@astrosheep/square 0.4.0 → 0.4.2

package/dist/square-posting.js

@@ -0,0 +1,174 @@
+import { randomUUID } from 'node:crypto';
+import { DeliveryLedger, deliveryLedgerLocation } from './delivery-ledger.js';
+import { dispatchPostedCard } from './notifications.js';
+import { retainDeliveryLedger } from './delivery-lifetime.js';
+import { projectNotification, displayAttentionPath } from './attention-presentation.js';
+import { coreDone } from './decisions.js';
+import { activityMetadataHasContent } from './model.js';
+import { formatActivityId } from './square-core.js';
+import { squarePostKey } from './square-post.js';
+const openLedger = (env) => DeliveryLedger.open({
+    location: deliveryLedgerLocation(env),
+});
+function renderPost(location, post) {
+    if (post.kind === 'notice')
+        return { text: post.body ?? '', full: true };
+    const projected = projectNotification({ squarePath: location, actIndex: post.index, recipient: post.recipient,
+        actor: post.from, route: post.route, body: post.body ?? '',
+        metadataOnly: !(post.body?.trim()) && activityMetadataHasContent(post.metadata) });
+    return { text: projected.text, full: projected.isFull };
+}
+/** Local producer custody and current host attachment are different observations. */
+export async function deliverySessionsForSeats(ledger, seats) {
+    const owners = [...new Set(seats.map(seat => seat.owner))];
+    return new Map(await Promise.all(owners.map(async (owner) => [owner, await ledger.session(owner)])));
+}
+/** Read-only host observations for status; callers fence them against the captured World seats. */
+export async function readSquareSessions(seats, env) {
+    if (!seats.length)
+        return new Map();
+    const ledger = await openLedger(env);
+    try {
+        return await deliverySessionsForSeats(ledger, seats);
+    }
+    finally {
+        await ledger.close();
+    }
+}
+/** A first producer join may register an absent owner, never resume or revive one. */
+export async function ensureInitialDeliverySession(owner, env, route) {
+    const ledger = await openLedger(env);
+    try {
+        const current = await ledger.session(owner);
+        if (!current) {
+            return !!await ledger.attach({ owner, expectedGeneration: null, routes: route ? [route] : [] });
+        }
+        if (current.state !== 'attached')
+            return false;
+        if (route)
+            return ledger.updateRoutes({ owner, generation: current.generation,
+                routes: [...current.routes.filter(candidate => candidate.kind !== route.kind), route] });
+        return true;
+    }
+    finally {
+        await ledger.close();
+    }
+}
+/** Called only by privileged mutations. Sandbox lease/ACK/selection never enters here. */
+export async function reconcileSquareDelivery(artifact, location, env, clock) {
+    const snapshot = (await artifact.read(facts => ({ seats: facts.roster().filter(person => person.joined)
+            .flatMap(person => { const seat = facts.seat(person.name); return seat ? [seat] : []; }), posts: facts.postedPosts() }))).value;
+    if (!snapshot.seats.length && !snapshot.posts.length)
+        return;
+    const ledger = await openLedger(env);
+    try {
+        const sessions = await deliverySessionsForSeats(ledger, snapshot.seats);
+        for (const seat of snapshot.seats) {
+            const session = sessions.get(seat.owner);
+            if (!session)
+                continue;
+            if (session.state === 'deleted') {
+                await artifact.transactAs({ kind: 'host-cleanup', seat }, facts => {
+                    const current = facts.seat(seat.participant);
+                    if (current?.owner === seat.owner && current.generation === seat.generation && facts.participant(seat.participant)?.joined)
+                        facts.land(coreDone(facts, seat.participant, '', clock()));
+                });
+            }
+            else if (seat.attachment !== session.state) {
+                const attachment = session.state;
+                await artifact.transactAs({ kind: 'producer' }, facts => facts.setSeatAttachment(seat, attachment));
+            }
+        }
+        // A full receipt is monotonic external presentation evidence, never inferred from silence.
+        const receipts = new Map();
+        for (const owner of new Set(snapshot.posts.map(post => post.owner))) {
+            const keys = snapshot.posts.filter(post => post.owner === owner).map(post => squarePostKey(location, post));
+            receipts.set(owner, new Map((await ledger.receipts(owner, { keys })).map(receipt => [receipt.key, receipt.at])));
+        }
+        for (const post of snapshot.posts) {
+            const cardKey = squarePostKey(location, post);
+            const receipt = receipts.get(post.owner)?.get(cardKey);
+            if (receipt !== undefined && post.full === true && !post.consumed)
+                await artifact.transactAs({ kind: 'producer' }, facts => facts.foldReceipt(post, receipt));
+        }
+        await suppressWithdrawn(artifact, ledger, location);
+    }
+    finally {
+        await ledger.close();
+    }
+}
+async function suppressWithdrawn(artifact, ledger, location) {
+    const posts = (await artifact.read(facts => facts.postedPosts().filter(post => {
+        const seat = facts.seat(post.recipient);
+        return post.consumed || !seat || seat.owner !== post.owner || seat.generation !== post.generation;
+    }))).value;
+    // Departure withdraws only the captured notification, never producer read history or held effects.
+    for (const post of posts)
+        await ledger.suppress({ owner: post.owner, key: squarePostKey(location, post), scope: 'exact' });
+}
+/** One export path for Square activities and Square-owned notices. No transaction spans I/O. */
+export async function flushSquarePosts(artifact, location, env, clock) {
+    // Delivery enrichment cannot turn a committed producer mutation into a retry of that mutation.
+    let lifetime;
+    try {
+        const snapshot = (await artifact.read(facts => ({ pending: facts.pendingPosts(), posted: facts.postedPosts() }))).value;
+        if (!snapshot.pending.length && !snapshot.posted.length)
+            return;
+        const ledger = await openLedger(env);
+        lifetime = retainDeliveryLedger(ledger);
+        for (const post of snapshot.pending) {
+            const session = await ledger.session(post.owner);
+            if (session?.state !== 'attached')
+                continue;
+            const rendered = renderPost(location, post), token = randomUUID();
+            const owned = (await artifact.transactAs({ kind: 'producer' }, facts => facts.acquirePost({ ...post, full: rendered.full }, token, process.pid, clock(), Date.now()))).value;
+            if (!owned)
+                continue;
+            let posted = false, knownUnsent = true;
+            try {
+                // This check is not custody across the await; the ledger independently fences delivery.
+                const current = await ledger.session(post.owner);
+                if (current?.state !== 'attached' || current.generation !== session.generation
+                    || !(await artifact.read(facts => facts.ownsPost(token, Date.now()))).value)
+                    continue;
+                knownUnsent = false;
+                const result = await ledger.post({ owner: post.owner, key: squarePostKey(location, post), text: rendered.text,
+                    ...(post.kind === 'activity' ? { details: { kind: 'presentation', origin: displayAttentionPath(location),
+                            ref: formatActivityId(post.index), author: post.from, body: post.body ?? '',
+                            ...(post.route === 'bell' ? { badge: '🔔' } : {}) } } : {}),
+                });
+                posted = ['posted', 'duplicate', 'suppressed'].includes(result.status);
+                knownUnsent = !posted;
+                if (result.status === 'conflict')
+                    throw new Error('A Square card key already holds different text.');
+            }
+            finally {
+                const disposition = posted ? 'posted' : owned === 'initial' && knownUnsent ? 'never-exported' : 'uncertain';
+                await artifact.settleAs({ kind: 'producer' }, facts => facts.settlePost(token, rendered.full, disposition));
+            }
+        }
+        await suppressWithdrawn(artifact, ledger, location);
+        const posts = (await artifact.read(facts => facts.postedPosts().filter(post => {
+            const seat = facts.seat(post.recipient);
+            return !post.consumed && seat?.owner === post.owner && seat.generation === post.generation;
+        }))).value;
+        for (const owner of new Set(posts.map(post => post.owner))) {
+            const session = await ledger.session(owner);
+            if (session?.state !== 'attached')
+                continue;
+            const pendingKeys = new Set((await ledger.pending(owner, { generation: session.generation })).map(card => card.key));
+            for (const post of posts.filter(post => post.owner === owner)) {
+                const key = squarePostKey(location, post);
+                if (pendingKeys.has(key))
+                    await dispatchPostedCard(ledger, owner, key, lifetime.track, env);
+            }
+        }
+    }
+    catch {
+        // Unsettled/uncertain producer work is retried with its stable key at the next mutation.
+        // Missing ledger evidence never proves that an external card was not inserted or delivered.
+    }
+    finally {
+        await lifetime?.close();
+    }
+}

package/dist/square-producer-sqlite.d.ts

@@ -0,0 +1,11 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { ProducerRead, ProducerWrite } from './square-post.js';
+/** Private Square producer bookkeeping, on the artifact's existing connection/transaction. */
+export declare const producerSchemaSql = "CREATE TABLE square_notices (\n  notice_index INTEGER PRIMARY KEY CHECK (notice_index >= 0), at REAL NOT NULL,\n  sender_json TEXT NOT NULL, body_json TEXT NOT NULL, metadata_json TEXT\n);\nCREATE TABLE notice_audience (\n  notice_index INTEGER NOT NULL, recipient_key_json TEXT NOT NULL, recipient_json TEXT NOT NULL,\n  owner_json TEXT NOT NULL, generation_json TEXT NOT NULL, consumed_at REAL,\n  PRIMARY KEY (notice_index,recipient_key_json)\n) WITHOUT ROWID;\nCREATE TABLE producer_consumption (\n  recipient_key_json TEXT NOT NULL, owner_json TEXT NOT NULL, generation_json TEXT NOT NULL,\n  sender_json TEXT NOT NULL, match_json TEXT NOT NULL, at REAL NOT NULL,\n  PRIMARY KEY (recipient_key_json,generation_json,sender_json,match_json)\n) WITHOUT ROWID;\nCREATE TABLE square_posts (\n  kind TEXT NOT NULL CHECK (kind IN ('activity','notice')), item_index INTEGER NOT NULL,\n  recipient_key_json TEXT NOT NULL, token TEXT UNIQUE, owner_pid INTEGER,\n  first_export_at REAL NOT NULL, claim_at REAL NOT NULL,\n  posted INTEGER NOT NULL DEFAULT 0 CHECK (posted IN (0,1)), full INTEGER CHECK (full IN (0,1)),\n  PRIMARY KEY (kind,item_index,recipient_key_json)\n) WITHOUT ROWID;";
+export declare function initializeProducerSqlite(db: DatabaseSync): void;
+export declare function resetProducerSqlite(db: DatabaseSync): void;
+export declare function createProducerDriver(db: DatabaseSync): ProducerRead & ProducerWrite & {
+    readonly changed: boolean;
+    readonly deliveryChanged: boolean;
+    consumeActivity(index: number, at: number): void;
+};

package/dist/square-producer-sqlite.js

@@ -0,0 +1,210 @@
+import { matchesMetadata, validateMetadataMatch } from './delivery-deferral.js';
+import { SquareError, sameName, validateName, validateActivityMetadata } from './model.js';
+import { decoded, encode, finite, integer, json, key, object } from './sqlite-values.js';
+/** Private Square producer bookkeeping, on the artifact's existing connection/transaction. */
+export const producerSchemaSql = `CREATE TABLE square_notices (
+  notice_index INTEGER PRIMARY KEY CHECK (notice_index >= 0), at REAL NOT NULL,
+  sender_json TEXT NOT NULL, body_json TEXT NOT NULL, metadata_json TEXT
+);
+CREATE TABLE notice_audience (
+  notice_index INTEGER NOT NULL, recipient_key_json TEXT NOT NULL, recipient_json TEXT NOT NULL,
+  owner_json TEXT NOT NULL, generation_json TEXT NOT NULL, consumed_at REAL,
+  PRIMARY KEY (notice_index,recipient_key_json)
+) WITHOUT ROWID;
+CREATE TABLE producer_consumption (
+  recipient_key_json TEXT NOT NULL, owner_json TEXT NOT NULL, generation_json TEXT NOT NULL,
+  sender_json TEXT NOT NULL, match_json TEXT NOT NULL, at REAL NOT NULL,
+  PRIMARY KEY (recipient_key_json,generation_json,sender_json,match_json)
+) WITHOUT ROWID;
+CREATE TABLE square_posts (
+  kind TEXT NOT NULL CHECK (kind IN ('activity','notice')), item_index INTEGER NOT NULL,
+  recipient_key_json TEXT NOT NULL, token TEXT UNIQUE, owner_pid INTEGER,
+  first_export_at REAL NOT NULL, claim_at REAL NOT NULL,
+  posted INTEGER NOT NULL DEFAULT 0 CHECK (posted IN (0,1)), full INTEGER CHECK (full IN (0,1)),
+  PRIMARY KEY (kind,item_index,recipient_key_json)
+) WITHOUT ROWID;`;
+export function initializeProducerSqlite(db) { db.exec(producerSchemaSql); }
+export function resetProducerSqlite(db) {
+    for (const table of ['square_posts', 'producer_consumption', 'notice_audience', 'square_notices'])
+        db.exec(`DROP TABLE ${table}`);
+}
+function canonicalMatch(match) {
+    const fields = validateMetadataMatch(match).fields.map(field => ({ path: [...field.path], equals: field.equals }));
+    fields.sort((a, b) => {
+        const left = JSON.stringify(a.path), right = JSON.stringify(b.path);
+        return left < right ? -1 : left > right ? 1 : 0;
+    });
+    return encode({ fields });
+}
+const EXPORT_IDENTITY_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+const EXPORT_OWNERSHIP_MS = 60_000;
+function withinExportWindow(first, now) {
+    return now >= first && now - first < EXPORT_IDENTITY_WINDOW_MS;
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+export function createProducerDriver(db) {
+    let changed = false;
+    const rows = (sql, args = []) => db.prepare(sql).all(...args);
+    const one = (sql, args = []) => db.prepare(sql).get(...args);
+    const run = (sql, args = []) => {
+        const count = Number(db.prepare(sql).run(...args).changes);
+        if (count)
+            changed = true;
+        return count;
+    };
+    function authority(seat) {
+        const current = one(`SELECT s.*,p.joined FROM participant_seats s JOIN participants p
+      ON p.name_key_json=s.participant_key_json WHERE s.participant_key_json=?`, [key(seat.participant)]);
+        if (!current || current.joined !== 1 || current.owner_json !== encode(seat.owner)
+            || current.generation_json !== encode(seat.generation) || current.attachment !== 'attached')
+            throw new SquareError('already_joined', 'This participant seat is away or has been replaced.', { reason: 'needs_seat' });
+    }
+    function consumed(post) {
+        return rows(`SELECT sender_json,match_json FROM producer_consumption WHERE recipient_key_json=? AND owner_json=? AND generation_json=?`, [key(post.recipient), encode(post.owner), encode(post.generation)])
+            .some(row => sameName(decoded(row.sender_json, true), post.from) && matchesMetadata(post.metadata, json(row.match_json)));
+    }
+    function knownConsumed(post) {
+        return post.kind === 'activity'
+            ? !!one('SELECT 1 FROM caught_activity WHERE recipient_key_json=? AND act_index=?', [key(post.recipient), post.index])
+                || !!one(`SELECT 1 FROM activities WHERE kind='read' AND actor_key_json=? AND json_extract(payload_json,'$.through')>=?`, [key(post.recipient), post.index])
+            : one('SELECT consumed_at FROM notice_audience WHERE recipient_key_json=? AND notice_index=?', [key(post.recipient), post.index])?.consumed_at != null;
+    }
+    function consume(post, at) {
+        return post.kind === 'activity'
+            ? run('INSERT INTO caught_activity(recipient_key_json,act_index,at) VALUES(?,?,?) ON CONFLICT DO NOTHING', [key(post.recipient), post.index, at])
+            : run('UPDATE notice_audience SET consumed_at=? WHERE recipient_key_json=? AND notice_index=? AND consumed_at IS NULL', [at, key(post.recipient), post.index]);
+    }
+    function allPosts() {
+        const activity = rows(`SELECT a.act_index,a.at,a.actor_json,a.payload_json,d.*,p.name_json,
+        x.full,x.posted FROM activities a JOIN landed_audience d ON d.act_index=a.act_index
+        JOIN participants p ON p.name_key_json=d.recipient_key_json
+        LEFT JOIN square_posts x ON x.kind='activity' AND x.item_index=a.act_index AND x.recipient_key_json=d.recipient_key_json
+        WHERE a.kind='say' AND d.owner_json IS NOT NULL AND d.generation_json IS NOT NULL ORDER BY a.act_index,d.recipient_order`)
+            .map((row) => {
+            const payload = object(json(row.payload_json));
+            return { kind: 'activity', index: integer(row.act_index), recipient: decoded(row.name_json, true),
+                owner: decoded(row.owner_json, true), generation: decoded(row.generation_json, true), from: decoded(row.actor_json, true), at: finite(row.at),
+                ...(payload.body === undefined ? {} : { body: payload.body }),
+                ...(payload.metadata === undefined ? {} : { metadata: payload.metadata }), route: row.reason,
+                ...(row.full === null ? {} : { full: row.full === 1 }) };
+        });
+        const notices = rows(`SELECT n.*,a.*,x.full FROM square_notices n JOIN notice_audience a USING(notice_index)
+      LEFT JOIN square_posts x ON x.kind='notice' AND x.item_index=n.notice_index AND x.recipient_key_json=a.recipient_key_json ORDER BY n.notice_index,a.recipient_key_json`)
+            .map((row) => ({ kind: 'notice', index: integer(row.notice_index), recipient: decoded(row.recipient_json, true),
+            owner: decoded(row.owner_json, true), generation: decoded(row.generation_json, true), from: decoded(row.sender_json, true), at: finite(row.at),
+            body: decoded(row.body_json), ...(row.metadata_json === null ? {} : { metadata: json(row.metadata_json) }),
+            ...(row.full === null ? {} : { full: row.full === 1 }) }));
+        return [...activity, ...notices].map(post => ({ ...post, consumed: knownConsumed(post) }));
+    }
+    const driver = {
+        pendingPosts() {
+            return allPosts().filter(post => !post.consumed && !one(`SELECT 1 FROM square_posts WHERE kind=? AND item_index=? AND recipient_key_json=? AND posted=1`, [post.kind, post.index, key(post.recipient)]));
+        },
+        postedPosts() {
+            return allPosts().filter(post => !!one(`SELECT 1 FROM square_posts WHERE kind=? AND item_index=? AND recipient_key_json=? AND (posted=1 OR token IS NOT NULL)`, [post.kind, post.index, key(post.recipient)]));
+        },
+        ownsPost(token, exportAt = Date.now()) {
+            const row = one('SELECT * FROM square_posts WHERE token=?', [token]);
+            return !!row && row.posted !== 1 && withinExportWindow(finite(row.first_export_at), finite(exportAt))
+                && exportAt >= finite(row.claim_at) && exportAt - finite(row.claim_at) < EXPORT_OWNERSHIP_MS;
+        },
+        insertNotice(input, at) {
+            validateName(input.from);
+            if (typeof input.body !== 'string' || !input.body.trim())
+                throw new SquareError('invalid_args', 'A notification needs a non-empty body.');
+            const metadata = validateActivityMetadata(input.metadata);
+            const targets = typeof input.to === 'string' ? [input.to] : input.to;
+            if (!Array.isArray(targets) || targets.length < 1 || targets.length > 10)
+                throw new SquareError('invalid_args', 'A notification needs between 1 and 10 recipients.');
+            const recipients = [];
+            for (const name of targets) {
+                validateName(name);
+                if (recipients.some(row => sameName(decoded(row.participant_json, true), name)))
+                    continue;
+                const row = one(`SELECT s.* FROM participant_seats s JOIN participants p ON p.name_key_json=s.participant_key_json WHERE p.joined=1 AND p.name_key_json=?`, [key(name)]);
+                if (!row)
+                    throw new SquareError('invalid_args', `Notification recipient ${name} is not standing.`, { reason: 'not_standing', targets: [name] });
+                recipients.push(row);
+            }
+            const index = integer(one('SELECT COALESCE(MAX(notice_index),-1)+1 AS n FROM square_notices').n);
+            if (!Number.isSafeInteger(index + 1))
+                throw new SquareError('invalid_args', 'Notification index is exhausted.');
+            const body = input.body;
+            run('INSERT INTO square_notices VALUES(?,?,?,?,?)', [index, finite(at), encode(input.from), encode(body), metadata === undefined ? null : encode(metadata)]);
+            for (const row of recipients) {
+                const post = { kind: 'notice', index, recipient: decoded(row.participant_json, true), owner: decoded(row.owner_json, true),
+                    generation: decoded(row.generation_json, true), from: input.from, body, at, ...(metadata === undefined ? {} : { metadata }) };
+                run('INSERT INTO notice_audience VALUES(?,?,?,?,?,?)', [index, key(post.recipient), encode(post.recipient), encode(post.owner), encode(post.generation), consumed(post) ? at : null]);
+            }
+            return { id: `notice/${index}`, at, from: input.from, to: recipients.map(row => decoded(row.participant_json, true)), body, ...(metadata === undefined ? {} : { metadata }) };
+        },
+        ackMatching(seat, input, at) {
+            authority(seat);
+            validateName(input.from);
+            if (input.future !== 'exact')
+                throw new SquareError('invalid_args', 'Future consumption requires an explicit exact outcome.');
+            const match = canonicalMatch(input.match);
+            run('INSERT INTO producer_consumption VALUES(?,?,?,?,?,?) ON CONFLICT DO NOTHING', [key(seat.participant), encode(seat.owner), encode(seat.generation), key(input.from), match, finite(at)]);
+            let count = 0;
+            for (const post of allPosts()) {
+                if (sameName(post.recipient, seat.participant) && post.owner === seat.owner && post.generation === seat.generation
+                    && sameName(post.from, input.from) && matchesMetadata(post.metadata, input.match) && !post.consumed)
+                    count += consume(post, at);
+            }
+            return count;
+        },
+        acquirePost(post, token, pid, now, exportAt = Date.now()) {
+            // A scanned value is not custody. Re-read all source and policy facts under the World writer.
+            const current = allPosts().find(candidate => candidate.kind === post.kind && candidate.index === post.index && candidate.recipient === post.recipient);
+            if (!current || current.owner !== post.owner || current.generation !== post.generation || current.consumed)
+                return false;
+            const seat = one('SELECT * FROM participant_seats WHERE participant_key_json=?', [key(post.recipient)]);
+            if (!seat || seat.owner_json !== encode(post.owner) || seat.generation_json !== encode(post.generation) || seat.attachment !== 'attached')
+                return false;
+            if (consumed(current)) {
+                consume(current, now);
+                return false;
+            }
+            const previous = one('SELECT * FROM square_posts WHERE kind=? AND item_index=? AND recipient_key_json=?', [post.kind, post.index, key(post.recipient)]);
+            finite(exportAt);
+            if (previous?.posted === 1)
+                return false;
+            const first = previous ? finite(previous.first_export_at) : exportAt;
+            // Missing ledger identity after retention cannot prove an abandoned export was unsent.
+            if (!withinExportWindow(first, exportAt) || previous && exportAt < finite(previous.claim_at))
+                return false;
+            if (previous?.token != null && exportAt >= finite(previous.claim_at)
+                && exportAt - finite(previous.claim_at) < EXPORT_OWNERSHIP_MS && processIsAlive(integer(previous.owner_pid, 1)))
+                return false;
+            run(`INSERT INTO square_posts(kind,item_index,recipient_key_json,token,owner_pid,full,first_export_at,claim_at) VALUES(?,?,?,?,?,?,?,?)
+        ON CONFLICT(kind,item_index,recipient_key_json) DO UPDATE SET token=excluded.token,owner_pid=excluded.owner_pid,full=excluded.full,claim_at=excluded.claim_at`, [post.kind, post.index, key(post.recipient), token, integer(pid, 1), post.full === undefined ? null : Number(post.full), first, exportAt]);
+            return previous ? 'recovered' : 'initial';
+        },
+        settlePost(token, full, disposition) {
+            // Only a proved-unsent initial claim may erase its export age; prior uncertainty survives.
+            if (disposition === 'never-exported')
+                return run('DELETE FROM square_posts WHERE token=?', [token]) > 0;
+            return run('UPDATE square_posts SET token=NULL,owner_pid=NULL,posted=?,full=? WHERE token=?', [Number(disposition === 'posted'), Number(full), token]) > 0;
+        },
+        foldReceipt(post, at) {
+            const current = allPosts().find(candidate => candidate.kind === post.kind && candidate.index === post.index && candidate.recipient === post.recipient);
+            if (!current || current.owner !== post.owner || current.generation !== post.generation || current.full !== true || current.consumed)
+                return false;
+            return consume(current, finite(at)) > 0;
+        },
+        consumeActivity(index, at) {
+            for (const post of allPosts())
+                if (post.kind === 'activity' && post.index === index && consumed(post))
+                    consume(post, at);
+        },
+    };
+    return Object.defineProperties(driver, { changed: { get: () => changed }, deliveryChanged: { get: () => changed } });
+}

package/dist/square-sqlite.d.ts

@@ -1,12 +1,12 @@
 import { type DatabaseSync } from 'node:sqlite';
 import { type ActivityObservation, type HardCap, type Seat, type StoredAct, type HydratedAct, type WatchLease } from './model.js';
 import type { SquareHeader, SquareRead } from './ports.js';
-import type { ChannelWrite, EndpointRef } from './channel-ports.js';
+import type { SeatRef } from './ports.js';
 import type { StoreFormat } from './artifact-store.js';
 export { invalidArtifact } from './sqlite-values.js';
-export { endpointGeneration } from './sqlite-channel.js';
+export { validateEndpointGeneration as endpointGeneration } from './message.js';
 export declare const APPLICATION_ID = 1397838405;
-export declare const CURRENT_USER_VERSION = 11;
+export declare const CURRENT_USER_VERSION = 12;
 /** Explicit import/export DTOs, not a runtime transaction model. */
 export interface SquareRuntimeState {
     nextActIndex: number;
@@ -22,8 +22,8 @@ export interface SquareState {
     runtime: SquareRuntimeState;
 }
 export declare function emptyRuntimeState(nextActIndex?: number): SquareRuntimeState;
-/** Agora owns only its allocator/configuration header and social tables; neutral storage owns the revision header. */
-export declare const AGORA_SCHEMA_SQL = "CREATE TABLE square_meta (\n  id INTEGER PRIMARY KEY CHECK (id = 1),\n  next_act_index INTEGER NOT NULL CHECK (next_act_index BETWEEN 0 AND 9007199254740991),\n  hard_cap INTEGER CHECK (hard_cap BETWEEN 1 AND 9007199254740991),\n  throttle_per_minute INTEGER CHECK (throttle_per_minute BETWEEN 1 AND 9007199254740991),\n  preamble_json TEXT NOT NULL CHECK (json_valid(preamble_json)),\n  warmup_json TEXT NOT NULL CHECK (json_valid(warmup_json))\n);\nCREATE TABLE activities (\n  act_index INTEGER PRIMARY KEY CHECK (act_index BETWEEN 0 AND 9007199254740991),\n  at REAL NOT NULL,\n  kind TEXT NOT NULL CHECK (kind IN ('join','done','say','read','listen','ignore','unlisten')),\n  actor_json TEXT COLLATE BINARY NOT NULL,\n  actor_key_json TEXT COLLATE BINARY NOT NULL,\n  reach TEXT CHECK (reach = 'bell'),\n  reply_index INTEGER CHECK (reply_index >= 0 AND reply_index < act_index),\n  message_index INTEGER CHECK (message_index IS NULL OR message_index BETWEEN 0 AND 9007199254740991),\n  payload_json TEXT NOT NULL CHECK (json_valid(payload_json)),\n  CHECK ((kind = 'say') = (message_index IS NOT NULL)),\n  CHECK (kind = 'say' OR (reach IS NULL AND reply_index IS NULL))\n);\nCREATE INDEX activity_kind_index ON activities(kind, act_index);\nCREATE INDEX activity_actor_index ON activities(actor_key_json, act_index);\nCREATE INDEX activity_say_actor_index ON activities(actor_key_json, act_index) WHERE kind='say';\nCREATE INDEX activity_say_time ON activities(at, act_index) WHERE kind='say';\nCREATE INDEX activity_bell_actor_time ON activities(actor_key_json, at, act_index) WHERE kind='say' AND reach='bell';\nCREATE UNIQUE INDEX activity_message ON activities(message_index) WHERE message_index IS NOT NULL;\nCREATE TABLE participants (\n  name_key_json TEXT COLLATE BINARY PRIMARY KEY NOT NULL,\n  name_json TEXT NOT NULL,\n  first_index INTEGER NOT NULL UNIQUE,\n  joined INTEGER NOT NULL CHECK (joined IN (0,1)),\n  done INTEGER NOT NULL CHECK (done IN (0,1)),\n  say_count INTEGER NOT NULL CHECK (say_count >= 0),\n  last_active_at REAL,\n  last_join_index INTEGER,\n  CHECK (NOT (joined=1 AND done=1))\n) WITHOUT ROWID;\nCREATE TABLE attention (\n  listener_key_json TEXT COLLATE BINARY NOT NULL,\n  target_key_json TEXT COLLATE BINARY NOT NULL,\n  target_json TEXT NOT NULL,\n  kind TEXT NOT NULL CHECK (kind IN ('listen','ignore')),\n  since_index INTEGER NOT NULL,\n  PRIMARY KEY (listener_key_json, target_key_json)\n) WITHOUT ROWID;\nCREATE INDEX attention_target ON attention(target_key_json, kind, listener_key_json);\nCREATE TABLE landed_audience (\n  act_index INTEGER NOT NULL,\n  recipient_key_json TEXT COLLATE BINARY NOT NULL,\n  recipient_order INTEGER NOT NULL CHECK (recipient_order >= 0),\n  reason TEXT NOT NULL CHECK (reason IN ('mention','reply','attention','bell')),\n  PRIMARY KEY (act_index, recipient_key_json),\n  UNIQUE (act_index, recipient_order)\n) WITHOUT ROWID;\nCREATE INDEX audience_recipient ON landed_audience(recipient_key_json, act_index);";
+/** Square owns activity, audience, participant, and read-state facts. */
+export declare const AGORA_SCHEMA_SQL = "CREATE TABLE square_meta (\n  id INTEGER PRIMARY KEY CHECK (id = 1),\n  next_act_index INTEGER NOT NULL CHECK (next_act_index BETWEEN 0 AND 9007199254740991),\n  hard_cap INTEGER CHECK (hard_cap BETWEEN 1 AND 9007199254740991),\n  throttle_per_minute INTEGER CHECK (throttle_per_minute BETWEEN 1 AND 9007199254740991),\n  preamble_json TEXT NOT NULL CHECK (json_valid(preamble_json)),\n  warmup_json TEXT NOT NULL CHECK (json_valid(warmup_json))\n);\nCREATE TABLE activities (\n  act_index INTEGER PRIMARY KEY CHECK (act_index BETWEEN 0 AND 9007199254740991),\n  at REAL NOT NULL,\n  kind TEXT NOT NULL CHECK (kind IN ('join','done','say','read','listen','ignore','unlisten')),\n  actor_json TEXT COLLATE BINARY NOT NULL,\n  actor_key_json TEXT COLLATE BINARY NOT NULL,\n  reach TEXT CHECK (reach = 'bell'),\n  reply_index INTEGER CHECK (reply_index >= 0 AND reply_index < act_index),\n  payload_json TEXT NOT NULL CHECK (json_valid(payload_json)),\n  CHECK (kind = 'say' OR (reach IS NULL AND reply_index IS NULL))\n);\nCREATE INDEX activity_kind_index ON activities(kind, act_index);\nCREATE INDEX activity_actor_index ON activities(actor_key_json, act_index);\nCREATE INDEX activity_say_actor_index ON activities(actor_key_json, act_index) WHERE kind='say';\nCREATE INDEX activity_say_time ON activities(at, act_index) WHERE kind='say';\nCREATE INDEX activity_bell_actor_time ON activities(actor_key_json, at, act_index) WHERE kind='say' AND reach='bell';\nCREATE TABLE participants (\n  name_key_json TEXT COLLATE BINARY PRIMARY KEY NOT NULL,\n  name_json TEXT NOT NULL,\n  first_index INTEGER NOT NULL UNIQUE,\n  joined INTEGER NOT NULL CHECK (joined IN (0,1)),\n  done INTEGER NOT NULL CHECK (done IN (0,1)),\n  say_count INTEGER NOT NULL CHECK (say_count >= 0),\n  last_active_at REAL,\n  last_join_index INTEGER,\n  CHECK (NOT (joined=1 AND done=1))\n) WITHOUT ROWID;\nCREATE TABLE attention (\n  listener_key_json TEXT COLLATE BINARY NOT NULL,\n  target_key_json TEXT COLLATE BINARY NOT NULL,\n  target_json TEXT NOT NULL,\n  kind TEXT NOT NULL CHECK (kind IN ('listen','ignore')),\n  since_index INTEGER NOT NULL,\n  PRIMARY KEY (listener_key_json, target_key_json)\n) WITHOUT ROWID;\nCREATE INDEX attention_target ON attention(target_key_json, kind, listener_key_json);\nCREATE TABLE landed_audience (\n  act_index INTEGER NOT NULL,\n  recipient_key_json TEXT COLLATE BINARY NOT NULL,\n  recipient_order INTEGER NOT NULL CHECK (recipient_order >= 0),\n  reason TEXT NOT NULL CHECK (reason IN ('mention','reply','attention','bell')),\n  owner_json TEXT,\n  generation_json TEXT,\n  PRIMARY KEY (act_index, recipient_key_json),\n  UNIQUE (act_index, recipient_order)\n) WITHOUT ROWID;\nCREATE INDEX audience_recipient ON landed_audience(recipient_key_json, act_index);\nCREATE TABLE participant_seats (\n  participant_key_json TEXT PRIMARY KEY NOT NULL, participant_json TEXT NOT NULL,\n  owner_json TEXT NOT NULL, generation_json TEXT NOT NULL,\n  wake_address_json TEXT, attachment TEXT NOT NULL CHECK (attachment IN ('attached','detached'))\n) WITHOUT ROWID;\nCREATE INDEX participant_seat_owner ON participant_seats(owner_json);\nCREATE TABLE caught_activity (\n  recipient_key_json TEXT NOT NULL, act_index INTEGER NOT NULL, at REAL NOT NULL,\n  PRIMARY KEY (recipient_key_json,act_index)\n) WITHOUT ROWID;\nCREATE TABLE catch_leases (\n  recipient_key_json TEXT PRIMARY KEY NOT NULL, generation_json TEXT NOT NULL,\n  lease_json TEXT NOT NULL CHECK (json_valid(lease_json))\n) WITHOUT ROWID;";
 export interface AgoraConfig {
     readonly hardCap?: number | null;
     readonly throttlePerMinute?: number;
@@ -32,38 +32,28 @@ export interface AgoraConfig {
 }
 export declare function initializeAgoraSqlite(db: DatabaseSync, configuration?: AgoraConfig): void;
 export declare function resetAgoraSqlite(db: DatabaseSync): void;
-/** The lower schema is supplied by the composition root; Agora never defines Channel tables. */
-export interface LowerSchema {
-    readonly schemaSql: string;
-    initialize(db: DatabaseSync): void;
-    reset(db: DatabaseSync): void;
-}
-/** Explicit full-Square framing and reset, composed from the neutral store and the supplied Channel schema. */
-export declare function squareStoreFormat(lower: LowerSchema, resetStorage: (db: DatabaseSync) => void): StoreFormat;
-/** A persisted upper activity. A say is a relation: it may not carry content and must name its message. */
+/** Full Square framing and reset, including producer state. */
+export declare function squareStoreFormat(resetStorage: (db: DatabaseSync) => void): StoreFormat;
+/** Validate the complete persisted activity. */
 export declare function validateStoredActivity(value: unknown): StoredAct;
-/** The explicit upper projection of a stored say onto its authoritative message content. */
+/** Validate complete activity content. */
 export declare function validateHydratedActivity(value: unknown): HydratedAct;
 export declare function validateWatchLease(value: unknown): WatchLease;
 export declare function readSquareHeader(db: DatabaseSync): SquareHeader;
 export interface SqliteDriver extends SquareRead {
-    readonly channel: ChannelWrite;
     storeSeat(seat: Seat): boolean;
-    removeSeat(seat: EndpointRef): boolean;
+    removeSeat(seat: SeatRef): boolean;
     applyLanding(effect: import('./square-domain.js').LandingEffect): void;
     readonly changed: boolean;
     readonly deliveryChanged: boolean;
-    /** Explicit import replay: one message for every say, then the activity/audience facts. */
+    /** Explicit import replay of activity and audience facts. */
     importLanding(activity: HydratedAct): StoredAct;
 }
-export declare function createSqliteDriver(db: DatabaseSync, channelDriver?: ChannelWrite & {
-    readonly changed: boolean;
-    readonly deliveryChanged: boolean;
-}): SqliteDriver;
+export declare function createSqliteDriver(db: DatabaseSync): SqliteDriver;
 /** Explicit import replay. Caller owns the transaction and format publication. */
-export declare function initializeSqlite(db: DatabaseSync, state: SquareState, revision: number, lower: LowerSchema): void;
+export declare function initializeSqlite(db: DatabaseSync, state: SquareState, revision: number): void;
 export declare function exportSqliteState(db: DatabaseSync): SquareState;
-/** Read-only integrity inspection; maintained-index replay runs when the lower schema is supplied. */
-export declare function inspectSqlite(db: DatabaseSync, lower?: LowerSchema): {
+/** Read-only integrity inspection. */
+export declare function inspectSqlite(db: DatabaseSync): {
     standingCount: number;
 };