@code-yeongyu/senpi-agent-core 2026.10.27-1 → 2026.10.30-1

package/dist/agent-loop.js

@@ -535,6 +535,7 @@ async function streamAssistantResponse(context, config, signal, emit, streamFunc
                         await emit(carryAssistantCapture(event, {
                             type: "message_start",
                             message: { ...partialMessage },
+                            streaming: true,
                         }));
                         break;
                     case "text_start":

package/dist/agent.js

@@ -1,4 +1,4 @@
-import { readProviderDiagnostic, sanitizeProviderDiagnostic, } from "@earendil-works/pi-ai";
+import { readProviderDiagnostic, sanitizeProviderDiagnostic, sanitizeProviderErrorMessage, } from "@earendil-works/pi-ai";
 import { buildProviderContext as buildProviderContextFromAgentContext, runAgentLoop, runAgentLoopContinue, } from "./agent-loop.js";
 import { ProviderRetryWatchdogAbortError } from "./assistant-terminal-state.js";
 import { dispatchInternalAgent, internalLoopSink, } from "./internal-events.js";
@@ -600,6 +600,8 @@ export class Agent {
             ...(!aborted && isLocalFailure(error) ? { failureSource: "local" } : {}),
             timestamp: Date.now(),
         };
+        // A thrown provider error never passed the stream boundary: classify and redact it the same way (senpi#4282).
+        sanitizeProviderErrorMessage(failureMessage);
         await this.processEvents({ type: "message_start", message: failureMessage });
         await this.processEvents({ type: "message_end", message: failureMessage });
         await this.processEvents({ type: "turn_end", message: failureMessage, toolResults: [] });

package/dist/assistant-terminal-state.js

@@ -1,4 +1,4 @@
-import { isClassifierRefusal, isCursorExecResolved, readProviderDiagnostic, } from "@earendil-works/pi-ai";
+import { isClassifierRefusal, isCursorExecResolved, readProviderDiagnostic, sanitizeProviderErrorMessage, } from "@earendil-works/pi-ai";
 import { isOAuthRefreshUnavailableError } from "@earendil-works/pi-ai/utils/oauth-refresh-error";
 import { OAUTH_REFRESH_UNAVAILABLE_DIAGNOSTIC } from "@earendil-works/pi-ai/utils/retry";
 const EMPTY_USAGE = {
@@ -69,7 +69,7 @@ export function shouldFinalizeIdleAsStop(partialMessage, providerToolResults) {
 export function createTerminalFailureAssistantMessage(model, reason, error, partialMessage) {
     const errorMessage = error instanceof Error ? error.message : String(error);
     const providerDiagnostic = reason === "error" ? readProviderDiagnostic(error) : undefined;
-    return {
+    const message = {
         role: "assistant",
         content: partialMessage?.content ?? [{ type: "text", text: "" }],
         api: partialMessage?.api ?? model.api,
@@ -94,6 +94,9 @@ export function createTerminalFailureAssistantMessage(model, reason, error, part
         ...(error instanceof ProviderRetryWatchdogAbortError ? { abortSource: "provider" } : {}),
         timestamp: partialMessage?.timestamp ?? Date.now(),
     };
+    // A thrown provider error never passed the stream boundary: classify and redact it the same way (senpi#4282).
+    sanitizeProviderErrorMessage(message);
+    return message;
 }
 export function normalizeTerminalAssistantMessage(message, event) {
     if (event.type === "done")

package/dist/conformance/index.d.ts

@@ -0,0 +1,42 @@
+export type { ConformanceManifest, ManifestCase, MappingProblem, MappingProblemCode } from "./mapping.ts";
+export { buildManifest, findImplementationGaps, findMappingProblems } from "./mapping.ts";
+export type { AdapterKind, RegisteredCase } from "./registry.ts";
+export { ADAPTER_KINDS, CONFORMANCE_REGISTRY } from "./registry.ts";
+export type { CaseImplementation, CaseResult, ConformanceHost, HostReport } from "./runner.ts";
+export { runSuite } from "./runner.ts";
+export type { SuiteHashEntry } from "./suite-hash.ts";
+export { computeSuiteHash, sha256Hex } from "./suite-hash.ts";
+export type { CommitResult, DurableStore, DurableStoreErrorCode, DurableStoreOptions, RecordScan, StoreDocument, StoreOperation, StoreRecord, StoreSnapshot, StoreValue, StoreWrite, StoreWritePoint, } from "../durable/store.ts";
+export { DurableStoreError } from "../durable/store.ts";
+export type { KillDeclaration } from "../durable/testing/kill-store.ts";
+export { KILL_STORE_CASES, KILL_STORE_DECLARATIONS } from "../durable/testing/kill-store.ts";
+export { STORE_CASES } from "../durable/testing/store-cases.ts";
+export type { StoreCaseAdapters, StoreConformanceAdapter } from "../durable/testing/store-harness.ts";
+export type { KillWakeDeclaration } from "../durable/testing/kill-wake.ts";
+export { KILL_WAKE_CASES, KILL_WAKE_DECLARATIONS } from "../durable/testing/kill-wake.ts";
+export type { ManualTimers } from "../durable/testing/manual-timers.ts";
+export { createManualTimers } from "../durable/testing/manual-timers.ts";
+export { MULTI_HOST_CASES } from "../durable/testing/multi-host-cases.ts";
+export { WAKE_CASES } from "../durable/testing/wake-cases.ts";
+export type { WakeAlarmSession, WakeCaseAdapters, WakeConformanceAdapter } from "../durable/testing/wake-harness.ts";
+export type { Wake, WakeAlarm, WakeAlarmOptions, WakeAlarmPoint, WakeHost, WakeHostOptions, WakePoint, } from "../durable/wake-host.ts";
+export { createWakeHost } from "../durable/wake-host.ts";
+export type { BunTimerHost, BunTimerHostOptions, SetTimer } from "../durable/wake-host-bun-timer.ts";
+export { createBunTimerHost } from "../durable/wake-host-bun-timer.ts";
+export type { AlarmPersistence } from "../durable/wake-host-store-alarm.ts";
+export { storeAlarmPersistence } from "../durable/wake-host-store-alarm.ts";
+export type { CarrierLink, InProcessNetwork, InProcessNetworkOptions } from "../transport/in-process-carrier.ts";
+export { createInProcessNetwork } from "../transport/in-process-carrier.ts";
+export type { LocalEndpoint } from "../transport/local-endpoint.ts";
+export { localEndpoint } from "../transport/local-endpoint.ts";
+export type { ReferencePacket, ReliableTransportOptions } from "../transport/reliable-transport.ts";
+export { createReliableTransport, decodeReferencePacket } from "../transport/reliable-transport.ts";
+export { FAULT_TRANSPORT_CASES } from "../transport/testing/fault-cases.ts";
+export type { FaultProfileName } from "../transport/testing/fault-transport.ts";
+export { FAULT_PROFILE_NAMES } from "../transport/testing/fault-transport.ts";
+export { MULTI_CASES } from "../transport/testing/multi-cases.ts";
+export { TRANSPORT_CASES } from "../transport/testing/transport-cases.ts";
+export type { CarrierFault, TransportCaseAdapters, TransportConformanceAdapter, WireView, } from "../transport/testing/transport-harness.ts";
+export type { CarrierConnection, CarrierSide, FrameHandler, Transport, TransportClock, TransportFrame, TransportSide, } from "../transport/transport.ts";
+export { TransportClosedError } from "../transport/transport.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/conformance/index.js

@@ -0,0 +1,23 @@
+export { buildManifest, findImplementationGaps, findMappingProblems } from "./mapping.js";
+export { ADAPTER_KINDS, CONFORMANCE_REGISTRY } from "./registry.js";
+export { runSuite } from "./runner.js";
+export { computeSuiteHash, sha256Hex } from "./suite-hash.js";
+export { DurableStoreError } from "../durable/store.js";
+export { KILL_STORE_CASES, KILL_STORE_DECLARATIONS } from "../durable/testing/kill-store.js";
+export { STORE_CASES } from "../durable/testing/store-cases.js";
+export { KILL_WAKE_CASES, KILL_WAKE_DECLARATIONS } from "../durable/testing/kill-wake.js";
+export { createManualTimers } from "../durable/testing/manual-timers.js";
+export { MULTI_HOST_CASES } from "../durable/testing/multi-host-cases.js";
+export { WAKE_CASES } from "../durable/testing/wake-cases.js";
+export { createWakeHost } from "../durable/wake-host.js";
+export { createBunTimerHost } from "../durable/wake-host-bun-timer.js";
+export { storeAlarmPersistence } from "../durable/wake-host-store-alarm.js";
+export { createInProcessNetwork } from "../transport/in-process-carrier.js";
+export { localEndpoint } from "../transport/local-endpoint.js";
+export { createReliableTransport, decodeReferencePacket } from "../transport/reliable-transport.js";
+export { FAULT_TRANSPORT_CASES } from "../transport/testing/fault-cases.js";
+export { FAULT_PROFILE_NAMES } from "../transport/testing/fault-transport.js";
+export { MULTI_CASES } from "../transport/testing/multi-cases.js";
+export { TRANSPORT_CASES } from "../transport/testing/transport-cases.js";
+export { TransportClosedError } from "../transport/transport.js";
+//# sourceMappingURL=index.js.map

package/dist/conformance/mapping.d.ts

@@ -0,0 +1,24 @@
+import type { RegisteredCase } from "./registry.ts";
+export type MappingProblemCode = "duplicate-id" | "malformed-id" | "malformed-impl" | "missing-intro" | "missing-adapters" | "duplicate-adapter" | "missing-expected";
+export interface MappingProblem {
+    readonly id: string;
+    readonly code: MappingProblemCode;
+}
+export interface ManifestCase extends RegisteredCase {
+    readonly impl_hash: string;
+}
+/** The exported suite: what every host runs and every host report is compared against. */
+export interface ConformanceManifest {
+    readonly suite_hash: string;
+    readonly cases: readonly ManifestCase[];
+}
+/** Every reason the registry is not a complete, unambiguous mapping; empty when it is. */
+export declare function findMappingProblems(cases: readonly RegisteredCase[]): MappingProblem[];
+/** Registered cases with no implementation, and implementations with no registered case. */
+export declare function findImplementationGaps(cases: readonly Pick<RegisteredCase, "id">[], implementations: ReadonlyMap<string, unknown>): {
+    unimplemented: string[];
+    unregistered: string[];
+};
+/** Build the manifest export, hashing each implementation file through `readImpl` (repository-relative path). */
+export declare function buildManifest(cases: readonly RegisteredCase[], readImpl: (impl: string) => Promise<Uint8Array>): Promise<ConformanceManifest>;
+//# sourceMappingURL=mapping.d.ts.map

package/dist/conformance/mapping.js

@@ -0,0 +1,62 @@
+import { computeSuiteHash, sha256Hex } from "./suite-hash.js";
+const CASE_ID = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+)+$/;
+const isRepoRelativeTs = (path) => path.endsWith(".ts") && !path.startsWith("/") && !path.includes("\\") && !path.split("/").includes("..");
+function problemsOf(entry) {
+    const codes = [];
+    if (!CASE_ID.test(entry.id))
+        codes.push("malformed-id");
+    if (!isRepoRelativeTs(entry.impl))
+        codes.push("malformed-impl");
+    if (entry.intro.trim() === "")
+        codes.push("missing-intro");
+    if (entry.adapters.length === 0)
+        codes.push("missing-adapters");
+    if (new Set(entry.adapters).size !== entry.adapters.length)
+        codes.push("duplicate-adapter");
+    if (entry.expected.trim() === "")
+        codes.push("missing-expected");
+    return codes;
+}
+/** Every reason the registry is not a complete, unambiguous mapping; empty when it is. */
+export function findMappingProblems(cases) {
+    const problems = [];
+    const seen = new Set();
+    for (const entry of cases) {
+        if (seen.has(entry.id))
+            problems.push({ id: entry.id, code: "duplicate-id" });
+        seen.add(entry.id);
+        for (const code of problemsOf(entry))
+            problems.push({ id: entry.id, code });
+    }
+    return problems;
+}
+/** Registered cases with no implementation, and implementations with no registered case. */
+export function findImplementationGaps(cases, implementations) {
+    const registered = new Set(cases.map((entry) => entry.id));
+    return {
+        unimplemented: [...registered].filter((id) => !implementations.has(id)),
+        unregistered: [...implementations.keys()].filter((id) => !registered.has(id)),
+    };
+}
+/** Build the manifest export, hashing each implementation file through `readImpl` (repository-relative path). */
+export async function buildManifest(cases, readImpl) {
+    const problems = findMappingProblems(cases);
+    if (problems.length > 0) {
+        throw new Error(`conformance registry mapping problems: ${problems.map((p) => `${p.id} ${p.code}`).join(", ")}`);
+    }
+    const manifestCases = [];
+    for (const entry of cases) {
+        let bytes;
+        try {
+            bytes = await readImpl(entry.impl);
+        }
+        catch (error) {
+            throw new Error(`conformance case ${entry.id}: cannot read its implementation ${entry.impl}`, {
+                cause: error,
+            });
+        }
+        manifestCases.push({ ...entry, impl_hash: await sha256Hex(bytes) });
+    }
+    return { suite_hash: await computeSuiteHash(manifestCases), cases: manifestCases };
+}
+//# sourceMappingURL=mapping.js.map

package/dist/conformance/registry.d.ts

@@ -0,0 +1,15 @@
+export declare const ADAPTER_KINDS: readonly ["store", "wake", "transport", "executor", "host"];
+export type AdapterKind = (typeof ADAPTER_KINDS)[number];
+/** One conformance case: where it is implemented, which change introduced it, what it needs, and what it proves. */
+export interface RegisteredCase {
+    /** Unique upper-case ID, for example `STORE-01` or `KILL-STORE-01`. */
+    readonly id: string;
+    /** Repository-relative path of the TypeScript file that implements the case. */
+    readonly impl: string;
+    /** The change that introduced the case (a pull request such as `#4727`). */
+    readonly intro: string;
+    readonly adapters: readonly AdapterKind[];
+    readonly expected: string;
+}
+export declare const CONFORMANCE_REGISTRY: readonly RegisteredCase[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/conformance/registry.js

@@ -0,0 +1,75 @@
+export const ADAPTER_KINDS = ["store", "wake", "transport", "executor", "host"];
+/**
+ * Every case of the durable-core conformance suite (packages/agent/docs/durable-core-adr.md). A change that adds cases
+ * registers each of them here, with its mapping, in the same change.
+ */
+const STORE_CASES_IMPL = "packages/agent/src/durable/testing/store-cases.ts";
+const KILL_STORE_IMPL = "packages/agent/src/durable/testing/kill-store.ts";
+const WAKE_CASES_IMPL = "packages/agent/src/durable/testing/wake-cases.ts";
+const MULTI_HOST_IMPL = "packages/agent/src/durable/testing/multi-host-cases.ts";
+const KILL_WAKE_IMPL = "packages/agent/src/durable/testing/kill-wake.ts";
+const TRANSPORT_CASES_IMPL = "packages/agent/src/transport/testing/transport-cases.ts";
+const MULTI_CASES_IMPL = "packages/agent/src/transport/testing/multi-cases.ts";
+const FAULT_CASES_IMPL = "packages/agent/src/transport/testing/fault-cases.ts";
+const transportCase = (id, impl, expected) => ({
+    id,
+    impl,
+    intro: "#4741",
+    adapters: ["transport"],
+    expected,
+});
+const faultCase = (n, profile) => transportCase(`FAULT-TRANSPORT-0${n}`, FAULT_CASES_IMPL, `${profile} profile: lane order kept, committed frames delivered once, resume from the last ACK`);
+const wakeCase = (id, impl, expected) => ({
+    id,
+    impl,
+    intro: "#4735",
+    adapters: ["store", "wake"],
+    expected,
+});
+const storeCase = (id, impl, expected) => ({
+    id,
+    impl,
+    intro: "#4730",
+    adapters: ["store"],
+    expected,
+});
+export const CONFORMANCE_REGISTRY = [
+    storeCase("STORE-01", STORE_CASES_IMPL, "a commit adopts once, after its batch is durable; every instance sees each batch whole"),
+    storeCase("STORE-02", STORE_CASES_IMPL, "a cut at every write point of a commit leaves nothing of it durable, with no adopt and no seq burned"),
+    storeCase("STORE-03", STORE_CASES_IMPL, "concurrent admissions run one at a time in admission order; a refused mutation releases the line"),
+    storeCase("STORE-04", STORE_CASES_IMPL, "an old owner's delayed commit or claim after the new owner's first commit is refused and changes nothing"),
+    storeCase("STORE-05", STORE_CASES_IMPL, "claim + import across hosts is whole, idempotent and tail-only; a diverged log is refused atomically"),
+    storeCase("STORE-06", STORE_CASES_IMPL, "minted IDs are unique; record and document scans, deletes and duplicate-ID refusal behave as specified"),
+    storeCase("STORE-07", STORE_CASES_IMPL, "a claim raises the epoch by exactly one; a claim that skips an epoch is refused and changes nothing"),
+    storeCase("KILL-STORE-01", KILL_STORE_IMPL, "everywhere: kill before a commit; after restart nothing is durable and the batch commits with the same IDs"),
+    storeCase("KILL-STORE-02", KILL_STORE_IMPL, "everywhere: kill after a commit is durable; after restart it is whole, stable IDs, and a retry applies nothing"),
+    storeCase("KILL-STORE-03", KILL_STORE_IMPL, "everywhere: kill before a claim; after restart the epoch is unchanged and the claim succeeds"),
+    storeCase("KILL-STORE-04", KILL_STORE_IMPL, "everywhere: kill after a claim is durable; after restart the new epoch holds and the old one is fenced"),
+    storeCase("KILL-STORE-05", KILL_STORE_IMPL, "everywhere: kill before an import; after restart nothing is imported and the import succeeds"),
+    storeCase("KILL-STORE-06", KILL_STORE_IMPL, "everywhere: kill after an import is durable; after restart it is whole and a re-import adds nothing"),
+    wakeCase("WAKE-01", WAKE_CASES_IMPL, "pre-arm: a recovery alarm is durable before admitted work starts and before a new instance resumes"),
+    wakeCase("WAKE-02", WAKE_CASES_IMPL, "update: after each commit the alarm is min(heartbeat if active, earliest wake), cleared only when idle"),
+    wakeCase("WAKE-03", WAKE_CASES_IMPL, "resume: a fire re-arms before resume, runs due work once, and an early fire is harmless"),
+    wakeCase("WAKE-RET-01", WAKE_CASES_IMPL, "retention: an alarm survives host restarts and reopened instances, fires once, and is cleared after the work"),
+    wakeCase("MULTI-HOST-01", MULTI_HOST_IMPL, "many sessions on one host instance: records and wakes stay per session"),
+    wakeCase("KILL-WAKE-01", KILL_WAKE_IMPL, "everywhere: kill during admit's alarm write; nothing is durable and a retried admission runs once"),
+    wakeCase("KILL-WAKE-02", KILL_WAKE_IMPL, "everywhere: kill after admit's arm, before work; the alarm fires harmlessly and ends cleared"),
+    wakeCase("KILL-WAKE-03", KILL_WAKE_IMPL, "everywhere: kill between a commit and its alarm update; the pre-armed heartbeat recovers the wake, run once"),
+    wakeCase("KILL-WAKE-04", KILL_WAKE_IMPL, "everywhere: eviction during the update's alarm write; the heartbeat recovers the wake, run once"),
+    wakeCase("KILL-WAKE-05", KILL_WAKE_IMPL, "everywhere: kill after a fire's re-arm, before resume; the next fire runs the due work once"),
+    wakeCase("KILL-WAKE-06", KILL_WAKE_IMPL, "everywhere: kill after a resumed task's commit is durable; the task never runs twice and the alarm clears"),
+    wakeCase("KILL-WAKE-07", KILL_WAKE_IMPL, "everywhere: eviction during the alarm clear after the work; the next fire is harmless and clears it"),
+    wakeCase("KILL-WAKE-08", KILL_WAKE_IMPL, "everywhere: a concurrent fire's updates cannot clear an uncommitted admission's heartbeat; a kill after its commit recovers the wake, run once"),
+    transportCase("TRANSPORT-01", TRANSPORT_CASES_IMPL, "order: frames on each lane are delivered in send order, each once"),
+    transportCase("TRANSPORT-02", TRANSPORT_CASES_IMPL, "resume: after the carrier drops and re-attaches, each lane continues from its last ACK; nothing lost or repeated"),
+    transportCase("TRANSPORT-03", TRANSPORT_CASES_IMPL, "backpressure: a stalled receiver bounds its lane's senders; sends resolve in order once it drains"),
+    transportCase("MULTI-LANE-01", MULTI_CASES_IMPL, "N scopes over one transport keep per-scope order and interleave"),
+    transportCase("MULTI-FAIR-01", MULTI_CASES_IMPL, "a stalled or long lane in A does not starve B: B is delivered within a bounded number of A's frames"),
+    transportCase("MULTI-FAIR-02", MULTI_CASES_IMPL, "a frame lost on one lane is resent on that lane's own deadline: another lane's ACK progress never postpones it"),
+    faultCase(1, "slow"),
+    faultCase(2, "lossy"),
+    faultCase(3, "laggy"),
+    faultCase(4, "flap"),
+    faultCase(5, "drop-reattach"),
+];
+//# sourceMappingURL=registry.js.map

package/dist/conformance/runner.d.ts

@@ -0,0 +1,27 @@
+import type { ConformanceManifest } from "./mapping.ts";
+import type { AdapterKind } from "./registry.ts";
+/** A host under test: its name in reports, the adapter kinds it provides, and the adapters handed to each case. */
+export interface ConformanceHost<TAdapters> {
+    readonly name: string;
+    readonly provides: readonly AdapterKind[];
+    readonly adapters: TAdapters;
+}
+/** A case passes when it resolves and fails when it rejects. */
+export type CaseImplementation<TAdapters> = (adapters: TAdapters) => Promise<void>;
+export type CaseResult = {
+    readonly id: string;
+    readonly status: "pass";
+} | {
+    readonly id: string;
+    readonly status: "fail";
+    readonly error: string;
+};
+/** One host's run of the manifest. There is no skip: a case that cannot run on the host fails. */
+export interface HostReport {
+    readonly host: string;
+    readonly suite_hash: string;
+    readonly results: readonly CaseResult[];
+}
+/** Run every manifest case on `host`, one at a time in manifest order, and report under the manifest's suite hash. */
+export declare function runSuite<TAdapters>(manifest: ConformanceManifest, host: ConformanceHost<TAdapters>, implementations: ReadonlyMap<string, CaseImplementation<TAdapters>>): Promise<HostReport>;
+//# sourceMappingURL=runner.d.ts.map

package/dist/conformance/runner.js

@@ -0,0 +1,23 @@
+async function runCase(id, adapters, host, implementation) {
+    if (implementation === undefined)
+        return { id, status: "fail", error: "no implementation is registered for this case" };
+    const missing = adapters.filter((kind) => !host.provides.includes(kind));
+    if (missing.length > 0)
+        return { id, status: "fail", error: `the host does not provide adapter: ${missing.join(", ")}` };
+    try {
+        await implementation(host.adapters);
+        return { id, status: "pass" };
+    }
+    catch (error) {
+        return { id, status: "fail", error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/** Run every manifest case on `host`, one at a time in manifest order, and report under the manifest's suite hash. */
+export async function runSuite(manifest, host, implementations) {
+    const results = [];
+    for (const entry of manifest.cases) {
+        results.push(await runCase(entry.id, entry.adapters, host, implementations.get(entry.id)));
+    }
+    return { host: host.name, suite_hash: manifest.suite_hash, results };
+}
+//# sourceMappingURL=runner.js.map

package/dist/conformance/suite-hash.d.ts

@@ -0,0 +1,12 @@
+export interface SuiteHashEntry {
+    readonly id: string;
+    readonly impl_hash: string;
+}
+/** Lower-case hex SHA-256 through Web Crypto, so the same code runs on Bun, Node and a Durable Object. */
+export declare function sha256Hex(bytes: Uint8Array): Promise<string>;
+/**
+ * The suite hash: SHA-256 over one `id<TAB>impl_hash` line per case, sorted by ID. It changes when a case is added,
+ * removed or renamed, or when any case implementation changes, and never with registration order.
+ */
+export declare function computeSuiteHash(entries: readonly SuiteHashEntry[]): Promise<string>;
+//# sourceMappingURL=suite-hash.d.ts.map

package/dist/conformance/suite-hash.js

@@ -0,0 +1,20 @@
+/** Lower-case hex SHA-256 through Web Crypto, so the same code runs on Bun, Node and a Durable Object. */
+export async function sha256Hex(bytes) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)));
+    return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+ * The suite hash: SHA-256 over one `id<TAB>impl_hash` line per case, sorted by ID. It changes when a case is added,
+ * removed or renamed, or when any case implementation changes, and never with registration order.
+ */
+export async function computeSuiteHash(entries) {
+    const ids = new Set();
+    for (const { id } of entries) {
+        if (ids.has(id))
+            throw new Error(`duplicate conformance case ID in the suite hash: ${id}`);
+        ids.add(id);
+    }
+    const lines = entries.map(({ id, impl_hash }) => `${id}\t${impl_hash}\n`).sort();
+    return sha256Hex(new TextEncoder().encode(lines.join("")));
+}
+//# sourceMappingURL=suite-hash.js.map

package/dist/durable/store-admission.d.ts

@@ -0,0 +1,7 @@
+/** The single admission line above a DurableStore: mutations run one at a time, in admission order. */
+export interface AdmissionLine {
+    /** Run `mutation` after every earlier admission settles. A rejected mutation releases the line. */
+    admit<T>(mutation: () => Promise<T>): Promise<T>;
+}
+export declare function createAdmissionLine(): AdmissionLine;
+//# sourceMappingURL=store-admission.d.ts.map

package/dist/durable/store-admission.js

@@ -0,0 +1,11 @@
+export function createAdmissionLine() {
+    let tail = Promise.resolve();
+    return {
+        admit(mutation) {
+            const run = tail.then(() => mutation());
+            tail = run.then(() => undefined, () => undefined);
+            return run;
+        },
+    };
+}
+//# sourceMappingURL=store-admission.js.map

package/dist/durable/store-memory.d.ts

@@ -0,0 +1,15 @@
+import { type DurableStore, type DurableStoreOptions, type StoreRecord, type StoreValue } from "./store.ts";
+interface MediumState {
+    readonly epoch: number;
+    readonly records: readonly StoreRecord[];
+    readonly documents: ReadonlyMap<string, StoreValue>;
+}
+/** The memory backend's durable medium. It outlives every store opened on it, so a kill is dropping an instance. */
+export interface MemoryStoreMedium {
+    current: MediumState;
+}
+export declare function createMemoryStoreMedium(): MemoryStoreMedium;
+/** A DurableStore over `medium`. Each operation stages its writes and publishes them in one assignment: atomic. */
+export declare function openMemoryStore(medium: MemoryStoreMedium, options?: DurableStoreOptions): DurableStore;
+export {};
+//# sourceMappingURL=store-memory.d.ts.map

package/dist/durable/store-memory.js

@@ -0,0 +1,140 @@
+import { DurableStoreError, } from "./store.js";
+export function createMemoryStoreMedium() {
+    return { current: { epoch: 0, records: [], documents: new Map() } };
+}
+const copy = (value) => structuredClone(value);
+const copyRecord = (record) => ({ ...record, data: copy(record.data) });
+const isList = (value) => Array.isArray(value);
+function sameValue(a, b) {
+    if (a === undefined || b === undefined || a === null || b === null)
+        return a === b;
+    if (typeof a !== "object" || typeof b !== "object")
+        return a === b;
+    if (isList(a) || isList(b)) {
+        return isList(a) && isList(b) && a.length === b.length && a.every((item, index) => sameValue(item, b[index]));
+    }
+    const keys = Object.keys(a);
+    return (keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && sameValue(a[key], b[key])));
+}
+const sameRecord = (a, b) => b !== undefined && a.seq === b.seq && a.id === b.id && a.kind === b.kind && sameValue(a.data, b.data);
+function requireOwner(state, epoch) {
+    if (state.epoch === 0)
+        throw new DurableStoreError("unclaimed", "the store has no owner; claim it first");
+    if (epoch !== state.epoch) {
+        throw new DurableStoreError("stale-epoch", `epoch ${epoch} is not the owner epoch ${state.epoch}`);
+    }
+}
+function importedTail(state, snapshot) {
+    const ids = new Set();
+    const wellFormed = snapshot.head === snapshot.records.length &&
+        snapshot.records.every((record, index) => record.seq === index + 1 && !ids.has(record.id) && ids.add(record.id));
+    const extendsLog = state.records.length <= snapshot.records.length &&
+        state.records.every((record, index) => sameRecord(record, snapshot.records[index]));
+    if (!wellFormed || !extendsLog) {
+        throw new DurableStoreError("import-conflict", "the snapshot's log does not extend this store's log");
+    }
+    return snapshot.records.slice(state.records.length);
+}
+function scan(records, query) {
+    const matching = records.filter((record) => (query.fromSeq === undefined || record.seq >= query.fromSeq) &&
+        (query.toSeq === undefined || record.seq <= query.toSeq) &&
+        (query.kind === undefined || record.kind === query.kind));
+    const ordered = query.order === "desc" ? matching.reverse() : matching;
+    return (query.limit === undefined ? ordered : ordered.slice(0, query.limit)).map(copyRecord);
+}
+const documentsOf = (state, prefix) => [...state.documents]
+    .filter(([key]) => key.startsWith(prefix))
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+    .map(([key, data]) => ({ key, data: copy(data) }));
+/** A DurableStore over `medium`. Each operation stages its writes and publishes them in one assignment: atomic. */
+export function openMemoryStore(medium, options = {}) {
+    const point = (at) => options.onWritePoint?.(at);
+    return {
+        readEpoch: async () => medium.current.epoch,
+        readHead: async () => medium.current.records.length,
+        async claim(expectedEpoch, nextEpoch) {
+            point({ op: "claim", at: "before" });
+            const state = medium.current;
+            if (!Number.isSafeInteger(nextEpoch) || nextEpoch !== expectedEpoch + 1) {
+                throw new DurableStoreError("invalid-claim", `a claim must raise the epoch to exactly ${expectedEpoch + 1}`);
+            }
+            if (state.epoch !== expectedEpoch) {
+                throw new DurableStoreError("stale-epoch", `expected epoch ${expectedEpoch}, the owner epoch is ${state.epoch}`);
+            }
+            medium.current = { ...state, epoch: nextEpoch };
+            point({ op: "claim", at: "durable" });
+        },
+        async commit(epoch, writes, adopt) {
+            point({ op: "commit", at: "before" });
+            const state = medium.current;
+            requireOwner(state, epoch);
+            const records = [...state.records];
+            const ids = new Set(records.map((record) => record.id));
+            const documents = new Map(state.documents);
+            const seqs = [];
+            writes.forEach((write, index) => {
+                point({ op: "commit", at: "write", index });
+                switch (write.op) {
+                    case "append": {
+                        if (ids.has(write.id))
+                            throw new DurableStoreError("duplicate-record-id", `record ${write.id} exists`);
+                        ids.add(write.id);
+                        const seq = records.length + 1;
+                        records.push({ seq, id: write.id, kind: write.kind, data: copy(write.data) });
+                        seqs.push(seq);
+                        break;
+                    }
+                    case "put":
+                        documents.set(write.key, copy(write.data));
+                        break;
+                    case "delete":
+                        documents.delete(write.key);
+                        break;
+                }
+            });
+            medium.current = { epoch: state.epoch, records, documents };
+            point({ op: "commit", at: "durable" });
+            const result = { seqs, head: records.length };
+            adopt(result);
+            return result;
+        },
+        mintId: () => crypto.randomUUID(),
+        scanRecords: async (query = {}) => scan(medium.current.records, query),
+        getDocument: async (key) => {
+            const data = medium.current.documents.get(key);
+            return data === undefined ? undefined : copy(data);
+        },
+        scanDocuments: async (prefix) => documentsOf(medium.current, prefix),
+        exportSnapshot: async () => {
+            const state = medium.current;
+            return {
+                epoch: state.epoch,
+                head: state.records.length,
+                records: state.records.map(copyRecord),
+                documents: documentsOf(state, ""),
+            };
+        },
+        async importSnapshot(epoch, snapshot) {
+            point({ op: "import", at: "before" });
+            const state = medium.current;
+            requireOwner(state, epoch);
+            if (epoch <= snapshot.epoch) {
+                throw new DurableStoreError("invalid-claim", `epoch ${epoch} is not above the source epoch ${snapshot.epoch}`);
+            }
+            const records = [...state.records];
+            const documents = new Map();
+            let index = 0;
+            for (const record of importedTail(state, snapshot)) {
+                point({ op: "import", at: "write", index: index++ });
+                records.push(copyRecord(record));
+            }
+            for (const document of snapshot.documents) {
+                point({ op: "import", at: "write", index: index++ });
+                documents.set(document.key, copy(document.data));
+            }
+            medium.current = { epoch: state.epoch, records, documents };
+            point({ op: "import", at: "durable" });
+        },
+    };
+}
+//# sourceMappingURL=store-memory.js.map