@aria-cli/tools 1.0.0

package/dist/network-runtime/address-types.js

@@ -0,0 +1,166 @@
+import { z } from "zod";
+const NonEmptyStringSchema = z.string().trim().min(1);
+/**
+ * Stable durable identity for a node.
+ * Semantic rules are enforced by the runtime cutover plan; the contract layer
+ * starts by making the shape canonical everywhere.
+ */
+export const NodeIdSchema = NonEmptyStringSchema.brand();
+/** One boot of a given node runtime. */
+export const RuntimeIdSchema = NonEmptyStringSchema.brand();
+export const NodeMetadataSchema = z.object({
+    nodeId: NodeIdSchema,
+    createdAt: NonEmptyStringSchema,
+    schemaVersion: z.number().int().positive(),
+    migratedFromLegacy: z.boolean(),
+});
+/** Monotonic publication revision for externally visible runtime advertisements. */
+export const PublicationRevisionSchema = z.number().int().nonnegative();
+/** Monotonic endpoint revision for register/discovery refreshes. */
+export const EndpointRevisionSchema = z.number().int().nonnegative();
+/** Monotonic generation for peer-binding continuity transitions. */
+export const BindingGenerationSchema = z.number().int().nonnegative();
+/** Monotonic generation for revocation precedence and continuity conflict checks. */
+export const RevocationGenerationSchema = z.number().int().nonnegative();
+/** How a local operator confirmed a revocation decision. */
+export const RevocationOperatorConfirmationSchema = z.enum([
+    "local_operator_confirmed",
+    "remote_capability_authenticated",
+]);
+/** Structured local authority record for a peer revocation decision. */
+export const RevocationDecisionSchema = z.object({
+    localNodeId: NodeIdSchema,
+    targetNodeId: NodeIdSchema,
+    revocationGeneration: RevocationGenerationSchema,
+    operatorConfirmation: RevocationOperatorConfirmationSchema,
+});
+/** Monotonic owner generation for runtime ownership records. */
+export const OwnerGenerationSchema = z.number().int().positive();
+/** Monotonic revision for durable delivery lifecycle state transitions. */
+export const DeliveryLifecycleRevisionSchema = z.number().int().nonnegative();
+export const RuntimeOwnerRecordSchema = z
+    .object({
+    schemaVersion: z.number().int().positive(),
+    nodeId: NodeIdSchema,
+    ariaHome: NonEmptyStringSchema,
+    runtimePid: z.number().int().positive(),
+    runtimeId: RuntimeIdSchema,
+    displayNameSnapshot: NonEmptyStringSchema.optional(),
+    runtimeSocket: NonEmptyStringSchema,
+    startedAt: NonEmptyStringSchema,
+    lastHeartbeat: NonEmptyStringSchema,
+    ownerGeneration: OwnerGenerationSchema,
+})
+    .strict();
+/** One attached local client of the runtime. */
+export const ClientIdSchema = NonEmptyStringSchema.brand();
+/** Durable principal fingerprint (SHA-256 hex of signing public key DER). Signing-key evidence only. */
+export const PrincipalFingerprintSchema = NonEmptyStringSchema.brand();
+/** Transport public key / transport identity for a peer. */
+export const PeerTransportIdSchema = NonEmptyStringSchema.brand();
+/** TLS CA certificate fingerprint (SHA-256 hex of CA cert DER). Certificate-authority evidence only — distinct from signing-key evidence. */
+export const TlsCaFingerprintSchema = NonEmptyStringSchema.brand();
+/** Local-only loopback TLS SAN identity used for same-machine control attachment. */
+export const LoopbackTlsIdentitySchema = NonEmptyStringSchema.brand();
+/** Base64-encoded signing public key material crossing runtime/shared boundaries. */
+export const SigningPublicKeySchema = NonEmptyStringSchema.brand();
+/** Explicit network transport endpoint advertisement. */
+export const TransportEndpointAdvertisementSchema = z.object({
+    host: NonEmptyStringSchema,
+    port: z.number().int().min(1).max(65535),
+});
+/**
+ * Runtime-owned local inbox addressing.
+ * Same-machine clients are local attachments, not mesh peers.
+ */
+export const InboxAddressSchema = z.discriminatedUnion("kind", [
+    z.object({
+        kind: z.literal("node"),
+        nodeId: NodeIdSchema,
+    }),
+    z.object({
+        kind: z.literal("client"),
+        clientId: ClientIdSchema,
+    }),
+]);
+/**
+ * Public control-plane endpoint advertisement used by peers for pinned,
+ * mutating requests.
+ */
+export const ControlEndpointAdvertisementSchema = z.object({
+    host: NonEmptyStringSchema,
+    port: z.number().int().min(1).max(65535),
+    tlsCaFingerprint: TlsCaFingerprintSchema,
+    tlsServerIdentity: PrincipalFingerprintSchema,
+    protocolVersion: z.number().int().positive(),
+    endpointRevision: EndpointRevisionSchema.optional(),
+});
+/**
+ * Remote/public node advertisement. This deliberately excludes local-only
+ * runtime/session identity like RuntimeId.
+ */
+export const NodeAdvertisementSchema = z.object({
+    nodeId: NodeIdSchema,
+    principalFingerprint: PrincipalFingerprintSchema,
+    transportPublicKey: PeerTransportIdSchema,
+    publicationRevision: PublicationRevisionSchema.optional(),
+    controlEndpoint: ControlEndpointAdvertisementSchema.optional(),
+    displayNameSnapshot: NonEmptyStringSchema.optional(),
+});
+/**
+ * Local-only runtime registry summary. This is not a remote/public mesh
+ * contract and may include RuntimeId.
+ */
+export const LocalRuntimeSummarySchema = z.object({
+    nodeId: NodeIdSchema,
+    runtimeId: RuntimeIdSchema,
+    lastHeartbeat: NonEmptyStringSchema.optional(),
+    controlEndpoint: ControlEndpointAdvertisementSchema.optional(),
+    displayNameSnapshot: NonEmptyStringSchema.optional(),
+});
+// ── Durable Delivery Handle ────────────────────────────────────────
+/**
+ * Branded operation handle for durable delivery.
+ * Produced ONLY by `submitDurable()` — the caller never mints handles.
+ */
+export const DurableDeliveryHandleSchema = NonEmptyStringSchema.brand();
+/**
+ * Terminal status types for a durable delivery operation.
+ */
+export const DurableDeliveryResultSchema = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("pending"),
+        queuedAt: z.string(),
+        nextAttemptAt: z.string().optional(),
+        attemptCount: z.number(),
+    }),
+    z.object({
+        status: z.literal("delivered"),
+        deliveredAt: z.string(),
+    }),
+    z.object({
+        status: z.literal("expired"),
+        reason: z.literal("ttl_exceeded"),
+        queuedAt: z.string(),
+        expiredAt: z.string(),
+    }),
+    z.object({
+        status: z.literal("rejected"),
+        reason: z.enum(["recipient_revoked", "recipient_unknown", "envelope_invalid"]),
+    }),
+]);
+/**
+ * Submit result — returned immediately from `submitDurable()`.
+ */
+export const DurableSubmitResultSchema = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("accepted"),
+        operationId: DurableDeliveryHandleSchema,
+        queuedAt: z.string(),
+    }),
+    z.object({
+        status: z.literal("rejected"),
+        reason: z.enum(["recipient_revoked", "recipient_unknown", "envelope_invalid"]),
+    }),
+]);
+//# sourceMappingURL=address-types.js.map

package/dist/network-runtime/address-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address-types.js","sourceRoot":"","sources":["../../src/network-runtime/address-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,EAAY,CAAC;AAGnE,wCAAwC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,EAAe,CAAC;AAGzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,oBAAoB;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;CAChC,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAGxE,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAGrE,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAGtE,qFAAqF;AACrF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAGzE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,IAAI,CAAC;IACzD,0BAA0B;IAC1B,iCAAiC;CAClC,CAAC,CAAC;AAGH,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,YAAY;IAC1B,oBAAoB,EAAE,0BAA0B;IAChD,oBAAoB,EAAE,oCAAoC;CAC3D,CAAC,CAAC;AAGH,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAGjE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAG9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,oBAAoB;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,eAAe;IAC1B,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACpD,aAAa,EAAE,oBAAoB;IACnC,SAAS,EAAE,oBAAoB;IAC/B,aAAa,EAAE,oBAAoB;IACnC,eAAe,EAAE,qBAAqB;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,gDAAgD;AAChD,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC,KAAK,EAAc,CAAC;AAGvE,wGAAwG;AACxG,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,EAA0B,CAAC;AAG/F,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,KAAK,EAAqB,CAAC;AAGrF,6IAA6I;AAC7I,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,KAAK,EAAsB,CAAC;AAGvF,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC,KAAK,EAAyB,CAAC;AAE7F,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,KAAK,EAAsB,CAAC;AAGvF,yDAAyD;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACzC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,YAAY;KACrB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,cAAc;KACzB,CAAC;CACH,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACxC,gBAAgB,EAAE,sBAAsB;IACxC,iBAAiB,EAAE,0BAA0B;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,YAAY;IACpB,oBAAoB,EAAE,0BAA0B;IAChD,kBAAkB,EAAE,qBAAqB;IACzC,mBAAmB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAC9D,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;IAC1B,aAAa,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAC9D,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH,sEAAsE;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC,KAAK,EAA2B,CAAC;AAGjG;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;KAC/E,CAAC;CACH,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACtE,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7B,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;KACrB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;KAC/E,CAAC;CACH,CAAC,CAAC"}

package/dist/network-runtime/db-owner-fencing.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared database-level ownership fencing for runtime-owned durable stores.
+ *
+ * All stores backed by the same SQLite database share one `owner_epoch` table.
+ * The runtime claims the epoch once at startup. Each store's write methods
+ * call `assertDbOwnership()` before durable mutations.
+ *
+ * A zombie runtime whose generation is stale gets StaleOwnerError on
+ * its next write — no external kill needed.
+ */
+interface SqliteStatementLike {
+    run(...params: unknown[]): {
+        changes: number;
+    };
+    get(...params: unknown[]): unknown;
+}
+export interface OwnerEpochDb {
+    exec(sql: string): unknown;
+    prepare(sql: string): SqliteStatementLike;
+}
+export declare class StaleOwnerError extends Error {
+    readonly kind: "StaleOwnerError";
+    readonly claimedGeneration: number;
+    readonly currentGeneration: number;
+    constructor(claimed: number, current: number);
+}
+/**
+ * Ensure the owner_epoch table exists in the given database.
+ * Safe to call multiple times (idempotent).
+ */
+export declare function ensureOwnerEpochTable(db: OwnerEpochDb): void;
+/**
+ * Atomically claim the owner epoch for this runtime.
+ * Throws StaleOwnerError if a newer generation already owns the database.
+ */
+export declare function claimDbOwnerEpoch(db: OwnerEpochDb, generation: number): void;
+/**
+ * Assert the calling runtime is still the current owner of this database.
+ * Must be called inside the same SQLite transaction as the write.
+ * Throws StaleOwnerError if superseded.
+ */
+export declare function assertDbOwnership(db: OwnerEpochDb, generation: number): void;
+export {};
+//# sourceMappingURL=db-owner-fencing.d.ts.map

package/dist/network-runtime/db-owner-fencing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-owner-fencing.d.ts","sourceRoot":"","sources":["../../src/network-runtime/db-owner-fencing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,UAAU,mBAAmB;IAC3B,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAAC;CAC3C;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAS7C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAO5D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAoB5E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAS5E"}

package/dist/network-runtime/db-owner-fencing.js

@@ -0,0 +1,70 @@
+/**
+ * Shared database-level ownership fencing for runtime-owned durable stores.
+ *
+ * All stores backed by the same SQLite database share one `owner_epoch` table.
+ * The runtime claims the epoch once at startup. Each store's write methods
+ * call `assertDbOwnership()` before durable mutations.
+ *
+ * A zombie runtime whose generation is stale gets StaleOwnerError on
+ * its next write — no external kill needed.
+ */
+export class StaleOwnerError extends Error {
+    kind = "StaleOwnerError";
+    claimedGeneration;
+    currentGeneration;
+    constructor(claimed, current) {
+        super(`StaleOwnerError: runtime claims generation ${claimed} but store is at generation ${current}. ` +
+            `This runtime has been superseded and must shut down immediately.`);
+        this.name = "StaleOwnerError";
+        this.claimedGeneration = claimed;
+        this.currentGeneration = current;
+    }
+}
+/**
+ * Ensure the owner_epoch table exists in the given database.
+ * Safe to call multiple times (idempotent).
+ */
+export function ensureOwnerEpochTable(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS owner_epoch (
+      scope TEXT PRIMARY KEY DEFAULT 'runtime',
+      owner_generation INTEGER NOT NULL
+    )
+  `);
+}
+/**
+ * Atomically claim the owner epoch for this runtime.
+ * Throws StaleOwnerError if a newer generation already owns the database.
+ */
+export function claimDbOwnerEpoch(db, generation) {
+    ensureOwnerEpochTable(db);
+    const result = db
+        .prepare(`INSERT INTO owner_epoch (scope, owner_generation) VALUES ('runtime', ?)
+       ON CONFLICT(scope) DO UPDATE SET owner_generation = excluded.owner_generation
+       WHERE excluded.owner_generation > owner_epoch.owner_generation`)
+        .run(generation);
+    if (result.changes === 0) {
+        const row = db
+            .prepare("SELECT owner_generation FROM owner_epoch WHERE scope = 'runtime'")
+            .get();
+        const current = row?.owner_generation ?? 0;
+        if (current > generation) {
+            throw new StaleOwnerError(generation, current);
+        }
+    }
+}
+/**
+ * Assert the calling runtime is still the current owner of this database.
+ * Must be called inside the same SQLite transaction as the write.
+ * Throws StaleOwnerError if superseded.
+ */
+export function assertDbOwnership(db, generation) {
+    const row = db
+        .prepare("SELECT owner_generation FROM owner_epoch WHERE scope = 'runtime'")
+        .get();
+    const current = row?.owner_generation ?? 0;
+    if (current > generation) {
+        throw new StaleOwnerError(generation, current);
+    }
+}
+//# sourceMappingURL=db-owner-fencing.js.map

package/dist/network-runtime/db-owner-fencing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-owner-fencing.js","sourceRoot":"","sources":["../../src/network-runtime/db-owner-fencing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,iBAA0B,CAAC;IAClC,iBAAiB,CAAS;IAC1B,iBAAiB,CAAS;IAEnC,YAAY,OAAe,EAAE,OAAe;QAC1C,KAAK,CACH,8CAA8C,OAAO,+BAA+B,OAAO,IAAI;YAC7F,kEAAkE,CACrE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAgB;IACpD,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAgB,EAAE,UAAkB;IACpE,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAE1B,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CACN;;sEAEgE,CACjE;SACA,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CAAC,kEAAkE,CAAC;aAC3E,GAAG,EAA8C,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,EAAE,gBAAgB,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAgB,EAAE,UAAkB;IACpE,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,kEAAkE,CAAC;SAC3E,GAAG,EAA8C,CAAC;IAErD,MAAM,OAAO,GAAG,GAAG,EAAE,gBAAgB,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/network-runtime/delivery-receipts.d.ts

@@ -0,0 +1,118 @@
+import { z } from "zod";
+export declare const RuntimeTransportSchema: z.ZodEnum<{
+    in_process: "in_process";
+    local_runtime: "local_runtime";
+    tunnel: "tunnel";
+    relay: "relay";
+}>;
+export type RuntimeTransport = z.infer<typeof RuntimeTransportSchema>;
+export declare const DeliveryStateSchema: z.ZodEnum<{
+    expired: "expired";
+    rejected: "rejected";
+    accepted: "accepted";
+    queued_for_route: "queued_for_route";
+    dispatching: "dispatching";
+    sent: "sent";
+    acked: "acked";
+    failed: "failed";
+}>;
+export type DeliveryState = z.infer<typeof DeliveryStateSchema>;
+export declare const SessionStateSchema: z.ZodEnum<{
+    none: "none";
+    handshaking: "handshaking";
+    connected: "connected";
+    reconnecting: "reconnecting";
+    dead: "dead";
+}>;
+export type SessionState = z.infer<typeof SessionStateSchema>;
+export declare const DeliveryReadinessSchema: z.ZodEnum<{
+    cannot_address: "cannot_address";
+    can_queue_only: "can_queue_only";
+    can_send_now: "can_send_now";
+}>;
+export type DeliveryReadiness = z.infer<typeof DeliveryReadinessSchema>;
+export declare const QueuedReasonSchema: z.ZodEnum<{
+    route_not_established: "route_not_established";
+    awaiting_remote_ack: "awaiting_remote_ack";
+    transport_unavailable: "transport_unavailable";
+}>;
+export type QueuedReason = z.infer<typeof QueuedReasonSchema>;
+export declare const OutboxReceiptStatusSchema: z.ZodEnum<{
+    expired: "expired";
+    queued_for_route: "queued_for_route";
+    dispatching: "dispatching";
+    acked: "acked";
+}>;
+export type OutboxReceiptStatus = z.infer<typeof OutboxReceiptStatusSchema>;
+export declare const DeliveryReceiptInputSchema: z.ZodObject<{
+    transport: z.ZodEnum<{
+        in_process: "in_process";
+        local_runtime: "local_runtime";
+        tunnel: "tunnel";
+        relay: "relay";
+    }>;
+    delivered: z.ZodBoolean;
+    queued: z.ZodBoolean;
+    accepted: z.ZodOptional<z.ZodBoolean>;
+    deliveryState: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
+        rejected: "rejected";
+        accepted: "accepted";
+        queued_for_route: "queued_for_route";
+        dispatching: "dispatching";
+        sent: "sent";
+        acked: "acked";
+        failed: "failed";
+    }>>;
+    sessionState: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        handshaking: "handshaking";
+        connected: "connected";
+        reconnecting: "reconnecting";
+        dead: "dead";
+    }>>;
+    deliveryReadiness: z.ZodOptional<z.ZodEnum<{
+        cannot_address: "cannot_address";
+        can_queue_only: "can_queue_only";
+        can_send_now: "can_send_now";
+    }>>;
+    queuedReason: z.ZodOptional<z.ZodEnum<{
+        route_not_established: "route_not_established";
+        awaiting_remote_ack: "awaiting_remote_ack";
+        transport_unavailable: "transport_unavailable";
+    }>>;
+}, z.core.$strict>;
+export type DeliveryReceiptInput = z.input<typeof DeliveryReceiptInputSchema>;
+export interface CanonicalDeliveryReceipt {
+    transport: RuntimeTransport;
+    delivered: boolean;
+    queued: boolean;
+    accepted: boolean;
+    deliveryState: DeliveryState;
+    sessionState: SessionState;
+    deliveryReadiness: DeliveryReadiness;
+    queuedReason?: QueuedReason;
+}
+export declare function canonicalizeDeliveryReceipt(input: DeliveryReceiptInput): CanonicalDeliveryReceipt;
+export declare function createAckedDeliveryReceipt(input: {
+    transport: RuntimeTransport;
+    sessionState?: SessionState;
+    deliveryReadiness?: DeliveryReadiness;
+}): CanonicalDeliveryReceipt;
+export declare function createQueuedForRouteReceipt(input: {
+    transport: RuntimeTransport;
+    sessionState?: SessionState;
+    deliveryReadiness?: DeliveryReadiness;
+}): CanonicalDeliveryReceipt;
+export declare function createDispatchingDeliveryReceipt(input: {
+    transport: RuntimeTransport;
+    sessionState?: SessionState;
+    deliveryReadiness?: DeliveryReadiness;
+}): CanonicalDeliveryReceipt;
+export declare function createSentDeliveryReceipt(input: {
+    transport: RuntimeTransport;
+    sessionState?: SessionState;
+    deliveryReadiness?: DeliveryReadiness;
+}): CanonicalDeliveryReceipt;
+export declare function canonicalizeOutboxReceiptStatus(status: string): OutboxReceiptStatus;
+//# sourceMappingURL=delivery-receipts.d.ts.map

package/dist/network-runtime/delivery-receipts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-receipts.d.ts","sourceRoot":"","sources":["../../src/network-runtime/delivery-receipts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,sBAAsB;;;;;EAA6D,CAAC;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,mBAAmB;;;;;;;;;EAS9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,kBAAkB;;;;;;EAAuE,CAAC;AACvG,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;EAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,yBAAyB;;;;;EAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAW5B,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AA2LD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,oBAAoB,GAC1B,wBAAwB,CAoC1B;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,GAAG,wBAAwB,CAU3B;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,GAAG,wBAAwB,CAW3B;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,GAAG,wBAAwB,CAW3B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,GAAG,wBAAwB,CAU3B;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAYnF"}