@code-yeongyu/senpi 2026.11.6-3 → 2026.11.9

package/dist/core/egress/device-proxy-call.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Following one device call (row CK9; custody design 4.3-4.5). Frames are handled in order: `hooked` is stored (W4')
+ * only as the call's seq-0 frame while the stored request has no hooks applied (a late or unsolicited `hooked` never
+ * rewrites the stored request), events are pushed as they arrive, and the terminal event is held until the row is
+ * durably `ended` with the assembled message, then pushed, then acked. Silence is bounded with the loop's own numbers:
+ * a liveness probe every half idle window re-attaches on progress, waits for a device offline longer than the resume
+ * window, and cancels with `budget` after one idle window plus one resume window without progress. An events stream
+ * that ends before the terminal frame is parked, so the probe (and with it the bound) keeps running. Open question
+ * (design 4.4 "or stream-start bound without a first event"): the design names no value for that bound on this seam,
+ * so the idle+resume bound also covers a call with no first event until CK1 exports the loop's stream-start constant.
+ */
+import type { DeviceId } from "@earendil-works/pi-agent-core";
+import type { Api, AssistantMessageEventStream, Model } from "@earendil-works/pi-ai";
+import type { EgressLedger } from "./ledger.ts";
+import type { EgressCallRow } from "./ledger-schema.ts";
+import type { Abortion, EgressClock, StepWaits, WaitConditionSource } from "./device-proxy-waits.ts";
+import type { SignedPlacementClaim } from "./placement-claim.ts";
+import type { ProviderCallChannel, ProviderCallStart } from "./wire.ts";
+export type ClaimRefusal = "claim_expired" | "registry_key_revoked" | "registry_key_unknown";
+export type CallOutcome = {
+    readonly kind: "ended" | "mismatch" | "unknown";
+    readonly row: EgressCallRow;
+} | {
+    readonly kind: "refused";
+    readonly row: EgressCallRow;
+    readonly code: ClaimRefusal;
+    readonly message: string;
+};
+export interface DeviceRouteBounds {
+    readonly idleMs: number;
+    readonly resumeWindowMs: number;
+    readonly deadlineMs: number;
+}
+export interface CallContext {
+    readonly out: AssistantMessageEventStream;
+    readonly model: Model<Api>;
+    readonly ledger: EgressLedger;
+    readonly channel: ProviderCallChannel;
+    readonly offlineFor: (deviceId: DeviceId) => number;
+    readonly waits: StepWaits;
+    readonly conditions: WaitConditionSource;
+    readonly clock: EgressClock;
+    readonly bounds: DeviceRouteBounds;
+    readonly signal: AbortSignal;
+    /** The egress's own abort registry (one listener per signal). */
+    readonly abortion: Abortion;
+    readonly claim: () => Promise<SignedPlacementClaim>;
+    /** The row a user abort must cancel; kept current as `hooked` and `ended` replace it. */
+    readonly live: {
+        row: EgressCallRow | undefined;
+    };
+}
+/** Sends `start` (or, to resume a row the brain already dispatched, first asks the hand for its result) and follows it. */
+export declare function followCall(ctx: CallContext, initial: EgressCallRow, begin: {
+    readonly start: ProviderCallStart;
+} | {
+    readonly resume: true;
+}): Promise<CallOutcome>;
+//# sourceMappingURL=device-proxy-call.d.ts.map

package/dist/core/egress/device-proxy-call.js

@@ -0,0 +1,148 @@
+import { failureMessage, idleTimeoutText, storedRequestJson } from "./device-proxy-request.js";
+/** Sends `start` (or, to resume a row the brain already dispatched, first asks the hand for its result) and follows it. */
+export async function followCall(ctx, initial, begin) {
+    const { channel, ledger, out, signal } = ctx;
+    const deviceId = initial.deviceId;
+    if (deviceId === undefined)
+        throw new Error(`egress_call ${initial.callId} has no device`);
+    const aborted = ctx.abortion(signal);
+    let row = initial;
+    ctx.live.row = row;
+    let lastSeq = 0;
+    let terminal;
+    let lastProgress = ctx.clock.now();
+    let frames = channel.events(row.callId, 0)[Symbol.asyncIterator]();
+    let pending;
+    /** The events stream ended before the terminal frame: only the timed probe can move the call on until it re-attaches. */
+    let streamEnded = false;
+    const parked = new Promise(() => { });
+    const close = (stream) => {
+        stream.return?.().catch(() => { });
+    };
+    const reattach = (fromSeq) => {
+        close(frames);
+        frames = channel.events(row.callId, fromSeq)[Symbol.asyncIterator]();
+        pending = undefined;
+        streamEnded = false;
+    };
+    const store = async (next) => {
+        row = await next;
+        ctx.live.row = row;
+    };
+    const onEvent = (seq, event) => {
+        if (seq <= lastSeq)
+            return;
+        lastSeq = seq;
+        if (event.type === "done" || event.type === "error") {
+            terminal = event;
+            return;
+        }
+        out.push(event);
+    };
+    const settle = async (end) => {
+        if (end.t === "provider.call.error")
+            return onError(end);
+        if (!terminal)
+            throw new Error(`device call ${row.callId} ended without a terminal event`);
+        const message = terminal.type === "done" ? terminal.message : terminal.error;
+        await store(ledger.end(row, { kind: "message", message }));
+        out.push(terminal);
+        await channel.ack({ t: "provider.call.ack", callId: row.callId });
+        return { kind: "ended", row };
+    };
+    const onError = async (error) => {
+        if (error.code === "definition_mismatch")
+            return { kind: "mismatch", row };
+        if (error.code === "claim_expired" ||
+            error.code === "registry_key_revoked" ||
+            error.code === "registry_key_unknown")
+            return { kind: "refused", row, code: error.code, message: error.message };
+        if (error.code === "aborted" && signal.aborted)
+            throw signal.reason;
+        const { code, message, retryable, usage } = error;
+        await store(ledger.end(row, { kind: "error", code, message, retryable, ...(usage ? { usage } : {}) }));
+        const stopReason = code === "aborted" ? "aborted" : "error";
+        out.push({ type: "error", reason: stopReason, error: failureMessage(ctx.model, stopReason, message, usage) });
+        await channel.ack({ t: "provider.call.ack", callId: row.callId });
+        return { kind: "ended", row };
+    };
+    const onReply = async (reply) => {
+        if (reply.state === "unknown")
+            return { kind: "unknown", row };
+        if (reply.hooked && !row.hooksApplied)
+            await store(ledger.recordHooked(row, storedRequestJson(reply.hooked.request)));
+        if (reply.state === "running") {
+            if (reply.lastSeq > lastSeq) {
+                reattach(lastSeq + 1);
+                lastProgress = ctx.clock.now();
+            }
+            return undefined;
+        }
+        reply.events.forEach((event, index) => onEvent(index + 1, event));
+        return settle(reply.end);
+    };
+    const query = async () => onReply(await Promise.race([
+        channel.result({ t: "provider.call.result", callId: row.callId, claim: await ctx.claim() }),
+        aborted,
+    ]));
+    const probe = async () => {
+        if (ctx.offlineFor(deviceId) >= ctx.bounds.resumeWindowMs) {
+            const waitFor = [{ kind: "device-online", deviceId }];
+            const steer = `open omo on ${deviceId}`;
+            await ctx.waits.hold({ reason: "device-offline", steer, waitFor }, ctx.conditions.until(waitFor, signal));
+            lastProgress = ctx.clock.now();
+        }
+        else if (ctx.clock.now() - lastProgress >= ctx.bounds.idleMs + ctx.bounds.resumeWindowMs) {
+            await channel.cancel({ t: "provider.call.cancel", callId: row.callId, reason: "budget" });
+            throw new Error(idleTimeoutText(ctx.bounds.idleMs));
+        }
+        return query();
+    };
+    const follow = async () => {
+        if ("start" in begin)
+            await Promise.race([channel.start(begin.start), aborted]);
+        else {
+            const resumed = await query();
+            if (resumed)
+                return resumed;
+        }
+        for (;;) {
+            const reading = streamEnded ? parked : (pending ??= frames.next());
+            const sleeper = new AbortController();
+            const tick = ctx.clock.sleep(ctx.bounds.idleMs / 2, sleeper.signal).then(() => "probe", () => parked);
+            const next = await Promise.race([reading, tick, aborted]);
+            sleeper.abort();
+            if (next === "probe") {
+                const outcome = await probe();
+                if (outcome)
+                    return outcome;
+                continue;
+            }
+            pending = undefined;
+            if (next.done) {
+                streamEnded = true;
+                const outcome = await query();
+                if (outcome)
+                    return outcome;
+                continue;
+            }
+            const frame = next.value;
+            lastProgress = ctx.clock.now();
+            if (frame.t === "provider.call.hooked") {
+                if (!row.hooksApplied && lastSeq === 0)
+                    await store(ledger.recordHooked(row, storedRequestJson(frame.request)));
+            }
+            else if (frame.t === "provider.call.event")
+                onEvent(frame.seq, frame.event);
+            else
+                return settle(frame);
+        }
+    };
+    try {
+        return await follow();
+    }
+    finally {
+        close(frames);
+    }
+}
+//# sourceMappingURL=device-proxy-call.js.map

package/dist/core/egress/device-proxy-lost-calls.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Pacing of the 4.5 `unknown` reissue (row CK9; security review H1). A hand that has lost a call (`result` answers
+ * `unknown`) makes the brain supersede the row and reissue the stored request, and a hand that loses every call would
+ * otherwise drive an unbounded supersede/W4 cycle through the session's durable store. Per (step, device): the first
+ * lost call is reissued at once, the next one only after the key backoff (5 s doubling to 5 min), and after
+ * `MAX_AUTOMATIC_REISSUES` automatic reissues the step waits for the user's choice "re-run this step or select another
+ * device" (the cap mirrors the two-mismatch cap of 4.2). The count and the backoff are kept per device, and the
+ * user's choice restarts both. Callback-stream steps already wait for that choice before every reissue (4.5), so for
+ * them only the backoff applies.
+ */
+import type { DeviceId } from "@earendil-works/pi-agent-core";
+import { type EgressClock, type StepWaits, type WaitConditionSource } from "./device-proxy-waits.ts";
+export interface LostCallPacer {
+    /** Called after a lost call was superseded and before `attempt` (the reissue) is dispatched. */
+    beforeReissue(deviceId: DeviceId, attempt: number): Promise<void>;
+}
+export interface LostCallPacing {
+    readonly stepId: string;
+    readonly waits: StepWaits;
+    readonly conditions: WaitConditionSource;
+    readonly clock: EgressClock;
+    readonly signal: AbortSignal;
+    /** False for callback-stream steps, whose every reissue already waits for the user's choice. */
+    readonly askUser: boolean;
+}
+export declare function lostCallPacer(pacing: LostCallPacing): LostCallPacer;
+//# sourceMappingURL=device-proxy-lost-calls.d.ts.map

package/dist/core/egress/device-proxy-lost-calls.js

@@ -0,0 +1,28 @@
+import { nextKeyBackoffMs } from "./device-proxy-waits.js";
+const MAX_AUTOMATIC_REISSUES = 2;
+export function lostCallPacer(pacing) {
+    const { stepId, waits, conditions, clock, signal } = pacing;
+    /** Per device: automatic reissues since the last user choice, and the delay of the last paced one. */
+    const paced = new Map();
+    return {
+        async beforeReissue(deviceId, attempt) {
+            const { reissues, backoff } = paced.get(deviceId) ?? { reissues: 0 };
+            if (pacing.askUser && reissues >= MAX_AUTOMATIC_REISSUES) {
+                paced.delete(deviceId);
+                const waitFor = [{ kind: "user-choice", choiceId: `${stepId}:${attempt}` }];
+                const steer = `${deviceId} lost this step ${reissues + 1} times: re-run it or select another device`;
+                await waits.hold({ reason: "result-pending", steer, waitFor }, conditions.until(waitFor, signal));
+                return;
+            }
+            if (reissues === 0) {
+                paced.set(deviceId, { reissues: 1 });
+                return;
+            }
+            const delay = nextKeyBackoffMs(backoff);
+            paced.set(deviceId, { reissues: reissues + 1, backoff: delay });
+            const steer = `${deviceId} lost this step; reissuing it`;
+            await waits.hold({ reason: "result-pending", steer, waitFor: [] }, clock.sleep(delay, signal));
+        },
+    };
+}
+//# sourceMappingURL=device-proxy-lost-calls.js.map

package/dist/core/egress/device-proxy-ports.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The ports the device route of hosted model-key custody runs on (row CK9; custody design 2.3, 4.2-4.6): the hands'
+ * channels and presence, the session's route inputs, the placement claim, the request-hook runner, the wait sources
+ * and the loop's bounds. The hosted wrapper (V7b) supplies them; tests supply doubles.
+ */
+import type { DeviceId, EgressHostHooks, EgressRouteDecision, ProviderId, StreamFn } from "@earendil-works/pi-agent-core";
+import type { DeviceRouteBounds } from "./device-proxy-call.ts";
+import type { RequestHookRunner } from "./device-proxy-request.ts";
+import type { EgressClock, WaitConditionSource } from "./device-proxy-waits.ts";
+import type { EgressLedger } from "./ledger.ts";
+import type { EgressCallCapability, VariantRecord } from "./ledger-schema.ts";
+import type { SignedPlacementClaim } from "./placement-claim.ts";
+import type { ProviderCallChannel, StepNotice } from "./wire.ts";
+export interface DeviceHands {
+    channel(deviceId: DeviceId): ProviderCallChannel;
+    /** How long the device has been continuously offline (0 while online); compared with the resume window (4.4). */
+    offlineFor(deviceId: DeviceId): number;
+}
+/** The session's route inputs (route.ts `decideRoute` over presence, roster, hooks and variants; CK6/CK25). */
+export interface DeviceRouteSource {
+    decide(providerId: ProviderId, variants: ReadonlyMap<DeviceId, VariantRecord>): EgressRouteDecision;
+    /** The head entry's `sourceDigest`, sent as `expectedSourceDigest` unless the hand serves its own definition. */
+    headDigest(providerId: ProviderId): string | undefined;
+    capability(providerId: ProviderId): EgressCallCapability;
+    liveDigest(deviceId: DeviceId, providerId: ProviderId): string | undefined;
+}
+export interface PlacementClaimSource {
+    current(): Promise<SignedPlacementClaim>;
+    /** Re-claims (same epoch on expiry; under the new registry generation on `registry_key_revoked`). */
+    renew(code: "claim_expired" | "registry_key_revoked"): Promise<void>;
+}
+export interface DeviceProxyEgressDeps {
+    readonly sessionId: string;
+    readonly host: EgressHostHooks;
+    readonly ledger: EgressLedger;
+    readonly hands: DeviceHands;
+    readonly route: DeviceRouteSource;
+    readonly claims: PlacementClaimSource;
+    readonly requestHooks: RequestHookRunner;
+    readonly conditions: WaitConditionSource;
+    readonly notify: (notice: StepNotice) => void;
+    readonly clock: EgressClock;
+    readonly bounds: DeviceRouteBounds;
+    readonly cwd?: string;
+}
+export interface DeviceProxyEgress {
+    readonly stream: StreamFn;
+}
+//# sourceMappingURL=device-proxy-ports.d.ts.map

package/dist/core/egress/device-proxy-ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-proxy-ports.js.map

package/dist/core/egress/device-proxy-request.d.ts

@@ -0,0 +1,34 @@
+/**
+ * What the device route sends (row CK9; custody design 2.3 options hygiene, 4.5 hook rules). The admitted request is
+ * built once from the loop's context and the wire allowlist of its options, stored as JSON text, and every attempt
+ * sends the parse of that stored text, so a reissue is byte-for-byte the admitted request. Request hooks run once per
+ * step: on the hand itself (`hooks: "enabled"`, reported back by `hooked`), or over V5 before a non-hand server. Hook
+ * output is filtered through the same allowlist before it is stored, and every parse filters again: a hook that adds
+ * `env` or `headers` must not reach another device, where `env` can move the dial under that device's credential.
+ */
+import type { DeviceId, EgressRouteDecision } from "@earendil-works/pi-agent-core";
+import type { Api, AssistantMessage, Model, SimpleStreamOptions, TranscriptContext, Usage } from "@earendil-works/pi-ai";
+import { type ProviderCallRequest } from "./wire.ts";
+export declare const admittedRequestJson: (context: TranscriptContext, options: SimpleStreamOptions | undefined) => string;
+/** The JSON text the ledger stores for a request that came back from a hook (`hooked`, V5). */
+export declare const storedRequestJson: (request: ProviderCallRequest) => string;
+export declare function parseStoredRequest(json: string): ProviderCallRequest;
+export interface StoredRequest {
+    readonly requestJson: string;
+    readonly hooksApplied: boolean;
+}
+export interface DispatchPlan extends StoredRequest {
+    readonly hooks: "enabled" | "disabled";
+}
+export type RequestHookRunner = (hand: DeviceId, request: ProviderCallRequest) => Promise<ProviderCallRequest>;
+/**
+ * The hook rules of 4.5: to the hand, `hooks` is `enabled` exactly when the stored request does not carry them yet;
+ * to any other server, a request-hooked provider without applied hooks runs them on the hand first and stores the
+ * post-hook request with `hooksApplied: true`; everything else goes with `hooks: "disabled"`.
+ */
+export declare function planDispatch(decision: EgressRouteDecision, stored: StoredRequest, runRequestHooks: RequestHookRunner): Promise<DispatchPlan>;
+/** The terminal message the loop receives when the hand refused or failed the call, or the step was aborted. */
+export declare function failureMessage(model: Model<Api>, stopReason: "error" | "aborted", errorMessage: string, usage?: Usage): AssistantMessage;
+export declare const ABORT_TEXT = "Request was aborted";
+export declare const idleTimeoutText: (idleMs: number) => string;
+//# sourceMappingURL=device-proxy-request.d.ts.map

package/dist/core/egress/device-proxy-request.js

@@ -0,0 +1,69 @@
+import { WIRE_STREAM_OPTION_KEYS } from "./wire.js";
+function copyWireKey(from, to, key) {
+    const value = from[key];
+    if (value !== undefined)
+        to[key] = value;
+}
+/** Only allowlisted, serializable request shaping crosses to the hand: never `commitStep`, secrets, headers or callbacks. */
+function toWireOptions(options) {
+    const wire = {};
+    if (options)
+        for (const key of WIRE_STREAM_OPTION_KEYS)
+            copyWireKey(options, wire, key);
+    return wire;
+}
+export const admittedRequestJson = (context, options) => JSON.stringify({ context, options: toWireOptions(options) });
+const isRequest = (value) => typeof value === "object" &&
+    value !== null &&
+    (("context" in value && "options" in value) || "compactBody" in value);
+const toWireRequest = (request) => "context" in request
+    ? { context: request.context, options: toWireOptions(request.options) }
+    : { compactBody: request.compactBody };
+/** The JSON text the ledger stores for a request that came back from a hook (`hooked`, V5). */
+export const storedRequestJson = (request) => JSON.stringify(toWireRequest(request));
+export function parseStoredRequest(json) {
+    const parsed = JSON.parse(json);
+    if (!isRequest(parsed))
+        throw new Error("stored egress request is not a provider-call request");
+    return toWireRequest(parsed);
+}
+/**
+ * The hook rules of 4.5: to the hand, `hooks` is `enabled` exactly when the stored request does not carry them yet;
+ * to any other server, a request-hooked provider without applied hooks runs them on the hand first and stores the
+ * post-hook request with `hooksApplied: true`; everything else goes with `hooks: "disabled"`.
+ */
+export async function planDispatch(decision, stored, runRequestHooks) {
+    if (decision.executorHooks === "enabled")
+        return { ...stored, hooks: stored.hooksApplied ? "disabled" : "enabled" };
+    if (!stored.hooksApplied && decision.requestHooksOn !== undefined) {
+        const hooked = await runRequestHooks(decision.requestHooksOn, parseStoredRequest(stored.requestJson));
+        return { requestJson: storedRequestJson(hooked), hooksApplied: true, hooks: "disabled" };
+    }
+    return { ...stored, hooks: "disabled" };
+}
+/** A fresh object per message: `Usage` is mutable and consumers update it in place. */
+const noUsage = () => ({
+    input: 0,
+    output: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    totalTokens: 0,
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+});
+/** The terminal message the loop receives when the hand refused or failed the call, or the step was aborted. */
+export function failureMessage(model, stopReason, errorMessage, usage = noUsage()) {
+    return {
+        role: "assistant",
+        content: [],
+        api: model.api,
+        provider: model.provider,
+        model: model.id,
+        usage,
+        stopReason,
+        errorMessage,
+        timestamp: Date.now(),
+    };
+}
+export const ABORT_TEXT = "Request was aborted";
+export const idleTimeoutText = (idleMs) => `Idle timeout waiting for provider stream after ${idleMs}ms`;
+//# sourceMappingURL=device-proxy-request.js.map

package/dist/core/egress/device-proxy-waits.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Waits on the device route (row CK9; custody design 2.3 "Pause = tracked local work", 4.2 live digests, 4.4). A wait
+ * is never a thrown value: it is bracketed by the host's `onWait`/`onWaitEnd` (W7, `step.waiting`) and held in the
+ * stream's `trackLocalWork`, so the loop's idle watchdog re-arms instead of failing the step. A user abort releases the
+ * wait at once.
+ */
+import type { DeviceId, EgressHostHooks, EgressWait, ProviderId, StepRef, WaitCondition } from "@earendil-works/pi-agent-core";
+import type { AssistantMessageEventStream } from "@earendil-works/pi-ai";
+import type { HandPresence } from "./wire.ts";
+export interface EgressClock {
+    now(): number;
+    /** Resolves after `ms`, or rejects with the signal's reason once it aborts. */
+    sleep(ms: number, signal: AbortSignal): Promise<void>;
+}
+export interface WaitConditionSource {
+    /** Resolves once any of `waitFor` holds (device online, user choice made, ...), or rejects when `signal` aborts. */
+    until(waitFor: readonly WaitCondition[], signal: AbortSignal): Promise<void>;
+}
+/** A promise that rejects with the abort reason as soon as `signal` aborts; it never resolves. */
+export type Abortion = (signal: AbortSignal) => Promise<never>;
+/**
+ * One promise (and one listener) per signal, however many waits race it: an indefinite key backoff must not pile up
+ * abort listeners. The registry belongs to its owner (one egress, one board), never to the module.
+ */
+export declare function createAbortion(): Abortion;
+export interface StepWaits {
+    /** Holds `work` as a tracked wait of the current step until it settles. */
+    hold<T>(wait: Omit<EgressWait, "call">, work: Promise<T>): Promise<T>;
+}
+export declare function stepWaits(stream: AssistantMessageEventStream, host: EgressHostHooks, step: StepRef, signal: AbortSignal, abortion: Abortion): StepWaits;
+/** Registry-key backoff while the hand cannot check the key: 5 s doubling to a 5 minute cap, indefinitely (4.6). */
+export declare const nextKeyBackoffMs: (previous: number | undefined) => number;
+export interface LiveDigestBoard {
+    report(presence: HandPresence): void;
+    digest(deviceId: DeviceId, providerId: ProviderId): string | undefined;
+    /** Resolves with the new digest the next time the device reports a value DIFFERENT from its last one (4.2). */
+    changed(deviceId: DeviceId, providerId: ProviderId, signal: AbortSignal): Promise<string>;
+}
+export declare function createLiveDigestBoard(): LiveDigestBoard;
+//# sourceMappingURL=device-proxy-waits.d.ts.map

package/dist/core/egress/device-proxy-waits.js

@@ -0,0 +1,67 @@
+/**
+ * One promise (and one listener) per signal, however many waits race it: an indefinite key backoff must not pile up
+ * abort listeners. The registry belongs to its owner (one egress, one board), never to the module.
+ */
+export function createAbortion() {
+    const abortions = new WeakMap();
+    return (signal) => {
+        const known = abortions.get(signal);
+        if (known)
+            return known;
+        const { promise, reject } = Promise.withResolvers();
+        if (signal.aborted)
+            reject(signal.reason);
+        else
+            signal.addEventListener("abort", () => reject(signal.reason), { once: true });
+        promise.catch(() => { });
+        abortions.set(signal, promise);
+        return promise;
+    };
+}
+export function stepWaits(stream, host, step, signal, abortion) {
+    return {
+        async hold(wait, work) {
+            await host.onWait({ ...wait, call: step });
+            try {
+                return await stream.trackLocalWork(Promise.race([work, abortion(signal)]));
+            }
+            finally {
+                await host.onWaitEnd(step.stepId);
+            }
+        },
+    };
+}
+/** Registry-key backoff while the hand cannot check the key: 5 s doubling to a 5 minute cap, indefinitely (4.6). */
+export const nextKeyBackoffMs = (previous) => previous === undefined ? 5_000 : Math.min(previous * 2, 300_000);
+export function createLiveDigestBoard() {
+    const abortion = createAbortion();
+    const digests = new Map();
+    const waiters = new Map();
+    const keyOf = (deviceId, providerId) => JSON.stringify([deviceId, providerId]);
+    return {
+        report(presence) {
+            for (const [providerId, digest] of Object.entries(presence.liveDigests ?? {})) {
+                const key = keyOf(presence.deviceId, providerId);
+                const previous = digests.get(key);
+                digests.set(key, digest);
+                if (previous === digest)
+                    continue;
+                const woken = waiters.get(key);
+                waiters.delete(key);
+                for (const wake of woken ?? [])
+                    wake(digest);
+            }
+        },
+        digest: (deviceId, providerId) => digests.get(keyOf(deviceId, providerId)),
+        changed(deviceId, providerId, signal) {
+            const key = keyOf(deviceId, providerId);
+            const { promise, resolve } = Promise.withResolvers();
+            const set = waiters.get(key) ?? new Set();
+            set.add(resolve);
+            waiters.set(key, set);
+            signal.addEventListener("abort", () => set.delete(resolve), { once: true });
+            return Promise.race([promise, abortion(signal)]);
+        },
+    };
+}
+//# sourceMappingURL=device-proxy-waits.js.map

package/dist/core/egress/device-proxy.d.ts

@@ -0,0 +1,3 @@
+import type { DeviceProxyEgress, DeviceProxyEgressDeps } from "./device-proxy-ports.ts";
+export declare function createDeviceProxyEgress(deps: DeviceProxyEgressDeps): DeviceProxyEgress;
+//# sourceMappingURL=device-proxy.d.ts.map