@astrosheep/square 0.3.106 → 0.4.1

package/dist/square-facade.d.ts

@@ -1,12 +1,27 @@
-import type { DeliveryDeferral, MetadataMatch } from './delivery-deferral.js';
-export type { DeliveryDeferral, MetadataMatch, MetadataScalar } from './delivery-deferral.js';
+import type { MetadataMatch } from './delivery-deferral.js';
+export type { MetadataMatch, MetadataScalar } from './delivery-deferral.js';
 import type { ActivityId, Perception, Reach } from './square-core.js';
-import type { Owner, StoredAct, WakeAddress, ActivityMetadata, ActivityDelivery, DirectedNotificationRoute } from './model.js';
-import type { WakeTransportPort, SquareResourceOwner } from './ports.js';
+import type { Owner, HydratedAct, WakeAddress, ActivityMetadata, DirectedNotificationRoute } from './model.js';
+import type { SquareResourceOwner } from './ports.js';
+import type { OperationControl } from './neutral.js';
+export interface ActivitySearch {
+    readonly text: string;
+    readonly mode: 'literal' | 'regex';
+}
+export interface AckResult {
+    readonly consumed: number;
+}
+import type { FutureAck } from './square-post.js';
+export type { NotificationId, SendInput, SendResult, FutureAck } from './square-post.js';
+export interface HeldSeat {
+    readonly name: string;
+    readonly generation: string;
+}
+export type { CatchWaitStart, OperationProgress, OperationControl, OperationFailureDetail, OperationError } from './neutral.js';
 export type { ActivityId, Perception, Reach } from './square-core.js';
-export type { Owner, WakeAddress, ActivityMetadata, ActivityDelivery, JsonValue, DirectedNotificationRoute } from './model.js';
-/** Indexed archive event, including read bookkeeping. */
-export type ArchiveRecord = Readonly<StoredAct>;
+export type { Owner, WakeAddress, ActivityMetadata, JsonValue, DirectedNotificationRoute } from './model.js';
+/** Indexed archive event, including read bookkeeping and a say's linked content. */
+export type ArchiveRecord = Readonly<HydratedAct>;
 export interface Activity {
     readonly id: ActivityId;
     readonly at: number;
@@ -14,7 +29,6 @@ export interface Activity {
     readonly actor: string;
     readonly body?: string;
     readonly metadata?: ActivityMetadata;
-    readonly delivery?: ActivityDelivery;
     readonly mentions: readonly string[];
     readonly reach?: Reach;
     readonly target?: string;
@@ -50,22 +64,6 @@ export interface ExpressResult {
     readonly hint?: string;
     readonly observation?: ExpressObservation;
 }
-export type ChannelTruncate = number | false;
-export interface ChannelSendInput {
-    readonly from: string;
-    readonly to: string | readonly string[];
-    readonly body: string;
-    readonly truncate?: ChannelTruncate;
-    readonly metadata?: ActivityMetadata;
-}
-export interface ChannelSendResult {
-    readonly id: ActivityId;
-    readonly at: number;
-    readonly from: string;
-    readonly to: readonly string[];
-    readonly body: string;
-    readonly metadata?: ActivityMetadata;
-}
 export interface ListenerChangeResult {
     readonly activity: Activity | null;
     readonly observation?: ListenerObservation;
@@ -86,10 +84,6 @@ export interface CatchOptions extends ObservationOptions {
     readonly limit?: number;
     readonly replace?: boolean;
 }
-export interface ActivitySearch {
-    readonly text: string;
-    readonly mode: 'literal' | 'regex';
-}
 export interface ActivityCursor {
     readonly id: ActivityId;
     readonly direction: 'before' | 'after';
@@ -111,10 +105,6 @@ export interface PendingResult {
     /** Matching unconsumed activities outside this page. */
     readonly remaining: number;
 }
-export interface AckResult {
-    /** Newly consumed addressed IDs; repeated acknowledgement is a no-op. */
-    readonly consumed: number;
-}
 export type CatchReason = 'drained' | 'idle' | 'capped' | 'quorum' | 'replaced' | 'already-active';
 export interface CatchResult {
     readonly activities: readonly PerceivedActivity[];
@@ -124,37 +114,6 @@ export interface CatchResult {
     readonly hint?: string;
     readonly observation?: CatchObservation;
 }
-export interface CatchWaitStart {
-    readonly idleMs: number;
-    readonly replacementRequested: boolean;
-    readonly replaced: boolean;
-}
-export type OperationProgress = {
-    readonly kind: 'waiting';
-    readonly reason: 'throttled';
-    readonly delayMs?: number;
-} | ({
-    readonly kind: 'catch-started';
-    readonly participant: string;
-} & CatchWaitStart);
-export interface OperationControl {
-    readonly signal?: AbortSignal;
-    readonly onProgress?: (progress: OperationProgress) => void;
-}
-export interface OperationFailureDetail {
-    readonly operation: 'express' | 'join' | 'catch' | 'history' | 'other';
-    readonly subject?: 'caller' | 'filter' | 'recipient';
-    readonly participant?: string;
-    readonly expressEffect?: 'unsent' | 'landed' | 'unknown';
-    readonly landedId?: ActivityId;
-    readonly historyBounds?: {
-        readonly maxLimit: number;
-        readonly totalMatches: number;
-    };
-}
-export interface OperationError extends Error {
-    readonly operation?: OperationFailureDetail;
-}
 export interface HistoryQuery extends ActivityQuery, ObservationOptions {
     /** Ten by default; null explicitly reads the full archive. */
     readonly limit?: number | null;
@@ -170,7 +129,6 @@ export interface HistoryResult {
 }
 export interface OpenOptions {
     readonly clock?: () => number;
-    readonly wakeTransport?: WakeTransportPort | false;
 }
 export interface SquareLocation {
     readonly path?: string;
@@ -202,7 +160,7 @@ export interface JoinResult {
 }
 export interface Participant {
     readonly name: string;
-    readonly generation: ActivityId;
+    readonly generation: string;
     express(body: string | undefined, options?: ExpressOptions, control?: OperationControl): Promise<ExpressResult>;
     express(input: ExpressInput, control?: OperationControl): Promise<ExpressResult>;
     listen(target: string, options?: ObservationOptions, control?: OperationControl): Promise<ListenerChangeResult>;
@@ -211,20 +169,11 @@ export interface Participant {
     listening(options?: ObservationOptions, control?: OperationControl): Promise<ListeningResult>;
     catch(options?: CatchOptions, control?: OperationControl): Promise<CatchResult>;
     pending(options?: PendingOptions, control?: OperationControl): Promise<PendingResult>;
+    /** Local custody only: ledger-only detach/delete is observed on privileged reconciliation. */
     ack(ids: readonly ActivityId[], control?: OperationControl): Promise<AckResult>;
+    ack(input: FutureAck, control?: OperationControl): Promise<AckResult>;
     /** Leave without a message. Only an omitted or empty body is accepted. */
     done(body?: string, options?: ObservationOptions, control?: OperationControl): Promise<LifecycleResult>;
-    deferDelivery(input: Readonly<{
-        match: MetadataMatch;
-        durationMs: number;
-    }>, control?: OperationControl): Promise<DeliveryDeferral>;
-    renewDeliveryDeferral(id: string, durationMs: number, control?: OperationControl): Promise<DeliveryDeferral | null>;
-    releaseDeliveryDeferral(id: string, control?: OperationControl): Promise<boolean>;
-}
-export interface HeldSeat {
-    readonly name: string;
-    readonly generation: ActivityId;
-    readonly attachment: 'attached' | 'detached';
 }
 export type ParticipantPresence = 'never-joined' | 'active' | 'watching' | 'away' | 'done';
 export interface ParticipantSummary {

package/dist/square-location.d.ts

@@ -1,2 +1,7 @@
-import type { SquareLocation } from './square-facade.js';
+interface SquareLocation {
+    readonly path?: string;
+    readonly cwd?: string;
+    readonly env?: NodeJS.ProcessEnv;
+}
 export declare function squareLocation(input: SquareLocation): string;
+export {};

package/dist/square-location.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { SquareError } from './model.js';
+import { SquareError } from './neutral.js';
 export function squareLocation(input) {
     const selected = input.path ?? (input.env ?? process.env).SQUARE_LOCATION;
     if (selected === undefined || selected.trim() === '')

package/dist/square-post.d.ts

@@ -0,0 +1,53 @@
+import { type ActivityMetadata, type DirectedNotificationRoute, type Owner } from './model.js';
+import type { MetadataMatch } from './delivery-deferral.js';
+import type { SeatRef } from './ports.js';
+/** Producer notices are not activities in the square. */
+export type NotificationId = `notice/${number}`;
+export interface SendInput {
+    readonly from: string;
+    readonly to: string | readonly string[];
+    readonly body: string;
+    readonly metadata?: ActivityMetadata;
+}
+export interface SendResult {
+    readonly id: NotificationId;
+    readonly at: number;
+    readonly from: string;
+    readonly to: readonly string[];
+    readonly body: string;
+    readonly metadata?: ActivityMetadata;
+}
+/** The caller supplies every scalar equality identifying one exact outcome. */
+export interface FutureAck {
+    readonly from: string;
+    readonly match: MetadataMatch;
+    readonly future: 'exact';
+}
+/** One Square-owned recipient card; neither an endpoint nor a shared message resource. */
+export interface SquarePost {
+    readonly kind: 'activity' | 'notice';
+    readonly index: number;
+    readonly recipient: string;
+    readonly owner: Owner;
+    readonly generation: string;
+    readonly from: string;
+    readonly at: number;
+    readonly body?: string;
+    readonly metadata?: ActivityMetadata;
+    readonly route?: DirectedNotificationRoute;
+    readonly full?: boolean;
+    readonly consumed?: boolean;
+}
+export interface ProducerRead {
+    pendingPosts(): readonly SquarePost[];
+    postedPosts(): readonly SquarePost[];
+    ownsPost(token: string, exportAt?: number): boolean;
+}
+export interface ProducerWrite {
+    insertNotice(input: SendInput, at: number): SendResult;
+    ackMatching(seat: SeatRef, input: FutureAck, at: number): number;
+    acquirePost(post: SquarePost, token: string, pid: number, now: number, exportAt?: number): false | 'initial' | 'recovered';
+    settlePost(token: string, full: boolean, disposition: 'posted' | 'uncertain' | 'never-exported'): boolean;
+    foldReceipt(post: SquarePost, at: number): boolean;
+}
+export declare function squarePostKey(location: string, post: Pick<SquarePost, 'kind' | 'index' | 'recipient' | 'generation'>): string;

package/dist/square-post.js

@@ -0,0 +1,4 @@
+import { nameKey } from './model.js';
+export function squarePostKey(location, post) {
+    return `square:${location}#${post.kind === 'activity' ? 'act' : 'notice'}/${post.index}/recipient/${encodeURIComponent(nameKey(post.recipient))}/join/${encodeURIComponent(post.generation)}`;
+}

package/dist/square-posting.d.ts

@@ -0,0 +1,13 @@
+import { DeliveryLedger, type DeliveryRoute, type DeliverySession } from './delivery-ledger.js';
+import { type Seat } from './model.js';
+import type { SquareArtifactPort } from './ports.js';
+/** Local producer custody and current host attachment are different observations. */
+export declare function deliverySessionsForSeats(ledger: DeliveryLedger, seats: readonly Seat[]): Promise<ReadonlyMap<string, DeliverySession | undefined>>;
+/** Read-only host observations for status; callers fence them against the captured World seats. */
+export declare function readSquareSessions(seats: readonly Seat[], env: NodeJS.ProcessEnv): Promise<ReadonlyMap<string, DeliverySession | undefined>>;
+/** A first producer join may register an absent owner, never resume or revive one. */
+export declare function ensureInitialDeliverySession(owner: Seat['owner'], env: NodeJS.ProcessEnv, route?: DeliveryRoute): Promise<boolean>;
+/** Called only by privileged mutations. Sandbox lease/ACK/selection never enters here. */
+export declare function reconcileSquareDelivery(artifact: SquareArtifactPort, location: string, env: NodeJS.ProcessEnv, clock: () => number): Promise<void>;
+/** One export path for Square activities and Square-owned notices. No transaction spans I/O. */
+export declare function flushSquarePosts(artifact: SquareArtifactPort, location: string, env: NodeJS.ProcessEnv, clock: () => number): Promise<void>;

package/dist/square-posting.js

@@ -0,0 +1,174 @@
+import { randomUUID } from 'node:crypto';
+import { DeliveryLedger, deliveryLedgerLocation } from './delivery-ledger.js';
+import { dispatchPostedCard } from './notifications.js';
+import { retainDeliveryLedger } from './delivery-lifetime.js';
+import { projectNotification, displayAttentionPath } from './attention-presentation.js';
+import { coreDone } from './decisions.js';
+import { activityMetadataHasContent } from './model.js';
+import { formatActivityId } from './square-core.js';
+import { squarePostKey } from './square-post.js';
+const openLedger = (env) => DeliveryLedger.open({
+    location: deliveryLedgerLocation(env),
+});
+function renderPost(location, post) {
+    if (post.kind === 'notice')
+        return { text: post.body ?? '', full: true };
+    const projected = projectNotification({ squarePath: location, actIndex: post.index, recipient: post.recipient,
+        actor: post.from, route: post.route, body: post.body ?? '',
+        metadataOnly: !(post.body?.trim()) && activityMetadataHasContent(post.metadata) });
+    return { text: projected.text, full: projected.isFull };
+}
+/** Local producer custody and current host attachment are different observations. */
+export async function deliverySessionsForSeats(ledger, seats) {
+    const owners = [...new Set(seats.map(seat => seat.owner))];
+    return new Map(await Promise.all(owners.map(async (owner) => [owner, await ledger.session(owner)])));
+}
+/** Read-only host observations for status; callers fence them against the captured World seats. */
+export async function readSquareSessions(seats, env) {
+    if (!seats.length)
+        return new Map();
+    const ledger = await openLedger(env);
+    try {
+        return await deliverySessionsForSeats(ledger, seats);
+    }
+    finally {
+        await ledger.close();
+    }
+}
+/** A first producer join may register an absent owner, never resume or revive one. */
+export async function ensureInitialDeliverySession(owner, env, route) {
+    const ledger = await openLedger(env);
+    try {
+        const current = await ledger.session(owner);
+        if (!current) {
+            return !!await ledger.attach({ owner, expectedGeneration: null, routes: route ? [route] : [] });
+        }
+        if (current.state !== 'attached')
+            return false;
+        if (route)
+            return ledger.updateRoutes({ owner, generation: current.generation,
+                routes: [...current.routes.filter(candidate => candidate.kind !== route.kind), route] });
+        return true;
+    }
+    finally {
+        await ledger.close();
+    }
+}
+/** Called only by privileged mutations. Sandbox lease/ACK/selection never enters here. */
+export async function reconcileSquareDelivery(artifact, location, env, clock) {
+    const snapshot = (await artifact.read(facts => ({ seats: facts.roster().filter(person => person.joined)
+            .flatMap(person => { const seat = facts.seat(person.name); return seat ? [seat] : []; }), posts: facts.postedPosts() }))).value;
+    if (!snapshot.seats.length && !snapshot.posts.length)
+        return;
+    const ledger = await openLedger(env);
+    try {
+        const sessions = await deliverySessionsForSeats(ledger, snapshot.seats);
+        for (const seat of snapshot.seats) {
+            const session = sessions.get(seat.owner);
+            if (!session)
+                continue;
+            if (session.state === 'deleted') {
+                await artifact.transactAs({ kind: 'host-cleanup', seat }, facts => {
+                    const current = facts.seat(seat.participant);
+                    if (current?.owner === seat.owner && current.generation === seat.generation && facts.participant(seat.participant)?.joined)
+                        facts.land(coreDone(facts, seat.participant, '', clock()));
+                });
+            }
+            else if (seat.attachment !== session.state) {
+                const attachment = session.state;
+                await artifact.transactAs({ kind: 'producer' }, facts => facts.setSeatAttachment(seat, attachment));
+            }
+        }
+        // A full receipt is monotonic external presentation evidence, never inferred from silence.
+        const receipts = new Map();
+        for (const owner of new Set(snapshot.posts.map(post => post.owner))) {
+            const keys = snapshot.posts.filter(post => post.owner === owner).map(post => squarePostKey(location, post));
+            receipts.set(owner, new Map((await ledger.receipts(owner, { keys })).map(receipt => [receipt.key, receipt.at])));
+        }
+        for (const post of snapshot.posts) {
+            const cardKey = squarePostKey(location, post);
+            const receipt = receipts.get(post.owner)?.get(cardKey);
+            if (receipt !== undefined && post.full === true && !post.consumed)
+                await artifact.transactAs({ kind: 'producer' }, facts => facts.foldReceipt(post, receipt));
+        }
+        await suppressWithdrawn(artifact, ledger, location);
+    }
+    finally {
+        await ledger.close();
+    }
+}
+async function suppressWithdrawn(artifact, ledger, location) {
+    const posts = (await artifact.read(facts => facts.postedPosts().filter(post => {
+        const seat = facts.seat(post.recipient);
+        return post.consumed || !seat || seat.owner !== post.owner || seat.generation !== post.generation;
+    }))).value;
+    // Departure withdraws only the captured notification, never producer read history or held effects.
+    for (const post of posts)
+        await ledger.suppress({ owner: post.owner, key: squarePostKey(location, post), scope: 'exact' });
+}
+/** One export path for Square activities and Square-owned notices. No transaction spans I/O. */
+export async function flushSquarePosts(artifact, location, env, clock) {
+    // Delivery enrichment cannot turn a committed producer mutation into a retry of that mutation.
+    let lifetime;
+    try {
+        const snapshot = (await artifact.read(facts => ({ pending: facts.pendingPosts(), posted: facts.postedPosts() }))).value;
+        if (!snapshot.pending.length && !snapshot.posted.length)
+            return;
+        const ledger = await openLedger(env);
+        lifetime = retainDeliveryLedger(ledger);
+        for (const post of snapshot.pending) {
+            const session = await ledger.session(post.owner);
+            if (session?.state !== 'attached')
+                continue;
+            const rendered = renderPost(location, post), token = randomUUID();
+            const owned = (await artifact.transactAs({ kind: 'producer' }, facts => facts.acquirePost({ ...post, full: rendered.full }, token, process.pid, clock(), Date.now()))).value;
+            if (!owned)
+                continue;
+            let posted = false, knownUnsent = true;
+            try {
+                // This check is not custody across the await; the ledger independently fences delivery.
+                const current = await ledger.session(post.owner);
+                if (current?.state !== 'attached' || current.generation !== session.generation
+                    || !(await artifact.read(facts => facts.ownsPost(token, Date.now()))).value)
+                    continue;
+                knownUnsent = false;
+                const result = await ledger.post({ owner: post.owner, key: squarePostKey(location, post), text: rendered.text,
+                    ...(post.kind === 'activity' ? { details: { kind: 'presentation', origin: displayAttentionPath(location),
+                            ref: formatActivityId(post.index), author: post.from, body: post.body ?? '',
+                            ...(post.route === 'bell' ? { badge: '🔔' } : {}) } } : {}),
+                });
+                posted = ['posted', 'duplicate', 'suppressed'].includes(result.status);
+                knownUnsent = !posted;
+                if (result.status === 'conflict')
+                    throw new Error('A Square card key already holds different text.');
+            }
+            finally {
+                const disposition = posted ? 'posted' : owned === 'initial' && knownUnsent ? 'never-exported' : 'uncertain';
+                await artifact.settleAs({ kind: 'producer' }, facts => facts.settlePost(token, rendered.full, disposition));
+            }
+        }
+        await suppressWithdrawn(artifact, ledger, location);
+        const posts = (await artifact.read(facts => facts.postedPosts().filter(post => {
+            const seat = facts.seat(post.recipient);
+            return !post.consumed && seat?.owner === post.owner && seat.generation === post.generation;
+        }))).value;
+        for (const owner of new Set(posts.map(post => post.owner))) {
+            const session = await ledger.session(owner);
+            if (session?.state !== 'attached')
+                continue;
+            const pendingKeys = new Set((await ledger.pending(owner, { generation: session.generation })).map(card => card.key));
+            for (const post of posts.filter(post => post.owner === owner)) {
+                const key = squarePostKey(location, post);
+                if (pendingKeys.has(key))
+                    await dispatchPostedCard(ledger, owner, key, lifetime.track, env);
+            }
+        }
+    }
+    catch {
+        // Unsettled/uncertain producer work is retried with its stable key at the next mutation.
+        // Missing ledger evidence never proves that an external card was not inserted or delivered.
+    }
+    finally {
+        await lifetime?.close();
+    }
+}

package/dist/square-producer-sqlite.d.ts

@@ -0,0 +1,11 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { ProducerRead, ProducerWrite } from './square-post.js';
+/** Private Square producer bookkeeping, on the artifact's existing connection/transaction. */
+export declare const producerSchemaSql = "CREATE TABLE square_notices (\n  notice_index INTEGER PRIMARY KEY CHECK (notice_index >= 0), at REAL NOT NULL,\n  sender_json TEXT NOT NULL, body_json TEXT NOT NULL, metadata_json TEXT\n);\nCREATE TABLE notice_audience (\n  notice_index INTEGER NOT NULL, recipient_key_json TEXT NOT NULL, recipient_json TEXT NOT NULL,\n  owner_json TEXT NOT NULL, generation_json TEXT NOT NULL, consumed_at REAL,\n  PRIMARY KEY (notice_index,recipient_key_json)\n) WITHOUT ROWID;\nCREATE TABLE producer_consumption (\n  recipient_key_json TEXT NOT NULL, owner_json TEXT NOT NULL, generation_json TEXT NOT NULL,\n  sender_json TEXT NOT NULL, match_json TEXT NOT NULL, at REAL NOT NULL,\n  PRIMARY KEY (recipient_key_json,generation_json,sender_json,match_json)\n) WITHOUT ROWID;\nCREATE TABLE square_posts (\n  kind TEXT NOT NULL CHECK (kind IN ('activity','notice')), item_index INTEGER NOT NULL,\n  recipient_key_json TEXT NOT NULL, token TEXT UNIQUE, owner_pid INTEGER,\n  first_export_at REAL NOT NULL, claim_at REAL NOT NULL,\n  posted INTEGER NOT NULL DEFAULT 0 CHECK (posted IN (0,1)), full INTEGER CHECK (full IN (0,1)),\n  PRIMARY KEY (kind,item_index,recipient_key_json)\n) WITHOUT ROWID;";
+export declare function initializeProducerSqlite(db: DatabaseSync): void;
+export declare function resetProducerSqlite(db: DatabaseSync): void;
+export declare function createProducerDriver(db: DatabaseSync): ProducerRead & ProducerWrite & {
+    readonly changed: boolean;
+    readonly deliveryChanged: boolean;
+    consumeActivity(index: number, at: number): void;
+};

package/dist/square-producer-sqlite.js

@@ -0,0 +1,210 @@
+import { matchesMetadata, validateMetadataMatch } from './delivery-deferral.js';
+import { SquareError, sameName, validateName, validateActivityMetadata } from './model.js';
+import { decoded, encode, finite, integer, json, key, object } from './sqlite-values.js';
+/** Private Square producer bookkeeping, on the artifact's existing connection/transaction. */
+export const producerSchemaSql = `CREATE TABLE square_notices (
+  notice_index INTEGER PRIMARY KEY CHECK (notice_index >= 0), at REAL NOT NULL,
+  sender_json TEXT NOT NULL, body_json TEXT NOT NULL, metadata_json TEXT
+);
+CREATE TABLE notice_audience (
+  notice_index INTEGER NOT NULL, recipient_key_json TEXT NOT NULL, recipient_json TEXT NOT NULL,
+  owner_json TEXT NOT NULL, generation_json TEXT NOT NULL, consumed_at REAL,
+  PRIMARY KEY (notice_index,recipient_key_json)
+) WITHOUT ROWID;
+CREATE TABLE producer_consumption (
+  recipient_key_json TEXT NOT NULL, owner_json TEXT NOT NULL, generation_json TEXT NOT NULL,
+  sender_json TEXT NOT NULL, match_json TEXT NOT NULL, at REAL NOT NULL,
+  PRIMARY KEY (recipient_key_json,generation_json,sender_json,match_json)
+) WITHOUT ROWID;
+CREATE TABLE square_posts (
+  kind TEXT NOT NULL CHECK (kind IN ('activity','notice')), item_index INTEGER NOT NULL,
+  recipient_key_json TEXT NOT NULL, token TEXT UNIQUE, owner_pid INTEGER,
+  first_export_at REAL NOT NULL, claim_at REAL NOT NULL,
+  posted INTEGER NOT NULL DEFAULT 0 CHECK (posted IN (0,1)), full INTEGER CHECK (full IN (0,1)),
+  PRIMARY KEY (kind,item_index,recipient_key_json)
+) WITHOUT ROWID;`;
+export function initializeProducerSqlite(db) { db.exec(producerSchemaSql); }
+export function resetProducerSqlite(db) {
+    for (const table of ['square_posts', 'producer_consumption', 'notice_audience', 'square_notices'])
+        db.exec(`DROP TABLE ${table}`);
+}
+function canonicalMatch(match) {
+    const fields = validateMetadataMatch(match).fields.map(field => ({ path: [...field.path], equals: field.equals }));
+    fields.sort((a, b) => {
+        const left = JSON.stringify(a.path), right = JSON.stringify(b.path);
+        return left < right ? -1 : left > right ? 1 : 0;
+    });
+    return encode({ fields });
+}
+const EXPORT_IDENTITY_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+const EXPORT_OWNERSHIP_MS = 60_000;
+function withinExportWindow(first, now) {
+    return now >= first && now - first < EXPORT_IDENTITY_WINDOW_MS;
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+export function createProducerDriver(db) {
+    let changed = false;
+    const rows = (sql, args = []) => db.prepare(sql).all(...args);
+    const one = (sql, args = []) => db.prepare(sql).get(...args);
+    const run = (sql, args = []) => {
+        const count = Number(db.prepare(sql).run(...args).changes);
+        if (count)
+            changed = true;
+        return count;
+    };
+    function authority(seat) {
+        const current = one(`SELECT s.*,p.joined FROM participant_seats s JOIN participants p
+      ON p.name_key_json=s.participant_key_json WHERE s.participant_key_json=?`, [key(seat.participant)]);
+        if (!current || current.joined !== 1 || current.owner_json !== encode(seat.owner)
+            || current.generation_json !== encode(seat.generation) || current.attachment !== 'attached')
+            throw new SquareError('already_joined', 'This participant seat is away or has been replaced.', { reason: 'needs_seat' });
+    }
+    function consumed(post) {
+        return rows(`SELECT sender_json,match_json FROM producer_consumption WHERE recipient_key_json=? AND owner_json=? AND generation_json=?`, [key(post.recipient), encode(post.owner), encode(post.generation)])
+            .some(row => sameName(decoded(row.sender_json, true), post.from) && matchesMetadata(post.metadata, json(row.match_json)));
+    }
+    function knownConsumed(post) {
+        return post.kind === 'activity'
+            ? !!one('SELECT 1 FROM caught_activity WHERE recipient_key_json=? AND act_index=?', [key(post.recipient), post.index])
+                || !!one(`SELECT 1 FROM activities WHERE kind='read' AND actor_key_json=? AND json_extract(payload_json,'$.through')>=?`, [key(post.recipient), post.index])
+            : one('SELECT consumed_at FROM notice_audience WHERE recipient_key_json=? AND notice_index=?', [key(post.recipient), post.index])?.consumed_at != null;
+    }
+    function consume(post, at) {
+        return post.kind === 'activity'
+            ? run('INSERT INTO caught_activity(recipient_key_json,act_index,at) VALUES(?,?,?) ON CONFLICT DO NOTHING', [key(post.recipient), post.index, at])
+            : run('UPDATE notice_audience SET consumed_at=? WHERE recipient_key_json=? AND notice_index=? AND consumed_at IS NULL', [at, key(post.recipient), post.index]);
+    }
+    function allPosts() {
+        const activity = rows(`SELECT a.act_index,a.at,a.actor_json,a.payload_json,d.*,p.name_json,
+        x.full,x.posted FROM activities a JOIN landed_audience d ON d.act_index=a.act_index
+        JOIN participants p ON p.name_key_json=d.recipient_key_json
+        LEFT JOIN square_posts x ON x.kind='activity' AND x.item_index=a.act_index AND x.recipient_key_json=d.recipient_key_json
+        WHERE a.kind='say' AND d.owner_json IS NOT NULL AND d.generation_json IS NOT NULL ORDER BY a.act_index,d.recipient_order`)
+            .map((row) => {
+            const payload = object(json(row.payload_json));
+            return { kind: 'activity', index: integer(row.act_index), recipient: decoded(row.name_json, true),
+                owner: decoded(row.owner_json, true), generation: decoded(row.generation_json, true), from: decoded(row.actor_json, true), at: finite(row.at),
+                ...(payload.body === undefined ? {} : { body: payload.body }),
+                ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }), route: row.reason,
+                ...(row.full === null ? {} : { full: row.full === 1 }) };
+        });
+        const notices = rows(`SELECT n.*,a.*,x.full FROM square_notices n JOIN notice_audience a USING(notice_index)
+      LEFT JOIN square_posts x ON x.kind='notice' AND x.item_index=n.notice_index AND x.recipient_key_json=a.recipient_key_json ORDER BY n.notice_index,a.recipient_key_json`)
+            .map((row) => ({ kind: 'notice', index: integer(row.notice_index), recipient: decoded(row.recipient_json, true),
+            owner: decoded(row.owner_json, true), generation: decoded(row.generation_json, true), from: decoded(row.sender_json, true), at: finite(row.at),
+            body: decoded(row.body_json), ...(row.metadata_json === null ? {} : { metadata: json(row.metadata_json) }),
+            ...(row.full === null ? {} : { full: row.full === 1 }) }));
+        return [...activity, ...notices].map(post => ({ ...post, consumed: knownConsumed(post) }));
+    }
+    const driver = {
+        pendingPosts() {
+            return allPosts().filter(post => !post.consumed && !one(`SELECT 1 FROM square_posts WHERE kind=? AND item_index=? AND recipient_key_json=? AND posted=1`, [post.kind, post.index, key(post.recipient)]));
+        },
+        postedPosts() {
+            return allPosts().filter(post => !!one(`SELECT 1 FROM square_posts WHERE kind=? AND item_index=? AND recipient_key_json=? AND (posted=1 OR token IS NOT NULL)`, [post.kind, post.index, key(post.recipient)]));
+        },
+        ownsPost(token, exportAt = Date.now()) {
+            const row = one('SELECT * FROM square_posts WHERE token=?', [token]);
+            return !!row && row.posted !== 1 && withinExportWindow(finite(row.first_export_at), finite(exportAt))
+                && exportAt >= finite(row.claim_at) && exportAt - finite(row.claim_at) < EXPORT_OWNERSHIP_MS;
+        },
+        insertNotice(input, at) {
+            validateName(input.from);
+            if (typeof input.body !== 'string' || !input.body.trim())
+                throw new SquareError('invalid_args', 'A notification needs a non-empty body.');
+            const metadata = validateActivityMetadata(input.metadata);
+            const targets = typeof input.to === 'string' ? [input.to] : input.to;
+            if (!Array.isArray(targets) || targets.length < 1 || targets.length > 10)
+                throw new SquareError('invalid_args', 'A notification needs between 1 and 10 recipients.');
+            const recipients = [];
+            for (const name of targets) {
+                validateName(name);
+                if (recipients.some(row => sameName(decoded(row.participant_json, true), name)))
+                    continue;
+                const row = one(`SELECT s.* FROM participant_seats s JOIN participants p ON p.name_key_json=s.participant_key_json WHERE p.joined=1 AND p.name_key_json=?`, [key(name)]);
+                if (!row)
+                    throw new SquareError('invalid_args', `Notification recipient ${name} is not standing.`, { reason: 'not_standing', targets: [name] });
+                recipients.push(row);
+            }
+            const index = integer(one('SELECT COALESCE(MAX(notice_index),-1)+1 AS n FROM square_notices').n);
+            if (!Number.isSafeInteger(index + 1))
+                throw new SquareError('invalid_args', 'Notification index is exhausted.');
+            const body = input.body;
+            run('INSERT INTO square_notices VALUES(?,?,?,?,?)', [index, finite(at), encode(input.from), encode(body), metadata === undefined ? null : encode(metadata)]);
+            for (const row of recipients) {
+                const post = { kind: 'notice', index, recipient: decoded(row.participant_json, true), owner: decoded(row.owner_json, true),
+                    generation: decoded(row.generation_json, true), from: input.from, body, at, ...(metadata === undefined ? {} : { metadata }) };
+                run('INSERT INTO notice_audience VALUES(?,?,?,?,?,?)', [index, key(post.recipient), encode(post.recipient), encode(post.owner), encode(post.generation), consumed(post) ? at : null]);
+            }
+            return { id: `notice/${index}`, at, from: input.from, to: recipients.map(row => decoded(row.participant_json, true)), body, ...(metadata === undefined ? {} : { metadata }) };
+        },
+        ackMatching(seat, input, at) {
+            authority(seat);
+            validateName(input.from);
+            if (input.future !== 'exact')
+                throw new SquareError('invalid_args', 'Future consumption requires an explicit exact outcome.');
+            const match = canonicalMatch(input.match);
+            run('INSERT INTO producer_consumption VALUES(?,?,?,?,?,?) ON CONFLICT DO NOTHING', [key(seat.participant), encode(seat.owner), encode(seat.generation), key(input.from), match, finite(at)]);
+            let count = 0;
+            for (const post of allPosts()) {
+                if (sameName(post.recipient, seat.participant) && post.owner === seat.owner && post.generation === seat.generation
+                    && sameName(post.from, input.from) && matchesMetadata(post.metadata, input.match) && !post.consumed)
+                    count += consume(post, at);
+            }
+            return count;
+        },
+        acquirePost(post, token, pid, now, exportAt = Date.now()) {
+            // A scanned value is not custody. Re-read all source and policy facts under the World writer.
+            const current = allPosts().find(candidate => candidate.kind === post.kind && candidate.index === post.index && candidate.recipient === post.recipient);
+            if (!current || current.owner !== post.owner || current.generation !== post.generation || current.consumed)
+                return false;
+            const seat = one('SELECT * FROM participant_seats WHERE participant_key_json=?', [key(post.recipient)]);
+            if (!seat || seat.owner_json !== encode(post.owner) || seat.generation_json !== encode(post.generation) || seat.attachment !== 'attached')
+                return false;
+            if (consumed(current)) {
+                consume(current, now);
+                return false;
+            }
+            const previous = one('SELECT * FROM square_posts WHERE kind=? AND item_index=? AND recipient_key_json=?', [post.kind, post.index, key(post.recipient)]);
+            finite(exportAt);
+            if (previous?.posted === 1)
+                return false;
+            const first = previous ? finite(previous.first_export_at) : exportAt;
+            // Missing ledger identity after retention cannot prove an abandoned export was unsent.
+            if (!withinExportWindow(first, exportAt) || previous && exportAt < finite(previous.claim_at))
+                return false;
+            if (previous?.token != null && exportAt >= finite(previous.claim_at)
+                && exportAt - finite(previous.claim_at) < EXPORT_OWNERSHIP_MS && processIsAlive(integer(previous.owner_pid, 1)))
+                return false;
+            run(`INSERT INTO square_posts(kind,item_index,recipient_key_json,token,owner_pid,full,first_export_at,claim_at) VALUES(?,?,?,?,?,?,?,?)
+        ON CONFLICT(kind,item_index,recipient_key_json) DO UPDATE SET token=excluded.token,owner_pid=excluded.owner_pid,full=excluded.full,claim_at=excluded.claim_at`, [post.kind, post.index, key(post.recipient), token, integer(pid, 1), post.full === undefined ? null : Number(post.full), first, exportAt]);
+            return previous ? 'recovered' : 'initial';
+        },
+        settlePost(token, full, disposition) {
+            // Only a proved-unsent initial claim may erase its export age; prior uncertainty survives.
+            if (disposition === 'never-exported')
+                return run('DELETE FROM square_posts WHERE token=?', [token]) > 0;
+            return run('UPDATE square_posts SET token=NULL,owner_pid=NULL,posted=?,full=? WHERE token=?', [Number(disposition === 'posted'), Number(full), token]) > 0;
+        },
+        foldReceipt(post, at) {
+            const current = allPosts().find(candidate => candidate.kind === post.kind && candidate.index === post.index && candidate.recipient === post.recipient);
+            if (!current || current.owner !== post.owner || current.generation !== post.generation || current.full !== true || current.consumed)
+                return false;
+            return consume(current, finite(at)) > 0;
+        },
+        consumeActivity(index, at) {
+            for (const post of allPosts())
+                if (post.kind === 'activity' && post.index === index && consumed(post))
+                    consume(post, at);
+        },
+    };
+    return Object.defineProperties(driver, { changed: { get: () => changed }, deliveryChanged: { get: () => changed } });
+}