@eventsdk/sdk 0.0.0-stage → 0.4.0

package/dist/core/index.js

@@ -0,0 +1 @@
+var CoreError=class extends Error{constructor(code){super(code);this.code=code;this.name="CoreError"}code};function assertNotAborted(signal){if(signal?.aborted)throw new CoreError("ABORTED")}async function boundedOperation(options,operation){assertNotAborted(options.signal);if(!Number.isSafeInteger(options.timeoutMs)||options.timeoutMs<1||options.timeoutMs>2147483647){throw new CoreError("INVALID_CONFIGURATION")}const controller=new AbortController;let rejectAbort;const stopped=new Promise((_resolve,reject)=>{rejectAbort=reject});const stop=code=>{controller.abort();rejectAbort?.(new CoreError(code))};const onAbort=()=>stop("ABORTED");options.signal?.addEventListener("abort",onAbort,{once:true});const timer=setTimeout(()=>stop("TIMEOUT"),options.timeoutMs);try{return await Promise.race([Promise.resolve().then(()=>{assertNotAborted(controller.signal);return operation(controller.signal)}),stopped])}finally{clearTimeout(timer);options.signal?.removeEventListener("abort",onAbort)}}function assertLiveLease(lease,now){if(!Number.isFinite(now)||!lease.token||!Number.isSafeInteger(lease.generation)||lease.generation<1||!Number.isFinite(lease.expiresAt)||lease.expiresAt<=now){throw new CoreError("STALE_LEASE")}}function decideRetry(attempt,now,policy,random){if(!Number.isSafeInteger(attempt)||attempt<1||!Number.isSafeInteger(now)||now<0||!Number.isSafeInteger(policy.maxAttempts)||policy.maxAttempts<1||!Number.isSafeInteger(policy.baseDelayMs)||policy.baseDelayMs<0||!Number.isSafeInteger(policy.maxDelayMs)||policy.maxDelayMs<policy.baseDelayMs||policy.jitterRatio<0||policy.jitterRatio>1||!Number.isFinite(policy.jitterRatio)){throw new CoreError("INVALID_CONFIGURATION")}if(attempt>=policy.maxAttempts)return{kind:"EXHAUSTED"};const sample=random.next();if(!Number.isFinite(sample)||sample<0||sample>=1)throw new CoreError("INVALID_CONFIGURATION");const base=Math.min(policy.maxDelayMs,policy.baseDelayMs*2**Math.min(attempt-1,52));const delay=Math.min(policy.maxDelayMs,base*(1-policy.jitterRatio+sample*policy.jitterRatio));const nextAttemptAt=now+Math.floor(delay);if(!Number.isSafeInteger(nextAttemptAt))throw new CoreError("INVALID_CONFIGURATION");return{kind:"RETRY",nextAttemptAt}}import{canonicalJson}from"@eventsdk/sdk/contracts";function eventMessageId(event,digest){return digest.sha256(event.deliveryid===void 0?`${event.source}\0${event.id}`:canonicalJson(["eventsdk-delivery-message/1",event.source,event.id,event.deliveryid]))}function eventDigest(event,digest){return digest.sha256(canonicalJson(event))}function inboxKey(key){return[key.consumerRef,key.targetScope,key.source,key.id].map(value=>`${value.length}:${value}`).join("")}import{parseCloudEvent}from"@eventsdk/sdk/contracts";function assertOrigin(event,origin,now){if(!Number.isFinite(now)||!origin.issuer||!origin.subject||!Array.isArray(origin.audience)||event.serviceorigin!==origin.serviceRef||!origin.audience.includes(event.audience)||!Number.isFinite(Date.parse(origin.expiresAt))||Date.parse(origin.expiresAt)<=now||!Number.isFinite(Date.parse(origin.verifiedAt))||Date.parse(origin.verifiedAt)>now){throw new CoreError("ORIGIN_MISMATCH")}}function authorizedScope(event,decision){if(decision.decision!=="ALLOW"){throw new CoreError(decision.decision==="DENY"?"AUTHORIZATION_DENIED":"AUTHORIZATION_UNKNOWN")}if(!decision.targetScope||decision.source!==event.source||decision.connectionRef!==event.connectionref||decision.grantRef!==event.grantref||decision.grantVersion!==event.grantversion){throw new CoreError("AUTHORIZATION_DENIED")}return decision.targetScope}import{canonicalJson as canonicalJson2,parseFanoutEventDraft}from"@eventsdk/sdk/contracts";function fanoutLogicalEvent(event){const{audience:_audience,connectionref:_connection,grantref:_grant,grantversion:_version,deliveryid:_delivery,...logical}=event;return parseFanoutEventDraft(logical)}function logicalEventDigest(event,digest){return digest.sha256(canonicalJson2(event.profile==="eventsdk/1.2"?fanoutLogicalEvent(event):event))}function deriveDeliveryId(event,digest){return digest.sha256(canonicalJson2(["eventsdk-delivery/1",event.source,event.id,event.audience,event.connectionref]))}async function assertDeliveryIdentity(event,digest){if(event.profile==="eventsdk/1.2"&&event.deliveryid!==await deriveDeliveryId(event,digest))throw new CoreError("EVENT_ID_CONFLICT")}function immutableSnapshot(value){return freezeDeep(structuredClone(value))}function freezeDeep(value){if(value!==null&&typeof value==="object"&&!Object.isFrozen(value)){Object.freeze(value);for(const nested of Object.values(value))freezeDeep(nested)}return value}async function recordEvent(tx,input,origin,dependencies,options){const event=immutableSnapshot(parseCloudEvent(input));origin=immutableSnapshot(origin);await boundedOperation(options,async signal=>{assertOrigin(event,origin,dependencies.clock.now());await assertDeliveryIdentity(event,dependencies.digest);if(event.profile==="eventsdk/1.2"&&!dependencies.outbox.recordFanoutInTransaction)throw new CoreError("ADAPTER_CAPABILITY_REQUIRED");const decision=await dependencies.authorization.authorize({phase:"OUTBOUND",event,origin,signal});if(authorizedScope(event,decision)!==event.sourcetenant)throw new CoreError("AUTHORIZATION_DENIED");const digest=await eventDigest(event,dependencies.digest);assertOrigin(event,origin,dependencies.clock.now());const record={event,origin,digest};if(event.profile==="eventsdk/1.2"){if(!dependencies.outbox.recordFanoutInTransaction)throw new CoreError("ADAPTER_CAPABILITY_REQUIRED");await dependencies.outbox.recordFanoutInTransaction(tx,{...record,logicalDigest:await logicalEventDigest(event,dependencies.digest),deliveryId:event.deliveryid},signal)}else await dependencies.outbox.recordInTransaction(tx,record,signal)})}async function refreshOrigin(event,previous,clock,signal,port){const verified=port?immutableSnapshot(await port.refresh(event,previous,signal)):previous;assertOrigin(event,verified,clock.now());return verified}async function publishClaim(claim,deps,options){try{return await boundedOperation(options,async signal=>{assertLiveLease(claim.lease,deps.clock.now());await assertDeliveryIdentity(claim.event,deps.digest);if(await eventDigest(claim.event,deps.digest)!==claim.digest)throw new CoreError("EVENT_ID_CONFLICT");const origin=await refreshOrigin(claim.event,claim.origin,deps.clock,signal,deps.originRefresh);const decision=await deps.authorization.authorize({phase:"OUTBOUND",event:claim.event,origin,signal});if(authorizedScope(claim.event,decision)!==claim.event.sourcetenant)throw new CoreError("AUTHORIZATION_DENIED");const messageId=await eventMessageId(claim.event,deps.digest);assertOrigin(claim.event,origin,deps.clock.now());assertLiveLease(claim.lease,deps.clock.now());const ack=await deps.publisher.publish(claim.event,{messageId,signal});return{status:"PUBLISHED",ack}})}catch(error){if(error instanceof CoreError&&["AUTHORIZATION_DENIED","AUTHORIZATION_UNKNOWN","ORIGIN_MISMATCH","EVENT_ID_CONFLICT"].includes(error.code)){return{status:"HOLD",reasonCode:error.code}}const retry=decideRetry(claim.attempt,deps.clock.now(),options.retry,deps.random);return retry.kind==="RETRY"?{status:"UNKNOWN",nextAttemptAt:retry.nextAttemptAt}:{status:"HOLD",reasonCode:"PUBLISH_UNKNOWN_RETRY_EXHAUSTED"}}}async function relayOutbox(deps,options){if(!Number.isSafeInteger(options.batchSize)||options.batchSize<1||options.batchSize>1e3||!Number.isFinite(options.leaseMs)||options.leaseMs<=options.timeoutMs)throw new CoreError("INVALID_CONFIGURATION");const claims=await boundedOperation(options,signal=>deps.outbox.claimReady({limit:options.batchSize,now:deps.clock.now(),leaseMs:options.leaseMs,signal}));if(claims.length>options.batchSize)throw new CoreError("INVALID_CONFIGURATION");const summary={published:0,unknown:0,held:0};const immutableClaims=immutableSnapshot(claims);for(const raw of immutableClaims){const claim=immutableSnapshot(raw);assertNotAborted(options.signal);assertLiveLease(claim.lease,deps.clock.now());if(claim.event.profile==="eventsdk/1.2"&&!deps.outbox.settleFanoutPublish)throw new CoreError("ADAPTER_CAPABILITY_REQUIRED");const outcome=await publishClaim(claim,deps,options);await boundedOperation({timeoutMs:options.timeoutMs},signal=>{assertLiveLease(claim.lease,deps.clock.now());if(claim.event.profile==="eventsdk/1.2"){if(!deps.outbox.settleFanoutPublish)throw new CoreError("ADAPTER_CAPABILITY_REQUIRED");return deps.outbox.settleFanoutPublish(claim.event,claim.lease,outcome,signal)}return deps.outbox.settlePublish(claim.event,claim.lease,outcome,signal)});if(outcome.status==="PUBLISHED")summary.published+=1;else if(outcome.status==="UNKNOWN")summary.unknown+=1;else summary.held+=1}return summary}import{parseCloudEvent as parseCloudEvent2}from"@eventsdk/sdk/contracts";import{parseBusinessReceipt}from"@eventsdk/sdk/contracts";function receivedReceipt(event,deliveryRef,consumerRef,targetScope,clock,ids){return parseBusinessReceipt({receiptRef:ids.next(),originSource:event.source,originEventId:event.id,deliveryRef,consumerRef,targetScope,disposition:"RECEIVED",recordedAt:new Date(clock.now()).toISOString(),revision:1})}async function persistAdmission(record,inbox,digest,signal){if(record.event.profile!=="eventsdk/1.2")return inbox.persistAccepted(record,signal);if(!inbox.persistFanoutAccepted)throw new CoreError("ADAPTER_CAPABILITY_REQUIRED");return inbox.persistFanoutAccepted({...record,logicalDigest:await logicalEventDigest(record.event,digest),deliveryId:record.event.deliveryid},signal)}async function quarantine(input,deps,reasonCode,signal){await deps.inbox.persistQuarantine({deliveryRef:input.deliveryRef,consumerRef:input.consumerRef,reasonCode,recordedAt:new Date(deps.clock.now()).toISOString()},signal);if(reasonCode==="AUTHORIZATION_UNKNOWN")throw new CoreError("AUTHORIZATION_UNKNOWN");return{kind:"REJECTED",reasonCode}}async function admitVerified(event,input,deps,signal){let targetScope;try{if(event.audience!==deps.audience)throw new CoreError("ORIGIN_MISMATCH");assertOrigin(event,input.origin,deps.clock.now());await assertDeliveryIdentity(event,deps.digest);const decision=await deps.authorization.authorize({phase:"RECEIVE",event,origin:input.origin,consumerRef:input.consumerRef,signal});targetScope=authorizedScope(event,decision);assertOrigin(event,input.origin,deps.clock.now())}catch(error){if(!(error instanceof CoreError))throw error;return quarantine(input,deps,error.code,signal)}const receipt=receivedReceipt(event,input.deliveryRef,input.consumerRef,targetScope,deps.clock,deps.ids);const result=await persistAdmission({key:{source:event.source,id:event.id,consumerRef:input.consumerRef,targetScope},event,origin:input.origin,digest:await eventDigest(event,deps.digest),deliveryRef:input.deliveryRef,receipt},deps.inbox,deps.digest,signal);if(result.kind==="CONFLICT")return quarantine(input,deps,"EVENT_ID_CONFLICT",signal);return result}async function acceptDelivery(input,deps,options){input=immutableSnapshot(input);if(!input.consumerRef||!input.deliveryRef)throw new CoreError("INVALID_CONFIGURATION");return boundedOperation(options,async signal=>{let event;try{event=parseCloudEvent2(input.event)}catch{return quarantine(input,deps,"INVALID_CONTRACT",signal)}return admitVerified(event,input,deps,signal)})}import{parseBusinessReceipt as parseBusinessReceipt4}from"@eventsdk/sdk/contracts";import{canonicalJson as canonicalJson3,parseBusinessReceipt as parseBusinessReceipt2}from"@eventsdk/sdk/contracts";var transitions={RECEIVED:["APPLIED","REJECTED","HOLD","UNKNOWN"],HOLD:["APPLIED","REJECTED","HOLD","UNKNOWN"],UNKNOWN:["APPLIED","REJECTED","HOLD"],APPLIED:[],REJECTED:[]};function assertReceiptTransition(previous,next){const identity=["receiptRef","originSource","originEventId","deliveryRef","consumerRef","targetScope"];if(identity.some(field=>previous[field]!==next[field]))throw new CoreError("RECEIPT_MISMATCH");if(next.revision!==previous.revision+1||!transitions[previous.disposition].includes(next.disposition)){throw new CoreError("INVALID_TRANSITION")}}function classifyReceiptCommit(previous,next){parseBusinessReceipt2(previous);parseBusinessReceipt2(next);if(previous.disposition==="HOLD"&&canonicalJson3(previous)===canonicalJson3(next)){return"UNCHANGED"}assertReceiptTransition(previous,next);return"TRANSITION"}import{parseBusinessReceipt as parseBusinessReceipt3,parseCloudEvent as parseCloudEvent3}from"@eventsdk/sdk/contracts";async function validateClaim(claim,digest){parseCloudEvent3(claim.event);await assertDeliveryIdentity(claim.event,digest);parseBusinessReceipt3(claim.receipt);if(claim.key.source!==claim.event.source||claim.key.id!==claim.event.id||claim.receipt.originSource!==claim.event.source||claim.receipt.originEventId!==claim.event.id||claim.receipt.consumerRef!==claim.key.consumerRef||claim.receipt.targetScope!==claim.key.targetScope||claim.receipt.deliveryRef!==claim.deliveryRef)throw new CoreError("RECEIPT_MISMATCH");if(claim.receipt.disposition==="UNKNOWN")throw new CoreError("RECOVERY_REQUIRED");if(claim.receipt.disposition==="APPLIED"||claim.receipt.disposition==="REJECTED"){throw new CoreError("INVALID_TRANSITION")}if(await eventDigest(claim.event,digest)!==claim.digest)throw new CoreError("EVENT_ID_CONFLICT")}import{canonicalJson as canonicalJson4,parseResultRef}from"@eventsdk/sdk/contracts";async function readAuthorizedResult(request,reader,authorization,digest,signal,clock){request=immutableSnapshot(request);assertNotAborted(signal);assertOrigin(request.event,request.origin,clock.now());const reference=parseResultRef(request.reference);if(reference.sourceSystem!==request.event.serviceorigin)throw new CoreError("RESULT_MISMATCH");const decision=await authorization.authorize({phase:"RESULT_READ",event:request.event,origin:request.origin,consumerRef:request.consumerRef,targetScope:request.targetScope,resultRef:reference,signal});if(authorizedScope(request.event,decision)!==request.targetScope)throw new CoreError("TARGET_SCOPE_CHANGED");assertNotAborted(signal);assertOrigin(request.event,request.origin,clock.now());const raw=await reader.read(request.reference,{event:request.event,origin:request.origin,targetScope:request.targetScope,signal});if(!raw)throw new CoreError("RECOVERY_REQUIRED");const snapshot=immutableSnapshot(raw);parseResultRef(snapshot.reference);const fields=["sourceSystem","resourceType","resourceId","revision","digest","evidenceRef"];if(fields.some(field=>snapshot.reference[field]!==request.reference[field])||`sha256:${await digest.sha256(canonicalJson4(snapshot.value))}`!==request.reference.digest){throw new CoreError("RESULT_MISMATCH")}assertNotAborted(signal);assertOrigin(request.event,request.origin,clock.now());return snapshot}import{canonicalJson as canonicalJson6}from"@eventsdk/sdk/contracts";import{canonicalJson as canonicalJson5,parseResultRef as parseResultRef2}from"@eventsdk/sdk/contracts";function resultObject(value){if(value===null||typeof value!=="object"||Array.isArray(value))throw new CoreError("INVALID_DOMAIN_RESULT");const prototype=Object.getPrototypeOf(value);if(prototype!==Object.prototype&&prototype!==null)throw new CoreError("INVALID_DOMAIN_RESULT");for(const key of Reflect.ownKeys(value)){const descriptor=Object.getOwnPropertyDescriptor(value,key);if(typeof key!=="string"||!descriptor?.enumerable||!("value"in descriptor)){throw new CoreError("INVALID_DOMAIN_RESULT")}}return value}function appliedResult(value){if(Object.keys(value).some(key=>key!=="disposition"&&key!=="resultRef"))throw new CoreError("INVALID_DOMAIN_RESULT");if(!Object.hasOwn(value,"resultRef"))return Object.freeze({disposition:"APPLIED"});resultObject(value.resultRef);canonicalJson5(value.resultRef);const reference=parseResultRef2(value.resultRef);return immutableSnapshot({disposition:"APPLIED",resultRef:reference})}function normalizeDomainApplyResult(value){if(value===void 0)return Object.freeze({disposition:"APPLIED"});try{const result=resultObject(value);if(!Object.hasOwn(result,"disposition")||result.disposition==="APPLIED")return appliedResult(result);if(result.disposition!=="REJECTED"&&result.disposition!=="HOLD")throw new CoreError("INVALID_DOMAIN_RESULT");if(Object.keys(result).some(key=>key!=="disposition"&&key!=="reasonCode")||typeof result.reasonCode!=="string"||!/^[A-Z][A-Z0-9_]{0,63}$/.test(result.reasonCode)){throw new CoreError("INVALID_DOMAIN_RESULT")}return Object.freeze({disposition:result.disposition,reasonCode:result.reasonCode})}catch{throw new CoreError("INVALID_DOMAIN_RESULT")}}async function runDomainApply(tx,claim,deps,snapshot,signal){let invoked=false;let observed;const operation=async()=>{if(invoked)throw new CoreError("INVALID_DOMAIN_RESULT");invoked=true;observed=normalizeDomainApplyResult(await deps.domain.apply(tx,claim,snapshot,signal));return observed};if(!deps.inbox.withDomainSavepoint){const outcome2=await operation();if(outcome2.disposition!=="APPLIED")throw new CoreError("ADAPTER_CAPABILITY_REQUIRED");return outcome2}const outcome=normalizeDomainApplyResult(await deps.inbox.withDomainSavepoint(tx,operation,signal));if(!invoked||!observed||canonicalJson6(outcome)!==canonicalJson6(observed))throw new CoreError("INVALID_DOMAIN_RESULT");return outcome}function dispositionReceipt(claim,disposition,clock,reasonCode,resultRef){const{reasonCode:_previousReason,resultRef:_previousResult,...previous}=claim.receipt;const next={...previous,...reasonCode?{reasonCode}:{},...resultRef?{resultRef}:{},disposition,revision:claim.receipt.revision+1,recordedAt:new Date(clock.now()).toISOString()};assertReceiptTransition(claim.receipt,next);return parseBusinessReceipt4(next)}async function applyAuthorizedDomain(tx,claim,deps,snapshot,signal){assertNotAborted(signal);assertOrigin(claim.event,claim.origin,deps.clock.now());assertLiveLease(claim.lease,deps.clock.now());const outcome=await runDomainApply(tx,claim,deps,snapshot,signal);assertNotAborted(signal);assertOrigin(claim.event,claim.origin,deps.clock.now());assertLiveLease(claim.lease,deps.clock.now());if(outcome.disposition==="APPLIED"&&outcome.resultRef&&outcome.resultRef.sourceSystem!==claim.event.audience){throw new CoreError("RESULT_MISMATCH")}if(outcome.disposition==="HOLD"&&claim.receipt.disposition==="HOLD"&&claim.receipt.reasonCode===outcome.reasonCode)return claim.receipt;const receipt=outcome.disposition==="APPLIED"?dispositionReceipt(claim,"APPLIED",deps.clock,void 0,outcome.resultRef):dispositionReceipt(claim,outcome.disposition,deps.clock,outcome.reasonCode);await deps.inbox.completeInTransaction(tx,claim,receipt,signal);return receipt}async function applyTransaction(claim,deps,snapshot,signal){return deps.inbox.transact(claim,async tx=>{assertLiveLease(claim.lease,deps.clock.now());const decision=await deps.authorization.authorizeInTransaction(tx,{phase:"APPLY",event:claim.event,origin:claim.origin,consumerRef:claim.key.consumerRef,targetScope:claim.key.targetScope,signal});if(decision.decision!=="ALLOW"){if(decision.decision==="UNKNOWN"&&claim.receipt.disposition==="HOLD")return claim.receipt;const receipt=dispositionReceipt(claim,decision.decision==="DENY"?"REJECTED":"HOLD",deps.clock,/^[A-Z][A-Z0-9_]{0,63}$/.test(decision.reasonCode)?decision.reasonCode:"AUTHORIZATION_UNAVAILABLE");await deps.inbox.completeInTransaction(tx,claim,receipt,signal);return receipt}if(authorizedScope(claim.event,decision)!==claim.key.targetScope)throw new CoreError("TARGET_SCOPE_CHANGED");return applyAuthorizedDomain(tx,claim,deps,snapshot,signal)},signal)}async function applyDelivery(claim,deps,options,readback){claim=immutableSnapshot(claim);return boundedOperation(options,async signal=>{await validateClaim(claim,deps.digest);assertLiveLease(claim.lease,deps.clock.now());const origin=await refreshOrigin(claim.event,claim.origin,deps.clock,signal,deps.originRefresh);claim=immutableSnapshot({...claim,origin});let snapshot;if(readback)snapshot=await readAuthorizedResult({reference:readback.reference,event:claim.event,origin:claim.origin,consumerRef:claim.key.consumerRef,targetScope:claim.key.targetScope},readback.reader,readback.authorization,readback.digest,signal,deps.clock);return applyTransaction(claim,deps,snapshot,signal)})}import{parseBusinessReceipt as parseBusinessReceipt5}from"@eventsdk/sdk/contracts";async function recoverReceipt(key,deliveryRef,reader,options){key=immutableSnapshot({source:key.source,id:key.id,consumerRef:key.consumerRef,targetScope:key.targetScope});return boundedOperation(options,async signal=>{const raw=await reader.read(key,deliveryRef,signal);assertNotAborted(signal);if(!raw)return{status:"WAIT",receipt:null};const receipt=immutableSnapshot(parseBusinessReceipt5(raw));if(receipt.originSource!==key.source||receipt.originEventId!==key.id||receipt.consumerRef!==key.consumerRef||receipt.targetScope!==key.targetScope||receipt.deliveryRef!==deliveryRef)throw new CoreError("RECEIPT_MISMATCH");return{status:["APPLIED","REJECTED"].includes(receipt.disposition)?"RESOLVED":"WAIT",receipt}})}import{parseBusinessReceipt as parseBusinessReceipt6}from"@eventsdk/sdk/contracts";async function recoverReceiptByIdentity(key,reader,options){key=immutableSnapshot({source:key.source,id:key.id,consumerRef:key.consumerRef,targetScope:key.targetScope});if(Object.values(key).some(part=>typeof part!=="string"||part.length===0)){throw new CoreError("INVALID_CONFIGURATION")}return boundedOperation(options,async signal=>{const raw=await reader.readByIdentity(key,signal);assertNotAborted(signal);if(!raw)return{status:"WAIT",receipt:null};const receipt=immutableSnapshot(parseBusinessReceipt6(raw));if(receipt.originSource!==key.source||receipt.originEventId!==key.id||receipt.consumerRef!==key.consumerRef||receipt.targetScope!==key.targetScope){throw new CoreError("RECEIPT_MISMATCH")}return{status:receipt.disposition==="APPLIED"||receipt.disposition==="REJECTED"?"RESOLVED":"WAIT",receipt}})}async function stageEventLogPage(cursor,limit,source,checkpoint,options){if(!Number.isSafeInteger(limit)||limit<1||limit>1e3)throw new CoreError("INVALID_CONFIGURATION");return boundedOperation(options,async signal=>{const page=immutableSnapshot(await source.readAfter(cursor,limit,signal));if(page.kind==="GAP"){await checkpoint.recordGap(cursor,page.oldestAvailableCursor,signal);return"GAP"}if(page.items.length>limit||page.items.length>0&&page.nextCursor===cursor||page.items.some(item=>!item.revision||!item.commitEvidenceRef||!item.cursor)){throw new CoreError("INVALID_CONFIGURATION")}await checkpoint.stageAndAdvance(cursor,page,signal);return"PAGE"})}import{canonicalJson as canonicalJson7}from"@eventsdk/sdk/contracts";async function recoverGap(source,scope,expectedWatermark,port,options){return boundedOperation(options,async signal=>{const raw=await port.readAuthorized(source,scope,signal);assertNotAborted(signal);const snapshot=immutableSnapshot(raw);if(!snapshot)throw new CoreError("RECOVERY_REQUIRED");if(snapshot.source!==source||snapshot.scope!==scope||[snapshot.source,snapshot.scope,snapshot.revision,snapshot.watermark,snapshot.evidenceRef].some(reference=>typeof reference!=="string"||reference.length===0))throw new CoreError("RESULT_MISMATCH");canonicalJson7(snapshot.value);assertNotAborted(signal);await port.applyAndCheckpoint(expectedWatermark,snapshot,signal);assertNotAborted(signal);return snapshot})}async function replayDeadLetter(entry,port,authorization,options){entry=immutableSnapshot(entry);return boundedOperation(options,signal=>port.transactReplay(entry,async(tx,claim)=>{if(inboxKey(entry.key)!==inboxKey(claim.key)||entry.originalDeliveryRef!==claim.deliveryRef){throw new CoreError("RECEIPT_MISMATCH")}if(claim.receipt.disposition==="UNKNOWN")throw new CoreError("RECOVERY_REQUIRED");if(claim.receipt.disposition==="APPLIED"||claim.receipt.disposition==="REJECTED"){throw new CoreError("INVALID_TRANSITION")}const decision=await authorization.authorizeInTransaction(tx,{phase:"APPLY",event:claim.event,origin:claim.origin,consumerRef:claim.key.consumerRef,targetScope:claim.key.targetScope,signal});if(authorizedScope(claim.event,decision)!==claim.key.targetScope)throw new CoreError("TARGET_SCOPE_CHANGED");await port.requeueInTransaction(tx,claim,signal)},signal))}async function observeDeliveryHealth(port,sink,options){const health=await boundedOperation(options,signal=>port.read(signal));if(!Number.isFinite(health.observedAt)||health.oldestPendingAt!==null&&!Number.isFinite(health.oldestPendingAt)){throw new CoreError("INVALID_CONFIGURATION")}const gauges={outbox_pending:health.outboxPending,outbox_oldest_age_ms:health.oldestPendingAt===null?0:Math.max(0,health.observedAt-health.oldestPendingAt),consumer_lag:health.consumerLag,retry_pending:health.retryPending,quarantined:health.quarantined,unresolved_receipts:health.unresolvedReceipts,gaps:health.gaps,authorization_denials:health.authorizationDenials};if(health.brokerStoredBytes!==void 0)gauges.broker_stored_bytes=health.brokerStoredBytes;if(health.brokerQuotaBytes!==void 0)gauges.broker_quota_bytes=health.brokerQuotaBytes;if(health.bridgeUnconfirmed!==void 0)gauges.bridge_unconfirmed=health.bridgeUnconfirmed;if(Object.values(gauges).some(value=>!Number.isFinite(value)||value<0))throw new CoreError("INVALID_CONFIGURATION");for(const[name,value]of Object.entries(gauges))sink.gauge(`eventsdk_${name}`,value);return health}import{parseBusinessReceipt as parseBusinessReceipt7}from"@eventsdk/sdk/contracts";function assertCorrelated(claim,receipt){if(receipt.receiptRef!==claim.receipt.receiptRef||receipt.revision<claim.receipt.revision||(claim.receipt.disposition==="APPLIED"||claim.receipt.disposition==="REJECTED")&&receipt.disposition!==claim.receipt.disposition||receipt.originSource!==claim.key.source||receipt.originEventId!==claim.key.id||receipt.consumerRef!==claim.key.consumerRef||receipt.targetScope!==claim.key.targetScope||receipt.deliveryRef!==claim.deliveryRef)throw new CoreError("RECEIPT_MISMATCH")}async function quarantineWork(claim,deps,reasonCode,signal){await deps.deadLetters.quarantine(claim,{ref:deps.ids.next(),key:claim.key,originalDeliveryRef:claim.deliveryRef,reasonCode,attempts:claim.attempt,recordedAt:new Date(deps.clock.now()).toISOString()},signal);return"QUARANTINED"}async function reconcileWork(claim,deps,options){return boundedOperation({timeoutMs:options.timeoutMs},async signal=>{const raw=await deps.receipts.readReceipt(claim.key,signal);if(!raw)throw new CoreError("RECOVERY_REQUIRED");const receipt=immutableSnapshot(parseBusinessReceipt7(raw));assertCorrelated(claim,receipt);if(receipt.disposition==="APPLIED"||receipt.disposition==="REJECTED")return receipt.disposition;const current={...claim,receipt};if(receipt.disposition==="UNKNOWN")return quarantineWork(current,deps,"OUTCOME_UNKNOWN_READBACK_REQUIRED",signal);const retry=decideRetry(claim.attempt,deps.clock.now(),options.retry,deps.random);if(retry.kind==="EXHAUSTED")return quarantineWork(current,deps,"RETRY_EXHAUSTED",signal);await deps.work.defer(claim.key,claim.lease,receipt,retry.nextAttemptAt,"APPLY_NOT_TERMINAL",signal);return"RETRY"})}async function runClaim(claim,deps,options){try{assertLiveLease(claim.lease,deps.clock.now());if(claim.receipt.disposition==="RECEIVED"||claim.receipt.disposition==="HOLD"){try{await boundedOperation(options,signal=>deps.process(claim,{timeoutMs:options.timeoutMs,signal}))}catch{}}return await reconcileWork(claim,deps,options)}catch{return"UNRESOLVED"}}async function runInboxWorker(deps,options){if(!Number.isSafeInteger(options.batchSize)||options.batchSize<1||options.batchSize>1e3||!Number.isFinite(options.leaseMs)||options.leaseMs<=options.timeoutMs)throw new CoreError("INVALID_CONFIGURATION");const claims=immutableSnapshot(await boundedOperation(options,signal=>deps.work.claimReady({limit:options.batchSize,now:deps.clock.now(),leaseMs:options.leaseMs,signal})));if(claims.length>options.batchSize)throw new CoreError("INVALID_CONFIGURATION");const summary={APPLIED:0,REJECTED:0,RETRY:0,QUARANTINED:0,UNRESOLVED:0};for(const claim of claims){assertNotAborted(options.signal);if(!Number.isSafeInteger(claim.attempt)||claim.attempt<1)throw new CoreError("INVALID_CONFIGURATION");summary[await runClaim(claim,deps,options)]+=1}return summary}import{parseCloudEvent as parseCloudEvent4,parseFanoutEventDraft as parseFanoutEventDraft2}from"@eventsdk/sdk/contracts";async function prepareFanoutDelivery(input,route,digest){const fact=immutableSnapshot(parseFanoutEventDraft2(input));const keys=Object.keys(route);if(keys.length!==4||keys.some(k=>!["audience","connectionref","grantref","grantversion"].includes(k)))throw new CoreError("INVALID_CONFIGURATION");const draft={...fact,...immutableSnapshot(route)};const event=parseCloudEvent4({...draft,deliveryid:await deriveDeliveryId(draft,digest)});if(event.profile!=="eventsdk/1.2")throw new CoreError("INVALID_CONFIGURATION");return event}async function recordFanoutEvent(tx,draft,recipients,deps,options){const fact=immutableSnapshot(parseFanoutEventDraft2(draft));const targets=immutableSnapshot(recipients);if(targets.length<1||targets.length>1e3)throw new CoreError("INVALID_CONFIGURATION");if(!deps.outbox.recordFanoutInTransaction)throw new CoreError("ADAPTER_CAPABILITY_REQUIRED");return boundedOperation(options,async signal=>{const events=[];const deliveryIds=new Set;for(const target of targets){signal.throwIfAborted();const event=await prepareFanoutDelivery(fact,target.route,deps.digest);if(deliveryIds.has(event.deliveryid))throw new CoreError("INVALID_CONFIGURATION");deliveryIds.add(event.deliveryid);events.push(event)}for(const[index,target]of targets.entries()){const event=events[index];if(!event)throw new CoreError("INVALID_CONFIGURATION");await recordEvent(tx,event,target.origin,deps,{...options,signal})}return events})}import{canonicalJson as canonicalJson8,parseTenantContext}from"@eventsdk/sdk/contracts";async function deriveExchangeConnectionRef(input,digest){const from=parseTenantContext(input.from),to=parseTenantContext(input.to);try{if(new URL(input.source).href.length>2048)throw new Error("source")}catch{throw new CoreError("INVALID_CONFIGURATION")}return`urn:eventsdk:connection:${await digest.sha256(canonicalJson8(["eventsdk-native-connection/1",input.source,from,to]))}`}import{parseOutboxRecoveryCommand}from"@eventsdk/sdk/contracts";async function authorizeOutboxRecovery(command,stored,deps,options){const record=immutableSnapshot(stored),input=immutableSnapshot(parseOutboxRecoveryCommand(command));return boundedOperation(options,async signal=>{const event=record.event;if(event.source!==input.source||event.id!==input.id||event.deliveryid!==input.deliveryid||record.status!=="HOLD"||record.generation!==input.expectedGeneration)throw new CoreError("RECOVERY_REQUIRED");await assertDeliveryIdentity(event,deps.digest);if(await eventDigest(event,deps.digest)!==record.digest)throw new CoreError("EVENT_ID_CONFLICT");const origin=await refreshOrigin(event,record.origin,deps.clock,signal,deps.originRefresh);const scope=authorizedScope(event,await deps.authorization.authorize({phase:"OUTBOUND",event,origin,signal}));if(scope!==event.sourcetenant)throw new CoreError("TARGET_SCOPE_CHANGED");return immutableSnapshot({event,digest:record.digest,generation:record.generation,origin,targetScope:scope})})}import{parseGapBaseline}from"@eventsdk/sdk/contracts";function assertGapBaselineBinding(event,value,targetScope){const baseline=parseGapBaseline(value);if(event.profile!=="eventsdk/1.2"||event.kind!=="EVENT"||baseline.source!==event.source||baseline.sourceTenant!==event.sourcetenant||baseline.targetService!==event.audience||baseline.connectionRef!==event.connectionref||baseline.grantRef!==event.grantref||baseline.grantVersion!==event.grantversion||baseline.createdAt!==event.time||targetScope!==void 0&&baseline.targetTenant!==targetScope)throw new CoreError("RESULT_MISMATCH")}export{CoreError,acceptDelivery,applyDelivery,assertDeliveryIdentity,assertGapBaselineBinding,assertLiveLease,assertNotAborted,assertReceiptTransition,authorizeOutboxRecovery,boundedOperation,classifyReceiptCommit,decideRetry,deriveDeliveryId,deriveExchangeConnectionRef,eventDigest,eventMessageId,fanoutLogicalEvent,inboxKey,logicalEventDigest,observeDeliveryHealth,prepareFanoutDelivery,readAuthorizedResult,recordEvent,recordFanoutEvent,recoverGap,recoverReceipt,recoverReceiptByIdentity,relayOutbox,replayDeadLetter,runInboxWorker,stageEventLogPage};

package/dist/core/outbox/authorize-recovery.d.ts

@@ -0,0 +1,75 @@
+import { type CloudEventV12, type OutboxRecoveryCommand } from '@eventsdk/sdk/contracts';
+import type { AuthorizationPort } from '@eventsdk/sdk/identity-contracts';
+import type { OutboxRecord } from '../ports/outbox.js';
+import type { OriginRefreshPort } from '../ports/origin-refresh.js';
+import type { Clock, Digest, OperationOptions } from '../runtime/dependencies.js';
+export interface HeldOutboxRecord extends OutboxRecord {
+    readonly event: CloudEventV12;
+    readonly status: string;
+    readonly generation: number;
+}
+export declare function authorizeOutboxRecovery(command: OutboxRecoveryCommand, stored: HeldOutboxRecord, deps: {
+    authorization: AuthorizationPort;
+    originRefresh: OriginRefreshPort;
+    clock: Clock;
+    digest: Digest;
+}, options: OperationOptions): Promise<{
+    event: {
+        readonly specversion: "1.0";
+        readonly id: string;
+        readonly source: string;
+        readonly type: string;
+        readonly time: string;
+        readonly dataschema: string;
+        readonly datacontenttype: "application/json";
+        readonly profile: "eventsdk/1.2";
+        readonly kind: "EVENT";
+        readonly serviceorigin: string;
+        readonly sourcetenant: string;
+        readonly audience: string;
+        readonly connectionref: string;
+        readonly grantref: string;
+        readonly grantversion: number;
+        readonly correlationid: string;
+        readonly causationid?: string;
+        readonly subject?: string;
+        readonly data: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | {
+            readonly [x: string]: string | number | boolean | any | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null)[] | {
+            readonly [x: string]: string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | readonly (string | number | boolean | any | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null)[] | any | null;
+        } | null;
+        readonly orgnamespace?: string;
+        readonly orgref?: string;
+        readonly projectnamespace?: string;
+        readonly projectref?: string;
+        readonly principalnamespace?: string;
+        readonly principalref?: string;
+        readonly resourcenamespace?: string;
+        readonly resourceref?: string;
+        readonly deliveryid: string;
+    };
+    digest: string;
+    generation: number;
+    origin: import("@eventsdk/sdk/identity-contracts").VerifiedOrigin;
+    targetScope: string;
+}>;

package/dist/core/outbox/outbox-relay.d.ts

@@ -0,0 +1,26 @@
+import type { AuthorizationPort } from '@eventsdk/sdk/identity-contracts';
+import type { OutboxRelayPort } from '../ports/outbox.js';
+import type { PublishPort } from '../ports/transport.js';
+import type { Clock, Digest, OperationOptions, Random } from '../runtime/dependencies.js';
+import type { OriginRefreshPort } from '../ports/origin-refresh.js';
+import { type RetryPolicy } from '../runtime/retry.js';
+export interface RelayDependencies {
+    readonly outbox: OutboxRelayPort;
+    readonly publisher: PublishPort;
+    readonly authorization: AuthorizationPort;
+    readonly clock: Clock;
+    readonly digest: Digest;
+    readonly random: Random;
+    readonly originRefresh?: OriginRefreshPort;
+}
+export interface RelayOptions extends OperationOptions {
+    readonly batchSize: number;
+    readonly leaseMs: number;
+    readonly retry: RetryPolicy;
+}
+export interface RelaySummary {
+    readonly published: number;
+    readonly unknown: number;
+    readonly held: number;
+}
+export declare function relayOutbox(deps: RelayDependencies, options: RelayOptions): Promise<RelaySummary>;

package/dist/core/outbox/record-event.d.ts

@@ -0,0 +1,10 @@
+import type { AuthorizationPort, VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+import type { OutboxRecordPort } from '../ports/outbox.js';
+import type { Clock, Digest, OperationOptions } from '../runtime/dependencies.js';
+export interface RecordDependencies<TTransaction> {
+    readonly outbox: OutboxRecordPort<TTransaction>;
+    readonly authorization: AuthorizationPort;
+    readonly digest: Digest;
+    readonly clock: Clock;
+}
+export declare function recordEvent<TTransaction>(tx: TTransaction, input: unknown, origin: VerifiedOrigin, dependencies: RecordDependencies<TTransaction>, options: OperationOptions): Promise<void>;

package/dist/core/outbox/record-fanout.d.ts

@@ -0,0 +1,16 @@
+import { type CloudEventV12 } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+import type { Digest, OperationOptions } from '../runtime/dependencies.js';
+import { type RecordDependencies } from './record-event.js';
+export interface FanoutRoute {
+    readonly audience: string;
+    readonly connectionref: string;
+    readonly grantref: string;
+    readonly grantversion: number;
+}
+export interface FanoutRecipient {
+    readonly route: FanoutRoute;
+    readonly origin: VerifiedOrigin;
+}
+export declare function prepareFanoutDelivery(input: unknown, route: FanoutRoute, digest: Digest): Promise<CloudEventV12>;
+export declare function recordFanoutEvent<T>(tx: T, draft: unknown, recipients: readonly FanoutRecipient[], deps: RecordDependencies<T>, options: OperationOptions): Promise<readonly CloudEventV12[]>;

package/dist/core/ports/dead-letter.d.ts

@@ -0,0 +1,29 @@
+import type { BusinessReceipt } from '@eventsdk/sdk/contracts';
+import type { ClaimedInbox } from './inbox.js';
+import type { InboxKey } from '../runtime/event-identity.js';
+import type { Lease } from '../runtime/lease.js';
+export interface DeadLetterEntry {
+    readonly ref: string;
+    readonly key: InboxKey;
+    readonly originalDeliveryRef: string;
+    readonly reasonCode: string;
+    readonly attempts: number;
+    readonly recordedAt: string;
+}
+export interface DeadLetterPort<TTransaction> {
+    quarantine(claim: ClaimedInbox, entry: DeadLetterEntry, signal: AbortSignal): Promise<void>;
+    transactReplay(entry: DeadLetterEntry, operation: (tx: TTransaction, claim: ClaimedInbox) => Promise<void>, signal: AbortSignal): Promise<void>;
+    requeueInTransaction(tx: TTransaction, claim: ClaimedInbox, signal: AbortSignal): Promise<void>;
+}
+export interface InboxWorkClaim extends ClaimedInbox {
+    readonly attempt: number;
+}
+export interface InboxWorkPort {
+    claimReady(input: {
+        limit: number;
+        now: number;
+        leaseMs: number;
+        signal: AbortSignal;
+    }): Promise<readonly InboxWorkClaim[]>;
+    defer(key: InboxKey, lease: Lease, expectedReceipt: Pick<BusinessReceipt, 'receiptRef' | 'revision' | 'disposition'>, nextAttemptAt: number, reasonCode: string, signal: AbortSignal): Promise<void>;
+}

package/dist/core/ports/inbox.d.ts

@@ -0,0 +1,43 @@
+import type { BusinessReceipt, CloudEvent } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+import type { InboxKey } from '../runtime/event-identity.js';
+import type { Lease } from '../runtime/lease.js';
+import type { DomainApplyOutcome } from '../inbox/domain-apply-result.js';
+export interface AcceptedEvent {
+    readonly key: InboxKey;
+    readonly event: CloudEvent;
+    readonly origin: VerifiedOrigin;
+    readonly digest: string;
+    readonly deliveryRef: string;
+    readonly receipt: BusinessReceipt;
+}
+export type PersistResult = {
+    readonly kind: 'RECEIVED' | 'DUPLICATE';
+    readonly receipt: BusinessReceipt;
+} | {
+    readonly kind: 'CONFLICT';
+};
+export interface QuarantineRecord {
+    readonly deliveryRef: string;
+    readonly consumerRef: string;
+    readonly reasonCode: string;
+    readonly recordedAt: string;
+}
+export interface FanoutAcceptedEvent extends AcceptedEvent {
+    readonly logicalDigest: string;
+    readonly deliveryId: string;
+}
+export interface InboxAdmissionPort {
+    persistFanoutAccepted?(record: FanoutAcceptedEvent, signal: AbortSignal): Promise<PersistResult>;
+    persistAccepted(record: AcceptedEvent, signal: AbortSignal): Promise<PersistResult>;
+    persistQuarantine(record: QuarantineRecord, signal: AbortSignal): Promise<void>;
+}
+export interface ClaimedInbox extends AcceptedEvent {
+    readonly lease: Lease;
+}
+export interface InboxApplyPort<TTransaction> {
+    transact(claim: ClaimedInbox, operation: (tx: TTransaction) => Promise<BusinessReceipt>, signal: AbortSignal): Promise<BusinessReceipt>;
+    withDomainSavepoint?(tx: TTransaction, operation: () => Promise<DomainApplyOutcome>, signal: AbortSignal): Promise<DomainApplyOutcome>;
+    completeInTransaction(tx: TTransaction, claim: ClaimedInbox, receipt: BusinessReceipt, signal: AbortSignal): Promise<void>;
+    readReceipt(key: InboxKey, signal: AbortSignal): Promise<BusinessReceipt | null>;
+}

package/dist/core/ports/observability.d.ts

@@ -0,0 +1,21 @@
+export interface DeliveryHealth {
+    readonly observedAt: number;
+    readonly outboxPending: number;
+    readonly oldestPendingAt: number | null;
+    readonly consumerLag: number;
+    readonly retryPending: number;
+    readonly quarantined: number;
+    readonly unresolvedReceipts: number;
+    readonly gaps: number;
+    readonly authorizationDenials: number;
+    readonly watermark: string;
+    readonly brokerStoredBytes?: number;
+    readonly brokerQuotaBytes?: number;
+    readonly bridgeUnconfirmed?: number;
+}
+export interface DeliveryHealthPort {
+    read(signal: AbortSignal): Promise<DeliveryHealth>;
+}
+export interface HealthMetricSink {
+    gauge(name: string, value: number): void;
+}

package/dist/core/ports/origin-refresh.d.ts

@@ -0,0 +1,5 @@
+import type { CloudEvent } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+export interface OriginRefreshPort {
+    refresh(event: CloudEvent, previous: VerifiedOrigin, signal: AbortSignal): Promise<VerifiedOrigin>;
+}

package/dist/core/ports/outbox.d.ts

@@ -0,0 +1,46 @@
+import type { CloudEvent } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+import type { EventIdentity } from '../runtime/event-identity.js';
+import type { Lease } from '../runtime/lease.js';
+import type { PublishAck } from './transport.js';
+export interface OutboxRecord {
+    readonly event: CloudEvent;
+    readonly digest: string;
+    readonly origin: VerifiedOrigin;
+}
+export interface ClaimedEvent extends OutboxRecord {
+    readonly lease: Lease;
+    readonly attempt: number;
+}
+export type PublishOutcome = {
+    readonly status: 'PUBLISHED';
+    readonly ack: PublishAck;
+} | {
+    readonly status: 'UNKNOWN';
+    readonly nextAttemptAt: number;
+} | {
+    readonly status: 'HOLD';
+    readonly reasonCode: string;
+};
+export interface FanoutOutboxRecord extends OutboxRecord {
+    readonly logicalDigest: string;
+    readonly deliveryId: string;
+}
+export interface OutboxRecordPort<TTransaction> {
+    recordFanoutInTransaction?(tx: TTransaction, record: FanoutOutboxRecord, signal: AbortSignal): Promise<void>;
+    recordInTransaction(tx: TTransaction, record: OutboxRecord, signal: AbortSignal): Promise<void>;
+}
+export interface OutboxRelayPort {
+    settleFanoutPublish?(identity: EventIdentity & {
+        readonly deliveryid: string;
+    }, lease: Lease, outcome: PublishOutcome, signal: AbortSignal): Promise<void>;
+    claimReady(input: {
+        limit: number;
+        now: number;
+        leaseMs: number;
+        signal: AbortSignal;
+    }): Promise<readonly ClaimedEvent[]>;
+    settlePublish(identity: EventIdentity, lease: Lease, outcome: PublishOutcome, signal: AbortSignal): Promise<void>;
+}
+export interface OutboxPort<TTransaction> extends OutboxRecordPort<TTransaction>, OutboxRelayPort {
+}

package/dist/core/ports/result-reader.d.ts

@@ -0,0 +1,14 @@
+import type { CloudEvent, JsonValue, ResultRef } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+export interface ResultSnapshot {
+    readonly reference: ResultRef;
+    readonly value: JsonValue;
+}
+export interface ResultReadPort {
+    read(reference: ResultRef, context: {
+        event: CloudEvent;
+        origin: VerifiedOrigin;
+        targetScope: string;
+        signal: AbortSignal;
+    }): Promise<ResultSnapshot | null>;
+}

package/dist/core/ports/transport.d.ts

@@ -0,0 +1,13 @@
+import type { CloudEvent } from '@eventsdk/sdk/contracts';
+export interface PublishAck {
+    readonly stream: string;
+    readonly sequence: number;
+    readonly duplicate: boolean;
+}
+export interface PublishContext {
+    readonly messageId: string;
+    readonly signal: AbortSignal;
+}
+export interface PublishPort {
+    publish(event: CloudEvent, context: PublishContext): Promise<PublishAck>;
+}

package/dist/core/receipt/receipt-state.d.ts

@@ -0,0 +1,3 @@
+import { type BusinessReceipt } from '@eventsdk/sdk/contracts';
+export declare function assertReceiptTransition(previous: BusinessReceipt, next: BusinessReceipt): void;
+export declare function classifyReceiptCommit(previous: BusinessReceipt, next: BusinessReceipt): 'UNCHANGED' | 'TRANSITION';

package/dist/core/recovery/event-log.d.ts

@@ -0,0 +1,28 @@
+import type { CloudEvent } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+import type { OperationOptions } from '../runtime/dependencies.js';
+export interface EventLogItem {
+    readonly cursor: string;
+    readonly revision: string;
+    readonly commitEvidenceRef: string;
+    readonly event: CloudEvent;
+    readonly origin: VerifiedOrigin;
+}
+export type EventLogPage = {
+    readonly kind: 'PAGE';
+    readonly items: readonly EventLogItem[];
+    readonly nextCursor: string;
+} | {
+    readonly kind: 'GAP';
+    readonly oldestAvailableCursor: string;
+};
+export interface NativeEventLogPort {
+    readAfter(cursor: string, limit: number, signal: AbortSignal): Promise<EventLogPage>;
+}
+export interface EventLogCheckpointPort {
+    stageAndAdvance(expectedCursor: string, page: Extract<EventLogPage, {
+        kind: 'PAGE';
+    }>, signal: AbortSignal): Promise<void>;
+    recordGap(expectedCursor: string, oldestAvailableCursor: string, signal: AbortSignal): Promise<void>;
+}
+export declare function stageEventLogPage(cursor: string, limit: number, source: NativeEventLogPort, checkpoint: EventLogCheckpointPort, options: OperationOptions): Promise<EventLogPage['kind']>;

package/dist/core/recovery/gap-baseline-binding.d.ts

@@ -0,0 +1,2 @@
+import type { CloudEvent, GapBaseline } from '@eventsdk/sdk/contracts';
+export declare function assertGapBaselineBinding(event: CloudEvent, value: GapBaseline, targetScope?: string): void;

package/dist/core/recovery/gap-recovery.d.ts

@@ -0,0 +1,15 @@
+import { type JsonValue } from '@eventsdk/sdk/contracts';
+import type { OperationOptions } from '../runtime/dependencies.js';
+export interface AuthorizedSnapshot {
+    readonly source: string;
+    readonly scope: string;
+    readonly revision: string;
+    readonly watermark: string;
+    readonly evidenceRef: string;
+    readonly value: JsonValue;
+}
+export interface SnapshotRecoveryPort {
+    readAuthorized(source: string, scope: string, signal: AbortSignal): Promise<AuthorizedSnapshot | null>;
+    applyAndCheckpoint(expectedWatermark: string, snapshot: AuthorizedSnapshot, signal: AbortSignal): Promise<void>;
+}
+export declare function recoverGap(source: string, scope: string, expectedWatermark: string, port: SnapshotRecoveryPort, options: OperationOptions): Promise<AuthorizedSnapshot>;

package/dist/core/recovery/receipt-identity-recovery.d.ts

@@ -0,0 +1,8 @@
+import { type BusinessReceipt } from '@eventsdk/sdk/contracts';
+import type { InboxKey } from '../runtime/event-identity.js';
+import type { OperationOptions } from '../runtime/dependencies.js';
+import type { RecoveryObservation } from './receipt-recovery.js';
+export interface ReceiptIdentityLookupPort {
+    readByIdentity(key: InboxKey, signal: AbortSignal): Promise<BusinessReceipt | null>;
+}
+export declare function recoverReceiptByIdentity(key: InboxKey, reader: ReceiptIdentityLookupPort, options: OperationOptions): Promise<RecoveryObservation>;

package/dist/core/recovery/receipt-recovery.d.ts

@@ -0,0 +1,14 @@
+import { type BusinessReceipt } from '@eventsdk/sdk/contracts';
+import type { InboxKey } from '../runtime/event-identity.js';
+import type { OperationOptions } from '../runtime/dependencies.js';
+export interface ReceiptLookupPort {
+    read(key: InboxKey, deliveryRef: string, signal: AbortSignal): Promise<BusinessReceipt | null>;
+}
+export type RecoveryObservation = {
+    readonly status: 'RESOLVED';
+    readonly receipt: BusinessReceipt;
+} | {
+    readonly status: 'WAIT';
+    readonly receipt: BusinessReceipt | null;
+};
+export declare function recoverReceipt(key: InboxKey, deliveryRef: string, reader: ReceiptLookupPort, options: OperationOptions): Promise<RecoveryObservation>;

package/dist/core/recovery/replay-dead-letter.d.ts

@@ -0,0 +1,4 @@
+import type { DeadLetterEntry, DeadLetterPort } from '../ports/dead-letter.js';
+import type { ApplyAuthorizationPort } from '../inbox/apply-delivery.js';
+import type { OperationOptions } from '../runtime/dependencies.js';
+export declare function replayDeadLetter<T>(entry: DeadLetterEntry, port: DeadLetterPort<T>, authorization: ApplyAuthorizationPort<T>, options: OperationOptions): Promise<void>;

package/dist/core/runtime/dependencies.d.ts

@@ -0,0 +1,19 @@
+export interface Clock {
+    now(): number;
+}
+export interface IdGenerator {
+    next(): string;
+}
+export interface Digest {
+    sha256(value: string): Promise<string>;
+}
+export interface Random {
+    next(): number;
+}
+export interface OperationOptions {
+    signal?: AbortSignal;
+    timeoutMs: number;
+}
+export interface MetricSink {
+    increment(name: string, labels: Readonly<Record<string, string>>): void;
+}

package/dist/core/runtime/errors.d.ts

@@ -0,0 +1,6 @@
+export type CoreErrorCode = 'ABORTED' | 'TIMEOUT' | 'INVALID_CONFIGURATION' | 'INVALID_DOMAIN_RESULT' | 'ADAPTER_CAPABILITY_REQUIRED' | 'STALE_LEASE' | 'EVENT_ID_CONFLICT' | 'AUTHORIZATION_DENIED' | 'AUTHORIZATION_UNKNOWN' | 'ORIGIN_MISMATCH' | 'TARGET_SCOPE_CHANGED' | 'RESULT_MISMATCH' | 'RECEIPT_MISMATCH' | 'RECOVERY_REQUIRED' | 'GAP' | 'INVALID_TRANSITION';
+export declare class CoreError extends Error {
+    readonly code: CoreErrorCode;
+    constructor(code: CoreErrorCode);
+}
+export declare function assertNotAborted(signal?: AbortSignal): void;

package/dist/core/runtime/event-identity.d.ts

@@ -0,0 +1,14 @@
+import { type CloudEvent } from '@eventsdk/sdk/contracts';
+import type { Digest } from './dependencies.js';
+export interface EventIdentity {
+    readonly source: string;
+    readonly id: string;
+    readonly deliveryid?: string;
+}
+export interface InboxKey extends EventIdentity {
+    readonly consumerRef: string;
+    readonly targetScope: string;
+}
+export declare function eventMessageId(event: EventIdentity, digest: Digest): Promise<string>;
+export declare function eventDigest(event: CloudEvent, digest: Digest): Promise<string>;
+export declare function inboxKey(key: InboxKey): string;

package/dist/core/runtime/exchange-connection.d.ts

@@ -0,0 +1,7 @@
+import { type TenantContext } from '@eventsdk/sdk/contracts';
+import type { Digest } from './dependencies.js';
+export declare function deriveExchangeConnectionRef(input: {
+    source: string;
+    from: TenantContext;
+    to: TenantContext;
+}, digest: Digest): Promise<string>;

package/dist/core/runtime/fanout-identity.d.ts

@@ -0,0 +1,6 @@
+import { type CloudEvent, type CloudEventV12, type FanoutEventDraft } from '@eventsdk/sdk/contracts';
+import type { Digest } from './dependencies.js';
+export declare function fanoutLogicalEvent(event: CloudEventV12): FanoutEventDraft;
+export declare function logicalEventDigest(event: CloudEvent, digest: Digest): Promise<string>;
+export declare function deriveDeliveryId(event: Pick<CloudEventV12, 'source' | 'id' | 'audience' | 'connectionref'>, digest: Digest): Promise<string>;
+export declare function assertDeliveryIdentity(event: CloudEvent, digest: Digest): Promise<void>;

package/dist/core/runtime/lease.d.ts

@@ -0,0 +1,6 @@
+export interface Lease {
+    readonly token: string;
+    readonly generation: number;
+    readonly expiresAt: number;
+}
+export declare function assertLiveLease(lease: Lease, now: number): void;

package/dist/core/runtime/observe-health.d.ts

@@ -0,0 +1,3 @@
+import type { DeliveryHealth, DeliveryHealthPort, HealthMetricSink } from '../ports/observability.js';
+import type { OperationOptions } from './dependencies.js';
+export declare function observeDeliveryHealth(port: DeliveryHealthPort, sink: HealthMetricSink, options: OperationOptions): Promise<DeliveryHealth>;

package/dist/core/runtime/operation.d.ts

@@ -0,0 +1,2 @@
+import type { OperationOptions } from './dependencies.js';
+export declare function boundedOperation<T>(options: OperationOptions, operation: (signal: AbortSignal) => Promise<T>): Promise<T>;

package/dist/core/runtime/retry.d.ts

@@ -0,0 +1,14 @@
+import type { Random } from './dependencies.js';
+export interface RetryPolicy {
+    readonly maxAttempts: number;
+    readonly baseDelayMs: number;
+    readonly maxDelayMs: number;
+    readonly jitterRatio: number;
+}
+export type RetryDecision = {
+    readonly kind: 'RETRY';
+    readonly nextAttemptAt: number;
+} | {
+    readonly kind: 'EXHAUSTED';
+};
+export declare function decideRetry(attempt: number, now: number, policy: RetryPolicy, random: Random): RetryDecision;

package/dist/event-link/errors.d.ts

@@ -0,0 +1,5 @@
+export declare class EventLinkProtocolError extends Error {
+    readonly code: 'INVALID' | 'FORBIDDEN' | 'EXPIRED' | 'CHANGED' | 'CONFLICT' | 'CODE_INVALID' | 'UNKNOWN';
+    constructor(code: 'INVALID' | 'FORBIDDEN' | 'EXPIRED' | 'CHANGED' | 'CONFLICT' | 'CODE_INVALID' | 'UNKNOWN');
+}
+export declare function eventLinkInput<T>(parse: () => T): T;

package/dist/event-link/exchange.d.ts

@@ -0,0 +1,9 @@
+import { type EventLinkProposal } from '@eventsdk/sdk/contracts';
+import { type EventLinkSenderBinding } from './protocol.js';
+export interface EventLinkExchangeOptions {
+    readonly fetch?: typeof fetch;
+    readonly now?: () => number;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+}
+export declare function exchangeEventLinkCode(binding: EventLinkSenderBinding, code: string, options?: EventLinkExchangeOptions): Promise<EventLinkProposal>;

package/dist/event-link/index.d.ts

@@ -0,0 +1,12 @@
+export { EventLinkProtocolError } from './errors.js';
+export { EVENT_LINK_MAX_BYTES, createEventLinkVerifier, createEventLinkState, eventLinkChallenge, eventLinkHash, } from './primitives.js';
+export { assertEventLinkRegistration, eventLinkRegistrationRevision } from './registration.js';
+export type { EventLinkClientRegistration, EventLinkReceiverRegistration } from './registration.js';
+export { buildEventLinkAuthorizationUrl, parseEventLinkAuthorization, parseEventLinkToken, validateEventLinkCallback, validateEventLinkProposalBinding, } from './protocol.js';
+export type { EventLinkSenderBinding } from './protocol.js';
+export { exchangeEventLinkCode } from './exchange.js';
+export type { EventLinkExchangeOptions } from './exchange.js';
+export { planEventLinkCallback, continueEventLinkAuthorization } from './sender.js';
+export type { EventLinkSenderSnapshot, EventLinkSenderClaim, EventLinkSenderPort, } from './sender.js';
+export { EventLinkReceiver } from './receiver.js';
+export type { EventLinkConsent, EventLinkReceiverActor, EventLinkReceiverState, EventLinkReceiverRecord, EventLinkReceiverTransaction, EventLinkReceiverPort, } from './receiver-ports.js';