@athenaintel/react 0.41.2 → 0.42.1

package/dist/agent-runtime/src/thread-prewarm-controller.d.ts

@@ -0,0 +1,76 @@
+import type { DeepAgentMessageWindowDeclaration } from "./message-window";
+import { type DeepAgentHeadersResolver, type DeepAgentWakeFetch } from "./deep-agent-transport-recipe";
+import { type AttachRetryGate, type DeepAgentAttachTimingEvent } from "./statewire-attach-observer";
+import { type DeepAgentPrewarmTransportFactory, type DeepAgentThreadPrewarmPool, type DeepAgentThreadPrewarmPoolOptions } from "./thread-prewarm";
+/** What signalled the intent to open the thread. */
+export type DeepAgentPrewarmReason = "hover" | "pointerdown" | "click" | "route";
+export interface DeepAgentThreadPrewarmControllerOptions<TState> {
+    /** Base URL of the deep-agent statewire host (the `…/v2/threads` mount). */
+    baseUrl: string;
+    /** The mounted thread's auth resolver — a pooled attach must be the attach the thread would open. */
+    headers: DeepAgentHeadersResolver;
+    /** The mounted thread's head window declaration (`useDeepAgentThread({ messageWindow })`); the pooled dial must ask for the same shape. */
+    messageWindow?: DeepAgentMessageWindowDeclaration | undefined;
+    /** The mounted thread's lane paging (`useDeepAgentThread({ laneHistory })`); the pooled dial and the wake must declare the same contract version. */
+    laneHistory?: boolean | undefined;
+    /** SSE when true, WebSocket otherwise; match the mounted thread. */
+    sse?: boolean;
+    /** Attach timing + retry hints for both the wake and the pooled dials. */
+    onAttachTiming?: (input: {
+        threadId: string;
+        event: DeepAgentAttachTimingEvent;
+    }) => void;
+    /** A pooled hello landed (hosts with a snapshot cache remember it here). */
+    onState?: DeepAgentThreadPrewarmPoolOptions<TState>["onState"];
+    onDiscard?: DeepAgentThreadPrewarmPoolOptions<TState>["onDiscard"];
+    /** Pool sizing; defaults are the pool's own. */
+    pool?: Pick<DeepAgentThreadPrewarmPoolOptions<TState>, "maxEntries" | "graceMs" | "ttlMs">;
+    /** One wake per thread per window: the route is idempotent, a flickering hover must not hammer it. */
+    wakeDedupeMs?: number;
+    maxWakeRecords?: number;
+    /** Test seams. */
+    fetch?: DeepAgentWakeFetch;
+    retryGate?: AttachRetryGate;
+    createTransport?: DeepAgentPrewarmTransportFactory<TState>;
+    now?: () => number;
+}
+export interface DeepAgentThreadPrewarmController<TState> {
+    /** Hand this to `useDeepAgentThread` / `useDeepAgentRuntime` as `prewarmPool`. */
+    readonly pool: DeepAgentThreadPrewarmPool<TState>;
+    /**
+     * Warm a thread the user is about to open. Every intent wakes the server
+     * instance (`POST …/prewarm`, deduped); only a hover dwell also dials a
+     * pooled attach — a pointer-down or click is followed by the thread's own
+     * attach within a frame or two, and a pooled dial started then is disposed
+     * before its handshake completes. Returns whether a pooled dial started.
+     */
+    prewarm(threadId: string, input: {
+        reason: DeepAgentPrewarmReason;
+    }): boolean;
+    /** The intent lapsed (pointer left the row): keep the dial warm for the grace window. */
+    release(threadId: string): void;
+    /** Whether a switch to `threadId` can seed its first frame from a pooled hello. */
+    isWarm(threadId: string): boolean;
+    /** Logout / identity change: drop every pooled dial and wake record. */
+    clear(): void;
+}
+/**
+ * The host-agnostic half of a surface's thread prewarm: the wake-then-dial
+ * policy Olympus runs from its sidebar, over the shared attach recipe, so a
+ * conversation list in any surface warms a thread the same way. A host binds
+ * one controller per (statewire host, principal) and clears it when either
+ * changes: a pooled attach dials with that principal's token.
+ *
+ * The wake's `Retry-After` (503/429) lands in the retry gate keyed by the
+ * thread URL, and the attach recipe waits that floor out before it dials —
+ * both the pooled attach and the thread's own attach after the click honour
+ * the server's hint without any host code. The one dial that can race the
+ * hint is the hover's own speculative attach, started alongside the wake; a
+ * floor that arrives while it is still handshaking discards it.
+ */
+export declare function createDeepAgentThreadPrewarmController<TState>({ baseUrl, headers, messageWindow, laneHistory, sse, onAttachTiming, onState, onDiscard, pool: poolOptions, wakeDedupeMs, maxWakeRecords, fetch: fetchOverride, retryGate, createTransport, now, }: DeepAgentThreadPrewarmControllerOptions<TState>): DeepAgentThreadPrewarmController<TState>;
+/** The retry-gate key the wake and the attach share for a thread. */
+export declare function deepAgentPrewarmGateKey({ baseUrl, threadId, }: {
+    baseUrl: string;
+    threadId: string;
+}): string;

package/dist/agent-runtime/src/thread-prewarm.d.ts

@@ -0,0 +1,118 @@
+import { type ResourceElement } from '@assistant-ui/tap';
+import type { Statewire } from 'statewire';
+/**
+ * Pre-dialed statewire attaches for threads the user is ABOUT to open.
+ *
+ * A thread switch today starts its network work only after React has torn
+ * down the previous thread and mounted the new one — the attach (socket open
+ * + server authorize + history load + hello) queues behind the heaviest part
+ * of the switch. The pool moves that attach ahead of the click: on sidebar
+ * hover (dwell-gated) or pointer-down the host asks the pool to `prewarm` a
+ * thread, and the pool mounts the thread's transport in a standalone tap root
+ * — built by the same recipe the thread uses — so it dials immediately. The
+ * server does its expensive work (authorize, `_load_history`, the hello) while
+ * the pointer is still on the row, and the instance it activates stays warm
+ * for the click.
+ *
+ * A pooled attach rides a process-local session lane, never the thread's
+ * persisted one: a persisted lane is single-consumer per tab (its Web Lock
+ * serializes every session mounted on it), and a pooled root sharing the
+ * lane with the thread's own session stalled the thread's dial behind the
+ * held lock and livelocked its teardown. The pool never hands its client over,
+ * so it has no use for the lane.
+ *
+ * Warm-and-seed, not a live handoff: when the thread mounts it `take`s the
+ * pooled hello as its seed — its first frame is the transcript, with no
+ * loading treatment — and dials its OWN attach against the now-warm instance;
+ * the pooled root is disposed in the same step, so one socket is live per
+ * thread after mount. A statewire session is a single-consumer object: handing
+ * a root one tap tree mounted to another tree's client left the client's
+ * change feed unreliable, and the outgoing thread's teardown redialed the
+ * shared root in a tight loop — so the pool never shares a live root.
+ *
+ * A take that arrives BEFORE the pooled hello does not close the socket. The
+ * server is still mid-`authorize`/activation on it, and pinned treats a client
+ * that leaves before it is served as grounds to discard the half-built
+ * instance record (`LocalDirectory.discard_unserved`) — with the wake and the
+ * thread's own attach still resolving on that same record, both then bounce
+ * off "instance closing; retry" (a 503 on the wake, a 1011 close on the
+ * attach) and the click pays a statewire backoff plus a cold re-activation
+ * instead of the warm instance the hover paid for (staging, 2026-09-04: every
+ * hover the pointer clicked through within a few hundred ms did this). The
+ * taken dial is kept as an orphan until its hello lands — remembered through
+ * `onState`, then disposed — or the grace window passes. `has` / `hasState` /
+ * `take` no longer see it, but it is still a live socket: it counts toward
+ * `maxEntries` (the oldest live root evicts first, orphan or not), and a
+ * renewed `prewarm` for the same thread re-adopts it instead of dialing a
+ * second socket.
+ *
+ * Bounds: at most `maxEntries` live roots (oldest evicts), each released
+ * entry disposed after `graceMs`, every entry disposed after `ttlMs`. A root
+ * that is refused (`gone`, or an `unauthorized` retry) or whose dial fails is
+ * discarded at once so the pool never retries a denial or a dead server the
+ * thread's own attach handles (and parks) with its full policy. Nothing here
+ * decides *what* to prewarm — hosts gate on their own rules (never the active
+ * thread, never a new chat, never under a view-as lens).
+ */
+type TransportValue<TState> = Statewire<TState | undefined>;
+type TransportElement<TState> = ResourceElement<TransportValue<TState>>;
+/** Builds the thread's transport element — once per prewarm. The transport must
+ * leave its session process-local (no `sessionStore`; see the module notes). */
+export type DeepAgentPrewarmTransportFactory<TState> = (input: {
+    threadId: string;
+}) => TransportElement<TState>;
+export type DeepAgentPrewarmDiscardReason = 'released' | 'expired' | 'evicted' | 'refused' | 'failed' | 'taken' | 'cleared' | 'discarded';
+export interface DeepAgentThreadPrewarmPoolOptions<TState> {
+    createTransport: DeepAgentPrewarmTransportFactory<TState>;
+    /** Live roots retained; the oldest evicts beyond this. */
+    maxEntries?: number;
+    /** How long a released (hover-left) entry stays warm before disposal. */
+    graceMs?: number;
+    /** Hard lifetime of any entry since its prewarm. */
+    ttlMs?: number;
+    /** The hello landed on a pooled root (state is the live wire state). */
+    onState?: (input: {
+        threadId: string;
+        state: TState;
+    }) => void;
+    onDiscard?: (input: {
+        threadId: string;
+        reason: DeepAgentPrewarmDiscardReason;
+    }) => void;
+    now?: () => number;
+}
+/** What a mounting thread takes from the pool: the hello, if it landed. */
+export interface PrewarmedDeepAgentHello<TState> {
+    threadId: string;
+    /** The wire state the pooled attach replicated, or `undefined` before the hello. */
+    state: TState | undefined;
+    /** Whether the pooled attach had reached `connected` when taken. */
+    connected: boolean;
+    /** `now()` at prewarm — when the dial started. */
+    dialedAt: number;
+}
+export interface DeepAgentThreadPrewarmPool<TState> {
+    /** Start (or refresh) a warm root for the thread. Returns `true` when a dial was started. */
+    prewarm(threadId: string): boolean;
+    /** The intent lapsed (hover left): keep the root warm for `graceMs`, then dispose. */
+    release(threadId: string): void;
+    has(threadId: string): boolean;
+    /** The root has replicated a hello. */
+    hasState(threadId: string): boolean;
+    /**
+     * Hand the pooled hello to the mounting thread and dispose the root (its
+     * socket closes): the thread seeds its first frame from the state and dials
+     * its own attach against the instance the pool warmed. Before the hello the
+     * dial stays up alongside the thread's own attach until it lands (or the
+     * grace window passes) — see the module notes — and the entry leaves the
+     * pool's view either way (`has` is false, a second take is `null`) while
+     * still counting toward `maxEntries`.
+     */
+    take(threadId: string): PrewarmedDeepAgentHello<TState> | null;
+    /** Dispose one entry immediately (e.g. the thread attaches on its own terms). */
+    discard(threadId: string): void;
+    clear(): void;
+    readonly size: number;
+}
+export declare function createDeepAgentThreadPrewarmPool<TState>({ createTransport, maxEntries, graceMs, ttlMs, onState, onDiscard, now, }: DeepAgentThreadPrewarmPoolOptions<TState>): DeepAgentThreadPrewarmPool<TState>;
+export {};

package/dist/agent-runtime/src/thread-snapshot-cache.d.ts

@@ -0,0 +1,99 @@
+import type { DeepAgentStreamValues } from './types';
+/**
+ * Per-tab LRU of the last wire state seen per thread, so a switch back to a
+ * recently-visited thread can mount with that snapshot instead of an empty
+ * "loading" state (see `UseDeepAgentThreadOptions.snapshotCache`). Entries are
+ * references into states the wire already produced — remembering is O(1) and
+ * copies nothing; the bound is `maxThreads` retained states.
+ */
+export interface DeepAgentThreadSnapshotCache {
+    /** Record the latest hydrated wire state for a thread. */
+    remember(threadId: string, state: DeepAgentStreamValues): void;
+    /** The freshest remembered state for a thread, or `undefined` when none is
+     * held or the entry aged out. */
+    take(threadId: string): DeepAgentStreamValues | undefined;
+    /**
+     * Drop a single thread's entry. Called when the server refuses
+     * authorization for the thread — a refused thread must not warm-paint on
+     * its next mount.
+     */
+    forget(threadId: string): void;
+    /**
+     * Drop every entry. Called when the acting identity changes — a snapshot
+     * captured under one account must never seed a mount under another.
+     */
+    clear(): void;
+    /**
+     * Whether a fresh entry is held for the thread, without consuming or
+     * touching it. Hosts read it at selection time to decide whether the switch
+     * can paint from a seed (no loading treatment) or must cover the attach
+     * wait. Optional so hand-rolled caches keep type-checking; the built-in
+     * cache implements it.
+     */
+    peek?(threadId: string): boolean;
+}
+/** A write observed on the cache — the durable-mirror seam (see `onChange`). */
+export type DeepAgentThreadSnapshotCacheChange = {
+    type: 'remember';
+    threadId: string;
+    state: DeepAgentStreamValues;
+    at: number;
+} | {
+    type: 'forget';
+    threadId: string;
+} | {
+    type: 'clear';
+};
+export interface DeepAgentThreadSnapshotCacheOptions {
+    /** Threads retained; the least-recently written entry evicts beyond this. */
+    maxThreads?: number;
+    /**
+     * Entries older than this are dropped at read time. The seed's value is
+     * "the thread you just left" — a snapshot from long ago is more likely to
+     * flash content the server has since rewritten than to save a paint.
+     */
+    maxAgeMs?: number;
+    /**
+     * Observer of every write (`remember`, `forget`, `clear`). Hosts mirror
+     * entries into durable storage from here so a reload can seed too; the
+     * observer is never invoked for `restore`, which re-admits mirrored entries.
+     * Exceptions are swallowed — a mirror fault must not break the wire path.
+     */
+    onChange?: (change: DeepAgentThreadSnapshotCacheChange) => void;
+    /** Injectable clock (tests). */
+    now?: () => number;
+}
+/** The built-in cache: the host contract plus the durable-mirror re-admission. */
+export interface CreatedDeepAgentThreadSnapshotCache extends DeepAgentThreadSnapshotCache {
+    peek(threadId: string): boolean;
+    /**
+     * Re-admit an entry captured earlier — a mirrored snapshot after a reload —
+     * under its ORIGINAL capture time, so the age bound still applies. Never
+     * displaces a fresher in-memory entry and never notifies `onChange`.
+     */
+    restore(threadId: string, state: DeepAgentStreamValues, at: number): void;
+}
+export declare function createDeepAgentThreadSnapshotCache(options?: DeepAgentThreadSnapshotCacheOptions): CreatedDeepAgentThreadSnapshotCache;
+/**
+ * Shape a remembered wire state for use as a mount's `initialState`.
+ *
+ * Messages/todos and the other app-owned keys seed as captured. The run lane
+ * seeds by what the user left: a thread whose run was `running` when the
+ * snapshot was taken seeds a running entry (see {@link seedRunsLane}) so the
+ * switch back reads Running with a Stop control on its first frame — the same
+ * frame `runs: []` would render as "ready" with a Send button over a thread the
+ * server is still mid-run on. Every other live-lifecycle lane normalizes to
+ * resting: a seeded input request could collect a decision the server may have
+ * already resolved, so an `input-required` entry seeds as no run at all.
+ * `__interrupt__` is dropped for the same reason, and so are `ptc_subagents`
+ * (the live in-eval dispatch lane — a seeded "running" dispatch card under a
+ * resting thread would render active with no eval behind it) and
+ * `outOfBandRunActive` (the host's out-of-band-run-in-progress flag — seeding a
+ * finished run's `true` would hide the composer until the attach corrected
+ * it). Durable thread properties (`runConfig`, `config`, `sessionPersisted`, …)
+ * seed as captured; the attach snapshot then replaces the whole seed. The
+ * protocol lane seeds as a seed's own copy (`withSeedProtocolLane`), so
+ * `isDeepAgentHostState` never reads the seed, or a state folded over it, as
+ * what the host holds now.
+ */
+export declare function toThreadSnapshotSeed(state: DeepAgentStreamValues): DeepAgentStreamValues;

package/dist/agent-runtime/src/thread-snapshot-mirror.cjs

@@ -0,0 +1,329 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const sealedIdb = require("./sealed-idb.cjs");
+const THREAD_SNAPSHOT_MIRROR_DATABASE = "athena-thread-snapshots:v2";
+const THREAD_SNAPSHOT_MIRROR_FORMAT = 1;
+const MAX_MIRRORED_SNAPSHOTS_PER_OWNER = 30;
+const MAX_MIRRORED_SNAPSHOT_MESSAGES = 150;
+const SNAPSHOT_MIRROR_DEBOUNCE_MS = 1500;
+const DATABASE_VERSION = 1;
+const SNAPSHOTS_STORE = "snapshots";
+const LISTS_STORE = "lists";
+const BY_OWNER = "byOwner";
+const BY_OWNER_AT = "byOwnerAt";
+function upgradeMirrorDatabase(db) {
+  if (!db.objectStoreNames.contains(SNAPSHOTS_STORE)) {
+    const store = db.createObjectStore(SNAPSHOTS_STORE, { keyPath: "key" });
+    store.createIndex(BY_OWNER, "owner", { unique: false });
+    store.createIndex(BY_OWNER_AT, ["owner", "at"], { unique: false });
+  }
+  if (!db.objectStoreNames.contains(LISTS_STORE)) {
+    const lists = db.createObjectStore(LISTS_STORE, { keyPath: "key" });
+    lists.createIndex(BY_OWNER, "owner", { unique: false });
+  }
+}
+function isRestingThreadSnapshot(state) {
+  var _a;
+  const run = (_a = state.runs) == null ? void 0 : _a[0];
+  if (run && run.status === "running") return false;
+  if (state.outOfBandRunActive === true) return false;
+  return Array.isArray(state.messages);
+}
+function classifyThreadSnapshotForMirror(state, maxMessages = MAX_MIRRORED_SNAPSHOT_MESSAGES) {
+  var _a;
+  if (!isRestingThreadSnapshot(state)) return "skip";
+  return (((_a = state.messages) == null ? void 0 : _a.length) ?? 0) <= maxMessages ? "persist" : "invalidate";
+}
+function isOwnFormat(record) {
+  if (typeof record !== "object" || record === null) return true;
+  const format = record.format;
+  return typeof format !== "number" || format <= THREAD_SNAPSHOT_MIRROR_FORMAT;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function createThreadSnapshotMirror({
+  getKey,
+  factory = sealedIdb.idbGlobals.indexedDB,
+  databaseName = THREAD_SNAPSHOT_MIRROR_DATABASE,
+  debounceMs = SNAPSHOT_MIRROR_DEBOUNCE_MS,
+  maxPerOwner = MAX_MIRRORED_SNAPSHOTS_PER_OWNER,
+  maxMessages = MAX_MIRRORED_SNAPSHOT_MESSAGES
+}) {
+  const database = sealedIdb.lazySealedDatabase({
+    factory,
+    name: databaseName,
+    version: DATABASE_VERSION,
+    upgrade: upgradeMirrorDatabase
+  });
+  const keyOf = async (ownerId, purpose) => {
+    try {
+      return await getKey(ownerId, purpose);
+    } catch {
+      return null;
+    }
+  };
+  const aadOf = (kind, owner, key) => `athena-thread-snapshot|${THREAD_SNAPSHOT_MIRROR_FORMAT}|${kind}|${owner}|${key}`;
+  const pending = /* @__PURE__ */ new Map();
+  const pendingLists = /* @__PURE__ */ new Map();
+  let queue = Promise.resolve();
+  const enqueue = (task) => {
+    queue = queue.then(task, task).catch(() => {
+    });
+    return queue;
+  };
+  const pruneOwner = async (db, owner) => {
+    const KeyRange = sealedIdb.idbGlobals.IDBKeyRange;
+    if (!KeyRange) return;
+    const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
+    const store = tx.objectStore(SNAPSHOTS_STORE);
+    const index = store.index(BY_OWNER_AT);
+    const range = KeyRange.bound([owner, Number.NEGATIVE_INFINITY], [owner, Number.POSITIVE_INFINITY]);
+    const beyond = [];
+    await new Promise((resolve, reject) => {
+      let kept = 0;
+      const request = index.openKeyCursor(range, "prev");
+      request.onsuccess = () => {
+        const cursor = request.result;
+        if (!cursor) {
+          resolve();
+          return;
+        }
+        kept += 1;
+        if (kept > maxPerOwner) beyond.push(cursor.primaryKey);
+        cursor.continue();
+      };
+      request.onerror = () => reject(request.error ?? new Error("IndexedDB cursor failed"));
+    });
+    for (const key of beyond) {
+      if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) store.delete(key);
+    }
+    await sealedIdb.transactionDone(tx);
+  };
+  const put = (input) => enqueue(async () => {
+    const db = await database();
+    if (!db) return;
+    const cryptoKey = await keyOf(input.ownerId, "write");
+    if (!cryptoKey) return;
+    const owner = await sealedIdb.sha256Hex(input.ownerId);
+    const key = await sealedIdb.sha256Hex(`${input.ownerId}|${input.threadId}`);
+    const sealed = await sealedIdb.sealJson({
+      key: cryptoKey,
+      value: { threadId: input.threadId, state: input.state },
+      aad: aadOf("snapshot", owner, key)
+    });
+    const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
+    const store = tx.objectStore(SNAPSHOTS_STORE);
+    if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) {
+      store.put({
+        key,
+        owner,
+        at: input.at,
+        format: THREAD_SNAPSHOT_MIRROR_FORMAT,
+        sealed
+      });
+    }
+    await sealedIdb.transactionDone(tx);
+    await pruneOwner(db, owner);
+  });
+  const deleteSnapshot = (input) => enqueue(async () => {
+    const db = await database();
+    if (!db) return;
+    const key = await sealedIdb.sha256Hex(`${input.ownerId}|${input.threadId}`);
+    const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
+    const store = tx.objectStore(SNAPSHOTS_STORE);
+    if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) store.delete(key);
+    await sealedIdb.transactionDone(tx);
+  });
+  const pendingKey = (ownerId, threadId) => `${ownerId}\0${threadId}`;
+  const flushPending = (key) => {
+    const entry = pending.get(key);
+    if (!entry) return Promise.resolve();
+    pending.delete(key);
+    clearTimeout(entry.timer);
+    return put(entry.input);
+  };
+  const putList = (input) => enqueue(async () => {
+    const db = await database();
+    if (!db) return;
+    const cryptoKey = await keyOf(input.ownerId, "write");
+    if (!cryptoKey) return;
+    const owner = await sealedIdb.sha256Hex(input.ownerId);
+    const key = await sealedIdb.sha256Hex(`${input.ownerId}|list|${input.listKey}`);
+    const sealed = await sealedIdb.sealJson({ key: cryptoKey, value: input.value, aad: aadOf("list", owner, key) });
+    const tx = db.transaction(LISTS_STORE, "readwrite");
+    const store = tx.objectStore(LISTS_STORE);
+    if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) {
+      store.put({
+        key,
+        owner,
+        at: Date.now(),
+        format: THREAD_SNAPSHOT_MIRROR_FORMAT,
+        sealed
+      });
+    }
+    await sealedIdb.transactionDone(tx);
+  });
+  const flushList = (key) => {
+    const entry = pendingLists.get(key);
+    if (!entry) return Promise.resolve();
+    pendingLists.delete(key);
+    clearTimeout(entry.timer);
+    return putList(entry.input);
+  };
+  const dropPendingOf = (ownerId) => {
+    for (const [key, entry] of pending) {
+      if (ownerId === null || entry.input.ownerId === ownerId) {
+        clearTimeout(entry.timer);
+        pending.delete(key);
+      }
+    }
+    for (const [key, entry] of pendingLists) {
+      if (ownerId === null || entry.input.ownerId === ownerId) {
+        clearTimeout(entry.timer);
+        pendingLists.delete(key);
+      }
+    }
+  };
+  return {
+    async load(ownerId) {
+      try {
+        const db = await database();
+        if (!db) return [];
+        const cryptoKey = await keyOf(ownerId, "read");
+        if (!cryptoKey) return [];
+        const owner = await sealedIdb.sha256Hex(ownerId);
+        const records = await sealedIdb.requestToPromise(
+          db.transaction(SNAPSHOTS_STORE, "readonly").objectStore(SNAPSHOTS_STORE).index(BY_OWNER).getAll(owner)
+        );
+        const loaded = [];
+        const unreadable = [];
+        for (const record of records) {
+          if (!record || record.format > THREAD_SNAPSHOT_MIRROR_FORMAT) continue;
+          try {
+            const value = await sealedIdb.openJson({
+              key: cryptoKey,
+              sealed: record.sealed,
+              aad: aadOf("snapshot", owner, record.key)
+            });
+            if (isRecord(value) && typeof value.threadId === "string" && isRecord(value.state) && typeof record.at === "number") {
+              loaded.push({ threadId: value.threadId, state: value.state, at: record.at });
+            }
+          } catch {
+            unreadable.push(record.key);
+          }
+        }
+        if (unreadable.length > 0) {
+          void enqueue(async () => {
+            const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
+            for (const key of unreadable) tx.objectStore(SNAPSHOTS_STORE).delete(key);
+            await sealedIdb.transactionDone(tx);
+          });
+        }
+        return loaded.sort((a, b) => a.at - b.at);
+      } catch {
+        return [];
+      }
+    },
+    write(input) {
+      const key = pendingKey(input.ownerId, input.threadId);
+      const verdict = classifyThreadSnapshotForMirror(input.state, maxMessages);
+      if (verdict === "invalidate") {
+        const existing2 = pending.get(key);
+        if (existing2) clearTimeout(existing2.timer);
+        pending.delete(key);
+        void deleteSnapshot(input);
+        return;
+      }
+      if (verdict === "skip") return;
+      const existing = pending.get(key);
+      if (existing) clearTimeout(existing.timer);
+      pending.set(key, {
+        input,
+        timer: setTimeout(() => {
+          void flushPending(key);
+        }, debounceMs)
+      });
+    },
+    remove(input) {
+      const key = pendingKey(input.ownerId, input.threadId);
+      const existing = pending.get(key);
+      if (existing) clearTimeout(existing.timer);
+      pending.delete(key);
+      void deleteSnapshot(input);
+    },
+    writeList(input) {
+      const key = pendingKey(input.ownerId, `list:${input.listKey}`);
+      const existing = pendingLists.get(key);
+      if (existing) clearTimeout(existing.timer);
+      pendingLists.set(key, {
+        input,
+        timer: setTimeout(() => {
+          void flushList(key);
+        }, debounceMs)
+      });
+    },
+    async loadList({ ownerId, listKey }) {
+      try {
+        const db = await database();
+        if (!db) return null;
+        const cryptoKey = await keyOf(ownerId, "read");
+        if (!cryptoKey) return null;
+        const owner = await sealedIdb.sha256Hex(ownerId);
+        const key = await sealedIdb.sha256Hex(`${ownerId}|list|${listKey}`);
+        const record = await sealedIdb.requestToPromise(
+          db.transaction(LISTS_STORE, "readonly").objectStore(LISTS_STORE).get(key)
+        );
+        if (!record || record.format > THREAD_SNAPSHOT_MIRROR_FORMAT || record.owner !== owner) return null;
+        try {
+          const value = await sealedIdb.openJson({ key: cryptoKey, sealed: record.sealed, aad: aadOf("list", owner, key) });
+          return { value, at: record.at };
+        } catch {
+          return null;
+        }
+      } catch {
+        return null;
+      }
+    },
+    clearOwner(ownerId) {
+      dropPendingOf(ownerId);
+      return enqueue(async () => {
+        const db = await database();
+        if (!db) return;
+        const owner = await sealedIdb.sha256Hex(ownerId);
+        const tx = db.transaction([SNAPSHOTS_STORE, LISTS_STORE], "readwrite");
+        for (const storeName of [SNAPSHOTS_STORE, LISTS_STORE]) {
+          const store = tx.objectStore(storeName);
+          const keys = await sealedIdb.requestToPromise(store.index(BY_OWNER).getAllKeys(owner));
+          for (const key of keys) store.delete(key);
+        }
+        await sealedIdb.transactionDone(tx);
+      });
+    },
+    clearAll() {
+      dropPendingOf(null);
+      return enqueue(async () => {
+        const db = await database();
+        if (!db) return;
+        const tx = db.transaction([SNAPSHOTS_STORE, LISTS_STORE], "readwrite");
+        tx.objectStore(SNAPSHOTS_STORE).clear();
+        tx.objectStore(LISTS_STORE).clear();
+        await sealedIdb.transactionDone(tx);
+      });
+    },
+    async flush() {
+      await Promise.all([...pending.keys()].map(flushPending));
+      await Promise.all([...pendingLists.keys()].map(flushList));
+      await queue;
+    }
+  };
+}
+exports.MAX_MIRRORED_SNAPSHOTS_PER_OWNER = MAX_MIRRORED_SNAPSHOTS_PER_OWNER;
+exports.MAX_MIRRORED_SNAPSHOT_MESSAGES = MAX_MIRRORED_SNAPSHOT_MESSAGES;
+exports.SNAPSHOT_MIRROR_DEBOUNCE_MS = SNAPSHOT_MIRROR_DEBOUNCE_MS;
+exports.THREAD_SNAPSHOT_MIRROR_DATABASE = THREAD_SNAPSHOT_MIRROR_DATABASE;
+exports.THREAD_SNAPSHOT_MIRROR_FORMAT = THREAD_SNAPSHOT_MIRROR_FORMAT;
+exports.classifyThreadSnapshotForMirror = classifyThreadSnapshotForMirror;
+exports.createThreadSnapshotMirror = createThreadSnapshotMirror;
+exports.isRestingThreadSnapshot = isRestingThreadSnapshot;
+//# sourceMappingURL=thread-snapshot-mirror.cjs.map