":["../../src/contracts/presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,OAAO,EAA+C,MAAM,eAAe,CAAC;AAE1F,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAC1C,oFAAoF;AACpF,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,iEAAiE;AACjE,eAAO,MAAM,cAAc,QAAW,CAAC;AAEvC,gHAAgH;AAChH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;CACzC;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAYzE"}

package/dist/contracts/presence.js

@@ -0,0 +1,34 @@
+/**
+ * Ephemeral presence — the lane that is allowed to lose data.
+ *
+ * Presence is authenticated and permission-gated but best-effort
+ * (local-live-protocol.md §2, realtime-sdk.md §6): TTL-bound, never
+ * journaled, never replayed after a gap, safe to drop under backpressure.
+ * Re-publishing IS the heartbeat; absence is the default that publishing
+ * re-earns. Identity (`user`) is stamped server-side from the enrolled
+ * account and never read from the client body.
+ */
+import { pass, failShape, isRecord, isNonEmptyString } from './validate.js';
+/** Clients re-publish while bound and on every position change. */
+export const PUBLISH_INTERVAL_MS = 10_000;
+/** The server expires any entry not re-published within this window (10s sweep). */
+export const SERVER_TTL_MS = 30_000;
+/** The surface-defined opaque position blob is capped at 8KB. */
+export const MAX_BLOB_BYTES = 8 * 1024;
+const EXAMPLE = '{ resource: "doc:...", peers: [{ session: "s1", user: "ada", at: 1719000000000 }] }';
+export function checkPresenceFrame(input) {
+    if (!isRecord(input))
+        return failShape(EXAMPLE, `got ${input === null ? 'null' : typeof input}`);
+    if (!isNonEmptyString(input.resource)) {
+        return failShape(EXAMPLE, `resource was ${JSON.stringify(input.resource)}, not a name`);
+    }
+    if (!Array.isArray(input.peers))
+        return failShape(EXAMPLE, 'peers was not an array');
+    for (const peer of input.peers) {
+        if (!isRecord(peer) || !isNonEmptyString(peer.session) || !isNonEmptyString(peer.user)) {
+            return failShape(EXAMPLE, `peer ${JSON.stringify(peer)} is missing session or user`);
+        }
+    }
+    return pass(input);
+}
+//# sourceMappingURL=presence.js.map

package/dist/contracts/presence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presence.js","sourceRoot":"","sources":["../../src/contracts/presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAgB,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE1F,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAgCvC,MAAM,OAAO,GAAG,qFAAqF,CAAC;AAEtG,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC,OAAO,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACrF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAiC,CAAC,CAAC;AACjD,CAAC"}