@fitchmultz/pi-subagents 0.46.2 → 0.48.0

package/dist/pi-intercom/bridge-launch.js

@@ -1,10 +1,12 @@
-import { createHash } from "node:crypto";
-import { statSync } from "node:fs";
 import { setTimeout as delay } from "node:timers/promises";
-import { loadNativeSession } from "../shared/native-session-loader.js";
 import { isRecord } from "../shared/unknown.js";
+import { launchCwd, spawnPolicy } from "./bridge-launch-policy.js";
 import { Fault, cancelled, log, wait } from "./bridge-protocol.js";
 import { RpcProcess } from "./bridge-rpc-process.js";
+import { exactPeer, savedView, browseSessions, } from "./bridge-catalog.js";
+import { createLaunchJournal, resumeLaunchJournal, validateLaunchState, } from "./bridge-launch-journal.js";
+import { spawnBrokerIfNeeded } from "./broker/spawn.js";
+import { resolveIntercomPresenceName } from "./identity.js";
 export function sameIdentity(left, right) {
     return (left.name === right?.name &&
         left.cwd === right.cwd &&
@@ -12,18 +14,27 @@ export function sameIdentity(left, right) {
 }
 function view(entry) {
     return {
-        sessionId: entry.sessionId,
-        peerId: entry.peerId,
+        id: entry.journal?.sessionId,
+        sessionId: entry.journal?.sessionId,
+        peerId: entry.journal?.peerId,
         name: entry.name,
-        sessionFile: entry.sessionFile,
+        cwd: entry.cwd,
+        sessionFile: entry.journal?.sessionFile,
         pid: entry.process?.pid,
         status: entry.process?.status ?? "starting",
         error: entry.process?.failure?.code,
+        saved: entry.journal !== undefined,
+        owned: true,
     };
 }
 export class Launcher {
     launches = new Set();
+    catalog;
+    resuming = new Set();
     stopping = false;
+    constructor(catalog) {
+        this.catalog = catalog;
+    }
     list(identity) {
         return {
             sessions: [...this.launches]
@@ -31,36 +42,175 @@ export class Launcher {
                 .map(view),
         };
     }
-    async stop(identity, sessionId) {
-        const entry = [...this.launches].find((candidate) => candidate.identity.fingerprint256 === identity.fingerprint256 &&
-            candidate.sessionId === sessionId);
-        if (!entry) {
-            throw new Fault(404, "unknown_session", "Session is not owned by this identity and helper.");
+    async browse(query, context) {
+        return browseSessions(this.catalog, query, {
+            policy: context.identity.launch,
+            signal: context.signal,
+            peers: context.peers,
+            activeState: (id) => {
+                const entry = this.active(id) ?? this.activePeer(id);
+                return entry?.identity.fingerprint256 === context.identity.fingerprint256
+                    ? (entry.process?.status ?? "starting")
+                    : undefined;
+            },
+        });
+    }
+    active(sessionId) {
+        return [...this.launches].find((entry) => entry.journal?.sessionId === sessionId && entry.process?.status !== "exited");
+    }
+    activePeer(peerId) {
+        return [...this.launches].find((entry) => entry.journal?.peerId === peerId && entry.process?.status !== "exited");
+    }
+    async owned(identity, id, context) {
+        const candidates = [...this.launches].filter((candidate) => candidate.identity.fingerprint256 === identity.fingerprint256);
+        const byId = candidates.findLast((candidate) => candidate.journal?.sessionId === id || candidate.journal?.peerId === id);
+        const named = candidates.filter((candidate) => candidate.process?.status !== "exited" &&
+            (candidate.name === id || candidate.name === `remote:${identity.name}:${id}`));
+        if (!byId && named.length > 1) {
+            throw new Fault(409, "ambiguous_session", "Multiple owned live processes match this name; use their native IDs.");
+        }
+        const entry = byId ?? named.at(0);
+        if (!entry?.process) {
+            throw new Fault(404, "unknown_session", "Control is available only for this identity's helper-owned subprocesses, not unrelated live peers or saved history.");
+        }
+        if (entry.process.status === "exited") {
+            const peers = await context.peers(context.signal);
+            if (peers.some((peer) => peer.id === entry.journal?.peerId)) {
+                throw new Fault(404, "unknown_session", "This journal has a newer live owner; the historical process is not current ownership.");
+            }
         }
+        return entry;
+    }
+    async stop(identity, sessionId, context) {
+        const entry = await this.owned(identity, sessionId, context);
         await this.retire(entry, new Fault(410, "session_stopped", "Session stopped by its owner."));
         return { session: view(entry) };
     }
+    async cancel(identity, sessionId, context) {
+        const entry = await this.owned(identity, sessionId, context);
+        if (!entry.admitted || entry.process?.status === "exited" || !entry.process) {
+            throw new Fault(409, "session_not_ready", "Only an admitted live owned session can be cancelled.");
+        }
+        const state = await entry.process.cancel(context.signal);
+        return { session: view(entry), cancelled: true, state, queuesPreserved: true };
+    }
     async start(name, context) {
+        return this.spawn({ name }, context, true);
+    }
+    async spawn(input, context, legacy = false) {
+        const policy = spawnPolicy(this.policy(context), input);
+        const cwd = legacy
+            ? context.identity.cwd
+            : launchCwd(policy, input.cwd ?? context.identity.cwd);
+        const name = `remote:${context.identity.name}:${input.name}`;
+        const existing = [...this.launches].find((entry) => entry.identity.fingerprint256 === context.identity.fingerprint256 &&
+            entry.name === name &&
+            entry.process?.status !== "exited");
+        const result = existing
+            ? this.reuseSpawn(existing, input, policy, cwd)
+            : await this.launch({ name, cwd }, context, policy);
+        return this.task(result, input.task, context);
+    }
+    reuseSpawn(entry, input, policy, cwd) {
+        if (entry.cwd !== cwd) {
+            throw new Fault(409, "cwd_conflict", "This live name already belongs to a different workspace.");
+        }
+        if (input.model !== undefined &&
+            (entry.journal?.model?.provider !== policy.provider ||
+                entry.journal?.model?.modelId !== policy.model)) {
+            throw new Fault(409, "model_conflict", "This live name already belongs to a different model selection; resume it without overriding history.");
+        }
+        return this.reuse(entry);
+    }
+    async resume(input, context) {
+        const policy = this.policy(context);
+        const selector = input.sessionId ?? input.target ?? `name:${input.name ?? ""}`;
+        if (this.resuming.has(selector)) {
+            throw new Fault(409, "launch_in_progress", "This resume selector is already starting.");
+        }
+        this.resuming.add(selector);
+        try {
+            const saved = await this.catalog.resolve(policy, input, context.signal);
+            launchCwd(policy, saved.cwd);
+            const owned = this.active(saved.sessionId);
+            if (owned) {
+                const result = this.reuse(owned);
+                const reused = owned.identity.fingerprint256 === context.identity.fingerprint256
+                    ? result
+                    : {
+                        ...result,
+                        session: {
+                            ...savedView(saved),
+                            peerId: saved.peerId,
+                            status: owned.process?.status,
+                        },
+                    };
+                return await this.task(reused, input.task, context);
+            }
+            await wait(spawnBrokerIfNeeded(process.execPath, []), context.signal);
+            const peer = exactPeer(saved, await context.peers(context.signal));
+            if (peer) {
+                return await this.task({ session: savedView(saved, peer), id: saved.sessionId, reused: true }, input.task, context);
+            }
+            // A different selector/identity may have completed catalog resolution during the peer lookup.
+            if (this.active(saved.sessionId)) {
+                throw new Fault(409, "launch_in_progress", "This native session is already starting.");
+            }
+            const result = await this.launch(saved, context, policy);
+            return await this.task(result, input.task, context);
+        }
+        finally {
+            this.resuming.delete(selector);
+        }
+    }
+    policy(context) {
         cancelled(context.signal);
         const policy = context.identity.launch;
         if (!policy || this.stopping) {
             throw new Fault(403, "launch_disabled", "Session launching is not enabled by local policy.");
         }
-        const fullName = `remote:${context.identity.name}:${name}`;
-        const existing = [...this.launches].find((entry) => entry.identity.fingerprint256 === context.identity.fingerprint256 &&
-            entry.name === fullName &&
-            entry.process?.status !== "exited");
-        if (existing) {
-            return this.reuse(existing);
+        return policy;
+    }
+    async task(result, task, context) {
+        const session = result.session;
+        if (task === undefined || !isRecord(session) || typeof session.peerId !== "string") {
+            return result;
+        }
+        try {
+            const receipt = await context.submit(session.peerId, task);
+            return { ...result, id: session.sessionId, task: { ...receipt, completed: false } };
+        }
+        catch (error) {
+            const fault = error instanceof Fault
+                ? error
+                : new Fault(503, "task_unconfirmed", "Task acceptance is unknown; inspect the session before retrying.");
+            throw new Fault(fault.status, fault.code, fault.message, {
+                ...fault.details,
+                session,
+                reused: result.reused,
+            });
         }
+    }
+    async launch(target, context, policy) {
         this.capacity(context.identity, policy);
         const entry = {
             identity: context.identity,
-            name: fullName,
+            name: target.name,
+            cwd: target.cwd,
             controller: new AbortController(),
             expires: context.expires,
             admitted: false,
         };
+        if (target.sessionId !== undefined &&
+            target.peerId !== undefined &&
+            target.sessionFile !== undefined) {
+            entry.journal = {
+                ...target,
+                sessionId: target.sessionId,
+                peerId: target.peerId,
+                sessionFile: target.sessionFile,
+            };
+        }
         this.launches.add(entry);
         try {
             return await this.establish(entry, policy, context);
@@ -72,15 +222,15 @@ export class Launcher {
             }
             throw error instanceof Fault
                 ? error
-                : new Fault(503, "launch_failed", "Pi startup failed; inspect the pinned local policy and resources.");
+                : new Fault(503, "launch_failed", "Pi startup failed; inspect local policy and resources.");
         }
     }
     reuse(entry) {
         if (entry.admitted &&
             (entry.process?.status === "idle" || entry.process?.status === "running")) {
-            return { session: view(entry), reused: true };
+            return { session: view(entry), id: entry.journal?.sessionId, reused: true };
         }
-        throw new Fault(409, "launch_in_progress", "This named session is starting or stopping; inspect sessions before retrying.");
+        throw new Fault(409, "launch_in_progress", "This session is starting or stopping; inspect sessions before retrying.");
     }
     capacity(identity, policy) {
         const active = [...this.launches].filter((entry) => entry.process?.status !== "exited");
@@ -95,52 +245,23 @@ export class Launcher {
             }
         }
     }
-    async journal(entry, policy) {
-        const { SessionManager } = await wait(loadNativeSession(policy.packageRoot), entry.controller.signal);
-        cancelled(entry.controller.signal);
-        const storage = statSync(policy.sessionDir);
-        if (!storage.isDirectory() ||
-            storage.uid !== process.getuid?.() ||
-            (storage.mode & 0o777) !== 0o700) {
-            throw new Fault(503, "storage_invalid", "Private launch storage is no longer valid.");
-        }
-        const previous = process.umask(0o077);
-        try {
-            const manager = SessionManager.create(entry.identity.cwd, policy.sessionDir);
-            manager.appendSessionInfo(entry.name);
-            manager.appendMessage({ role: "user", content: policy.context, timestamp: Date.now() });
-            entry.sessionId = manager.getSessionId();
-            entry.sessionFile = manager.getSessionFile();
-            entry.peerId = `pi-${createHash("sha256").update(entry.sessionId).digest("hex").slice(0, 32)}`;
-            if (entry.sessionFile === undefined || (statSync(entry.sessionFile).mode & 0o777) !== 0o600) {
-                throw new Fault(503, "journal_invalid", "Native journal was not privately persisted.");
-            }
-            const saved = SessionManager.open(entry.sessionFile, policy.sessionDir);
-            if (saved.getSessionId() !== entry.sessionId ||
-                saved.getSessionName() !== entry.name ||
-                saved.getCwd() !== entry.identity.cwd) {
-                throw new Fault(503, "journal_invalid", "Native journal identity did not persist.");
-            }
-        }
-        finally {
-            process.umask(previous);
-        }
-    }
     async establish(entry, policy, context) {
         const signal = AbortSignal.any([context.signal, entry.controller.signal]);
         const deadline = setTimeout(() => entry.controller.abort(new Fault(504, "launch_timeout", "Pi startup readiness deadline exceeded.")), policy.startupTimeoutMs);
         const abort = () => entry.controller.abort(new Fault(499, "launch_cancelled", "Session startup cancelled or exceeded its deadline."));
         signal.addEventListener("abort", abort, { once: true });
         try {
-            await this.journal(entry, policy);
+            const resuming = entry.journal !== undefined;
+            entry.journal = entry.journal
+                ? await resumeLaunchJournal(policy, entry.journal, signal)
+                : await createLaunchJournal(policy, { cwd: entry.cwd, name: entry.name ?? "" }, signal);
             cancelled(signal);
-            if (entry.sessionFile === undefined) {
-                throw new Fault(503, "journal_invalid", "Native journal path unavailable.");
-            }
-            entry.process = new RpcProcess(policy, entry.identity.cwd, entry.sessionFile);
+            entry.process = new RpcProcess(policy, entry.cwd, entry.journal.sessionFile, resuming);
             this.expiry(entry);
-            const state = await entry.process.state(signal);
-            this.validateState(entry, policy, state);
+            validateLaunchState(entry.journal, await entry.process.state(signal));
+            await wait(spawnBrokerIfNeeded(process.execPath, []).catch(() => {
+                throw new Fault(503, "broker_unavailable", "Local broker could not be acquired safely.");
+            }), signal);
             await this.peerReady(entry, context.peers, signal);
             cancelled(signal);
             entry.process.ready();
@@ -148,39 +269,28 @@ export class Launcher {
             log("launch_ready", {
                 fingerprint: entry.identity.fingerprint256,
                 name: entry.name,
-                peer: entry.peerId,
+                peer: entry.journal.peerId,
                 pid: entry.process.pid,
                 result: "ready",
             });
-            return { session: view(entry), reused: false };
+            return { session: view(entry), id: entry.journal.sessionId, reused: false };
         }
         finally {
             clearTimeout(deadline);
             signal.removeEventListener("abort", abort);
         }
     }
-    validateState(entry, policy, state) {
-        if (state.sessionId !== entry.sessionId ||
-            state.sessionFile !== entry.sessionFile ||
-            state.sessionName !== entry.name ||
-            state.isStreaming !== false ||
-            state.pendingMessageCount !== 0 ||
-            !isRecord(state.model) ||
-            state.model.provider !== policy.provider ||
-            state.model.id !== policy.model) {
-            throw new Fault(503, "readiness_failed", "Pi did not start idle with the exact saved session and configured model.");
-        }
-    }
     async peerReady(entry, peers, signal) {
         while (!entry.process?.failure) {
             cancelled(signal);
-            // Registration is asynchronous after native session_start; observe real broker publication.
+            // Native startup alone is insufficient: observe the exact Intercom publication.
             // oxlint-disable-next-line no-await-in-loop
             const rows = await peers(signal);
-            if (rows.some((peer) => peer.id === entry.peerId && peer.name === entry.name && peer.cwd === entry.identity.cwd)) {
+            if (rows.some((peer) => peer.id === entry.journal?.peerId &&
+                peer.name === resolveIntercomPresenceName(entry.name, entry.journal.sessionId) &&
+                peer.cwd === entry.cwd)) {
                 return;
             }
-            // Bounded readiness polling is not an acknowledgement substitute; only the row above succeeds.
             // oxlint-disable-next-line no-await-in-loop
             await delay(100, undefined, { signal });
         }

package/dist/pi-intercom/bridge-mailbox.js

@@ -0,0 +1,324 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, realpathSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { isRecord } from "../shared/unknown.js";
+import { normalizeMessage, normalizeSessionInfo } from "./types.js";
+import { Fault, INBOX_BYTES, INBOX_COUNT, fingerprint as certificateFingerprint, label, } from "./bridge-protocol.js";
+export function stateDirectory(value) {
+    if (value === undefined) {
+        return;
+    }
+    const path = label(value, "stateDir", 4096);
+    const stat = lstatSync(path);
+    if (!isAbsolute(path) ||
+        !stat.isDirectory() ||
+        stat.uid !== process.getuid?.() ||
+        (stat.mode & 0o777) !== 0o700) {
+        throw new Error("stateDir must be an absolute owned directory with mode 0700, not a symlink.");
+    }
+    return realpathSync(path);
+}
+function privateFile(path, create = false) {
+    const flags = create ? constants.O_RDWR | constants.O_CREAT : constants.O_RDONLY;
+    const fd = openSync(path, flags | constants.O_NOFOLLOW, 0o600);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() ||
+            stat.uid !== process.getuid?.() ||
+            (stat.mode & 0o777) !== 0o600 ||
+            stat.nlink !== 1) {
+            throw new Error("Mailbox files must be owned regular files with mode 0600 and one link.");
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function database(stateDir, fingerprint) {
+    stateDirectory(stateDir);
+    const path = join(stateDir, `${certificateFingerprint(fingerprint)}.sqlite`);
+    privateFile(path, true);
+    for (const suffix of ["-journal", "-wal", "-shm"]) {
+        try {
+            lstatSync(`${path}${suffix}`);
+        }
+        catch (error) {
+            if (isRecord(error) && error.code === "ENOENT") {
+                continue;
+            }
+            throw error;
+        }
+        privateFile(`${path}${suffix}`);
+    }
+    const db = new DatabaseSync(path, { enableDoubleQuotedStringLiterals: false });
+    try {
+        db.exec(`
+      PRAGMA journal_mode=DELETE;
+      PRAGMA synchronous=FULL;
+      PRAGMA secure_delete=ON;
+      PRAGMA cache_size=-1024;
+      PRAGMA busy_timeout=1000;
+      CREATE TABLE IF NOT EXISTS mailbox (
+        sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+        id TEXT NOT NULL UNIQUE,
+        envelope TEXT,
+        bytes INTEGER NOT NULL,
+        ask INTEGER NOT NULL,
+        receivedAt INTEGER NOT NULL,
+        acked INTEGER NOT NULL DEFAULT 0,
+        notified INTEGER NOT NULL DEFAULT 1
+      );
+      CREATE INDEX IF NOT EXISTS unread ON mailbox(sequence) WHERE acked=0;
+      CREATE INDEX IF NOT EXISTS asks ON mailbox(ask) WHERE ask=1 AND acked=0;
+      CREATE INDEX IF NOT EXISTS notifications ON mailbox(sequence) WHERE notified=0;
+      CREATE TABLE IF NOT EXISTS losses (
+        singleton INTEGER PRIMARY KEY CHECK(singleton=1),
+        count INTEGER NOT NULL
+      );
+      INSERT OR IGNORE INTO losses VALUES(1, 0);
+    `);
+        return db;
+    }
+    catch (error) {
+        db.close();
+        throw error;
+    }
+}
+function decode(value) {
+    const raw = typeof value === "string" ? JSON.parse(value) : undefined;
+    const from = isRecord(raw) ? normalizeSessionInfo(raw.from) : null;
+    const message = isRecord(raw) ? normalizeMessage(raw.message) : null;
+    if (!from || !message) {
+        throw new Fault(507, "mailbox_storage_failed", "Stored mailbox entry is invalid.");
+    }
+    return { from, message };
+}
+/** Persistent payloads leave only ID tombstones after acknowledgement, preventing replay resurrection. */
+export class Mailbox {
+    db;
+    entries = new Map();
+    bytes = 0;
+    sequence = 0;
+    failure;
+    admissionFailed = false;
+    notifications;
+    constructor(stateDir, fingerprint, notifications = false) {
+        try {
+            this.db = stateDir === undefined ? undefined : database(stateDir, fingerprint);
+        }
+        catch {
+            throw new Fault(507, "mailbox_storage_failed", "Cannot open private mailbox storage.");
+        }
+        this.notifications = notifications;
+    }
+    get persistent() {
+        return this.db !== undefined;
+    }
+    stored(action) {
+        if (this.failure) {
+            throw this.failure;
+        }
+        try {
+            return action();
+        }
+        catch (error) {
+            throw error instanceof Fault
+                ? error
+                : new Fault(507, "mailbox_storage_failed", "Mailbox storage operation failed.");
+        }
+    }
+    add(envelope) {
+        if (!this.db) {
+            return this.addVolatile(envelope);
+        }
+        const db = this.db;
+        return this.stored(() => {
+            try {
+                const payload = JSON.stringify(envelope);
+                const inserted = db
+                    .prepare("INSERT OR IGNORE INTO mailbox(id,envelope,bytes,ask,receivedAt,notified) VALUES(?,?,?,?,?,?)")
+                    .run(envelope.message.id, payload, Buffer.byteLength(payload), envelope.message.expectsReply === true ? 1 : 0, Date.now(), this.notifications ? 0 : 1);
+                this.admissionFailed = false;
+                return inserted.changes === 0 ? "duplicate" : "stored";
+            }
+            catch {
+                this.admissionFailed = true;
+                try {
+                    db.prepare("UPDATE losses SET count=MIN(count+1,9007199254740991) WHERE singleton=1").run();
+                }
+                catch {
+                    this.failure = new Fault(507, "mailbox_storage_failed", "Mailbox admission and loss recording failed; loss count is not durable.", { lossRecorded: false });
+                    throw this.failure;
+                }
+                return "lost";
+            }
+        });
+    }
+    addVolatile(envelope) {
+        if (this.entries.has(envelope.message.id)) {
+            return "duplicate";
+        }
+        const bytes = Buffer.byteLength(JSON.stringify(envelope));
+        if (this.entries.size >= INBOX_COUNT || this.bytes + bytes > INBOX_BYTES) {
+            return "lost";
+        }
+        this.entries.set(envelope.message.id, {
+            ...envelope,
+            bytes,
+            sequence: ++this.sequence,
+            receivedAt: Date.now(),
+            acked: 0,
+        });
+        this.bytes += bytes;
+        return "stored";
+    }
+    get(id) {
+        if (!this.db) {
+            return this.entries.get(id);
+        }
+        const db = this.db;
+        return this.stored(() => {
+            const row = db.prepare("SELECT envelope FROM mailbox WHERE id=? AND acked=0").get(id);
+            return row ? decode(row.envelope) : undefined;
+        });
+    }
+    remove(id) {
+        if (this.db) {
+            const db = this.db;
+            this.stored(() => db
+                .prepare("UPDATE mailbox SET acked=1, envelope=CASE WHEN notified=1 THEN NULL ELSE envelope END, bytes=CASE WHEN notified=1 THEN 0 ELSE bytes END WHERE id=?")
+                .run(id));
+            return;
+        }
+        const entry = this.entries.get(id);
+        if (entry) {
+            this.bytes -= entry.bytes;
+            this.entries.delete(id);
+        }
+    }
+    ack(ids) {
+        const acked = [];
+        const retained = [];
+        for (const id of ids) {
+            const entry = this.get(id);
+            if (entry?.message.expectsReply === true) {
+                // Durable consumer intake owns the primary wake; keep only the reply obligation here.
+                this.notificationAccepted(id);
+                retained.push(id);
+            }
+            else if (entry) {
+                this.remove(id);
+                acked.push(id);
+            }
+        }
+        return { acked, retained };
+    }
+    page(after, limit) {
+        return this.readPage(after, limit, false);
+    }
+    pendingNotifications(after = 0, limit = INBOX_COUNT) {
+        return this.readPage(after, limit, true);
+    }
+    notificationAccepted(id) {
+        const db = this.db;
+        if (db) {
+            this.stored(() => db
+                .prepare("UPDATE mailbox SET notified=1, envelope=CASE WHEN acked=1 THEN NULL ELSE envelope END, bytes=CASE WHEN acked=1 THEN 0 ELSE bytes END WHERE id=?")
+                .run(id));
+        }
+    }
+    readPage(after, limit, notifications) {
+        if (!Number.isSafeInteger(after) ||
+            after < 0 ||
+            !Number.isInteger(limit) ||
+            limit < 1 ||
+            limit > INBOX_COUNT) {
+            throw new Fault(400, "invalid_input", "Invalid mailbox page bounds.");
+        }
+        return this.stored(() => {
+            const candidates = this.candidates(after, limit, notifications);
+            const messages = [];
+            let bytes = 0;
+            let cursor = after;
+            let hasMore = false;
+            for (const candidate of candidates) {
+                const row = indexRow(candidate);
+                if (messages.length === limit || (messages.length > 0 && bytes + row.bytes > INBOX_BYTES)) {
+                    hasMore = true;
+                    break;
+                }
+                const envelope = decode(isRecord(candidate) && typeof candidate.envelope === "string"
+                    ? candidate.envelope
+                    : JSON.stringify(candidate));
+                messages.push(notifications
+                    ? { ...envelope, receivedAt: row.receivedAt, acknowledged: row.acked === 1 }
+                    : envelope);
+                bytes += row.bytes;
+                cursor = row.sequence;
+            }
+            return { messages, nextCursor: String(cursor), hasMore };
+        });
+    }
+    candidates(after, limit, notifications) {
+        if (this.db) {
+            return this.db
+                .prepare(`SELECT sequence,bytes,receivedAt,acked,envelope FROM mailbox WHERE ${notifications ? "notified=0" : "acked=0"} AND sequence>? ORDER BY sequence LIMIT ?`)
+                .iterate(after, limit + 1);
+        }
+        return notifications
+            ? []
+            : [...this.entries.values()].filter((entry) => entry.sequence > after).slice(0, limit + 1);
+    }
+    status(volatileLosses) {
+        const db = this.db;
+        const lostMessages = db
+            ? this.stored(() => db.prepare("SELECT count FROM losses WHERE singleton=1").get()?.count)
+            : volatileLosses;
+        if (typeof lostMessages !== "number") {
+            throw new Fault(507, "mailbox_storage_failed", "Stored loss counter is invalid.");
+        }
+        return {
+            lostMessages,
+            overflow: lostMessages > 0,
+            storageError: this.persistent && lostMessages > 0,
+        };
+    }
+    presence() {
+        const db = this.db;
+        if (!db) {
+            return {
+                pendingAsks: [...this.entries.values()].filter((entry) => entry.message.expectsReply === true).length,
+                acceptsAsks: this.entries.size < INBOX_COUNT && this.bytes < INBOX_BYTES,
+            };
+        }
+        return this.stored(() => {
+            const pendingAsks = db
+                .prepare("SELECT COUNT(*) AS count FROM mailbox WHERE ask=1 AND acked=0")
+                .get()?.count;
+            if (typeof pendingAsks !== "number") {
+                throw new Fault(507, "mailbox_storage_failed", "Stored ask counter is invalid.");
+            }
+            return { pendingAsks, acceptsAsks: !this.admissionFailed };
+        });
+    }
+    close() {
+        this.db?.close();
+        const discarded = this.entries.size;
+        this.entries.clear();
+        this.bytes = 0;
+        return discarded;
+    }
+}
+function indexRow(row) {
+    if (!isRecord(row)) {
+        throw new Fault(507, "mailbox_storage_failed", "Stored mailbox index is invalid.");
+    }
+    const { sequence, bytes, receivedAt, acked } = row;
+    if (typeof sequence !== "number" ||
+        typeof bytes !== "number" ||
+        typeof receivedAt !== "number" ||
+        typeof acked !== "number") {
+        throw new Fault(507, "mailbox_storage_failed", "Stored mailbox index is invalid.");
+    }
+    return { sequence, bytes, receivedAt, acked };
+}