@athenaintel/react 0.57.1 → 0.59.0

package/dist/agent-runtime/src/sealed-idb.cjs

@@ -26,6 +26,66 @@ async function sealJson({
   sealed.set(ciphertext, SEALED_IV_BYTES);
   return sealed;
 }
+async function sealText({
+  key,
+  text,
+  aad
+}) {
+  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));
+  const ciphertext = new Uint8Array(
+    await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: encoder.encode(aad) }, key, encoder.encode(text))
+  );
+  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);
+  sealed.set(iv, 0);
+  sealed.set(ciphertext, SEALED_IV_BYTES);
+  return sealed;
+}
+async function openText({
+  key,
+  sealed,
+  aad
+}) {
+  const iv = sealed.subarray(0, SEALED_IV_BYTES);
+  const plaintext = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv, additionalData: encoder.encode(aad) },
+    key,
+    sealed.subarray(SEALED_IV_BYTES)
+  );
+  return decoder.decode(plaintext);
+}
+const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function bytesToBase64(bytes) {
+  let out = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const a = bytes[index] ?? 0;
+    const b = bytes[index + 1];
+    const c = bytes[index + 2];
+    const triple = a << 16 | (b ?? 0) << 8 | (c ?? 0);
+    out += BASE64[triple >> 18 & 63];
+    out += BASE64[triple >> 12 & 63];
+    out += b === void 0 ? "=" : BASE64[triple >> 6 & 63];
+    out += c === void 0 ? "=" : BASE64[triple & 63];
+  }
+  return out;
+}
+function base64ToBytes(text) {
+  const clean = text.replace(/=+$/, "");
+  const bytes = new Uint8Array(Math.floor(clean.length * 3 / 4));
+  let bits = 0;
+  let value = 0;
+  let at = 0;
+  for (const char of clean) {
+    const digit = BASE64.indexOf(char);
+    if (digit === -1) throw new Error("base64: invalid character");
+    value = value << 6 | digit;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes[at++] = value >> bits & 255;
+    }
+  }
+  return bytes.subarray(0, at);
+}
 async function openJson({
   key,
   sealed,
@@ -101,12 +161,16 @@ function lazySealedDatabase({
   };
 }
 exports.SEALED_IV_BYTES = SEALED_IV_BYTES;
+exports.base64ToBytes = base64ToBytes;
+exports.bytesToBase64 = bytesToBase64;
 exports.idbGlobals = idbGlobals;
 exports.lazySealedDatabase = lazySealedDatabase;
 exports.openJson = openJson;
 exports.openSealedDatabase = openSealedDatabase;
+exports.openText = openText;
 exports.requestToPromise = requestToPromise;
 exports.sealJson = sealJson;
+exports.sealText = sealText;
 exports.sha256Hex = sha256Hex;
 exports.transactionDone = transactionDone;
 //# sourceMappingURL=sealed-idb.cjs.map

package/dist/agent-runtime/src/sealed-idb.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"sealed-idb.cjs","sources":["../../../../agent-runtime/src/sealed-idb.ts"],"sourcesContent":["/**\n * The sealed-record toolkit the device stores in this package share (the thread snapshot mirror,\n * the chat outbox): AES-GCM-256 sealing with a fresh IV and additional data that binds a record to\n * where it is stored, SHA-256 names so a database names no one, and the part of IndexedDB they use.\n *\n * This package compiles without the DOM lib (React Native honesty, `globals.d.ts`), so IndexedDB is\n * described structurally here; the stores run only where it exists and degrade to nothing where it\n * does not.\n */\n\nexport type IdbListener = ((event?: unknown) => void) | null;\n\nexport interface IdbRequest<T> {\n  readonly result: T;\n  readonly error: unknown;\n  onsuccess: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbOpenRequest extends IdbRequest<IdbDatabase> {\n  onupgradeneeded: IdbListener;\n  onblocked: IdbListener;\n}\n\nexport interface IdbFactory {\n  open(name: string, version?: number): IdbOpenRequest;\n}\n\nexport interface IdbCursor {\n  readonly primaryKey: unknown;\n  continue(): void;\n}\n\nexport interface IdbIndex {\n  getAll(query?: unknown): IdbRequest<unknown[]>;\n  getAllKeys(query?: unknown): IdbRequest<unknown[]>;\n  openKeyCursor(range?: unknown, direction?: string): IdbRequest<IdbCursor | null>;\n}\n\nexport interface IdbObjectStore {\n  put(value: unknown): IdbRequest<unknown>;\n  get(key: unknown): IdbRequest<unknown>;\n  delete(key: unknown): IdbRequest<unknown>;\n  clear(): IdbRequest<unknown>;\n  index(name: string): IdbIndex;\n  createIndex(name: string, keyPath: string | string[], options?: { unique?: boolean }): unknown;\n}\n\nexport interface IdbTransaction {\n  objectStore(name: string): IdbObjectStore;\n  readonly error: unknown;\n  oncomplete: IdbListener;\n  onabort: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbDatabase {\n  readonly objectStoreNames: { contains(name: string): boolean };\n  transaction(stores: string | string[], mode?: \"readonly\" | \"readwrite\"): IdbTransaction;\n  createObjectStore(name: string, options?: { keyPath: string }): IdbObjectStore;\n  onversionchange: IdbListener;\n  addEventListener(type: string, listener: () => void): void;\n  close(): void;\n}\n\nexport interface IdbKeyRangeStatic {\n  bound(lower: unknown, upper: unknown): unknown;\n}\n\nexport const idbGlobals = globalThis as { indexedDB?: object; IDBKeyRange?: IdbKeyRangeStatic };\n\n/** The AES-GCM IV length, prefixed to every sealed payload. */\nexport const SEALED_IV_BYTES = 12;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** `value` as JSON, sealed under `key` with a fresh IV; `aad` binds it to where it is stored. */\nexport async function sealJson({\n  key,\n  value,\n  aad,\n}: {\n  key: CryptoKey;\n  value: unknown;\n  aad: string;\n}): Promise<Uint8Array> {\n  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt(\n      { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n      key,\n      encoder.encode(JSON.stringify(value)),\n    ),\n  );\n  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);\n  sealed.set(iv, 0);\n  sealed.set(ciphertext, SEALED_IV_BYTES);\n  return sealed;\n}\n\n/** Opens what {@link sealJson} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */\nexport async function openJson({\n  key,\n  sealed,\n  aad,\n}: {\n  key: CryptoKey;\n  sealed: Uint8Array;\n  aad: string;\n}): Promise<unknown> {\n  const iv = sealed.subarray(0, SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>;\n  const plaintext = await crypto.subtle.decrypt(\n    { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n    key,\n    sealed.subarray(SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>,\n  );\n  return JSON.parse(decoder.decode(plaintext)) as unknown;\n}\n\nexport function requestToPromise<T>(request: IdbRequest<T>): Promise<T> {\n  return new Promise((resolve, reject) => {\n    request.onsuccess = () => resolve(request.result);\n    request.onerror = () => reject(request.error ?? new Error(\"IndexedDB request failed\"));\n  });\n}\n\nexport function transactionDone(tx: IdbTransaction): Promise<void> {\n  return new Promise((resolve, reject) => {\n    tx.oncomplete = () => resolve();\n    tx.onabort = () => reject(tx.error ?? new Error(\"IndexedDB transaction aborted\"));\n    tx.onerror = () => reject(tx.error ?? new Error(\"IndexedDB transaction failed\"));\n  });\n}\n\n/**\n * Opens `name` at `version`, creating what `upgrade` creates. Resolves `null` instead of failing:\n * a database a newer build upgraded past this version, a blocked open, or no IndexedDB at all\n * (private browsing, SSR) all mean \"no store here\".\n */\nexport function openSealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: IdbFactory;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): Promise<IdbDatabase | null> {\n  return new Promise((resolve) => {\n    try {\n      const request = factory.open(name, version);\n      request.onupgradeneeded = () => upgrade(request.result);\n      request.onsuccess = () => {\n        const db = request.result;\n        // Another page deleting or upgrading the database: step aside.\n        db.onversionchange = () => db.close();\n        resolve(db);\n      };\n      request.onerror = () => resolve(null);\n      request.onblocked = () => resolve(null);\n    } catch {\n      resolve(null);\n    }\n  });\n}\n\n/**\n * A lazily opened database handle that reopens after the browser (or another page's upgrade or\n * delete) closes it. `null` while there is no IndexedDB or Web Crypto here.\n */\nexport function lazySealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: object | undefined;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): () => Promise<IdbDatabase | null> {\n  let databasePromise: Promise<IdbDatabase | null> | null = null;\n  return () => {\n    if (!factory || typeof crypto === \"undefined\" || !crypto.subtle) return Promise.resolve(null);\n    databasePromise ??= openSealedDatabase({ factory: factory as IdbFactory, name, version, upgrade }).then(\n      (db) => {\n        if (db) {\n          const forget = () => {\n            databasePromise = null;\n          };\n          db.addEventListener(\"versionchange\", forget);\n          db.addEventListener(\"close\", forget);\n        } else {\n          databasePromise = null;\n        }\n        return db;\n      },\n    );\n    return databasePromise;\n  };\n}\n"],"names":[],"mappings":";;AAqEO,MAAM,aAAa;AAGnB,MAAM,kBAAkB;AAE/B,MAAM,UAAU,IAAI,YAAA;AACpB,MAAM,UAAU,IAAI,YAAA;AAEpB,eAAsB,UAAU,OAAgC;AAC9D,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;AAC1E,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACjG;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIwB;AACtB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC;AACjE,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO;AAAA,MAClB,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,MACzD;AAAA,MACA,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,IAAA;AAAA,EACtC;AAEF,QAAM,SAAS,IAAI,WAAW,kBAAkB,WAAW,UAAU;AACrE,SAAO,IAAI,IAAI,CAAC;AAChB,SAAO,IAAI,YAAY,eAAe;AACtC,SAAO;AACT;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIqB;AACnB,QAAM,KAAK,OAAO,SAAS,GAAG,eAAe;AAC7C,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,IACzD;AAAA,IACA,OAAO,SAAS,eAAe;AAAA,EAAA;AAEjC,SAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAC7C;AAEO,SAAS,iBAAoB,SAAoC;AACtE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAQ,YAAY,MAAM,QAAQ,QAAQ,MAAM;AAChD,YAAQ,UAAU,MAAM,OAAO,QAAQ,SAAS,IAAI,MAAM,0BAA0B,CAAC;AAAA,EACvF,CAAC;AACH;AAEO,SAAS,gBAAgB,IAAmC;AACjE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,OAAG,aAAa,MAAM,QAAA;AACtB,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,+BAA+B,CAAC;AAChF,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,8BAA8B,CAAC;AAAA,EACjF,CAAC;AACH;AAOO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKgC;AAC9B,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI;AACF,YAAM,UAAU,QAAQ,KAAK,MAAM,OAAO;AAC1C,cAAQ,kBAAkB,MAAM,QAAQ,QAAQ,MAAM;AACtD,cAAQ,YAAY,MAAM;AACxB,cAAM,KAAK,QAAQ;AAEnB,WAAG,kBAAkB,MAAM,GAAG,MAAA;AAC9B,gBAAQ,EAAE;AAAA,MACZ;AACA,cAAQ,UAAU,MAAM,QAAQ,IAAI;AACpC,cAAQ,YAAY,MAAM,QAAQ,IAAI;AAAA,IACxC,QAAQ;AACN,cAAQ,IAAI;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAMO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,MAAI,kBAAsD;AAC1D,SAAO,MAAM;AACX,QAAI,CAAC,WAAW,OAAO,WAAW,eAAe,CAAC,OAAO,OAAQ,QAAO,QAAQ,QAAQ,IAAI;AAC5F,0CAAoB,mBAAmB,EAAE,SAAgC,MAAM,SAAS,QAAA,CAAS,EAAE;AAAA,MACjG,CAAC,OAAO;AACN,YAAI,IAAI;AACN,gBAAM,SAAS,MAAM;AACnB,8BAAkB;AAAA,UACpB;AACA,aAAG,iBAAiB,iBAAiB,MAAM;AAC3C,aAAG,iBAAiB,SAAS,MAAM;AAAA,QACrC,OAAO;AACL,4BAAkB;AAAA,QACpB;AACA,eAAO;AAAA,MACT;AAAA,IAAA;AAEF,WAAO;AAAA,EACT;AACF;;;;;;;;;;"}
+{"version":3,"file":"sealed-idb.cjs","sources":["../../../../agent-runtime/src/sealed-idb.ts"],"sourcesContent":["/**\n * The sealed-record toolkit the device stores in this package share (the thread snapshot mirror,\n * the chat outbox): AES-GCM-256 sealing with a fresh IV and additional data that binds a record to\n * where it is stored, SHA-256 names so a database names no one, and the part of IndexedDB they use.\n *\n * This package compiles without the DOM lib (React Native honesty, `globals.d.ts`), so IndexedDB is\n * described structurally here; the stores run only where it exists and degrade to nothing where it\n * does not.\n */\n\nexport type IdbListener = ((event?: unknown) => void) | null;\n\nexport interface IdbRequest<T> {\n  readonly result: T;\n  readonly error: unknown;\n  onsuccess: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbOpenRequest extends IdbRequest<IdbDatabase> {\n  onupgradeneeded: IdbListener;\n  onblocked: IdbListener;\n}\n\nexport interface IdbFactory {\n  open(name: string, version?: number): IdbOpenRequest;\n}\n\nexport interface IdbCursor {\n  readonly primaryKey: unknown;\n  continue(): void;\n}\n\nexport interface IdbIndex {\n  getAll(query?: unknown): IdbRequest<unknown[]>;\n  getAllKeys(query?: unknown): IdbRequest<unknown[]>;\n  openKeyCursor(range?: unknown, direction?: string): IdbRequest<IdbCursor | null>;\n}\n\nexport interface IdbObjectStore {\n  put(value: unknown): IdbRequest<unknown>;\n  get(key: unknown): IdbRequest<unknown>;\n  delete(key: unknown): IdbRequest<unknown>;\n  clear(): IdbRequest<unknown>;\n  index(name: string): IdbIndex;\n  createIndex(name: string, keyPath: string | string[], options?: { unique?: boolean }): unknown;\n}\n\nexport interface IdbTransaction {\n  objectStore(name: string): IdbObjectStore;\n  readonly error: unknown;\n  oncomplete: IdbListener;\n  onabort: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbDatabase {\n  readonly objectStoreNames: { contains(name: string): boolean };\n  transaction(stores: string | string[], mode?: \"readonly\" | \"readwrite\"): IdbTransaction;\n  createObjectStore(name: string, options?: { keyPath: string }): IdbObjectStore;\n  onversionchange: IdbListener;\n  addEventListener(type: string, listener: () => void): void;\n  close(): void;\n}\n\nexport interface IdbKeyRangeStatic {\n  bound(lower: unknown, upper: unknown): unknown;\n}\n\nexport const idbGlobals = globalThis as { indexedDB?: object; IDBKeyRange?: IdbKeyRangeStatic };\n\n/** The AES-GCM IV length, prefixed to every sealed payload. */\nexport const SEALED_IV_BYTES = 12;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** `value` as JSON, sealed under `key` with a fresh IV; `aad` binds it to where it is stored. */\nexport async function sealJson({\n  key,\n  value,\n  aad,\n}: {\n  key: CryptoKey;\n  value: unknown;\n  aad: string;\n}): Promise<Uint8Array> {\n  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt(\n      { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n      key,\n      encoder.encode(JSON.stringify(value)),\n    ),\n  );\n  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);\n  sealed.set(iv, 0);\n  sealed.set(ciphertext, SEALED_IV_BYTES);\n  return sealed;\n}\n\n/** `text` sealed under `key` with a fresh IV; `aad` binds it to where it is stored. */\nexport async function sealText({\n  key,\n  text,\n  aad,\n}: {\n  key: CryptoKey;\n  text: string;\n  aad: string;\n}): Promise<Uint8Array> {\n  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt({ name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) }, key, encoder.encode(text)),\n  );\n  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);\n  sealed.set(iv, 0);\n  sealed.set(ciphertext, SEALED_IV_BYTES);\n  return sealed;\n}\n\n/** Opens what {@link sealText} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */\nexport async function openText({\n  key,\n  sealed,\n  aad,\n}: {\n  key: CryptoKey;\n  sealed: Uint8Array;\n  aad: string;\n}): Promise<string> {\n  const iv = sealed.subarray(0, SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>;\n  const plaintext = await crypto.subtle.decrypt(\n    { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n    key,\n    sealed.subarray(SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>,\n  );\n  return decoder.decode(plaintext);\n}\n\nconst BASE64 = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n\n/** Standard base64 of `bytes` (no DOM `btoa` here: React Native honesty). */\nexport function bytesToBase64(bytes: Uint8Array): string {\n  let out = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index] ?? 0;\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triple = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    out += BASE64[(triple >> 18) & 63];\n    out += BASE64[(triple >> 12) & 63];\n    out += b === undefined ? \"=\" : BASE64[(triple >> 6) & 63];\n    out += c === undefined ? \"=\" : BASE64[triple & 63];\n  }\n  return out;\n}\n\n/** The bytes {@link bytesToBase64} encoded; throws on a character outside the alphabet. */\nexport function base64ToBytes(text: string): Uint8Array {\n  const clean = text.replace(/=+$/, \"\");\n  const bytes = new Uint8Array(Math.floor((clean.length * 3) / 4));\n  let bits = 0;\n  let value = 0;\n  let at = 0;\n  for (const char of clean) {\n    const digit = BASE64.indexOf(char);\n    if (digit === -1) throw new Error(\"base64: invalid character\");\n    value = (value << 6) | digit;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes[at++] = (value >> bits) & 255;\n    }\n  }\n  return bytes.subarray(0, at);\n}\n\n/** Opens what {@link sealJson} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */\nexport async function openJson({\n  key,\n  sealed,\n  aad,\n}: {\n  key: CryptoKey;\n  sealed: Uint8Array;\n  aad: string;\n}): Promise<unknown> {\n  const iv = sealed.subarray(0, SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>;\n  const plaintext = await crypto.subtle.decrypt(\n    { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n    key,\n    sealed.subarray(SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>,\n  );\n  return JSON.parse(decoder.decode(plaintext)) as unknown;\n}\n\nexport function requestToPromise<T>(request: IdbRequest<T>): Promise<T> {\n  return new Promise((resolve, reject) => {\n    request.onsuccess = () => resolve(request.result);\n    request.onerror = () => reject(request.error ?? new Error(\"IndexedDB request failed\"));\n  });\n}\n\nexport function transactionDone(tx: IdbTransaction): Promise<void> {\n  return new Promise((resolve, reject) => {\n    tx.oncomplete = () => resolve();\n    tx.onabort = () => reject(tx.error ?? new Error(\"IndexedDB transaction aborted\"));\n    tx.onerror = () => reject(tx.error ?? new Error(\"IndexedDB transaction failed\"));\n  });\n}\n\n/**\n * Opens `name` at `version`, creating what `upgrade` creates. Resolves `null` instead of failing:\n * a database a newer build upgraded past this version, a blocked open, or no IndexedDB at all\n * (private browsing, SSR) all mean \"no store here\".\n */\nexport function openSealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: IdbFactory;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): Promise<IdbDatabase | null> {\n  return new Promise((resolve) => {\n    try {\n      const request = factory.open(name, version);\n      request.onupgradeneeded = () => upgrade(request.result);\n      request.onsuccess = () => {\n        const db = request.result;\n        // Another page deleting or upgrading the database: step aside.\n        db.onversionchange = () => db.close();\n        resolve(db);\n      };\n      request.onerror = () => resolve(null);\n      request.onblocked = () => resolve(null);\n    } catch {\n      resolve(null);\n    }\n  });\n}\n\n/**\n * A lazily opened database handle that reopens after the browser (or another page's upgrade or\n * delete) closes it. `null` while there is no IndexedDB or Web Crypto here.\n */\nexport function lazySealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: object | undefined;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): () => Promise<IdbDatabase | null> {\n  let databasePromise: Promise<IdbDatabase | null> | null = null;\n  return () => {\n    if (!factory || typeof crypto === \"undefined\" || !crypto.subtle) return Promise.resolve(null);\n    databasePromise ??= openSealedDatabase({ factory: factory as IdbFactory, name, version, upgrade }).then(\n      (db) => {\n        if (db) {\n          const forget = () => {\n            databasePromise = null;\n          };\n          db.addEventListener(\"versionchange\", forget);\n          db.addEventListener(\"close\", forget);\n        } else {\n          databasePromise = null;\n        }\n        return db;\n      },\n    );\n    return databasePromise;\n  };\n}\n"],"names":[],"mappings":";;AAqEO,MAAM,aAAa;AAGnB,MAAM,kBAAkB;AAE/B,MAAM,UAAU,IAAI,YAAA;AACpB,MAAM,UAAU,IAAI,YAAA;AAEpB,eAAsB,UAAU,OAAgC;AAC9D,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;AAC1E,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACjG;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIwB;AACtB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC;AACjE,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO;AAAA,MAClB,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,MACzD;AAAA,MACA,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,IAAA;AAAA,EACtC;AAEF,QAAM,SAAS,IAAI,WAAW,kBAAkB,WAAW,UAAU;AACrE,SAAO,IAAI,IAAI,CAAC;AAChB,SAAO,IAAI,YAAY,eAAe;AACtC,SAAO;AACT;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIwB;AACtB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC;AACjE,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA,GAAK,KAAK,QAAQ,OAAO,IAAI,CAAC;AAAA,EAAA;AAErH,QAAM,SAAS,IAAI,WAAW,kBAAkB,WAAW,UAAU;AACrE,SAAO,IAAI,IAAI,CAAC;AAChB,SAAO,IAAI,YAAY,eAAe;AACtC,SAAO;AACT;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIoB;AAClB,QAAM,KAAK,OAAO,SAAS,GAAG,eAAe;AAC7C,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,IACzD;AAAA,IACA,OAAO,SAAS,eAAe;AAAA,EAAA;AAEjC,SAAO,QAAQ,OAAO,SAAS;AACjC;AAEA,MAAM,SAAS;AAGR,SAAS,cAAc,OAA2B;AACvD,MAAI,MAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,SAAU,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACnD,WAAO,OAAQ,UAAU,KAAM,EAAE;AACjC,WAAO,OAAQ,UAAU,KAAM,EAAE;AACjC,WAAO,MAAM,SAAY,MAAM,OAAQ,UAAU,IAAK,EAAE;AACxD,WAAO,MAAM,SAAY,MAAM,OAAO,SAAS,EAAE;AAAA,EACnD;AACA,SAAO;AACT;AAGO,SAAS,cAAc,MAA0B;AACtD,QAAM,QAAQ,KAAK,QAAQ,OAAO,EAAE;AACpC,QAAM,QAAQ,IAAI,WAAW,KAAK,MAAO,MAAM,SAAS,IAAK,CAAC,CAAC;AAC/D,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,KAAK;AACT,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,OAAO,QAAQ,IAAI;AACjC,QAAI,UAAU,GAAI,OAAM,IAAI,MAAM,2BAA2B;AAC7D,YAAS,SAAS,IAAK;AACvB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,IAAI,IAAK,SAAS,OAAQ;AAAA,IAClC;AAAA,EACF;AACA,SAAO,MAAM,SAAS,GAAG,EAAE;AAC7B;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIqB;AACnB,QAAM,KAAK,OAAO,SAAS,GAAG,eAAe;AAC7C,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,IACzD;AAAA,IACA,OAAO,SAAS,eAAe;AAAA,EAAA;AAEjC,SAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAC7C;AAEO,SAAS,iBAAoB,SAAoC;AACtE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAQ,YAAY,MAAM,QAAQ,QAAQ,MAAM;AAChD,YAAQ,UAAU,MAAM,OAAO,QAAQ,SAAS,IAAI,MAAM,0BAA0B,CAAC;AAAA,EACvF,CAAC;AACH;AAEO,SAAS,gBAAgB,IAAmC;AACjE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,OAAG,aAAa,MAAM,QAAA;AACtB,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,+BAA+B,CAAC;AAChF,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,8BAA8B,CAAC;AAAA,EACjF,CAAC;AACH;AAOO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKgC;AAC9B,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI;AACF,YAAM,UAAU,QAAQ,KAAK,MAAM,OAAO;AAC1C,cAAQ,kBAAkB,MAAM,QAAQ,QAAQ,MAAM;AACtD,cAAQ,YAAY,MAAM;AACxB,cAAM,KAAK,QAAQ;AAEnB,WAAG,kBAAkB,MAAM,GAAG,MAAA;AAC9B,gBAAQ,EAAE;AAAA,MACZ;AACA,cAAQ,UAAU,MAAM,QAAQ,IAAI;AACpC,cAAQ,YAAY,MAAM,QAAQ,IAAI;AAAA,IACxC,QAAQ;AACN,cAAQ,IAAI;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAMO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,MAAI,kBAAsD;AAC1D,SAAO,MAAM;AACX,QAAI,CAAC,WAAW,OAAO,WAAW,eAAe,CAAC,OAAO,OAAQ,QAAO,QAAQ,QAAQ,IAAI;AAC5F,0CAAoB,mBAAmB,EAAE,SAAgC,MAAM,SAAS,QAAA,CAAS,EAAE;AAAA,MACjG,CAAC,OAAO;AACN,YAAI,IAAI;AACN,gBAAM,SAAS,MAAM;AACnB,8BAAkB;AAAA,UACpB;AACA,aAAG,iBAAiB,iBAAiB,MAAM;AAC3C,aAAG,iBAAiB,SAAS,MAAM;AAAA,QACrC,OAAO;AACL,4BAAkB;AAAA,QACpB;AACA,eAAO;AAAA,MACT;AAAA,IAAA;AAEF,WAAO;AAAA,EACT;AACF;;;;;;;;;;;;;;"}

package/dist/agent-runtime/src/sealed-idb.d.ts

@@ -75,6 +75,22 @@ export declare function sealJson({ key, value, aad, }: {
     value: unknown;
     aad: string;
 }): Promise<Uint8Array>;
+/** `text` sealed under `key` with a fresh IV; `aad` binds it to where it is stored. */
+export declare function sealText({ key, text, aad, }: {
+    key: CryptoKey;
+    text: string;
+    aad: string;
+}): Promise<Uint8Array>;
+/** Opens what {@link sealText} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */
+export declare function openText({ key, sealed, aad, }: {
+    key: CryptoKey;
+    sealed: Uint8Array;
+    aad: string;
+}): Promise<string>;
+/** Standard base64 of `bytes` (no DOM `btoa` here: React Native honesty). */
+export declare function bytesToBase64(bytes: Uint8Array): string;
+/** The bytes {@link bytesToBase64} encoded; throws on a character outside the alphabet. */
+export declare function base64ToBytes(text: string): Uint8Array;
 /** Opens what {@link sealJson} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */
 export declare function openJson({ key, sealed, aad, }: {
     key: CryptoKey;

package/dist/agent-runtime/src/sealed-idb.js

@@ -24,6 +24,66 @@ async function sealJson({
   sealed.set(ciphertext, SEALED_IV_BYTES);
   return sealed;
 }
+async function sealText({
+  key,
+  text,
+  aad
+}) {
+  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));
+  const ciphertext = new Uint8Array(
+    await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: encoder.encode(aad) }, key, encoder.encode(text))
+  );
+  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);
+  sealed.set(iv, 0);
+  sealed.set(ciphertext, SEALED_IV_BYTES);
+  return sealed;
+}
+async function openText({
+  key,
+  sealed,
+  aad
+}) {
+  const iv = sealed.subarray(0, SEALED_IV_BYTES);
+  const plaintext = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv, additionalData: encoder.encode(aad) },
+    key,
+    sealed.subarray(SEALED_IV_BYTES)
+  );
+  return decoder.decode(plaintext);
+}
+const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function bytesToBase64(bytes) {
+  let out = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const a = bytes[index] ?? 0;
+    const b = bytes[index + 1];
+    const c = bytes[index + 2];
+    const triple = a << 16 | (b ?? 0) << 8 | (c ?? 0);
+    out += BASE64[triple >> 18 & 63];
+    out += BASE64[triple >> 12 & 63];
+    out += b === void 0 ? "=" : BASE64[triple >> 6 & 63];
+    out += c === void 0 ? "=" : BASE64[triple & 63];
+  }
+  return out;
+}
+function base64ToBytes(text) {
+  const clean = text.replace(/=+$/, "");
+  const bytes = new Uint8Array(Math.floor(clean.length * 3 / 4));
+  let bits = 0;
+  let value = 0;
+  let at = 0;
+  for (const char of clean) {
+    const digit = BASE64.indexOf(char);
+    if (digit === -1) throw new Error("base64: invalid character");
+    value = value << 6 | digit;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes[at++] = value >> bits & 255;
+    }
+  }
+  return bytes.subarray(0, at);
+}
 async function openJson({
   key,
   sealed,
@@ -100,12 +160,16 @@ function lazySealedDatabase({
 }
 export {
   SEALED_IV_BYTES,
+  base64ToBytes,
+  bytesToBase64,
   idbGlobals,
   lazySealedDatabase,
   openJson,
   openSealedDatabase,
+  openText,
   requestToPromise,
   sealJson,
+  sealText,
   sha256Hex,
   transactionDone
 };

package/dist/agent-runtime/src/sealed-idb.js.map

@@ -1 +1 @@
-{"version":3,"file":"sealed-idb.js","sources":["../../../../agent-runtime/src/sealed-idb.ts"],"sourcesContent":["/**\n * The sealed-record toolkit the device stores in this package share (the thread snapshot mirror,\n * the chat outbox): AES-GCM-256 sealing with a fresh IV and additional data that binds a record to\n * where it is stored, SHA-256 names so a database names no one, and the part of IndexedDB they use.\n *\n * This package compiles without the DOM lib (React Native honesty, `globals.d.ts`), so IndexedDB is\n * described structurally here; the stores run only where it exists and degrade to nothing where it\n * does not.\n */\n\nexport type IdbListener = ((event?: unknown) => void) | null;\n\nexport interface IdbRequest<T> {\n  readonly result: T;\n  readonly error: unknown;\n  onsuccess: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbOpenRequest extends IdbRequest<IdbDatabase> {\n  onupgradeneeded: IdbListener;\n  onblocked: IdbListener;\n}\n\nexport interface IdbFactory {\n  open(name: string, version?: number): IdbOpenRequest;\n}\n\nexport interface IdbCursor {\n  readonly primaryKey: unknown;\n  continue(): void;\n}\n\nexport interface IdbIndex {\n  getAll(query?: unknown): IdbRequest<unknown[]>;\n  getAllKeys(query?: unknown): IdbRequest<unknown[]>;\n  openKeyCursor(range?: unknown, direction?: string): IdbRequest<IdbCursor | null>;\n}\n\nexport interface IdbObjectStore {\n  put(value: unknown): IdbRequest<unknown>;\n  get(key: unknown): IdbRequest<unknown>;\n  delete(key: unknown): IdbRequest<unknown>;\n  clear(): IdbRequest<unknown>;\n  index(name: string): IdbIndex;\n  createIndex(name: string, keyPath: string | string[], options?: { unique?: boolean }): unknown;\n}\n\nexport interface IdbTransaction {\n  objectStore(name: string): IdbObjectStore;\n  readonly error: unknown;\n  oncomplete: IdbListener;\n  onabort: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbDatabase {\n  readonly objectStoreNames: { contains(name: string): boolean };\n  transaction(stores: string | string[], mode?: \"readonly\" | \"readwrite\"): IdbTransaction;\n  createObjectStore(name: string, options?: { keyPath: string }): IdbObjectStore;\n  onversionchange: IdbListener;\n  addEventListener(type: string, listener: () => void): void;\n  close(): void;\n}\n\nexport interface IdbKeyRangeStatic {\n  bound(lower: unknown, upper: unknown): unknown;\n}\n\nexport const idbGlobals = globalThis as { indexedDB?: object; IDBKeyRange?: IdbKeyRangeStatic };\n\n/** The AES-GCM IV length, prefixed to every sealed payload. */\nexport const SEALED_IV_BYTES = 12;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** `value` as JSON, sealed under `key` with a fresh IV; `aad` binds it to where it is stored. */\nexport async function sealJson({\n  key,\n  value,\n  aad,\n}: {\n  key: CryptoKey;\n  value: unknown;\n  aad: string;\n}): Promise<Uint8Array> {\n  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt(\n      { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n      key,\n      encoder.encode(JSON.stringify(value)),\n    ),\n  );\n  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);\n  sealed.set(iv, 0);\n  sealed.set(ciphertext, SEALED_IV_BYTES);\n  return sealed;\n}\n\n/** Opens what {@link sealJson} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */\nexport async function openJson({\n  key,\n  sealed,\n  aad,\n}: {\n  key: CryptoKey;\n  sealed: Uint8Array;\n  aad: string;\n}): Promise<unknown> {\n  const iv = sealed.subarray(0, SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>;\n  const plaintext = await crypto.subtle.decrypt(\n    { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n    key,\n    sealed.subarray(SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>,\n  );\n  return JSON.parse(decoder.decode(plaintext)) as unknown;\n}\n\nexport function requestToPromise<T>(request: IdbRequest<T>): Promise<T> {\n  return new Promise((resolve, reject) => {\n    request.onsuccess = () => resolve(request.result);\n    request.onerror = () => reject(request.error ?? new Error(\"IndexedDB request failed\"));\n  });\n}\n\nexport function transactionDone(tx: IdbTransaction): Promise<void> {\n  return new Promise((resolve, reject) => {\n    tx.oncomplete = () => resolve();\n    tx.onabort = () => reject(tx.error ?? new Error(\"IndexedDB transaction aborted\"));\n    tx.onerror = () => reject(tx.error ?? new Error(\"IndexedDB transaction failed\"));\n  });\n}\n\n/**\n * Opens `name` at `version`, creating what `upgrade` creates. Resolves `null` instead of failing:\n * a database a newer build upgraded past this version, a blocked open, or no IndexedDB at all\n * (private browsing, SSR) all mean \"no store here\".\n */\nexport function openSealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: IdbFactory;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): Promise<IdbDatabase | null> {\n  return new Promise((resolve) => {\n    try {\n      const request = factory.open(name, version);\n      request.onupgradeneeded = () => upgrade(request.result);\n      request.onsuccess = () => {\n        const db = request.result;\n        // Another page deleting or upgrading the database: step aside.\n        db.onversionchange = () => db.close();\n        resolve(db);\n      };\n      request.onerror = () => resolve(null);\n      request.onblocked = () => resolve(null);\n    } catch {\n      resolve(null);\n    }\n  });\n}\n\n/**\n * A lazily opened database handle that reopens after the browser (or another page's upgrade or\n * delete) closes it. `null` while there is no IndexedDB or Web Crypto here.\n */\nexport function lazySealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: object | undefined;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): () => Promise<IdbDatabase | null> {\n  let databasePromise: Promise<IdbDatabase | null> | null = null;\n  return () => {\n    if (!factory || typeof crypto === \"undefined\" || !crypto.subtle) return Promise.resolve(null);\n    databasePromise ??= openSealedDatabase({ factory: factory as IdbFactory, name, version, upgrade }).then(\n      (db) => {\n        if (db) {\n          const forget = () => {\n            databasePromise = null;\n          };\n          db.addEventListener(\"versionchange\", forget);\n          db.addEventListener(\"close\", forget);\n        } else {\n          databasePromise = null;\n        }\n        return db;\n      },\n    );\n    return databasePromise;\n  };\n}\n"],"names":[],"mappings":"AAqEO,MAAM,aAAa;AAGnB,MAAM,kBAAkB;AAE/B,MAAM,UAAU,IAAI,YAAA;AACpB,MAAM,UAAU,IAAI,YAAA;AAEpB,eAAsB,UAAU,OAAgC;AAC9D,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;AAC1E,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACjG;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIwB;AACtB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC;AACjE,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO;AAAA,MAClB,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,MACzD;AAAA,MACA,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,IAAA;AAAA,EACtC;AAEF,QAAM,SAAS,IAAI,WAAW,kBAAkB,WAAW,UAAU;AACrE,SAAO,IAAI,IAAI,CAAC;AAChB,SAAO,IAAI,YAAY,eAAe;AACtC,SAAO;AACT;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIqB;AACnB,QAAM,KAAK,OAAO,SAAS,GAAG,eAAe;AAC7C,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,IACzD;AAAA,IACA,OAAO,SAAS,eAAe;AAAA,EAAA;AAEjC,SAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAC7C;AAEO,SAAS,iBAAoB,SAAoC;AACtE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAQ,YAAY,MAAM,QAAQ,QAAQ,MAAM;AAChD,YAAQ,UAAU,MAAM,OAAO,QAAQ,SAAS,IAAI,MAAM,0BAA0B,CAAC;AAAA,EACvF,CAAC;AACH;AAEO,SAAS,gBAAgB,IAAmC;AACjE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,OAAG,aAAa,MAAM,QAAA;AACtB,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,+BAA+B,CAAC;AAChF,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,8BAA8B,CAAC;AAAA,EACjF,CAAC;AACH;AAOO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKgC;AAC9B,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI;AACF,YAAM,UAAU,QAAQ,KAAK,MAAM,OAAO;AAC1C,cAAQ,kBAAkB,MAAM,QAAQ,QAAQ,MAAM;AACtD,cAAQ,YAAY,MAAM;AACxB,cAAM,KAAK,QAAQ;AAEnB,WAAG,kBAAkB,MAAM,GAAG,MAAA;AAC9B,gBAAQ,EAAE;AAAA,MACZ;AACA,cAAQ,UAAU,MAAM,QAAQ,IAAI;AACpC,cAAQ,YAAY,MAAM,QAAQ,IAAI;AAAA,IACxC,QAAQ;AACN,cAAQ,IAAI;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAMO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,MAAI,kBAAsD;AAC1D,SAAO,MAAM;AACX,QAAI,CAAC,WAAW,OAAO,WAAW,eAAe,CAAC,OAAO,OAAQ,QAAO,QAAQ,QAAQ,IAAI;AAC5F,0CAAoB,mBAAmB,EAAE,SAAgC,MAAM,SAAS,QAAA,CAAS,EAAE;AAAA,MACjG,CAAC,OAAO;AACN,YAAI,IAAI;AACN,gBAAM,SAAS,MAAM;AACnB,8BAAkB;AAAA,UACpB;AACA,aAAG,iBAAiB,iBAAiB,MAAM;AAC3C,aAAG,iBAAiB,SAAS,MAAM;AAAA,QACrC,OAAO;AACL,4BAAkB;AAAA,QACpB;AACA,eAAO;AAAA,MACT;AAAA,IAAA;AAEF,WAAO;AAAA,EACT;AACF;"}
+{"version":3,"file":"sealed-idb.js","sources":["../../../../agent-runtime/src/sealed-idb.ts"],"sourcesContent":["/**\n * The sealed-record toolkit the device stores in this package share (the thread snapshot mirror,\n * the chat outbox): AES-GCM-256 sealing with a fresh IV and additional data that binds a record to\n * where it is stored, SHA-256 names so a database names no one, and the part of IndexedDB they use.\n *\n * This package compiles without the DOM lib (React Native honesty, `globals.d.ts`), so IndexedDB is\n * described structurally here; the stores run only where it exists and degrade to nothing where it\n * does not.\n */\n\nexport type IdbListener = ((event?: unknown) => void) | null;\n\nexport interface IdbRequest<T> {\n  readonly result: T;\n  readonly error: unknown;\n  onsuccess: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbOpenRequest extends IdbRequest<IdbDatabase> {\n  onupgradeneeded: IdbListener;\n  onblocked: IdbListener;\n}\n\nexport interface IdbFactory {\n  open(name: string, version?: number): IdbOpenRequest;\n}\n\nexport interface IdbCursor {\n  readonly primaryKey: unknown;\n  continue(): void;\n}\n\nexport interface IdbIndex {\n  getAll(query?: unknown): IdbRequest<unknown[]>;\n  getAllKeys(query?: unknown): IdbRequest<unknown[]>;\n  openKeyCursor(range?: unknown, direction?: string): IdbRequest<IdbCursor | null>;\n}\n\nexport interface IdbObjectStore {\n  put(value: unknown): IdbRequest<unknown>;\n  get(key: unknown): IdbRequest<unknown>;\n  delete(key: unknown): IdbRequest<unknown>;\n  clear(): IdbRequest<unknown>;\n  index(name: string): IdbIndex;\n  createIndex(name: string, keyPath: string | string[], options?: { unique?: boolean }): unknown;\n}\n\nexport interface IdbTransaction {\n  objectStore(name: string): IdbObjectStore;\n  readonly error: unknown;\n  oncomplete: IdbListener;\n  onabort: IdbListener;\n  onerror: IdbListener;\n}\n\nexport interface IdbDatabase {\n  readonly objectStoreNames: { contains(name: string): boolean };\n  transaction(stores: string | string[], mode?: \"readonly\" | \"readwrite\"): IdbTransaction;\n  createObjectStore(name: string, options?: { keyPath: string }): IdbObjectStore;\n  onversionchange: IdbListener;\n  addEventListener(type: string, listener: () => void): void;\n  close(): void;\n}\n\nexport interface IdbKeyRangeStatic {\n  bound(lower: unknown, upper: unknown): unknown;\n}\n\nexport const idbGlobals = globalThis as { indexedDB?: object; IDBKeyRange?: IdbKeyRangeStatic };\n\n/** The AES-GCM IV length, prefixed to every sealed payload. */\nexport const SEALED_IV_BYTES = 12;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport async function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** `value` as JSON, sealed under `key` with a fresh IV; `aad` binds it to where it is stored. */\nexport async function sealJson({\n  key,\n  value,\n  aad,\n}: {\n  key: CryptoKey;\n  value: unknown;\n  aad: string;\n}): Promise<Uint8Array> {\n  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt(\n      { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n      key,\n      encoder.encode(JSON.stringify(value)),\n    ),\n  );\n  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);\n  sealed.set(iv, 0);\n  sealed.set(ciphertext, SEALED_IV_BYTES);\n  return sealed;\n}\n\n/** `text` sealed under `key` with a fresh IV; `aad` binds it to where it is stored. */\nexport async function sealText({\n  key,\n  text,\n  aad,\n}: {\n  key: CryptoKey;\n  text: string;\n  aad: string;\n}): Promise<Uint8Array> {\n  const iv = crypto.getRandomValues(new Uint8Array(SEALED_IV_BYTES));\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt({ name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) }, key, encoder.encode(text)),\n  );\n  const sealed = new Uint8Array(SEALED_IV_BYTES + ciphertext.byteLength);\n  sealed.set(iv, 0);\n  sealed.set(ciphertext, SEALED_IV_BYTES);\n  return sealed;\n}\n\n/** Opens what {@link sealText} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */\nexport async function openText({\n  key,\n  sealed,\n  aad,\n}: {\n  key: CryptoKey;\n  sealed: Uint8Array;\n  aad: string;\n}): Promise<string> {\n  const iv = sealed.subarray(0, SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>;\n  const plaintext = await crypto.subtle.decrypt(\n    { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n    key,\n    sealed.subarray(SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>,\n  );\n  return decoder.decode(plaintext);\n}\n\nconst BASE64 = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n\n/** Standard base64 of `bytes` (no DOM `btoa` here: React Native honesty). */\nexport function bytesToBase64(bytes: Uint8Array): string {\n  let out = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const a = bytes[index] ?? 0;\n    const b = bytes[index + 1];\n    const c = bytes[index + 2];\n    const triple = (a << 16) | ((b ?? 0) << 8) | (c ?? 0);\n    out += BASE64[(triple >> 18) & 63];\n    out += BASE64[(triple >> 12) & 63];\n    out += b === undefined ? \"=\" : BASE64[(triple >> 6) & 63];\n    out += c === undefined ? \"=\" : BASE64[triple & 63];\n  }\n  return out;\n}\n\n/** The bytes {@link bytesToBase64} encoded; throws on a character outside the alphabet. */\nexport function base64ToBytes(text: string): Uint8Array {\n  const clean = text.replace(/=+$/, \"\");\n  const bytes = new Uint8Array(Math.floor((clean.length * 3) / 4));\n  let bits = 0;\n  let value = 0;\n  let at = 0;\n  for (const char of clean) {\n    const digit = BASE64.indexOf(char);\n    if (digit === -1) throw new Error(\"base64: invalid character\");\n    value = (value << 6) | digit;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      bytes[at++] = (value >> bits) & 255;\n    }\n  }\n  return bytes.subarray(0, at);\n}\n\n/** Opens what {@link sealJson} sealed; throws for the wrong key, the wrong `aad`, or a damaged record. */\nexport async function openJson({\n  key,\n  sealed,\n  aad,\n}: {\n  key: CryptoKey;\n  sealed: Uint8Array;\n  aad: string;\n}): Promise<unknown> {\n  const iv = sealed.subarray(0, SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>;\n  const plaintext = await crypto.subtle.decrypt(\n    { name: \"AES-GCM\", iv, additionalData: encoder.encode(aad) },\n    key,\n    sealed.subarray(SEALED_IV_BYTES) as Uint8Array<ArrayBuffer>,\n  );\n  return JSON.parse(decoder.decode(plaintext)) as unknown;\n}\n\nexport function requestToPromise<T>(request: IdbRequest<T>): Promise<T> {\n  return new Promise((resolve, reject) => {\n    request.onsuccess = () => resolve(request.result);\n    request.onerror = () => reject(request.error ?? new Error(\"IndexedDB request failed\"));\n  });\n}\n\nexport function transactionDone(tx: IdbTransaction): Promise<void> {\n  return new Promise((resolve, reject) => {\n    tx.oncomplete = () => resolve();\n    tx.onabort = () => reject(tx.error ?? new Error(\"IndexedDB transaction aborted\"));\n    tx.onerror = () => reject(tx.error ?? new Error(\"IndexedDB transaction failed\"));\n  });\n}\n\n/**\n * Opens `name` at `version`, creating what `upgrade` creates. Resolves `null` instead of failing:\n * a database a newer build upgraded past this version, a blocked open, or no IndexedDB at all\n * (private browsing, SSR) all mean \"no store here\".\n */\nexport function openSealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: IdbFactory;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): Promise<IdbDatabase | null> {\n  return new Promise((resolve) => {\n    try {\n      const request = factory.open(name, version);\n      request.onupgradeneeded = () => upgrade(request.result);\n      request.onsuccess = () => {\n        const db = request.result;\n        // Another page deleting or upgrading the database: step aside.\n        db.onversionchange = () => db.close();\n        resolve(db);\n      };\n      request.onerror = () => resolve(null);\n      request.onblocked = () => resolve(null);\n    } catch {\n      resolve(null);\n    }\n  });\n}\n\n/**\n * A lazily opened database handle that reopens after the browser (or another page's upgrade or\n * delete) closes it. `null` while there is no IndexedDB or Web Crypto here.\n */\nexport function lazySealedDatabase({\n  factory,\n  name,\n  version,\n  upgrade,\n}: {\n  factory: object | undefined;\n  name: string;\n  version: number;\n  upgrade: (db: IdbDatabase) => void;\n}): () => Promise<IdbDatabase | null> {\n  let databasePromise: Promise<IdbDatabase | null> | null = null;\n  return () => {\n    if (!factory || typeof crypto === \"undefined\" || !crypto.subtle) return Promise.resolve(null);\n    databasePromise ??= openSealedDatabase({ factory: factory as IdbFactory, name, version, upgrade }).then(\n      (db) => {\n        if (db) {\n          const forget = () => {\n            databasePromise = null;\n          };\n          db.addEventListener(\"versionchange\", forget);\n          db.addEventListener(\"close\", forget);\n        } else {\n          databasePromise = null;\n        }\n        return db;\n      },\n    );\n    return databasePromise;\n  };\n}\n"],"names":[],"mappings":"AAqEO,MAAM,aAAa;AAGnB,MAAM,kBAAkB;AAE/B,MAAM,UAAU,IAAI,YAAA;AACpB,MAAM,UAAU,IAAI,YAAA;AAEpB,eAAsB,UAAU,OAAgC;AAC9D,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;AAC1E,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACjG;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIwB;AACtB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC;AACjE,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO;AAAA,MAClB,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,MACzD;AAAA,MACA,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,IAAA;AAAA,EACtC;AAEF,QAAM,SAAS,IAAI,WAAW,kBAAkB,WAAW,UAAU;AACrE,SAAO,IAAI,IAAI,CAAC;AAChB,SAAO,IAAI,YAAY,eAAe;AACtC,SAAO;AACT;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIwB;AACtB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC;AACjE,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA,GAAK,KAAK,QAAQ,OAAO,IAAI,CAAC;AAAA,EAAA;AAErH,QAAM,SAAS,IAAI,WAAW,kBAAkB,WAAW,UAAU;AACrE,SAAO,IAAI,IAAI,CAAC;AAChB,SAAO,IAAI,YAAY,eAAe;AACtC,SAAO;AACT;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIoB;AAClB,QAAM,KAAK,OAAO,SAAS,GAAG,eAAe;AAC7C,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,IACzD;AAAA,IACA,OAAO,SAAS,eAAe;AAAA,EAAA;AAEjC,SAAO,QAAQ,OAAO,SAAS;AACjC;AAEA,MAAM,SAAS;AAGR,SAAS,cAAc,OAA2B;AACvD,MAAI,MAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,IAAI,MAAM,QAAQ,CAAC;AACzB,UAAM,SAAU,KAAK,MAAQ,KAAK,MAAM,KAAM,KAAK;AACnD,WAAO,OAAQ,UAAU,KAAM,EAAE;AACjC,WAAO,OAAQ,UAAU,KAAM,EAAE;AACjC,WAAO,MAAM,SAAY,MAAM,OAAQ,UAAU,IAAK,EAAE;AACxD,WAAO,MAAM,SAAY,MAAM,OAAO,SAAS,EAAE;AAAA,EACnD;AACA,SAAO;AACT;AAGO,SAAS,cAAc,MAA0B;AACtD,QAAM,QAAQ,KAAK,QAAQ,OAAO,EAAE;AACpC,QAAM,QAAQ,IAAI,WAAW,KAAK,MAAO,MAAM,SAAS,IAAK,CAAC,CAAC;AAC/D,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,KAAK;AACT,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,OAAO,QAAQ,IAAI;AACjC,QAAI,UAAU,GAAI,OAAM,IAAI,MAAM,2BAA2B;AAC7D,YAAS,SAAS,IAAK;AACvB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,YAAM,IAAI,IAAK,SAAS,OAAQ;AAAA,IAClC;AAAA,EACF;AACA,SAAO,MAAM,SAAS,GAAG,EAAE;AAC7B;AAGA,eAAsB,SAAS;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIqB;AACnB,QAAM,KAAK,OAAO,SAAS,GAAG,eAAe;AAC7C,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,IAAI,gBAAgB,QAAQ,OAAO,GAAG,EAAA;AAAA,IACzD;AAAA,IACA,OAAO,SAAS,eAAe;AAAA,EAAA;AAEjC,SAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAC7C;AAEO,SAAS,iBAAoB,SAAoC;AACtE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAQ,YAAY,MAAM,QAAQ,QAAQ,MAAM;AAChD,YAAQ,UAAU,MAAM,OAAO,QAAQ,SAAS,IAAI,MAAM,0BAA0B,CAAC;AAAA,EACvF,CAAC;AACH;AAEO,SAAS,gBAAgB,IAAmC;AACjE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,OAAG,aAAa,MAAM,QAAA;AACtB,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,+BAA+B,CAAC;AAChF,OAAG,UAAU,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,8BAA8B,CAAC;AAAA,EACjF,CAAC;AACH;AAOO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKgC;AAC9B,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI;AACF,YAAM,UAAU,QAAQ,KAAK,MAAM,OAAO;AAC1C,cAAQ,kBAAkB,MAAM,QAAQ,QAAQ,MAAM;AACtD,cAAQ,YAAY,MAAM;AACxB,cAAM,KAAK,QAAQ;AAEnB,WAAG,kBAAkB,MAAM,GAAG,MAAA;AAC9B,gBAAQ,EAAE;AAAA,MACZ;AACA,cAAQ,UAAU,MAAM,QAAQ,IAAI;AACpC,cAAQ,YAAY,MAAM,QAAQ,IAAI;AAAA,IACxC,QAAQ;AACN,cAAQ,IAAI;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAMO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKsC;AACpC,MAAI,kBAAsD;AAC1D,SAAO,MAAM;AACX,QAAI,CAAC,WAAW,OAAO,WAAW,eAAe,CAAC,OAAO,OAAQ,QAAO,QAAQ,QAAQ,IAAI;AAC5F,0CAAoB,mBAAmB,EAAE,SAAgC,MAAM,SAAS,QAAA,CAAS,EAAE;AAAA,MACjG,CAAC,OAAO;AACN,YAAI,IAAI;AACN,gBAAM,SAAS,MAAM;AACnB,8BAAkB;AAAA,UACpB;AACA,aAAG,iBAAiB,iBAAiB,MAAM;AAC3C,aAAG,iBAAiB,SAAS,MAAM;AAAA,QACrC,OAAO;AACL,4BAAkB;AAAA,QACpB;AACA,eAAO;AAAA,MACT;AAAA,IAAA;AAEF,WAAO;AAAA,EACT;AACF;"}

package/dist/agent-runtime/src/send-recovery.cjs

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const statewireState = require("./statewire-state.cjs");
+const statewireHeldSends = require("./statewire-held-sends.cjs");
 const AUTO_RETRY_FATES = /* @__PURE__ */ new Set(["lost", "aborted"]);
 const MAX_AUTO_RETRIES_PER_MESSAGE = 3;
 const MAX_AUTO_RETRY_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -8,148 +8,120 @@ const MAX_BEFORE_RETRY_HOLDS = 10;
 function shouldAutoRetryFailedSend(failure) {
   return failure !== void 0 && AUTO_RETRY_FATES.has(failure.fate);
 }
-function awaitsLostPredecessor(entry) {
-  return entry.sendFailure.fate === "aborted" && entry.sendFailure.predecessorLost === true;
-}
 function isThenable(value) {
   return typeof value === "object" && value !== null && typeof value.then === "function";
 }
-function commandMessageId(update) {
-  var _a, _b;
-  const first = (_a = update.params) == null ? void 0 : _a[0];
-  const id = (_b = first == null ? void 0 : first.message) == null ? void 0 : _b.id;
-  return typeof id === "string" ? id : null;
+function idsOf(list, into) {
+  if (!Array.isArray(list)) return;
+  for (const item of list) {
+    const id = item == null ? void 0 : item.id;
+    if (typeof id === "string") into.add(id);
+  }
+}
+function stateHoldsMessage(state, messageId) {
+  var _a;
+  if (!state || typeof state !== "object") return false;
+  const value = state;
+  const ids = /* @__PURE__ */ new Set();
+  idsOf(value.messages, ids);
+  if (Array.isArray(value.runs)) {
+    for (const run of value.runs) {
+      const entry = run;
+      idsOf(entry == null ? void 0 : entry.queue, ids);
+      idsOf(entry == null ? void 0 : entry.steerQueue, ids);
+      idsOf((_a = entry == null ? void 0 : entry.dispatching) == null ? void 0 : _a.messages, ids);
+    }
+  }
+  return ids.has(messageId);
 }
 function createDeepAgentSendRecovery(options) {
   const now = options.now ?? Date.now;
-  const schedule = options.schedule ?? ((task) => queueMicrotask(task));
   let disposed = false;
-  let hydrated = false;
-  let armed = false;
-  let sweepScheduled = false;
   const attempts = /* @__PURE__ */ new Map();
-  const surfacedSkips = /* @__PURE__ */ new Set();
-  const surfacedDeferrals = /* @__PURE__ */ new Set();
-  const inFlight = /* @__PURE__ */ new Set();
-  const deferred = /* @__PURE__ */ new Set();
-  const holds = /* @__PURE__ */ new Map();
-  let holding = false;
+  let lostPredecessorHeld = false;
   const record = (event, data) => {
     var _a, _b;
     (_b = (_a = options.diagnostics) == null ? void 0 : _a.call(options)) == null ? void 0 : _b.record(event, data);
   };
-  const sweep = () => {
-    var _a, _b;
-    sweepScheduled = false;
-    if (disposed || holding || !hydrated || !armed) return;
-    const lane = options.lane();
-    if (lane === null) return;
-    armed = false;
-    deferred.clear();
-    const stamps = ((_a = options.failureStamps) == null ? void 0 : _a.call(options)) ?? null;
-    let lostPredecessorPending = false;
-    for (const entry of lane.failed) {
-      if (!shouldAutoRetryFailedSend(entry.sendFailure)) continue;
-      if (inFlight.has(entry.id)) {
-        if (entry.sendFailure.fate === "lost") lostPredecessorPending = true;
-        continue;
-      }
-      if (awaitsLostPredecessor(entry) && (lostPredecessorPending || inFlight.size > 0)) {
-        deferred.add(entry.id);
-        if (!surfacedDeferrals.has(entry.id)) {
-          surfacedDeferrals.add(entry.id);
-          record("send-recovery/deferred", { messageId: entry.id });
-        }
-        continue;
-      }
-      const isLost = entry.sendFailure.fate === "lost";
-      const stamp = stamps == null ? void 0 : stamps.get(entry.id);
-      if (stamp !== void 0 && now() - stamp > MAX_AUTO_RETRY_AGE_MS) {
-        if (!surfacedSkips.has(entry.id)) {
-          surfacedSkips.add(entry.id);
-          record("send-recovery/stale", { messageId: entry.id, ageMs: Math.round(now() - stamp) });
-        }
-        if (isLost) lostPredecessorPending = true;
-        continue;
-      }
-      const attempt = (attempts.get(entry.id) ?? 0) + 1;
-      if (attempt > MAX_AUTO_RETRIES_PER_MESSAGE) {
-        if (!surfacedSkips.has(entry.id)) {
-          surfacedSkips.add(entry.id);
-          record("send-recovery/exhausted", { messageId: entry.id });
-        }
-        if (isLost) lostPredecessorPending = true;
-        continue;
-      }
+  const prepareRetry = async (messageId) => {
+    var _a;
+    for (let held = 1; ; held++) {
       let before;
       try {
-        before = (_b = options.beforeRetry) == null ? void 0 : _b.call(options, entry.id);
+        before = (_a = options.beforeRetry) == null ? void 0 : _a.call(options, messageId);
       } catch {
-        record("send-recovery/before-retry-failed", { messageId: entry.id });
+        record("send-recovery/before-retry-failed", { messageId });
+        return void 0;
       }
-      if (isThenable(before)) {
-        const held = (holds.get(entry.id) ?? 0) + 1;
-        if (held <= MAX_BEFORE_RETRY_HOLDS) {
-          holds.set(entry.id, held);
-          holding = true;
-          armed = true;
-          record("send-recovery/held", { messageId: entry.id, holds: held });
-          const resume = () => {
-            holding = false;
-            armed = true;
-            scheduleSweep();
-          };
-          before.then(resume, resume);
-          return;
-        }
-        record("send-recovery/held-too-long", { messageId: entry.id });
+      if (!isThenable(before)) return typeof before === "function" ? before : void 0;
+      if (held > MAX_BEFORE_RETRY_HOLDS) {
+        Promise.resolve(before).catch(() => void 0);
+        record("send-recovery/held-too-long", { messageId });
+        return void 0;
       }
+      record("send-recovery/held", { messageId, holds: held });
       try {
-        lane.retryFailed(entry.id);
-        attempts.set(entry.id, attempt);
-        inFlight.add(entry.id);
-        if (isLost) lostPredecessorPending = true;
-        record("send-recovery/retry", {
-          messageId: entry.id,
-          fate: entry.sendFailure.fate,
-          attempt
-        });
+        await before;
       } catch {
-        record("send-recovery/raced", { messageId: entry.id });
-        try {
-          if (typeof before === "function") before();
-        } catch {
-        }
       }
+      if (disposed) return void 0;
     }
-    if (deferred.size > 0) armed = true;
   };
-  const scheduleSweep = () => {
-    if (disposed || sweepScheduled || holding || !hydrated || !armed) return;
-    sweepScheduled = true;
-    schedule(sweep);
+  const handle = async (update, messageId, state) => {
+    var _a, _b;
+    const failure = update.failure;
+    const outbox = options.outbox();
+    if (outbox === null) throw new Error("send recovery: the thread has no outbox yet");
+    const hold = (reason) => {
+      if (failure.fate === "lost") lostPredecessorHeld = true;
+      statewireHeldSends.requeueFailedRunSend({ outbox, update, held: true });
+      record(`send-recovery/${reason}`, { messageId, fate: failure.fate });
+    };
+    if (!shouldAutoRetryFailedSend(failure)) return hold("held");
+    if (failure.fate === "aborted" && "predecessorLost" in failure && failure.predecessorLost === true && lostPredecessorHeld)
+      return hold("deferred");
+    const stamp = (_b = (_a = options.failureStamps) == null ? void 0 : _a.call(options)) == null ? void 0 : _b.get(messageId);
+    if (stamp !== void 0 && now() - stamp > MAX_AUTO_RETRY_AGE_MS) {
+      record("send-recovery/stale", { messageId, ageMs: Math.round(now() - stamp) });
+      return hold("held");
+    }
+    const attempt = (attempts.get(messageId) ?? 0) + 1;
+    if (attempt > MAX_AUTO_RETRIES_PER_MESSAGE) {
+      record("send-recovery/exhausted", { messageId });
+      return hold("held");
+    }
+    const release = await prepareRetry(messageId);
+    if (disposed) {
+      release == null ? void 0 : release();
+      throw new Error("send recovery: disposed before the retry");
+    }
+    try {
+      statewireHeldSends.requeueFailedRunSend({ outbox, update, held: false, thread: statewireHeldSends.runSendThreadOfState(state) });
+    } catch (error) {
+      record("send-recovery/raced", { messageId });
+      try {
+        release == null ? void 0 : release();
+      } catch {
+      }
+      throw error;
+    }
+    attempts.set(messageId, attempt);
+    record("send-recovery/retry", { messageId, fate: failure.fate, attempt });
   };
   return {
-    observeStateChange(state) {
-      if (disposed) return;
-      if (!hydrated && statewireState.isDeepAgentStateHydrated(state)) {
-        hydrated = true;
-        armed = true;
+    onCommandChange(update, ctx) {
+      if (disposed || update.status !== "settled" || update.failure === void 0) return void 0;
+      const messageId = statewireHeldSends.runSendMessageId(update);
+      if (messageId === null) return void 0;
+      const { failure } = update;
+      if (failure.cause === "removed" || failure.cause === "unmount") return void 0;
+      if (stateHoldsMessage(ctx == null ? void 0 : ctx.state, messageId) || failure.fate === "rejected" && failure.code === "duplicate-id") {
+        record("send-recovery/covered", { messageId, fate: failure.fate });
+        return void 0;
       }
-      scheduleSweep();
-    },
-    observeCommand(update) {
-      if (disposed || update.status !== "settled") return;
-      const messageId = commandMessageId(update);
-      if (messageId !== null) inFlight.delete(messageId);
-      if (!shouldAutoRetryFailedSend(update.failure) && deferred.size === 0) return;
-      armed = true;
-      scheduleSweep();
-    },
-    observeFailedLaneChange() {
-      if (disposed) return;
-      armed = true;
-      scheduleSweep();
+      const handled = handle(update, messageId, ctx == null ? void 0 : ctx.state);
+      handled.catch(() => void 0);
+      return handled;
     },
     dispose() {
       disposed = true;

package/dist/agent-runtime/src/send-recovery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"send-recovery.cjs","sources":["../../../../agent-runtime/src/send-recovery.ts"],"sourcesContent":["import type {\n  StatewireDiagnosticsCommandUpdate,\n  StatewireDiagnosticsRecorder,\n} from './statewire-diagnostics';\nimport { isDeepAgentStateHydrated } from './statewire-state';\nimport type { StatewireFailedSendEntry, StatewireFailedSendLane } from './thread-extras';\n\n/**\n * Transport-level send durability for the deep-agent thread (the successor to\n * Olympus' localStorage outbox, #29368 → #31504).\n *\n * The durable journal itself is the statewire session record: every command is\n * persisted through the mounted session storage from `send()` until the server\n * durably admits or judges it, and a reload resends survivors on the SAME lane\n * seq (exactly-once — the server absorbs replayed seqs at or below its\n * watermark). What the record cannot recover on its own is a send the client\n * had to settle without a server verdict — a proven session loss or a record\n * reset settles it `lost`/`aborted` and RETAINS it in the record's failed lane\n * (message-carrying sends only), where the vendor drops it as soon as a\n * canonical snapshot shows the message landed (`failureCovered`).\n *\n * This controller turns that persisted failed lane back into live sends: once\n * the thread snapshot has hydrated (so covered entries are already gone), every\n * failed send the server NEVER judged is re-dispatched through the thread's own\n * `retryFailed` — same client-minted message id, re-anchored against the\n * current thread — which the host dedupes by id (a still-queued id re-places,\n * a durable one rejects `duplicate-id`). Server-judged fates (`rejected`,\n * `failed`, `crashed`, `expired`) are the user's decision and stay in the\n * manual retry/discard affordance.\n *\n * Ordering: an `aborted` send stamped `predecessorLost` was never attempted\n * because an earlier send of the same batch WAS attempted and settled `lost`\n * — it may or may not have run. Re-dispatching the successor first could land\n * it ahead of a predecessor that later turns out to have landed too, so the\n * successor is held until every preceding `lost` predecessor has settled: it\n * was covered by a snapshot, its retry was judged by the server, or the user\n * discarded it.\n */\n\n/** Fates the server never saw: the send died client-side (unmount, stream\n * gone, session lost) and is safe to re-dispatch under its original message\n * id. The complement — rejected/failed/crashed/expired — is server-judged. */\nconst AUTO_RETRY_FATES: ReadonlySet<string> = new Set(['lost', 'aborted']);\n\n/** A failed send is re-dispatched at most this many times per attach; a\n * persistent failure (repeated session losses) stays in the manual lane. */\nconst MAX_AUTO_RETRIES_PER_MESSAGE = 3;\n\n/** Persisted failures older than this stay manual: auto-sending a message the\n * user abandoned a day ago is worse than surfacing it for a decision. Mirrors\n * the retired outbox's retention window. */\nconst MAX_AUTO_RETRY_AGE_MS = 24 * 60 * 60 * 1000;\n\n/** How many times a host may hold one message's retry (`beforeRetry`\n * returning a promise) before the sweep sends it regardless: a hold is the\n * host's own bounded wait, never a reason to keep a message back for good. */\nexport const MAX_BEFORE_RETRY_HOLDS = 10;\n\nexport interface DeepAgentSendRecoveryOptions {\n  /**\n   * Reads the thread's failed-send lane. `null` while it is unavailable (the\n   * client has not mounted yet, or its extras are not a statewire thread) —\n   * the controller stays armed and retries on the next state change.\n   */\n  lane: () => StatewireFailedSendLane | null;\n  /**\n   * Persisted failure stamps (message id → epoch ms of the original send) for\n   * the freshness gate. `null`/absent means no persistence is readable — every\n   * lane entry then counts as fresh (an in-memory failed lane can only hold\n   * failures from this page session).\n   */\n  failureStamps?: (() => ReadonlyMap<string, number> | null) | undefined;\n  /** Transport lifecycle recorder; read per event so a late-mounted recorder still sees retries. */\n  diagnostics?: (() => StatewireDiagnosticsRecorder | undefined) | undefined;\n  /** Injectable clock (tests). */\n  now?: () => number;\n  /** Sweep scheduler; defaults to `queueMicrotask` so a sweep never dispatches\n   * from inside a statewire flush or a React render. */\n  schedule?: (task: () => void) => void;\n  /**\n   * Called right before a failed send is dispatched again, with its message\n   * id, so a host can put back the per-send context that message was sent\n   * with (Olympus stages the agents it named) before its command leaves.\n   *\n   * Returning a promise holds the retry: the host can't put that context back\n   * yet (every send of the conversation rides one ambient context, and a send\n   * with another context is still on its way). The sweep then stops at this\n   * message, so nothing behind it overtakes it, and asks again once the\n   * promise settles; past {@link MAX_BEFORE_RETRY_HOLDS} holds it sends the\n   * message regardless. A hook that throws never holds a retry back. A\n   * function returned is called when the message does not go after all (the\n   * retry raced its leaving the lane), so the host lets go of what it put back.\n   */\n  beforeRetry?: ((messageId: string) => void | PromiseLike<void> | (() => void)) | undefined;\n}\n\nexport interface DeepAgentSendRecovery {\n  /** Feed every (normalized) statewire state change; hydration arms the mount sweep. */\n  observeStateChange(state: unknown): void;\n  /** Feed every command-lifecycle update; a never-server-judged settle arms a sweep. */\n  observeCommand(update: StatewireDiagnosticsCommandUpdate): void;\n  /** Feed client notifications too: failed history can publish after the\n   * command settles, without any change to the canonical thread snapshot. */\n  observeFailedLaneChange(): void;\n  dispose(): void;\n}\n\n/** Whether a settle failure is a client-side death the recovery re-dispatches\n * (the server never judged the command). Exported for host-side telemetry. */\nexport function shouldAutoRetryFailedSend(failure: { fate: string } | undefined): boolean {\n  return failure !== undefined && AUTO_RETRY_FATES.has(failure.fate);\n}\n\n/** Whether a failed entry must wait for a lost predecessor to settle first. */\nfunction awaitsLostPredecessor(entry: StatewireFailedSendEntry): boolean {\n  return entry.sendFailure.fate === 'aborted' && entry.sendFailure.predecessorLost === true;\n}\n\nfunction isThenable(value: unknown): value is PromiseLike<unknown> {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { then?: unknown }).then === 'function'\n  );\n}\n\n/** The client-minted message id a run send carries, off a command update's params. */\nfunction commandMessageId(update: StatewireDiagnosticsCommandUpdate): string | null {\n  const first = update.params?.[0] as { message?: { id?: unknown } } | undefined;\n  const id = first?.message?.id;\n  return typeof id === 'string' ? id : null;\n}\n\nexport function createDeepAgentSendRecovery(\n  options: DeepAgentSendRecoveryOptions\n): DeepAgentSendRecovery {\n  const now = options.now ?? Date.now;\n  const schedule = options.schedule ?? ((task: () => void) => queueMicrotask(task));\n\n  let disposed = false;\n  let hydrated = false;\n  /** Work may exist: set at hydration and on retryable settles, cleared by a\n   * sweep that could actually read the lane. */\n  let armed = false;\n  let sweepScheduled = false;\n  /** Retry budget per message id, for this controller's attach lifetime. */\n  const attempts = new Map<string, number>();\n  /** Message ids already diagnosed as stale/exhausted, so the lane re-scan\n   * stays quiet about them. */\n  const surfacedSkips = new Set<string>();\n  /** Message ids whose deferral behind a lost predecessor was diagnosed once. */\n  const surfacedDeferrals = new Set<string>();\n  /** Re-dispatched sends still awaiting the server's verdict: a successor\n   * stamped `predecessorLost` waits while any of these is pending. */\n  const inFlight = new Set<string>();\n  /** Successors held back by the last sweep; a non-empty set keeps the\n   * controller armed so the next settle or state change re-sweeps. */\n  const deferred = new Set<string>();\n  /** How many times the host held each message's retry (`beforeRetry`'s promise). */\n  const holds = new Map<string, number>();\n  /** A host's hold in progress: no sweep runs until it settles. */\n  let holding = false;\n\n  const record = (event: string, data?: Record<string, unknown>): void => {\n    options.diagnostics?.()?.record(event, data);\n  };\n\n  const sweep = (): void => {\n    sweepScheduled = false;\n    // A host's hold re-sweeps once it settles; until then nothing is retried.\n    if (disposed || holding || !hydrated || !armed) return;\n    const lane = options.lane();\n    // No readable lane yet: stay armed so the next state change re-sweeps.\n    if (lane === null) return;\n    armed = false;\n    deferred.clear();\n    const stamps = options.failureStamps?.() ?? null;\n    // A `lost` entry earlier in lane order that this sweep leaves unsettled\n    // (skipped as stale/exhausted, or re-dispatched and now in flight).\n    let lostPredecessorPending = false;\n    for (const entry of lane.failed) {\n      if (!shouldAutoRetryFailedSend(entry.sendFailure)) continue;\n      // Shared retry/discard may still be waiting for the storage lock. The\n      // visible lane can keep this entry until then; do not spend another\n      // attempt on a send whose previous retry is still awaiting a verdict.\n      if (inFlight.has(entry.id)) {\n        if (entry.sendFailure.fate === 'lost') lostPredecessorPending = true;\n        continue;\n      }\n      if (awaitsLostPredecessor(entry) && (lostPredecessorPending || inFlight.size > 0)) {\n        deferred.add(entry.id);\n        if (!surfacedDeferrals.has(entry.id)) {\n          surfacedDeferrals.add(entry.id);\n          record('send-recovery/deferred', { messageId: entry.id });\n        }\n        continue;\n      }\n      const isLost = entry.sendFailure.fate === 'lost';\n      const stamp = stamps?.get(entry.id);\n      if (stamp !== undefined && now() - stamp > MAX_AUTO_RETRY_AGE_MS) {\n        if (!surfacedSkips.has(entry.id)) {\n          surfacedSkips.add(entry.id);\n          record('send-recovery/stale', { messageId: entry.id, ageMs: Math.round(now() - stamp) });\n        }\n        if (isLost) lostPredecessorPending = true;\n        continue;\n      }\n      const attempt = (attempts.get(entry.id) ?? 0) + 1;\n      if (attempt > MAX_AUTO_RETRIES_PER_MESSAGE) {\n        if (!surfacedSkips.has(entry.id)) {\n          surfacedSkips.add(entry.id);\n          record('send-recovery/exhausted', { messageId: entry.id });\n        }\n        if (isLost) lostPredecessorPending = true;\n        continue;\n      }\n      let before: ReturnType<NonNullable<DeepAgentSendRecoveryOptions['beforeRetry']>> | undefined;\n      try {\n        before = options.beforeRetry?.(entry.id);\n      } catch {\n        // A host's own context step failing never holds the retry back.\n        record('send-recovery/before-retry-failed', { messageId: entry.id });\n      }\n      if (isThenable(before)) {\n        const held = (holds.get(entry.id) ?? 0) + 1;\n        if (held <= MAX_BEFORE_RETRY_HOLDS) {\n          // The host can't put this message's context back yet: it waits, and\n          // so does everything behind it (nothing overtakes it); the sweep asks\n          // again once the hold settles.\n          holds.set(entry.id, held);\n          holding = true;\n          armed = true;\n          record('send-recovery/held', { messageId: entry.id, holds: held });\n          const resume = (): void => {\n            holding = false;\n            armed = true;\n            scheduleSweep();\n          };\n          before.then(resume, resume);\n          return;\n        }\n        record('send-recovery/held-too-long', { messageId: entry.id });\n      }\n      try {\n        lane.retryFailed(entry.id);\n        attempts.set(entry.id, attempt);\n        inFlight.add(entry.id);\n        if (isLost) lostPredecessorPending = true;\n        record('send-recovery/retry', {\n          messageId: entry.id,\n          fate: entry.sendFailure.fate,\n          attempt,\n        });\n      } catch {\n        // The entry settled or was covered between the lane read and the\n        // retry (the vendor drops covered failures against every snapshot);\n        // nothing was dispatched, so the host lets go of what it put back.\n        record('send-recovery/raced', { messageId: entry.id });\n        try {\n          if (typeof before === 'function') before();\n        } catch {\n          // The host's own step failing never stops the sweep.\n        }\n      }\n    }\n    // Held successors must be revisited once their predecessors settle.\n    if (deferred.size > 0) armed = true;\n  };\n\n  const scheduleSweep = (): void => {\n    if (disposed || sweepScheduled || holding || !hydrated || !armed) return;\n    sweepScheduled = true;\n    schedule(sweep);\n  };\n\n  return {\n    observeStateChange(state) {\n      if (disposed) return;\n      if (!hydrated && isDeepAgentStateHydrated(state)) {\n        // First real snapshot: the vendor's failureCovered pass has had its\n        // chance to drop entries whose message actually landed, so whatever\n        // remains provably never reached the thread.\n        hydrated = true;\n        armed = true;\n      }\n      scheduleSweep();\n    },\n    observeCommand(update) {\n      if (disposed || update.status !== 'settled') return;\n      const messageId = commandMessageId(update);\n      if (messageId !== null) inFlight.delete(messageId);\n      // A never-server-judged settle means new work; any settle while\n      // successors are held may be the predecessor they wait on.\n      if (!shouldAutoRetryFailedSend(update.failure) && deferred.size === 0) return;\n      armed = true;\n      scheduleSweep();\n    },\n    observeFailedLaneChange() {\n      if (disposed) return;\n      armed = true;\n      scheduleSweep();\n    },\n    dispose() {\n      disposed = true;\n    },\n  };\n}\n"],"names":["isDeepAgentStateHydrated"],"mappings":";;;AA0CA,MAAM,mBAAwC,oBAAI,IAAI,CAAC,QAAQ,SAAS,CAAC;AAIzE,MAAM,+BAA+B;AAKrC,MAAM,wBAAwB,KAAK,KAAK,KAAK;AAKtC,MAAM,yBAAyB;AAqD/B,SAAS,0BAA0B,SAAgD;AACxF,SAAO,YAAY,UAAa,iBAAiB,IAAI,QAAQ,IAAI;AACnE;AAGA,SAAS,sBAAsB,OAA0C;AACvE,SAAO,MAAM,YAAY,SAAS,aAAa,MAAM,YAAY,oBAAoB;AACvF;AAEA,SAAS,WAAW,OAA+C;AACjE,SACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA6B,SAAS;AAElD;AAGA,SAAS,iBAAiB,QAA0D;;AAClF,QAAM,SAAQ,YAAO,WAAP,mBAAgB;AAC9B,QAAM,MAAK,oCAAO,YAAP,mBAAgB;AAC3B,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAEO,SAAS,4BACd,SACuB;AACvB,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,WAAW,QAAQ,aAAa,CAAC,SAAqB,eAAe,IAAI;AAE/E,MAAI,WAAW;AACf,MAAI,WAAW;AAGf,MAAI,QAAQ;AACZ,MAAI,iBAAiB;AAErB,QAAM,+BAAe,IAAA;AAGrB,QAAM,oCAAoB,IAAA;AAE1B,QAAM,wCAAwB,IAAA;AAG9B,QAAM,+BAAe,IAAA;AAGrB,QAAM,+BAAe,IAAA;AAErB,QAAM,4BAAY,IAAA;AAElB,MAAI,UAAU;AAEd,QAAM,SAAS,CAAC,OAAe,SAAyC;;AACtE,wBAAQ,gBAAR,wDAAyB,OAAO,OAAO;AAAA,EACzC;AAEA,QAAM,QAAQ,MAAY;;AACxB,qBAAiB;AAEjB,QAAI,YAAY,WAAW,CAAC,YAAY,CAAC,MAAO;AAChD,UAAM,OAAO,QAAQ,KAAA;AAErB,QAAI,SAAS,KAAM;AACnB,YAAQ;AACR,aAAS,MAAA;AACT,UAAM,WAAS,aAAQ,kBAAR,qCAA6B;AAG5C,QAAI,yBAAyB;AAC7B,eAAW,SAAS,KAAK,QAAQ;AAC/B,UAAI,CAAC,0BAA0B,MAAM,WAAW,EAAG;AAInD,UAAI,SAAS,IAAI,MAAM,EAAE,GAAG;AAC1B,YAAI,MAAM,YAAY,SAAS,OAAQ,0BAAyB;AAChE;AAAA,MACF;AACA,UAAI,sBAAsB,KAAK,MAAM,0BAA0B,SAAS,OAAO,IAAI;AACjF,iBAAS,IAAI,MAAM,EAAE;AACrB,YAAI,CAAC,kBAAkB,IAAI,MAAM,EAAE,GAAG;AACpC,4BAAkB,IAAI,MAAM,EAAE;AAC9B,iBAAO,0BAA0B,EAAE,WAAW,MAAM,IAAI;AAAA,QAC1D;AACA;AAAA,MACF;AACA,YAAM,SAAS,MAAM,YAAY,SAAS;AAC1C,YAAM,QAAQ,iCAAQ,IAAI,MAAM;AAChC,UAAI,UAAU,UAAa,IAAA,IAAQ,QAAQ,uBAAuB;AAChE,YAAI,CAAC,cAAc,IAAI,MAAM,EAAE,GAAG;AAChC,wBAAc,IAAI,MAAM,EAAE;AAC1B,iBAAO,uBAAuB,EAAE,WAAW,MAAM,IAAI,OAAO,KAAK,MAAM,QAAQ,KAAK,EAAA,CAAG;AAAA,QACzF;AACA,YAAI,OAAQ,0BAAyB;AACrC;AAAA,MACF;AACA,YAAM,WAAW,SAAS,IAAI,MAAM,EAAE,KAAK,KAAK;AAChD,UAAI,UAAU,8BAA8B;AAC1C,YAAI,CAAC,cAAc,IAAI,MAAM,EAAE,GAAG;AAChC,wBAAc,IAAI,MAAM,EAAE;AAC1B,iBAAO,2BAA2B,EAAE,WAAW,MAAM,IAAI;AAAA,QAC3D;AACA,YAAI,OAAQ,0BAAyB;AACrC;AAAA,MACF;AACA,UAAI;AACJ,UAAI;AACF,kBAAS,aAAQ,gBAAR,iCAAsB,MAAM;AAAA,MACvC,QAAQ;AAEN,eAAO,qCAAqC,EAAE,WAAW,MAAM,IAAI;AAAA,MACrE;AACA,UAAI,WAAW,MAAM,GAAG;AACtB,cAAM,QAAQ,MAAM,IAAI,MAAM,EAAE,KAAK,KAAK;AAC1C,YAAI,QAAQ,wBAAwB;AAIlC,gBAAM,IAAI,MAAM,IAAI,IAAI;AACxB,oBAAU;AACV,kBAAQ;AACR,iBAAO,sBAAsB,EAAE,WAAW,MAAM,IAAI,OAAO,MAAM;AACjE,gBAAM,SAAS,MAAY;AACzB,sBAAU;AACV,oBAAQ;AACR,0BAAA;AAAA,UACF;AACA,iBAAO,KAAK,QAAQ,MAAM;AAC1B;AAAA,QACF;AACA,eAAO,+BAA+B,EAAE,WAAW,MAAM,IAAI;AAAA,MAC/D;AACA,UAAI;AACF,aAAK,YAAY,MAAM,EAAE;AACzB,iBAAS,IAAI,MAAM,IAAI,OAAO;AAC9B,iBAAS,IAAI,MAAM,EAAE;AACrB,YAAI,OAAQ,0BAAyB;AACrC,eAAO,uBAAuB;AAAA,UAC5B,WAAW,MAAM;AAAA,UACjB,MAAM,MAAM,YAAY;AAAA,UACxB;AAAA,QAAA,CACD;AAAA,MACH,QAAQ;AAIN,eAAO,uBAAuB,EAAE,WAAW,MAAM,IAAI;AACrD,YAAI;AACF,cAAI,OAAO,WAAW,WAAY,QAAA;AAAA,QACpC,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,OAAO,EAAG,SAAQ;AAAA,EACjC;AAEA,QAAM,gBAAgB,MAAY;AAChC,QAAI,YAAY,kBAAkB,WAAW,CAAC,YAAY,CAAC,MAAO;AAClE,qBAAiB;AACjB,aAAS,KAAK;AAAA,EAChB;AAEA,SAAO;AAAA,IACL,mBAAmB,OAAO;AACxB,UAAI,SAAU;AACd,UAAI,CAAC,YAAYA,wCAAyB,KAAK,GAAG;AAIhD,mBAAW;AACX,gBAAQ;AAAA,MACV;AACA,oBAAA;AAAA,IACF;AAAA,IACA,eAAe,QAAQ;AACrB,UAAI,YAAY,OAAO,WAAW,UAAW;AAC7C,YAAM,YAAY,iBAAiB,MAAM;AACzC,UAAI,cAAc,KAAM,UAAS,OAAO,SAAS;AAGjD,UAAI,CAAC,0BAA0B,OAAO,OAAO,KAAK,SAAS,SAAS,EAAG;AACvE,cAAQ;AACR,oBAAA;AAAA,IACF;AAAA,IACA,0BAA0B;AACxB,UAAI,SAAU;AACd,cAAQ;AACR,oBAAA;AAAA,IACF;AAAA,IACA,UAAU;AACR,iBAAW;AAAA,IACb;AAAA,EAAA;AAEJ;;;;"}
+{"version":3,"file":"send-recovery.cjs","sources":["../../../../agent-runtime/src/send-recovery.ts"],"sourcesContent":["import {\n  type DeepAgentOutbox,\n  type DeepAgentSettledUpdate,\n  requeueFailedRunSend,\n  runSendMessageId,\n  runSendThreadOfState,\n} from './statewire-held-sends';\nimport type { StatewireDiagnosticsRecorder } from './statewire-diagnostics';\n\n/**\n * Transport-level send durability for the deep-agent thread (the successor to\n * Olympus' localStorage outbox, #29368 → #31504).\n *\n * The durable journal itself is the statewire session record: a command waits\n * in the outbox until a flush stamps it, and a stamped command stays in the\n * record until the server judges it. Reconnects never re-send a seq — answers\n * ride the hello — and a reload resends what never arrived. What the record\n * cannot recover on its own is a send the client had to settle without a\n * server verdict (a proven session loss, a stream gone mid-flight): statewire\n * 0.24 turns that into a durable `settled` update with a `lost`/`aborted`\n * failure, delivered once through `onCommandChange` and acked when the\n * handler's promise resolves.\n *\n * This controller is that handler. A failed message-carrying run send the\n * server NEVER judged goes back into the outbox queued (`insert({ from })`\n * consumes the update in the same write, so a redelivery never inserts twice),\n * same client-minted message id, re-anchored against the attached state —\n * which the host dedupes by id. Everything else that failed — a server-judged\n * fate (`rejected`, `failed`, `crashed`, `expired`), a stale send, one that\n * exhausted its retries — is re-held for the user with the failure in\n * `localMeta.error` (`statewire-held-sends.ts`), where the queue tray offers\n * retry and discard.\n *\n * Dropped, not re-queued: a send whose message already landed (the attached\n * state shows it, or the host refused it as a `duplicate-id`), one the user\n * removed, and the in-memory `unmount` settles (the record still holds those\n * for the next mount).\n *\n * Ordering: updates arrive one at a time in settle order, and a re-queued send\n * goes to the lane's tail in that order, so successors stay behind their\n * predecessors. An `aborted` send stamped `predecessorLost` was never attempted\n * because an earlier send of the same batch WAS attempted and settled `lost`;\n * once such a predecessor has been held for the user rather than re-queued,\n * its successors are held too, so none can land ahead of it.\n */\n\n/** Fates the server never saw: the send died client-side (unmount, stream\n * gone, session lost) and is safe to re-dispatch under its original message\n * id. The complement — rejected/failed/crashed/expired — is server-judged. */\nconst AUTO_RETRY_FATES: ReadonlySet<string> = new Set(['lost', 'aborted']);\n\n/** A failed send is re-queued at most this many times per attach; a\n * persistent failure (repeated session losses) is held for the user. */\nconst MAX_AUTO_RETRIES_PER_MESSAGE = 3;\n\n/** Persisted failures older than this are held for the user: auto-sending a\n * message the user abandoned a day ago is worse than surfacing it for a\n * decision. Mirrors the retired outbox's retention window. */\nconst MAX_AUTO_RETRY_AGE_MS = 24 * 60 * 60 * 1000;\n\n/** How many times a host may hold one message's retry (`beforeRetry`\n * returning a promise) before the controller re-queues it regardless: a hold\n * is the host's own bounded wait, never a reason to keep a message back for good. */\nexport const MAX_BEFORE_RETRY_HOLDS = 10;\n\nexport interface DeepAgentSendRecoveryOptions {\n  /**\n   * The thread's outbox (`extras.outbox`). `null` while it is unavailable;\n   * the update is then left for the next delivery.\n   */\n  outbox: () => Pick<DeepAgentOutbox, 'insert'> | null;\n  /**\n   * Persisted failure stamps (message id → epoch ms of the original send) for\n   * the freshness gate. `null`/absent means no persistence is readable — every\n   * failure then counts as fresh.\n   */\n  failureStamps?: (() => ReadonlyMap<string, number> | null) | undefined;\n  /** Transport lifecycle recorder; read per event so a late-mounted recorder still sees retries. */\n  diagnostics?: (() => StatewireDiagnosticsRecorder | undefined) | undefined;\n  /** Injectable clock (tests). */\n  now?: () => number;\n  /**\n   * Called right before a failed send is re-queued, with its message id, so a\n   * host can put back the per-send context that message was sent with\n   * (Olympus stages the agents it named) before its command leaves.\n   *\n   * Returning a promise holds the retry: the host can't put that context back\n   * yet (every send of the conversation rides one ambient context, and a send\n   * with another context is still on its way). Delivery then waits, so nothing\n   * behind it overtakes it, and asks again once the promise settles; past\n   * {@link MAX_BEFORE_RETRY_HOLDS} holds it re-queues the message regardless.\n   * A hook that throws never holds a retry back. A function returned is\n   * called when the message does not go after all, so the host lets go of\n   * what it put back.\n   */\n  beforeRetry?: ((messageId: string) => void | PromiseLike<void> | (() => void)) | undefined;\n}\n\nexport interface DeepAgentSendRecovery {\n  /**\n   * Handles one command update (`onCommandChange`): returns a promise for a\n   * failed run send it acts on — a durable `settled` update is acked once it\n   * resolves — and `undefined` otherwise.\n   */\n  onCommandChange(update: DeepAgentSettledUpdate, ctx?: { state?: unknown }): Promise<void> | undefined;\n  dispose(): void;\n}\n\n/** Whether a settle failure is a client-side death the recovery re-dispatches\n * (the server never judged the command). Exported for host-side telemetry. */\nexport function shouldAutoRetryFailedSend(failure: { fate: string } | undefined): boolean {\n  return failure !== undefined && AUTO_RETRY_FATES.has(failure.fate);\n}\n\nfunction isThenable(value: unknown): value is PromiseLike<unknown> {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { then?: unknown }).then === 'function'\n  );\n}\n\nfunction idsOf(list: unknown, into: Set<string>): void {\n  if (!Array.isArray(list)) return;\n  for (const item of list) {\n    const id = (item as { id?: unknown } | null)?.id;\n    if (typeof id === 'string') into.add(id);\n  }\n}\n\n/** Whether the attached deep-agent state already shows `messageId`: in the\n * transcript, a run's queues, or the batch being dispatched. */\nfunction stateHoldsMessage(state: unknown, messageId: string): boolean {\n  if (!state || typeof state !== 'object') return false;\n  const value = state as { messages?: unknown; runs?: unknown };\n  const ids = new Set<string>();\n  idsOf(value.messages, ids);\n  if (Array.isArray(value.runs)) {\n    for (const run of value.runs) {\n      const entry = run as {\n        queue?: unknown;\n        steerQueue?: unknown;\n        dispatching?: { messages?: unknown } | null;\n      } | null;\n      idsOf(entry?.queue, ids);\n      idsOf(entry?.steerQueue, ids);\n      idsOf(entry?.dispatching?.messages, ids);\n    }\n  }\n  return ids.has(messageId);\n}\n\nexport function createDeepAgentSendRecovery(\n  options: DeepAgentSendRecoveryOptions\n): DeepAgentSendRecovery {\n  const now = options.now ?? Date.now;\n  let disposed = false;\n  /** Re-queue budget per message id, for this controller's attach lifetime. */\n  const attempts = new Map<string, number>();\n  /** A `lost` send was held for the user: `predecessorLost` successors wait behind it. */\n  let lostPredecessorHeld = false;\n\n  const record = (event: string, data?: Record<string, unknown>): void => {\n    options.diagnostics?.()?.record(event, data);\n  };\n\n  /** Asks the host to stage the message's context; resolves to its release hook. */\n  const prepareRetry = async (messageId: string): Promise<(() => void) | undefined> => {\n    for (let held = 1; ; held++) {\n      let before: ReturnType<NonNullable<DeepAgentSendRecoveryOptions['beforeRetry']>> | undefined;\n      try {\n        before = options.beforeRetry?.(messageId);\n      } catch {\n        // A host's own context step failing never holds the retry back.\n        record('send-recovery/before-retry-failed', { messageId });\n        return undefined;\n      }\n      if (!isThenable(before)) return typeof before === 'function' ? before : undefined;\n      if (held > MAX_BEFORE_RETRY_HOLDS) {\n        // Not waited on: a hold that later fails must not go unhandled.\n        Promise.resolve(before).catch(() => undefined);\n        record('send-recovery/held-too-long', { messageId });\n        return undefined;\n      }\n      record('send-recovery/held', { messageId, holds: held });\n      try {\n        await before;\n      } catch {\n        // A hold that fails still ends; the host is asked again.\n      }\n      if (disposed) return undefined;\n    }\n  };\n\n  const handle = async (\n    update: DeepAgentSettledUpdate,\n    messageId: string,\n    state: unknown\n  ): Promise<void> => {\n    const failure = update.failure!;\n    const outbox = options.outbox();\n    // No outbox yet: throwing leaves the update for the next delivery.\n    if (outbox === null) throw new Error('send recovery: the thread has no outbox yet');\n    const hold = (reason: string): void => {\n      if (failure.fate === 'lost') lostPredecessorHeld = true;\n      requeueFailedRunSend({ outbox, update, held: true });\n      record(`send-recovery/${reason}`, { messageId, fate: failure.fate });\n    };\n\n    if (!shouldAutoRetryFailedSend(failure)) return hold('held');\n    if (\n      failure.fate === 'aborted' &&\n      'predecessorLost' in failure &&\n      failure.predecessorLost === true &&\n      lostPredecessorHeld\n    )\n      return hold('deferred');\n    const stamp = options.failureStamps?.()?.get(messageId);\n    if (stamp !== undefined && now() - stamp > MAX_AUTO_RETRY_AGE_MS) {\n      record('send-recovery/stale', { messageId, ageMs: Math.round(now() - stamp) });\n      return hold('held');\n    }\n    const attempt = (attempts.get(messageId) ?? 0) + 1;\n    if (attempt > MAX_AUTO_RETRIES_PER_MESSAGE) {\n      record('send-recovery/exhausted', { messageId });\n      return hold('held');\n    }\n\n    const release = await prepareRetry(messageId);\n    if (disposed) {\n      release?.();\n      throw new Error('send recovery: disposed before the retry');\n    }\n    try {\n      requeueFailedRunSend({ outbox, update, held: false, thread: runSendThreadOfState(state) });\n    } catch (error) {\n      // Nothing was queued (the outbox refused the insert); the host lets go\n      // of what it put back and the update stays for the next delivery.\n      record('send-recovery/raced', { messageId });\n      try {\n        release?.();\n      } catch {\n        // The host's own step failing never masks the refusal.\n      }\n      throw error;\n    }\n    attempts.set(messageId, attempt);\n    record('send-recovery/retry', { messageId, fate: failure.fate, attempt });\n  };\n\n  return {\n    onCommandChange(update, ctx) {\n      if (disposed || update.status !== 'settled' || update.failure === undefined) return undefined;\n      const messageId = runSendMessageId(update);\n      if (messageId === null) return undefined;\n      const { failure } = update;\n      // The user removed it, or the record still holds it for the next mount.\n      if (failure.cause === 'removed' || failure.cause === 'unmount') return undefined;\n      if (\n        stateHoldsMessage(ctx?.state, messageId) ||\n        (failure.fate === 'rejected' && failure.code === 'duplicate-id')\n      ) {\n        record('send-recovery/covered', { messageId, fate: failure.fate });\n        return undefined;\n      }\n      const handled = handle(update, messageId, ctx?.state);\n      // statewire awaits a durable update's promise; an in-memory one's is\n      // dropped, and its rejection must not surface as unhandled.\n      handled.catch(() => undefined);\n      return handled;\n    },\n    dispose() {\n      disposed = true;\n    },\n  };\n}\n"],"names":["requeueFailedRunSend","runSendThreadOfState","runSendMessageId"],"mappings":";;;AAiDA,MAAM,mBAAwC,oBAAI,IAAI,CAAC,QAAQ,SAAS,CAAC;AAIzE,MAAM,+BAA+B;AAKrC,MAAM,wBAAwB,KAAK,KAAK,KAAK;AAKtC,MAAM,yBAAyB;AA+C/B,SAAS,0BAA0B,SAAgD;AACxF,SAAO,YAAY,UAAa,iBAAiB,IAAI,QAAQ,IAAI;AACnE;AAEA,SAAS,WAAW,OAA+C;AACjE,SACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA6B,SAAS;AAElD;AAEA,SAAS,MAAM,MAAe,MAAyB;AACrD,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG;AAC1B,aAAW,QAAQ,MAAM;AACvB,UAAM,KAAM,6BAAkC;AAC9C,QAAI,OAAO,OAAO,SAAU,MAAK,IAAI,EAAE;AAAA,EACzC;AACF;AAIA,SAAS,kBAAkB,OAAgB,WAA4B;;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,QAAM,0BAAU,IAAA;AAChB,QAAM,MAAM,UAAU,GAAG;AACzB,MAAI,MAAM,QAAQ,MAAM,IAAI,GAAG;AAC7B,eAAW,OAAO,MAAM,MAAM;AAC5B,YAAM,QAAQ;AAKd,YAAM,+BAAO,OAAO,GAAG;AACvB,YAAM,+BAAO,YAAY,GAAG;AAC5B,aAAM,oCAAO,gBAAP,mBAAoB,UAAU,GAAG;AAAA,IACzC;AAAA,EACF;AACA,SAAO,IAAI,IAAI,SAAS;AAC1B;AAEO,SAAS,4BACd,SACuB;AACvB,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,MAAI,WAAW;AAEf,QAAM,+BAAe,IAAA;AAErB,MAAI,sBAAsB;AAE1B,QAAM,SAAS,CAAC,OAAe,SAAyC;;AACtE,wBAAQ,gBAAR,wDAAyB,OAAO,OAAO;AAAA,EACzC;AAGA,QAAM,eAAe,OAAO,cAAyD;;AACnF,aAAS,OAAO,KAAK,QAAQ;AAC3B,UAAI;AACJ,UAAI;AACF,kBAAS,aAAQ,gBAAR,iCAAsB;AAAA,MACjC,QAAQ;AAEN,eAAO,qCAAqC,EAAE,WAAW;AACzD,eAAO;AAAA,MACT;AACA,UAAI,CAAC,WAAW,MAAM,UAAU,OAAO,WAAW,aAAa,SAAS;AACxE,UAAI,OAAO,wBAAwB;AAEjC,gBAAQ,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAC7C,eAAO,+BAA+B,EAAE,WAAW;AACnD,eAAO;AAAA,MACT;AACA,aAAO,sBAAsB,EAAE,WAAW,OAAO,MAAM;AACvD,UAAI;AACF,cAAM;AAAA,MACR,QAAQ;AAAA,MAER;AACA,UAAI,SAAU,QAAO;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,SAAS,OACb,QACA,WACA,UACkB;;AAClB,UAAM,UAAU,OAAO;AACvB,UAAM,SAAS,QAAQ,OAAA;AAEvB,QAAI,WAAW,KAAM,OAAM,IAAI,MAAM,6CAA6C;AAClF,UAAM,OAAO,CAAC,WAAyB;AACrC,UAAI,QAAQ,SAAS,OAAQ,uBAAsB;AACnDA,yBAAAA,qBAAqB,EAAE,QAAQ,QAAQ,MAAM,MAAM;AACnD,aAAO,iBAAiB,MAAM,IAAI,EAAE,WAAW,MAAM,QAAQ,MAAM;AAAA,IACrE;AAEA,QAAI,CAAC,0BAA0B,OAAO,EAAG,QAAO,KAAK,MAAM;AAC3D,QACE,QAAQ,SAAS,aACjB,qBAAqB,WACrB,QAAQ,oBAAoB,QAC5B;AAEA,aAAO,KAAK,UAAU;AACxB,UAAM,SAAQ,mBAAQ,kBAAR,wDAA2B,IAAI;AAC7C,QAAI,UAAU,UAAa,IAAA,IAAQ,QAAQ,uBAAuB;AAChE,aAAO,uBAAuB,EAAE,WAAW,OAAO,KAAK,MAAM,IAAA,IAAQ,KAAK,GAAG;AAC7E,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,WAAW,SAAS,IAAI,SAAS,KAAK,KAAK;AACjD,QAAI,UAAU,8BAA8B;AAC1C,aAAO,2BAA2B,EAAE,WAAW;AAC/C,aAAO,KAAK,MAAM;AAAA,IACpB;AAEA,UAAM,UAAU,MAAM,aAAa,SAAS;AAC5C,QAAI,UAAU;AACZ;AACA,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,QAAI;AACFA,8CAAqB,EAAE,QAAQ,QAAQ,MAAM,OAAO,QAAQC,mBAAAA,qBAAqB,KAAK,GAAG;AAAA,IAC3F,SAAS,OAAO;AAGd,aAAO,uBAAuB,EAAE,WAAW;AAC3C,UAAI;AACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AACA,aAAS,IAAI,WAAW,OAAO;AAC/B,WAAO,uBAAuB,EAAE,WAAW,MAAM,QAAQ,MAAM,SAAS;AAAA,EAC1E;AAEA,SAAO;AAAA,IACL,gBAAgB,QAAQ,KAAK;AAC3B,UAAI,YAAY,OAAO,WAAW,aAAa,OAAO,YAAY,OAAW,QAAO;AACpF,YAAM,YAAYC,mBAAAA,iBAAiB,MAAM;AACzC,UAAI,cAAc,KAAM,QAAO;AAC/B,YAAM,EAAE,YAAY;AAEpB,UAAI,QAAQ,UAAU,aAAa,QAAQ,UAAU,UAAW,QAAO;AACvE,UACE,kBAAkB,2BAAK,OAAO,SAAS,KACtC,QAAQ,SAAS,cAAc,QAAQ,SAAS,gBACjD;AACA,eAAO,yBAAyB,EAAE,WAAW,MAAM,QAAQ,MAAM;AACjE,eAAO;AAAA,MACT;AACA,YAAM,UAAU,OAAO,QAAQ,WAAW,2BAAK,KAAK;AAGpD,cAAQ,MAAM,MAAM,MAAS;AAC7B,aAAO;AAAA,IACT;AAAA,IACA,UAAU;AACR,iBAAW;AAAA,IACb;AAAA,EAAA;AAEJ;;;;"}