@estiva-app/protocol 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,117 @@ Every entry answers the wire question explicitly, including when the answer is
 nothing (ADR 0002 §4b). A change to the bytes an app publishes is a MAJOR — in
 `0.x`, a MINOR — even when no TypeScript signature moved.
 
+## 0.5.0 — 2026-09-01
+
+**Wire behaviour: unchanged.** No builder, tag layout, id computation or
+signature input moved. `queryAll` returns the same events; it asks for them in
+half as many requests.
+
+- **A short page no longer always costs a confirming round trip.** `queryAll`
+  spent two requests on every filter, including one holding three events, and
+  on Ship's `loadAll` that doubling was **33 filters → 66 requests** against a
+  relay that meters `POST /query` at 300 a minute.
+
+  The confirmation existed for a real reason: a page shorter than the requested
+  `limit` is ambiguous, because the relay clamps to `min(requested, ceiling)`
+  and may have clamped at exactly that many. The ambiguity dissolves
+  arithmetically rather than by trusting anyone — a clamp at `n` requires the
+  ceiling to *equal* `n`, the ceiling is one constant for the relay, and the
+  largest page it has already handed back is a lower bound on it. So
+  `n < observedPageCeiling` rules the clamp out on evidence the relay itself
+  produced.
+
+  **Deliberately not NIP-11's `limitation.max_limit`.** That number is a claim,
+  and a relay advertising more than it clamps to would make every page look
+  short and the first one get mistaken for the whole set — the SHA-8 bug, back.
+  Buzz currently advertises 1000 and clamps at 1000, so trusting it would work
+  today; the source default in `nip11.rs` is 10000 against a `buzz-db` clamp of
+  1000, so it has not always been true, and being right by luck is not a
+  design. Substituting a trusted 1000 for the observed bound fails the SHA-8
+  regression test outright, which is the control that settles it.
+
+  Conservative before it has evidence: the first filter through a fresh `Relay`
+  still confirms, and so does the **widest** filter on every read, since it
+  ties its own bound. The floor is therefore one request per filter *plus one*.
+
+  Measured on Ship's `loadAll` against production, published client versus this
+  one: **66 requests → 35 cold, 34 warm — 48% fewer — 8.8 s → 0.9 s, and the
+  fold compares equal event for event** (every project and issue address with
+  its status, every change id, every conversation id).
+
+- **This still does not fit a five-second poll.** 34 requests × 12 reads a
+  minute is 408 against a 300 budget; at a ten-second poll it is 204 and fits.
+  The remaining half is the caller's cadence, not this package's.
+
+Additive with no signature change, but the request pattern a caller produces
+changes, so a MINOR: ADR 0002 §4b puts the break on MINOR within `0.x`.
+
+## 0.4.0 — 2026-09-01
+
+**Wire behaviour: unchanged.** No builder, tag layout, id computation or
+signature input moved. `queryAll` returns the same array it always did — see
+below, that is the property the tests are about.
+
+- **`queryAll` runs its filters concurrently**, bounded by the new
+  `DEFAULT_QUERY_CONCURRENCY` (8) and overridable per call via
+  `QueryAllOptions.concurrency`. `concurrency: 1` is the old serial read
+  exactly.
+
+  Filters handed to one call are independent; only the pages *inside* a filter
+  are a cursor walk, and those stay sequential because page N+1's `until` is
+  not known until page N has answered. Running the filters in sequence made a
+  read cost the sum of every filter's latency. Measured on Ship's `loadAll`
+  against production: **33 filters, 66 round trips, median 206 ms, 100% of wall
+  clock spent inside `query` one request at a time.** The same read, same relay,
+  same credentials, through this build: **9.0 s → 1.68 s, and the fold compares
+  equal event for event** — every project and issue address with its status,
+  every change id, every conversation id.
+
+  The concurrency is deliberately not observable in the answer. Results are
+  collected per filter and concatenated in filter order, and a failure reports
+  the **lowest-indexed** filter's error rather than whichever request lost the
+  race — so a broken read names the same filter twice running.
+
+- **What this does not buy you: relay budget.** Buzz meters `POST /query`
+  against `human_api_calls_per_min` — a fixed 60-second window, default 300,
+  applied to every bridge call whatever tier the caller is. One Ship workspace
+  read is 66 of those. Concurrency changes when a read spends its requests,
+  never how many, so a poller that simply reads more often now spends the same
+  allowance sooner. Documented at `DEFAULT_QUERY_CONCURRENCY` because it is the
+  first thing a caller will get wrong.
+
+Additive, and behaviour under a caller's existing call changes (requests now
+overlap), so a MINOR: ADR 0002 §4b puts the break on MINOR within `0.x`.
+
+## 0.3.0 — 2026-09-01
+
+*Backfilled 2026-09-01. This release shipped without an entry, and so did 0.2.0
+below — the file's own rule is that every release answers the wire question, and
+twice it went unanswered. Recorded now from the release commits rather than left
+as a gap.*
+
+**Wire behaviour: unchanged.** NIP-19 is an encoding of a pointer, not of an
+event; nothing an app publishes moved.
+
+- **`nevent`** — `EventPointer`, `encodeNevent`, `decodeNevent`. An event that
+  is not addressable had no reference form at all, so a plain `kind:9` message
+  could be resolved by nothing. TLV type 0 carries the event id as 32 raw
+  bytes, where `naddr` carries a UTF-8 `d`; that difference is the whole of the
+  codec.
+
+## 0.2.0 — 2026-08-28
+
+*Backfilled 2026-09-01, from the release commit — see the note under 0.3.0.*
+
+**Wire behaviour: unchanged.** A read-path fix; no published bytes moved.
+
+- **`RELAY_PAGE_CEILING`, and `queryAll` pages instead of truncating.** Buzz
+  clamps a REQ to its advertised NIP-11 `max_limit`, which halved from 10000 to
+  1000, and NIP-01 has no truncation signal — so a caller asking for 2000 got
+  1000 and no indication why. `limit: 2000` was a literal at four call sites
+  across two apps and the agent, none of which could know when the relay changed
+  it.
+
 ## 0.1.2 — 2026-08-27
 
 **Wire behaviour: unchanged.** One constant added. No builder, tag layout, id

package/dist/bridge.d.ts

@@ -37,6 +37,48 @@ export interface PublishResult {
  * is the relay's real ceiling — see its note on why.
  */
 export declare const RELAY_PAGE_CEILING = 1000;
+/**
+ * How many of a {@link Relay.queryAll} call's filters may be in flight at once.
+ *
+ * Filters are independent — only paging *within* one is a cursor walk — and
+ * running them one after another made a read as slow as the sum of its parts.
+ * Measured on Ship's `loadAll` against production: **33 filters, 66 sequential
+ * round trips, median 206 ms, 100% of wall clock spent inside `query` one
+ * request at a time.** At a concurrency of 8 the same read returned a
+ * byte-identical answer in 1.9 s instead of 9.0 s.
+ *
+ * Bounded rather than unbounded on purpose. A workspace's filter count grows
+ * with its Folders, so `Promise.all` over all of them would open a fan-out
+ * whose width is set by the *data* — fine at 33, an accidental flood at 500,
+ * and the relay is shared. Eight is enough to hide the latency without any
+ * caller having to think about it.
+ *
+ * Pass `concurrency: 1` to restore the strictly serial read.
+ *
+ * ## This does not buy a caller more relay budget
+ *
+ * Concurrency changes how fast a read spends its requests, never how many it
+ * makes. Buzz meters `POST /query` against `human_api_calls_per_min` — a fixed
+ * 60-second window, **default 300, applied to every bridge call whatever tier
+ * the caller is** (`enforce_http_admission` in `api/bridge.rs` reads the human
+ * limit unconditionally). At 66 requests, one Ship workspace read is 22% of a
+ * minute's entire allowance, so no client gets more than ~4.5 of them a minute
+ * however it schedules them.
+ *
+ * A poller therefore has to slow down as its reads get faster, or it simply
+ * spends the same budget sooner and starts collecting
+ * `rate-limited: quota exceeded`. Making a read cheap is the fix for that;
+ * making it parallel is not.
+ */
+export declare const DEFAULT_QUERY_CONCURRENCY = 8;
+export interface QueryAllOptions {
+    /** Events per request. Defaults to {@link RELAY_PAGE_CEILING}. */
+    pageSize?: number;
+    /** Give up after this many pages *per filter*, rather than looping forever. */
+    maxPages?: number;
+    /** Filters in flight at once. Defaults to {@link DEFAULT_QUERY_CONCURRENCY}; 1 is serial. */
+    concurrency?: number;
+}
 export declare function parsePublishResponse(status: number, text: string): PublishResult;
 export interface QueryResult {
     ok: boolean;
@@ -95,6 +137,18 @@ export declare class Relay {
     private readonly signer;
     private readonly headers;
     private readonly transport;
+    /**
+     * The largest page this relay has ever handed back, across every call.
+     *
+     * A *lower bound* on the relay's real clamp, and the only one obtainable
+     * without trusting anybody: the relay returned this many events in one
+     * response, so its ceiling is at least this large. {@link Relay.pageFilter}
+     * uses it to tell a short page apart from a clamped one — see there.
+     *
+     * Per instance and never reset, so the second read through a long-lived
+     * `Relay` is cheaper than the first.
+     */
+    private observedPageCeiling;
     constructor(url: string, signer: Signer, options?: RelayOptions | RelayHeaders);
     private post;
     publish(event: SignedEvent): Promise<PublishResult>;
@@ -131,10 +185,26 @@ export declare class Relay {
      * value of `until` reaches past them without skipping some, and no correct
      * answer exists from this API — so it says so instead of returning a
      * plausible subset.
+     *
+     * **Filters run concurrently, up to {@link DEFAULT_QUERY_CONCURRENCY}.** They
+     * are independent of one another; only the pages inside one are a cursor
+     * walk. Doing them in sequence made a read cost the sum of every filter's
+     * latency, which is what put Ship's workspace read at nine seconds against a
+     * five-second poll — long enough that a write's re-read had usually not
+     * finished before the next one began.
+     *
+     * The concurrency is deliberately **not observable in the answer**: results
+     * are collected per filter and concatenated in filter order, so the returned
+     * array is identical to the serial one, and a failure reports the
+     * lowest-indexed filter's error rather than whichever lost the race.
+     */
+    queryAll(filters: Record<string, unknown>[], options?: QueryAllOptions): Promise<SignedEvent[]>;
+    /**
+     * One filter, paged to exhaustion. The sequential half, and it has to be:
+     * `until` is a cursor, so page N+1's request is not known until page N has
+     * answered. Only the filters are independent, which is why they are the
+     * axis {@link Relay.queryAll} parallelises.
      */
-    queryAll(filters: Record<string, unknown>[], options?: {
-        pageSize?: number;
-        maxPages?: number;
-    }): Promise<SignedEvent[]>;
+    private pageFilter;
 }
 //# sourceMappingURL=bridge.d.ts.map

package/dist/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAEvC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAehF;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,wDAAwD;AACxD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAgB5E;AAED;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAKzD,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEzF,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,iEAAiE;IACjE,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED;;;;;;GAMG;AACH,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;gBAErC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAY,GAAG,YAAiB;YAWpE,IAAI;IAwBZ,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAKzD;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAOvE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAClC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GACrD,OAAO,CAAC,WAAW,EAAE,CAAC;CAqC1B"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAEvC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAehF;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,wDAAwD;AACxD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAgB5E;AAED;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAKzD,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEzF,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,iEAAiE;IACjE,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED;;;;;;GAMG;AACH,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB,CAAI;gBAEnB,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAY,GAAG,YAAiB;YAWpE,IAAI;IAwBZ,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAKzD;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAOvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAClC,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,EAAE,CAAC;IAkEzB;;;;;OAKG;YACW,UAAU;CA+DzB"}

package/dist/bridge.js

@@ -53,6 +53,40 @@ import { authorizationHeader } from './nip98.js';
  * is the relay's real ceiling — see its note on why.
  */
 export const RELAY_PAGE_CEILING = 1000;
+/**
+ * How many of a {@link Relay.queryAll} call's filters may be in flight at once.
+ *
+ * Filters are independent — only paging *within* one is a cursor walk — and
+ * running them one after another made a read as slow as the sum of its parts.
+ * Measured on Ship's `loadAll` against production: **33 filters, 66 sequential
+ * round trips, median 206 ms, 100% of wall clock spent inside `query` one
+ * request at a time.** At a concurrency of 8 the same read returned a
+ * byte-identical answer in 1.9 s instead of 9.0 s.
+ *
+ * Bounded rather than unbounded on purpose. A workspace's filter count grows
+ * with its Folders, so `Promise.all` over all of them would open a fan-out
+ * whose width is set by the *data* — fine at 33, an accidental flood at 500,
+ * and the relay is shared. Eight is enough to hide the latency without any
+ * caller having to think about it.
+ *
+ * Pass `concurrency: 1` to restore the strictly serial read.
+ *
+ * ## This does not buy a caller more relay budget
+ *
+ * Concurrency changes how fast a read spends its requests, never how many it
+ * makes. Buzz meters `POST /query` against `human_api_calls_per_min` — a fixed
+ * 60-second window, **default 300, applied to every bridge call whatever tier
+ * the caller is** (`enforce_http_admission` in `api/bridge.rs` reads the human
+ * limit unconditionally). At 66 requests, one Ship workspace read is 22% of a
+ * minute's entire allowance, so no client gets more than ~4.5 of them a minute
+ * however it schedules them.
+ *
+ * A poller therefore has to slow down as its reads get faster, or it simply
+ * spends the same budget sooner and starts collecting
+ * `rate-limited: quota exceeded`. Making a read cheap is the fix for that;
+ * making it parallel is not.
+ */
+export const DEFAULT_QUERY_CONCURRENCY = 8;
 export function parsePublishResponse(status, text) {
     let parsed;
     try {
@@ -102,6 +136,18 @@ export class Relay {
     signer;
     headers;
     transport;
+    /**
+     * The largest page this relay has ever handed back, across every call.
+     *
+     * A *lower bound* on the relay's real clamp, and the only one obtainable
+     * without trusting anybody: the relay returned this many events in one
+     * response, so its ceiling is at least this large. {@link Relay.pageFilter}
+     * uses it to tell a short page apart from a clamped one — see there.
+     *
+     * Per instance and never reset, so the second read through a long-lived
+     * `Relay` is cheaper than the first.
+     */
+    observedPageCeiling = 0;
     constructor(url, signer, options = {}) {
         this.url = url.replace(/\/+$/, '');
         this.signer = signer;
@@ -178,38 +224,140 @@ export class Relay {
      * value of `until` reaches past them without skipping some, and no correct
      * answer exists from this API — so it says so instead of returning a
      * plausible subset.
+     *
+     * **Filters run concurrently, up to {@link DEFAULT_QUERY_CONCURRENCY}.** They
+     * are independent of one another; only the pages inside one are a cursor
+     * walk. Doing them in sequence made a read cost the sum of every filter's
+     * latency, which is what put Ship's workspace read at nine seconds against a
+     * five-second poll — long enough that a write's re-read had usually not
+     * finished before the next one began.
+     *
+     * The concurrency is deliberately **not observable in the answer**: results
+     * are collected per filter and concatenated in filter order, so the returned
+     * array is identical to the serial one, and a failure reports the
+     * lowest-indexed filter's error rather than whichever lost the race.
      */
     async queryAll(filters, options = {}) {
         const pageSize = options.pageSize ?? RELAY_PAGE_CEILING;
         const maxPages = options.maxPages ?? 100;
-        const seen = new Set();
-        const out = [];
-        for (const filter of filters) {
-            let until;
-            for (let page = 0;; page++) {
-                if (page >= maxPages) {
-                    throw new Error(`queryAll: gave up after ${maxPages} pages — refusing to return a partial set`);
+        const concurrency = Math.max(1, options.concurrency ?? DEFAULT_QUERY_CONCURRENCY);
+        /*
+          Per filter, in filter order — not one shared accumulator.
+    
+          Concurrency must not be observable in the answer. Collecting each
+          filter's pages into its own slot and concatenating in order at the end
+          makes the output byte-identical to the serial version, whatever order the
+          responses actually arrive in. Dedup then runs over that ordered
+          concatenation, so an id first seen under filter 0 still belongs to filter
+          0's run of events, exactly as before.
+        */
+        const perFilter = new Array(filters.length);
+        const failures = new Array(filters.length);
+        let next = 0;
+        let failed = false;
+        const worker = async () => {
+            for (;;) {
+                // Stop *starting* filters once one has failed. The serial version never
+                // reached them at all; this is as close as a fan-out gets, and it keeps
+                // a broken read from firing the whole remaining queue at the relay.
+                if (failed)
+                    return;
+                const index = next++;
+                if (index >= filters.length)
+                    return;
+                try {
+                    perFilter[index] = await this.pageFilter(filters[index], pageSize, maxPages);
                 }
-                const events = await this.query([
-                    { ...filter, limit: pageSize, ...(until === undefined ? {} : { until }) },
-                ]);
-                if (events.length === 0)
-                    break;
-                for (const e of events) {
-                    if (seen.has(e.id))
-                        continue;
-                    seen.add(e.id);
-                    out.push(e);
+                catch (error) {
+                    failures[index] = error;
+                    failed = true;
+                    return;
                 }
-                const oldest = Math.min(...events.map((e) => e.created_at));
-                if (until !== undefined && oldest >= until) {
-                    if (events.length >= pageSize) {
-                        throw new Error(`queryAll: more than ${pageSize} events share created_at=${until} — cannot page without skipping`);
-                    }
-                    break;
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(concurrency, filters.length) }, () => worker()));
+        /*
+          The lowest-indexed failure, not the first to reject in wall-clock time.
+    
+          Under `Promise.all` the error a caller sees would otherwise depend on
+          which request happened to lose the race, so two runs of the same broken
+          read could report different filters. Serial order is the one order that
+          is reproducible, and it is what the serial version reported.
+        */
+        const firstFailure = failures.findIndex((error) => error !== undefined);
+        if (firstFailure !== -1)
+            throw failures[firstFailure];
+        const seen = new Set();
+        const out = [];
+        for (const events of perFilter) {
+            for (const e of events) {
+                if (seen.has(e.id))
+                    continue;
+                seen.add(e.id);
+                out.push(e);
+            }
+        }
+        return out;
+    }
+    /**
+     * One filter, paged to exhaustion. The sequential half, and it has to be:
+     * `until` is a cursor, so page N+1's request is not known until page N has
+     * answered. Only the filters are independent, which is why they are the
+     * axis {@link Relay.queryAll} parallelises.
+     */
+    async pageFilter(filter, pageSize, maxPages) {
+        const out = [];
+        let until;
+        for (let page = 0;; page++) {
+            if (page >= maxPages) {
+                throw new Error(`queryAll: gave up after ${maxPages} pages — refusing to return a partial set`);
+            }
+            const events = await this.query([
+                { ...filter, limit: pageSize, ...(until === undefined ? {} : { until }) },
+            ]);
+            if (events.length === 0)
+                break;
+            out.push(...events);
+            /*
+              A page smaller than one this relay has already delivered is the end of
+              the filter, and no confirming round trip is needed to know it.
+      
+              The reason the confirmation existed is real: a page shorter than the
+              `limit` we asked for is ambiguous, because the relay clamps to
+              `min(requested, ceiling)` and might have clamped at exactly this many.
+              But that requires the ceiling to *equal* this page's size — and the
+              ceiling is one constant for the relay, already known to be at least
+              `observedPageCeiling`. So `n < observedPageCeiling` rules the clamp out
+              arithmetically rather than by trusting anything.
+      
+              Deliberately not NIP-11's `limitation.max_limit`. That number is a
+              claim: a relay advertising more than it clamps to would make every page
+              look short and the first one get mistaken for the whole set, which is
+              exactly the SHA-8 bug this loop exists to prevent. An observed page is
+              evidence — the relay demonstrably produced it.
+      
+              Conservative before it has evidence: the first filter through a fresh
+              `Relay` still pays the confirmation, and so does any page that ties the
+              largest seen so far — which means **the widest filter always confirms**,
+              since it ties its own bound on every read. So the floor is one request
+              per filter plus one, not one per filter.
+      
+              Measured on Ship's `loadAll` against production: **66 requests to 35
+              cold and 34 warm**, the same fold event for event, and 8.8 s to 0.9 s
+              alongside the concurrency of 0.4.0.
+            */
+            if (events.length > this.observedPageCeiling)
+                this.observedPageCeiling = events.length;
+            if (events.length < pageSize && events.length < this.observedPageCeiling)
+                break;
+            const oldest = Math.min(...events.map((e) => e.created_at));
+            if (until !== undefined && oldest >= until) {
+                if (events.length >= pageSize) {
+                    throw new Error(`queryAll: more than ${pageSize} events share created_at=${until} — cannot page without skipping`);
                 }
-                until = oldest;
+                break;
             }
+            until = oldest;
         }
         return out;
     }

package/dist/bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAchD;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAEtC,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,IAAI,MAAmF,CAAA;IACvF,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACjG,CAAC;IACD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QACjE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC3G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACnE,CAAC;AASD,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC7D,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,yBAAyB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7G,CAAC;AACH,CAAC;AAyCD;;;;;;GAMG;AACH,MAAM,OAAO,KAAK;IACC,GAAG,CAAQ;IACX,MAAM,CAAQ;IACd,OAAO,CAAc;IACrB,SAAS,CAAuB;IAEjD,YAAY,GAAW,EAAE,MAAc,EAAE,UAAuC,EAAE;QAChF,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,0EAA0E;QAC1E,4EAA4E;QAC5E,iCAAiC;QACjC,MAAM,IAAI,GAAiB,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QACzF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAgB;QAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzB,yEAAyE;gBACzE,yEAAyE;gBACzE,6DAA6D;gBAC7D,EAAE;gBACF,oEAAoE;gBACpE,kEAAkE;gBAClE,oDAAoD;gBACpD,aAAa,EAAE,IAAI;aACpB;YACD,IAAI;SACL,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAkB;QAC9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC1D,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAkC;QAC5C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,MAAM,CAAA;IACtB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAkC,EAClC,UAAoD,EAAE;QAEtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAA;QACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,MAAM,GAAG,GAAkB,EAAE,CAAA;QAE7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,KAAyB,CAAA;YAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;gBAC5B,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,2CAA2C,CAC/E,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;oBAC9B,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;iBAC1E,CAAC,CAAA;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAK;gBAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;wBAAE,SAAQ;oBAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;oBACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACb,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;gBAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC3C,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,4BAA4B,KAAK,iCAAiC,CAClG,CAAA;oBACH,CAAC;oBACD,MAAK;gBACP,CAAC;gBACD,KAAK,GAAG,MAAM,CAAA;YAChB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAchD;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAW1C,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,IAAI,MAAmF,CAAA;IACvF,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACjG,CAAC;IACD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QACjE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC3G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACnE,CAAC;AASD,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC7D,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,yBAAyB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7G,CAAC;AACH,CAAC;AAyCD;;;;;;GAMG;AACH,MAAM,OAAO,KAAK;IACC,GAAG,CAAQ;IACX,MAAM,CAAQ;IACd,OAAO,CAAc;IACrB,SAAS,CAAuB;IACjD;;;;;;;;;;OAUG;IACK,mBAAmB,GAAG,CAAC,CAAA;IAE/B,YAAY,GAAW,EAAE,MAAc,EAAE,UAAuC,EAAE;QAChF,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,0EAA0E;QAC1E,4EAA4E;QAC5E,iCAAiC;QACjC,MAAM,IAAI,GAAiB,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QACzF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAgB;QAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzB,yEAAyE;gBACzE,yEAAyE;gBACzE,6DAA6D;gBAC7D,EAAE;gBACF,oEAAoE;gBACpE,kEAAkE;gBAClE,oDAAoD;gBACpD,aAAa,EAAE,IAAI;aACpB;YACD,IAAI;SACL,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAkB;QAC9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC1D,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAkC;QAC5C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,MAAM,CAAA;IACtB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAkC,EAClC,UAA2B,EAAE;QAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAA;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAA;QAEjF;;;;;;;;;UASE;QACF,MAAM,SAAS,GAAoB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5D,MAAM,QAAQ,GAAc,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAErD,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,MAAM,GAAG,KAAK,CAAA;QAElB,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,SAAS,CAAC;gBACR,wEAAwE;gBACxE,wEAAwE;gBACxE,oEAAoE;gBACpE,IAAI,MAAM;oBAAE,OAAM;gBAClB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAA;gBACpB,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM;oBAAE,OAAM;gBACnC,IAAI,CAAC;oBACH,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;gBAC9E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;oBACvB,MAAM,GAAG,IAAI,CAAA;oBACb,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC,CAAA;QAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAC9E,CAAA;QAED;;;;;;;UAOE;QACF,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;QACvE,IAAI,YAAY,KAAK,CAAC,CAAC;YAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAA;QAErD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,MAAM,GAAG,GAAkB,EAAE,CAAA;QAC7B,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAE,SAAQ;gBAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CACtB,MAA+B,EAC/B,QAAgB,EAChB,QAAgB;QAEhB,MAAM,GAAG,GAAkB,EAAE,CAAA;QAC7B,IAAI,KAAyB,CAAA;QAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,2CAA2C,CAC/E,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAC9B,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;aAC1E,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;YAEnB;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2BE;YACF,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,mBAAmB;gBAAE,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAA;YACtF,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,mBAAmB;gBAAE,MAAK;YAE/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;YAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC3C,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,4BAA4B,KAAK,iCAAiC,CAClG,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,CAAC;YACD,KAAK,GAAG,MAAM,CAAA;QAChB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}

package/dist/index.d.ts

@@ -46,12 +46,12 @@
 /** Bumped by hand with the version in package.json — `test/version.test.ts`
  * pins the two together. It exists so "the upgrade reached the app" can be
  * checked by grepping a built bundle rather than by trusting a lockfile. */
-export declare const PROTOCOL_VERSION = "0.3.0";
+export declare const PROTOCOL_VERSION = "0.5.0";
 export { type NostrTag, type UnsignedEvent, type SignedEvent, type Profile, type ThreadRef, type ChannelVisibility, type ChannelKind, type MemberRole, type Label, type ResolutionAction, KIND, MAX_EMOJI_CHARS, MAX_MESSAGE_BYTES, MAX_MENTIONS, MAX_RATIONALE_BYTES, RELAY_AUTH_TOLERANCE_SECS, ASSERTION_SUBTYPE, computeEventId, toNostrSeconds, canonicalChannelName, threadTags, addr, relayAuthUrl, buildProfile, parseProfile, buildCreateChannel, buildDeleteChannel, buildEditChannelMetadata, buildAddMember, buildReaction, buildDeletion, buildMessage, buildResolution, buildFile, buildComponent, buildHighlight, buildUnsignedRelayAuthEvent, } from './events.js';
 export { type AddressPointer, type EventPointer, encodeNevent, decodeNevent, convertBits, bech32Encode, bech32Decode, encodeNaddr, decodeNaddr, pointerToAddress, addressToPointer, addrToNaddr, naddrToAddr, referenceToPointer, NADDR_RE, findNaddrs, stripNaddrs, } from './nip19.js';
 export { type AuthEventArgs, TIMESTAMP_TOLERANCE_SECS, normalizeUrl, buildUnsignedAuthEvent, base64, authorizationHeaderFor, authorizationHeader, } from './nip98.js';
 export { type Signer, type SignerKind, publicKeyFromSecret, signEvent, secretKeySigner, } from './sign.js';
-export { type PublishResult, type QueryResult, type RelayHeaders, type RelayOptions, type FetchLike, parsePublishResponse, parseQueryResponse, RELAY_PAGE_CEILING, Relay, } from './bridge.js';
+export { type PublishResult, type QueryResult, type RelayHeaders, type RelayOptions, type FetchLike, type QueryAllOptions, parsePublishResponse, parseQueryResponse, RELAY_PAGE_CEILING, DEFAULT_QUERY_CONCURRENCY, Relay, } from './bridge.js';
 export { type RelayState, type SocketLike, type RelayCredential, type LiveRelayOptions, type Subscription, type LiveRelay, toWebSocketUrl, parseFrame, createLiveRelay, } from './live.js';
 export { type ChannelEventHandler, type ChannelSubscription, type ChannelSubscriptions, createChannelSubscriptions, } from './subscriptions.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH;;4EAE4E;AAC5E,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,KAAK,EACV,KAAK,gBAAgB,EAErB,IAAI,EACJ,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,IAAI,EACJ,YAAY,EAEZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,aAAa,EACb,YAAY,EACZ,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,aAAa,EAClB,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,EACtB,MAAM,EACN,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EACf,mBAAmB,EACnB,SAAS,EACT,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,GACN,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,cAAc,EACd,UAAU,EACV,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH;;4EAE4E;AAC5E,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,KAAK,EACV,KAAK,gBAAgB,EAErB,IAAI,EACJ,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,IAAI,EACJ,YAAY,EAEZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,aAAa,EACb,YAAY,EACZ,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,aAAa,EAClB,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,EACtB,MAAM,EACN,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EACf,mBAAmB,EACnB,SAAS,EACT,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,GACN,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,cAAc,EACd,UAAU,EACV,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA"}

package/dist/index.js

@@ -46,7 +46,7 @@
 /** Bumped by hand with the version in package.json — `test/version.test.ts`
  * pins the two together. It exists so "the upgrade reached the app" can be
  * checked by grepping a built bundle rather than by trusting a lockfile. */
-export const PROTOCOL_VERSION = '0.3.0';
+export const PROTOCOL_VERSION = '0.5.0';
 export { 
 // constants
 KIND, MAX_EMOJI_CHARS, MAX_MESSAGE_BYTES, MAX_MENTIONS, MAX_RATIONALE_BYTES, RELAY_AUTH_TOLERANCE_SECS, ASSERTION_SUBTYPE, 
@@ -57,7 +57,7 @@ buildProfile, parseProfile, buildCreateChannel, buildDeleteChannel, buildEditCha
 export { encodeNevent, decodeNevent, convertBits, bech32Encode, bech32Decode, encodeNaddr, decodeNaddr, pointerToAddress, addressToPointer, addrToNaddr, naddrToAddr, referenceToPointer, NADDR_RE, findNaddrs, stripNaddrs, } from './nip19.js';
 export { TIMESTAMP_TOLERANCE_SECS, normalizeUrl, buildUnsignedAuthEvent, base64, authorizationHeaderFor, authorizationHeader, } from './nip98.js';
 export { publicKeyFromSecret, signEvent, secretKeySigner, } from './sign.js';
-export { parsePublishResponse, parseQueryResponse, RELAY_PAGE_CEILING, Relay, } from './bridge.js';
+export { parsePublishResponse, parseQueryResponse, RELAY_PAGE_CEILING, DEFAULT_QUERY_CONCURRENCY, Relay, } from './bridge.js';
 export { toWebSocketUrl, parseFrame, createLiveRelay, } from './live.js';
 export { createChannelSubscriptions, } from './subscriptions.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,OAAO;AAYL,YAAY;AACZ,IAAI,EACJ,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB;AACjB,8CAA8C;AAC9C,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,IAAI,EACJ,YAAY;AACZ,WAAW;AACX,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,aAAa,EACb,YAAY,EACZ,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,OAAO,EAGL,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAA;AAEnB,OAAO,EAEL,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,EACtB,MAAM,EACN,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAGL,mBAAmB,EACnB,SAAS,EACT,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EAML,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,GACN,MAAM,aAAa,CAAA;AAEpB,OAAO,EAOL,cAAc,EACd,UAAU,EACV,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EAIL,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,OAAO;AAYL,YAAY;AACZ,IAAI,EACJ,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB;AACjB,8CAA8C;AAC9C,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,IAAI,EACJ,YAAY;AACZ,WAAW;AACX,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,aAAa,EACb,YAAY,EACZ,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,OAAO,EAGL,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAA;AAEnB,OAAO,EAEL,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,EACtB,MAAM,EACN,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAGL,mBAAmB,EACnB,SAAS,EACT,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EAOL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,GACN,MAAM,aAAa,CAAA;AAEpB,OAAO,EAOL,cAAc,EACd,UAAU,EACV,eAAe,GAChB,MAAM,WAAW,CAAA;AAElB,OAAO,EAIL,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estiva-app/protocol",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "The Estiva wire format: Buzz-shaped Nostr event builders, NIP-01 ids, NIP-19 naddr, NIP-98 HTTP auth, and the relay clients. Speaks the protocol; interprets nothing.",
   "license": "MIT",
   "type": "module",

package/src/bridge.ts

@@ -67,6 +67,50 @@ export interface PublishResult {
  */
 export const RELAY_PAGE_CEILING = 1000
 
+/**
+ * How many of a {@link Relay.queryAll} call's filters may be in flight at once.
+ *
+ * Filters are independent — only paging *within* one is a cursor walk — and
+ * running them one after another made a read as slow as the sum of its parts.
+ * Measured on Ship's `loadAll` against production: **33 filters, 66 sequential
+ * round trips, median 206 ms, 100% of wall clock spent inside `query` one
+ * request at a time.** At a concurrency of 8 the same read returned a
+ * byte-identical answer in 1.9 s instead of 9.0 s.
+ *
+ * Bounded rather than unbounded on purpose. A workspace's filter count grows
+ * with its Folders, so `Promise.all` over all of them would open a fan-out
+ * whose width is set by the *data* — fine at 33, an accidental flood at 500,
+ * and the relay is shared. Eight is enough to hide the latency without any
+ * caller having to think about it.
+ *
+ * Pass `concurrency: 1` to restore the strictly serial read.
+ *
+ * ## This does not buy a caller more relay budget
+ *
+ * Concurrency changes how fast a read spends its requests, never how many it
+ * makes. Buzz meters `POST /query` against `human_api_calls_per_min` — a fixed
+ * 60-second window, **default 300, applied to every bridge call whatever tier
+ * the caller is** (`enforce_http_admission` in `api/bridge.rs` reads the human
+ * limit unconditionally). At 66 requests, one Ship workspace read is 22% of a
+ * minute's entire allowance, so no client gets more than ~4.5 of them a minute
+ * however it schedules them.
+ *
+ * A poller therefore has to slow down as its reads get faster, or it simply
+ * spends the same budget sooner and starts collecting
+ * `rate-limited: quota exceeded`. Making a read cheap is the fix for that;
+ * making it parallel is not.
+ */
+export const DEFAULT_QUERY_CONCURRENCY = 8
+
+export interface QueryAllOptions {
+  /** Events per request. Defaults to {@link RELAY_PAGE_CEILING}. */
+  pageSize?: number
+  /** Give up after this many pages *per filter*, rather than looping forever. */
+  maxPages?: number
+  /** Filters in flight at once. Defaults to {@link DEFAULT_QUERY_CONCURRENCY}; 1 is serial. */
+  concurrency?: number
+}
+
 export function parsePublishResponse(status: number, text: string): PublishResult {
   let parsed: { accepted?: boolean; event_id?: string; message?: string; error?: string }
   try {
@@ -161,6 +205,18 @@ export class Relay {
   private readonly signer: Signer
   private readonly headers: RelayHeaders
   private readonly transport: FetchLike | undefined
+  /**
+   * The largest page this relay has ever handed back, across every call.
+   *
+   * A *lower bound* on the relay's real clamp, and the only one obtainable
+   * without trusting anybody: the relay returned this many events in one
+   * response, so its ceiling is at least this large. {@link Relay.pageFilter}
+   * uses it to tell a short page apart from a clamped one — see there.
+   *
+   * Per instance and never reset, so the second read through a long-lived
+   * `Relay` is cheaper than the first.
+   */
+  private observedPageCeiling = 0
 
   constructor(url: string, signer: Signer, options: RelayOptions | RelayHeaders = {}) {
     this.url = url.replace(/\/+$/, '')
@@ -241,44 +297,154 @@ export class Relay {
    * value of `until` reaches past them without skipping some, and no correct
    * answer exists from this API — so it says so instead of returning a
    * plausible subset.
+   *
+   * **Filters run concurrently, up to {@link DEFAULT_QUERY_CONCURRENCY}.** They
+   * are independent of one another; only the pages inside one are a cursor
+   * walk. Doing them in sequence made a read cost the sum of every filter's
+   * latency, which is what put Ship's workspace read at nine seconds against a
+   * five-second poll — long enough that a write's re-read had usually not
+   * finished before the next one began.
+   *
+   * The concurrency is deliberately **not observable in the answer**: results
+   * are collected per filter and concatenated in filter order, so the returned
+   * array is identical to the serial one, and a failure reports the
+   * lowest-indexed filter's error rather than whichever lost the race.
    */
   async queryAll(
     filters: Record<string, unknown>[],
-    options: { pageSize?: number; maxPages?: number } = {},
+    options: QueryAllOptions = {},
   ): Promise<SignedEvent[]> {
     const pageSize = options.pageSize ?? RELAY_PAGE_CEILING
     const maxPages = options.maxPages ?? 100
+    const concurrency = Math.max(1, options.concurrency ?? DEFAULT_QUERY_CONCURRENCY)
+
+    /*
+      Per filter, in filter order — not one shared accumulator.
+
+      Concurrency must not be observable in the answer. Collecting each
+      filter's pages into its own slot and concatenating in order at the end
+      makes the output byte-identical to the serial version, whatever order the
+      responses actually arrive in. Dedup then runs over that ordered
+      concatenation, so an id first seen under filter 0 still belongs to filter
+      0's run of events, exactly as before.
+    */
+    const perFilter: SignedEvent[][] = new Array(filters.length)
+    const failures: unknown[] = new Array(filters.length)
+
+    let next = 0
+    let failed = false
+
+    const worker = async (): Promise<void> => {
+      for (;;) {
+        // Stop *starting* filters once one has failed. The serial version never
+        // reached them at all; this is as close as a fan-out gets, and it keeps
+        // a broken read from firing the whole remaining queue at the relay.
+        if (failed) return
+        const index = next++
+        if (index >= filters.length) return
+        try {
+          perFilter[index] = await this.pageFilter(filters[index], pageSize, maxPages)
+        } catch (error) {
+          failures[index] = error
+          failed = true
+          return
+        }
+      }
+    }
+
+    await Promise.all(
+      Array.from({ length: Math.min(concurrency, filters.length) }, () => worker()),
+    )
+
+    /*
+      The lowest-indexed failure, not the first to reject in wall-clock time.
+
+      Under `Promise.all` the error a caller sees would otherwise depend on
+      which request happened to lose the race, so two runs of the same broken
+      read could report different filters. Serial order is the one order that
+      is reproducible, and it is what the serial version reported.
+    */
+    const firstFailure = failures.findIndex((error) => error !== undefined)
+    if (firstFailure !== -1) throw failures[firstFailure]
+
     const seen = new Set<string>()
     const out: SignedEvent[] = []
+    for (const events of perFilter) {
+      for (const e of events) {
+        if (seen.has(e.id)) continue
+        seen.add(e.id)
+        out.push(e)
+      }
+    }
+    return out
+  }
+
+  /**
+   * One filter, paged to exhaustion. The sequential half, and it has to be:
+   * `until` is a cursor, so page N+1's request is not known until page N has
+   * answered. Only the filters are independent, which is why they are the
+   * axis {@link Relay.queryAll} parallelises.
+   */
+  private async pageFilter(
+    filter: Record<string, unknown>,
+    pageSize: number,
+    maxPages: number,
+  ): Promise<SignedEvent[]> {
+    const out: SignedEvent[] = []
+    let until: number | undefined
+    for (let page = 0; ; page++) {
+      if (page >= maxPages) {
+        throw new Error(
+          `queryAll: gave up after ${maxPages} pages — refusing to return a partial set`,
+        )
+      }
+      const events = await this.query([
+        { ...filter, limit: pageSize, ...(until === undefined ? {} : { until }) },
+      ])
+      if (events.length === 0) break
+      out.push(...events)
+
+      /*
+        A page smaller than one this relay has already delivered is the end of
+        the filter, and no confirming round trip is needed to know it.
+
+        The reason the confirmation existed is real: a page shorter than the
+        `limit` we asked for is ambiguous, because the relay clamps to
+        `min(requested, ceiling)` and might have clamped at exactly this many.
+        But that requires the ceiling to *equal* this page's size — and the
+        ceiling is one constant for the relay, already known to be at least
+        `observedPageCeiling`. So `n < observedPageCeiling` rules the clamp out
+        arithmetically rather than by trusting anything.
 
-    for (const filter of filters) {
-      let until: number | undefined
-      for (let page = 0; ; page++) {
-        if (page >= maxPages) {
+        Deliberately not NIP-11's `limitation.max_limit`. That number is a
+        claim: a relay advertising more than it clamps to would make every page
+        look short and the first one get mistaken for the whole set, which is
+        exactly the SHA-8 bug this loop exists to prevent. An observed page is
+        evidence — the relay demonstrably produced it.
+
+        Conservative before it has evidence: the first filter through a fresh
+        `Relay` still pays the confirmation, and so does any page that ties the
+        largest seen so far — which means **the widest filter always confirms**,
+        since it ties its own bound on every read. So the floor is one request
+        per filter plus one, not one per filter.
+
+        Measured on Ship's `loadAll` against production: **66 requests to 35
+        cold and 34 warm**, the same fold event for event, and 8.8 s to 0.9 s
+        alongside the concurrency of 0.4.0.
+      */
+      if (events.length > this.observedPageCeiling) this.observedPageCeiling = events.length
+      if (events.length < pageSize && events.length < this.observedPageCeiling) break
+
+      const oldest = Math.min(...events.map((e) => e.created_at))
+      if (until !== undefined && oldest >= until) {
+        if (events.length >= pageSize) {
           throw new Error(
-            `queryAll: gave up after ${maxPages} pages — refusing to return a partial set`,
+            `queryAll: more than ${pageSize} events share created_at=${until} — cannot page without skipping`,
           )
         }
-        const events = await this.query([
-          { ...filter, limit: pageSize, ...(until === undefined ? {} : { until }) },
-        ])
-        if (events.length === 0) break
-        for (const e of events) {
-          if (seen.has(e.id)) continue
-          seen.add(e.id)
-          out.push(e)
-        }
-        const oldest = Math.min(...events.map((e) => e.created_at))
-        if (until !== undefined && oldest >= until) {
-          if (events.length >= pageSize) {
-            throw new Error(
-              `queryAll: more than ${pageSize} events share created_at=${until} — cannot page without skipping`,
-            )
-          }
-          break
-        }
-        until = oldest
+        break
       }
+      until = oldest
     }
     return out
   }

package/src/index.ts

@@ -47,7 +47,7 @@
 /** Bumped by hand with the version in package.json — `test/version.test.ts`
  * pins the two together. It exists so "the upgrade reached the app" can be
  * checked by grepping a built bundle rather than by trusting a lockfile. */
-export const PROTOCOL_VERSION = '0.3.0'
+export const PROTOCOL_VERSION = '0.5.0'
 
 export {
   // types
@@ -137,9 +137,11 @@ export {
   type RelayHeaders,
   type RelayOptions,
   type FetchLike,
+  type QueryAllOptions,
   parsePublishResponse,
   parseQueryResponse,
   RELAY_PAGE_CEILING,
+  DEFAULT_QUERY_CONCURRENCY,
   Relay,
 } from './bridge.js'