@groundnuty/macf-channel-server 0.2.47 → 0.2.49

package/dist/collision.d.ts

@@ -34,12 +34,18 @@ export declare class RegisterRaceError extends MacfError {
  * forever.
  */
 export declare const MAX_REGISTER_RETRIES = 5;
-/** Result of a collision /health ping: liveness + the advertised version
- *  (null when the peer answered but carried no `version` field — a
- *  pre-groundnuty/macf#424 instance — or was unreachable/unparseable). */
+/** Result of a collision /health ping: liveness + the advertised version +
+ *  the RESPONDER's OWN `instance_id` (groundnuty/macf#733). `version` is null
+ *  when the peer answered but carried no `version` field (a pre-#424
+ *  instance) or was unreachable/unparseable. `instanceId` is null under the
+ *  same conditions PLUS the pre-#733 case where a live peer's `/health` body
+ *  simply predates the `instance_id` self-report — the identity check
+ *  (`classifyPeer`) treats a null `instanceId` as "can't compare" and falls
+ *  through to the unchanged #424 version quadrant (back-compat). */
 export interface HealthPingResult {
     readonly alive: boolean;
     readonly version: string | null;
+    readonly instanceId: string | null;
 }
 export type CollisionResult = {
     readonly action: 'register';
@@ -56,6 +62,25 @@ export type CollisionResult = {
  * Returns the action to take: register (fresh), takeover (the slot is held by a
  * dead OR alive-but-older instance), or abort (a same/newer live peer holds it).
  *
+ * Identity-aware liveness (groundnuty/macf#733): "something answers 2xx on the
+ * advertised port" is NOT the same claim as "the REGISTERED owner is alive" —
+ * a lingering socket from the just-exited owner, or an unrelated stray/orphan
+ * process, can answer 2xx on the port the registry recorded, and the #424
+ * quadrant below would then read that as a same-version live peer and ABORT,
+ * stranding the slot indefinitely (the bug that repeatedly bricked devops on
+ * 0.2.47). The `/health` responder now self-reports its OWN `instance_id`
+ * (`health.ts`), so `classifyPeer` can tell "the registered owner is
+ * confirmed alive" apart from "the registered owner is gone; something else
+ * answers." When the responder's `instance_id` is present AND differs from
+ * the registry slot's `instance_id`, the registered owner's liveness is
+ * UNCONFIRMED — takeover, bypassing the #424 quadrant entirely (this is an
+ * identity question, not a version question). When the responder's
+ * `instance_id` matches the slot (the common, correct case) OR the responder
+ * doesn't self-report one (a pre-#733 peer — back-compat), the unchanged
+ * #424 version quadrant below decides. See `classifyPeer`'s body for the
+ * concurrent-newer-instance-race analysis (why this is safe to do without
+ * its own displacement logic).
+ *
  * Version-aware takeover (groundnuty/macf#424): a same-version alive peer is
  * still protected (alive → abort), but an alive instance running an *older*
  * version no longer permanently squats the slot — a newer incoming displaces

package/dist/collision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collision.d.ts","sourceRoot":"","sources":["../src/collision.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAwD,MAAM,uBAAuB,CAAC;AAKxG,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAQrD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI;CAYpD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AA2BtC;;0EAE0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA2GD,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE;IACT,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,EACD,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAS1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE;IACT,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,EACD,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CA4G1B"}
+{"version":3,"file":"collision.d.ts","sourceRoot":"","sources":["../src/collision.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAwD,MAAM,uBAAuB,CAAC;AAKxG,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAQrD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI;CAYpD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AA2BtC;;;;;;;oEAOoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAmHD,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE;IACT,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,EACD,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAS1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE;IACT,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,EACD,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CA+I1B"}

package/dist/collision.js

@@ -71,8 +71,9 @@ const HEALTH_CONFIRM_DELAY_MS = 300;
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * Ping an agent's /health endpoint via mTLS.
- * Returns `{ alive, version }`: alive iff the agent responds 2xx; version is
- * the `version` field parsed from the JSON body (null if absent/unparseable).
+ * Returns `{ alive, version, instanceId }`: alive iff the agent responds 2xx;
+ * version + instanceId are the `version` / `instance_id` fields parsed from
+ * the JSON body (null if absent/unparseable).
  */
 function pingHealth(host, port, caCertPath, agentCertPath, agentKeyPath, timeoutMs = HEALTH_PING_TIMEOUT_MS) {
     // readFileSync on missing/unreadable cert files throws ENOENT/EACCES
@@ -92,7 +93,7 @@ function pingHealth(host, port, caCertPath, agentCertPath, agentKeyPath, timeout
         key = readFileSync(agentKeyPath);
     }
     catch {
-        return Promise.resolve({ alive: false, version: null });
+        return Promise.resolve({ alive: false, version: null, instanceId: null });
     }
     return new Promise((resolve) => {
         const req = request({
@@ -109,32 +110,37 @@ function pingHealth(host, port, caCertPath, agentCertPath, agentKeyPath, timeout
             const alive = res.statusCode !== undefined && res.statusCode >= 200 && res.statusCode < 300;
             if (!alive) {
                 res.resume(); // drain
-                resolve({ alive: false, version: null });
+                resolve({ alive: false, version: null, instanceId: null });
                 return;
             }
-            // Alive — read the body to extract the advertised version. A peer
-            // that answers 2xx but carries no `version` field (or an unparseable
-            // body) is treated as version=null (a pre-#424 instance).
+            // Alive — read the body to extract the advertised version + the
+            // responder's OWN instance_id (groundnuty/macf#733). A peer that
+            // answers 2xx but carries no `version` / `instance_id` field (or an
+            // unparseable body) is treated as version=null / instanceId=null (a
+            // pre-#424 / pre-#733 instance).
             const chunks = [];
             res.on('data', (c) => chunks.push(c));
             res.on('end', () => {
                 let version = null;
+                let instanceId = null;
                 try {
                     const body = JSON.parse(Buffer.concat(chunks).toString('utf-8'));
                     if (typeof body.version === 'string')
                         version = body.version;
+                    if (typeof body.instance_id === 'string')
+                        instanceId = body.instance_id;
                 }
                 catch {
-                    // alive but unparseable → version stays null
+                    // alive but unparseable → version/instanceId stay null
                 }
-                resolve({ alive: true, version });
+                resolve({ alive: true, version, instanceId });
             });
-            res.on('error', () => resolve({ alive: true, version: null }));
+            res.on('error', () => resolve({ alive: true, version: null, instanceId: null }));
         });
-        req.on('error', () => resolve({ alive: false, version: null }));
+        req.on('error', () => resolve({ alive: false, version: null, instanceId: null }));
         req.on('timeout', () => {
             req.destroy();
-            resolve({ alive: false, version: null });
+            resolve({ alive: false, version: null, instanceId: null });
         });
         req.end();
     });
@@ -149,13 +155,13 @@ function pingHealth(host, port, caCertPath, agentCertPath, agentKeyPath, timeout
  * version is that of the final (still-answering) ping, feeding the #424 quadrant.
  */
 async function confirmLiveness(host, port, caCertPath, agentCertPath, agentKeyPath) {
-    let result = { alive: false, version: null };
+    let result = { alive: false, version: null, instanceId: null };
     for (let attempt = 0; attempt < HEALTH_CONFIRM_ATTEMPTS; attempt += 1) {
         if (attempt > 0)
             await sleep(HEALTH_CONFIRM_DELAY_MS);
         result = await pingHealth(host, port, caCertPath, agentCertPath, agentKeyPath);
         if (!result.alive)
-            return { alive: false, version: null };
+            return { alive: false, version: null, instanceId: null };
     }
     return result;
 }
@@ -165,6 +171,25 @@ async function confirmLiveness(host, port, caCertPath, agentCertPath, agentKeyPa
  * Returns the action to take: register (fresh), takeover (the slot is held by a
  * dead OR alive-but-older instance), or abort (a same/newer live peer holds it).
  *
+ * Identity-aware liveness (groundnuty/macf#733): "something answers 2xx on the
+ * advertised port" is NOT the same claim as "the REGISTERED owner is alive" —
+ * a lingering socket from the just-exited owner, or an unrelated stray/orphan
+ * process, can answer 2xx on the port the registry recorded, and the #424
+ * quadrant below would then read that as a same-version live peer and ABORT,
+ * stranding the slot indefinitely (the bug that repeatedly bricked devops on
+ * 0.2.47). The `/health` responder now self-reports its OWN `instance_id`
+ * (`health.ts`), so `classifyPeer` can tell "the registered owner is
+ * confirmed alive" apart from "the registered owner is gone; something else
+ * answers." When the responder's `instance_id` is present AND differs from
+ * the registry slot's `instance_id`, the registered owner's liveness is
+ * UNCONFIRMED — takeover, bypassing the #424 quadrant entirely (this is an
+ * identity question, not a version question). When the responder's
+ * `instance_id` matches the slot (the common, correct case) OR the responder
+ * doesn't self-report one (a pre-#733 peer — back-compat), the unchanged
+ * #424 version quadrant below decides. See `classifyPeer`'s body for the
+ * concurrent-newer-instance-race analysis (why this is safe to do without
+ * its own displacement logic).
+ *
  * Version-aware takeover (groundnuty/macf#424): a same-version alive peer is
  * still protected (alive → abort), but an alive instance running an *older*
  * version no longer permanently squats the slot — a newer incoming displaces
@@ -232,15 +257,48 @@ export async function classifyPeer(name, existing, certPaths, incomingVersion, l
     // Liveness is re-confirmed across HEALTH_CONFIRM_ATTEMPTS pings to defeat the
     // just-killed-port race (groundnuty/macf#553): a single momentary 2xx from a
     // dying prior instance must NOT count as alive. A confirmed-live peer then
-    // flows into the unchanged #424 version quadrant below.
-    const { alive, version: existingVersion } = await confirmLiveness(existing.host, existing.port, certPaths.caCertPath, certPaths.agentCertPath, certPaths.agentKeyPath);
+    // flows into the identity check + the #424 version quadrant below.
+    const { alive, version: existingVersion, instanceId: responderInstanceId } = await confirmLiveness(existing.host, existing.port, certPaths.caCertPath, certPaths.agentCertPath, certPaths.agentKeyPath);
     if (alive) {
         const versionTakeoverDisabled = process.env['MACF_NO_VERSION_TAKEOVER'] === '1';
         const incomingVersioned = VERSION_PATTERN.test(incomingVersion);
-        // Decide takeover-vs-abort against a LIVE peer (the #424 quadrant).
+        // groundnuty/macf#733: the /health responder answered 2xx on every
+        // re-confirm ping (so `alive` is true), but that alone doesn't prove the
+        // REGISTERED owner (`existing.instance_id`) is who's answering. When the
+        // responder self-reports its OWN instance_id and it does NOT match the
+        // slot, the registered owner is confirmed GONE — something else (a
+        // lingering just-exited socket, an unrelated orphan) is squatting the
+        // port. `responderInstanceId === null` means the responder predates the
+        // #733 self-report (or the body was unparseable) — we can't compare, so
+        // fall through to the unchanged #424 version quadrant (back-compat).
+        //
+        // Concurrent-newer-instance-race safety: this identity check can, in a
+        // narrow TOCTOU window, mis-takeover against a genuinely newer live peer
+        // that raced us between our `registry.get()` read and this /health ping
+        // (e.g. the peer's own server is already up+serving at the recorded
+        // host:port under a fresh instance_id, but its registry write hasn't
+        // landed yet). This is bounded, not a permanent stranding: the caller's
+        // over-register loop (register-with-takeover.ts, macf#702) re-classifies
+        // against the FRESH registry value at CAS write time — if that peer is
+        // genuinely live + same-or-newer, our own registerConditional loses the
+        // race and we yield (RegisterRaceError); if the peer instead loses the
+        // slot to us first, its own registry heartbeat (DR-031 onDisplaced,
+        // macf#568) detects the takeover on its own next beat and stands down
+        // gracefully. Either direction self-corrects within one heartbeat
+        // interval — no additional displacement logic is added here.
+        const identityMismatch = responderInstanceId !== null && responderInstanceId !== existing.instance_id;
+        // Decide takeover-vs-abort against a LIVE peer (the identity check, then
+        // the #424 quadrant).
         let takeover;
         let basis;
-        if (versionTakeoverDisabled) {
+        if (identityMismatch) {
+            // The registered owner isn't the one answering — takeover regardless of
+            // version policy (this is an identity question, not a version one; it
+            // intentionally bypasses versionTakeoverDisabled + incomingVersioned).
+            takeover = true;
+            basis = 'takeover_stale_owner_gone';
+        }
+        else if (versionTakeoverDisabled) {
             takeover = false;
             basis = 'abort_version_takeover_disabled';
         }
@@ -275,6 +333,8 @@ export async function classifyPeer(name, existing, certPaths, incomingVersion, l
             agent: name,
             incoming_version: incomingVersion,
             existing_version: existingVersion,
+            existing_instance_id: existing.instance_id,
+            responder_instance_id: responderInstanceId,
             host: existing.host,
             port: existing.port,
         });

package/dist/collision.js.map

@@ -1 +1 @@
-{"version":3,"file":"collision.js","sourceRoot":"","sources":["../src/collision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAExG,yEAAyE;AACzE,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,MAAM,OAAO,cAAe,SAAQ,SAAS;IAC3C,YAAY,IAAY,EAAE,IAAY,EAAE,IAAY;QAClD,KAAK,CACH,iBAAiB,EACjB,UAAU,IAAI,2BAA2B,IAAI,IAAI,IAAI,IAAI;YACzD,kDAAkD,CACnD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,IAAY,EAAE,OAAyB;QACjD,KAAK,CACH,qBAAqB,EACrB,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,UAAU,IAAI,uDAAuD;gBACrE,6EAA6E;YAC/E,CAAC,CAAC,UAAU,IAAI,sDAAsD;gBACpE,QAAQ,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,cAAc,OAAO,CAAC,WAAW,KAAK;gBAC1E,8CAA8C,CACnD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAUpD;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAY,EACZ,IAAY,EACZ,UAAkB,EAClB,aAAqB,EACrB,YAAoB,EACpB,YAAoB,sBAAsB;IAE1C,qEAAqE;IACrE,iEAAiE;IACjE,4DAA4D;IAC5D,kEAAkE;IAClE,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,iCAAiC;IACjC,IAAI,EAAU,CAAC;IACf,IAAI,IAAY,CAAC;IACjB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACnC,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,QAAQ,EAAE,IAAI;YACd,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,SAAS;YACf,EAAE;YACF,IAAI;YACJ,GAAG;YACH,kBAAkB,EAAE,IAAI;YACxB,OAAO,EAAE,SAAS;SACnB,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YAC5F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ;gBACtB,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,qEAAqE;YACrE,0DAA0D;YAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,OAAO,GAAkB,IAAI,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA0B,CAAC;oBAC1F,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;wBAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;gBACD,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,IAAY,EACZ,UAAkB,EAClB,aAAqB,EACrB,YAAoB;IAEpB,IAAI,MAAM,GAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,QAAkB,EAClB,SAIC,EACD,eAAuB,EACvB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,QAAmB,EACnB,SAIC,EACD,eAAuB,EACvB,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC7B,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC/D,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,EACb,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,YAAY,CACvB,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,GAAG,CAAC;QAChF,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhE,oEAAoE;QACpE,IAAI,QAAiB,CAAC;QACtB,IAAI,KAAa,CAAC;QAClB,IAAI,uBAAuB,EAAE,CAAC;YAC5B,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,GAAG,iCAAiC,CAAC;QAC5C,CAAC;aAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9B,uDAAuD;YACvD,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,GAAG,4BAA4B,CAAC;QACvC,CAAC;aAAM,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YACpC,mEAAmE;YACnE,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,+BAA+B,CAAC;QAC1C,CAAC;aAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAClD,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,4CAA4C;YAC5C,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,+BAA+B,CAAC;QAC1C,CAAC;aAAM,IAAI,aAAa,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,wBAAwB,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,GAAG,qBAAqB,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,gBAAgB,EAAE,eAAe;YACjC,gBAAgB,EAAE,eAAe;YACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;QAEH,IAAI,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAEhE,0EAA0E;QAC1E,sEAAsE;QACtE,gFAAgF;QAChF,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,gFAAgF;QAChF,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,+EAA+E;QAC/E,iFAAiF;QACjF,wEAAwE;QACxE,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,YAAY,CAAC,QAAQ,EAAE,uBAAuB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC7B,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,eAAe;gBACjC,gBAAgB,EAAE,eAAe;gBACjC,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;gBAC/C,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC7B,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,QAAQ,CAAC,WAAW;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"collision.js","sourceRoot":"","sources":["../src/collision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAExG,yEAAyE;AACzE,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,MAAM,OAAO,cAAe,SAAQ,SAAS;IAC3C,YAAY,IAAY,EAAE,IAAY,EAAE,IAAY;QAClD,KAAK,CACH,iBAAiB,EACjB,UAAU,IAAI,2BAA2B,IAAI,IAAI,IAAI,IAAI;YACzD,kDAAkD,CACnD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,IAAY,EAAE,OAAyB;QACjD,KAAK,CACH,qBAAqB,EACrB,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,UAAU,IAAI,uDAAuD;gBACrE,6EAA6E;YAC/E,CAAC,CAAC,UAAU,IAAI,sDAAsD;gBACpE,QAAQ,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,cAAc,OAAO,CAAC,WAAW,KAAK;gBAC1E,8CAA8C,CACnD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAgBpD;;;;;GAKG;AACH,SAAS,UAAU,CACjB,IAAY,EACZ,IAAY,EACZ,UAAkB,EAClB,aAAqB,EACrB,YAAoB,EACpB,YAAoB,sBAAsB;IAE1C,qEAAqE;IACrE,iEAAiE;IACjE,4DAA4D;IAC5D,kEAAkE;IAClE,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,iCAAiC;IACjC,IAAI,EAAU,CAAC;IACf,IAAI,IAAY,CAAC;IACjB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACnC,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,QAAQ,EAAE,IAAI;YACd,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,SAAS;YACf,EAAE;YACF,IAAI;YACJ,GAAG;YACH,kBAAkB,EAAE,IAAI;YACxB,OAAO,EAAE,SAAS;SACnB,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YAC5F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ;gBACtB,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,gEAAgE;YAChE,iEAAiE;YACjE,oEAAoE;YACpE,oEAAoE;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,OAAO,GAAkB,IAAI,CAAC;gBAClC,IAAI,UAAU,GAAkB,IAAI,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAG9D,CAAC;oBACF,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;wBAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;oBAC7D,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;wBAAE,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;gBAC1E,CAAC;gBAAC,MAAM,CAAC;oBACP,uDAAuD;gBACzD,CAAC;gBACD,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,IAAY,EACZ,UAAkB,EAClB,aAAqB,EACrB,YAAoB;IAEpB,IAAI,MAAM,GAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACjF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,QAAkB,EAClB,SAIC,EACD,eAAuB,EACvB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,QAAmB,EACnB,SAIC,EACD,eAAuB,EACvB,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC7B,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,eAAe,CAChG,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,EACb,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,YAAY,CACvB,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,GAAG,CAAC;QAChF,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEhE,mEAAmE;QACnE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,kEAAkE;QAClE,6DAA6D;QAC7D,MAAM,gBAAgB,GAAG,mBAAmB,KAAK,IAAI,IAAI,mBAAmB,KAAK,QAAQ,CAAC,WAAW,CAAC;QAEtG,yEAAyE;QACzE,sBAAsB;QACtB,IAAI,QAAiB,CAAC;QACtB,IAAI,KAAa,CAAC;QAClB,IAAI,gBAAgB,EAAE,CAAC;YACrB,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,2BAA2B,CAAC;QACtC,CAAC;aAAM,IAAI,uBAAuB,EAAE,CAAC;YACnC,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,GAAG,iCAAiC,CAAC;QAC5C,CAAC;aAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9B,uDAAuD;YACvD,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,GAAG,4BAA4B,CAAC;QACvC,CAAC;aAAM,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YACpC,mEAAmE;YACnE,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,+BAA+B,CAAC;QAC1C,CAAC;aAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAClD,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,4CAA4C;YAC5C,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,+BAA+B,CAAC;QAC1C,CAAC;aAAM,IAAI,aAAa,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,wBAAwB,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,GAAG,qBAAqB,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,gBAAgB,EAAE,eAAe;YACjC,gBAAgB,EAAE,eAAe;YACjC,oBAAoB,EAAE,QAAQ,CAAC,WAAW;YAC1C,qBAAqB,EAAE,mBAAmB;YAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;QAEH,IAAI,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAEhE,0EAA0E;QAC1E,sEAAsE;QACtE,gFAAgF;QAChF,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,gFAAgF;QAChF,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,+EAA+E;QAC/E,iFAAiF;QACjF,wEAAwE;QACxE,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,YAAY,CAAC,QAAQ,EAAE,uBAAuB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC7B,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,eAAe;gBACjC,gBAAgB,EAAE,eAAe;gBACjC,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;gBAC/C,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC7B,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,QAAQ,CAAC,WAAW;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC"}

package/dist/delivery/driver.d.ts

@@ -0,0 +1,45 @@
+/**
+ * DR-038 Decision 6 — the pluggable store-DRIVER seam. `outbox.ts` / `inbox.ts`
+ * (the runtime-agnostic effectively-once logic) depend only on the
+ * `OutboxStore` / `InboxStore` interfaces (hoisted to `@groundnuty/macf-core`,
+ * `delivery/store.ts` — macf#741); THIS module is the one place `server.ts`
+ * decides which concrete driver backs those interfaces.
+ *
+ * Today there is exactly one driver: the in-memory reference (`in-memory-store.ts`).
+ * That is a PLACEHOLDER, not the DR-038 durability guarantee — see the loud
+ * warning in `createDefaultDeliveryStores` below. The devops-owned DR-008 VM
+ * disk-spool driver (and, later, a K8s PVC/broker driver) is expected to ship
+ * a sibling factory with the exact same `DeliveryStores` return shape; wiring
+ * it in is then a ONE-LINE swap of which factory `server.ts` calls — no change
+ * to `outbox.ts`, `inbox.ts`, the notify-peer sender wiring, or the `/notify` /
+ * `message/send` receiver wiring, all of which only ever see the `OutboxStore`
+ * / `InboxStore` interface.
+ */
+import type { Logger, OutboxStore, InboxStore } from '@groundnuty/macf-core';
+export interface DeliveryStores {
+    readonly outboxStore: OutboxStore;
+    readonly inboxStore: InboxStore;
+}
+/** A driver factory — the swap point for a future DR-008 disk/K8s driver. */
+export type DeliveryStoreFactory = (logger?: Logger) => DeliveryStores;
+/**
+ * The reference in-memory driver — `server.ts`'s DEFAULT until a durable
+ * driver lands.
+ *
+ * ⚠️ LOUD, DELIBERATE FLAG: this is NOT durable across a process crash. Every
+ * queued outbox entry and every undrained inbox entry lives only in this
+ * process's heap — a crash (the exact failure mode DR-038 exists to fix, per
+ * its "Live-validated, not hypothetical" motivation: the devops 8h outage +
+ * code-agent's #702 channel-server death) loses the lot, silently, with no
+ * on-disk trace. The WIRING in this slice (persist-then-send, persist-then-
+ * ACK, retry/backoff/TTL, dead-letter) is fully correct and exercised end-to-
+ * end by this slice's tests — what's missing is durability of the persist
+ * step itself, which requires swapping this factory for the devops-owned
+ * DR-008 disk-spool driver (or a K8s PVC/broker driver) once it lands. Until
+ * then, effectively-once degrades to "effectively-once for the lifetime of
+ * one process" — still strictly better than today's fire-and-forget (no
+ * retry at all across even a single-attempt transient failure), but NOT the
+ * full restart-survival guarantee DR-038 Decision 4 describes.
+ */
+export declare function createDefaultDeliveryStores(logger?: Logger): DeliveryStores;
+//# sourceMappingURL=driver.d.ts.map

package/dist/delivery/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../src/delivery/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAG7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,6EAA6E;AAC7E,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,cAAc,CAAC;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,CAa3E"}

package/dist/delivery/driver.js

@@ -0,0 +1,34 @@
+import { createInMemoryOutboxStore, createInMemoryInboxStore } from './in-memory-store.js';
+/**
+ * The reference in-memory driver — `server.ts`'s DEFAULT until a durable
+ * driver lands.
+ *
+ * ⚠️ LOUD, DELIBERATE FLAG: this is NOT durable across a process crash. Every
+ * queued outbox entry and every undrained inbox entry lives only in this
+ * process's heap — a crash (the exact failure mode DR-038 exists to fix, per
+ * its "Live-validated, not hypothetical" motivation: the devops 8h outage +
+ * code-agent's #702 channel-server death) loses the lot, silently, with no
+ * on-disk trace. The WIRING in this slice (persist-then-send, persist-then-
+ * ACK, retry/backoff/TTL, dead-letter) is fully correct and exercised end-to-
+ * end by this slice's tests — what's missing is durability of the persist
+ * step itself, which requires swapping this factory for the devops-owned
+ * DR-008 disk-spool driver (or a K8s PVC/broker driver) once it lands. Until
+ * then, effectively-once degrades to "effectively-once for the lifetime of
+ * one process" — still strictly better than today's fire-and-forget (no
+ * retry at all across even a single-attempt transient failure), but NOT the
+ * full restart-survival guarantee DR-038 Decision 4 describes.
+ */
+export function createDefaultDeliveryStores(logger) {
+    logger?.warn('delivery_store_in_memory_placeholder', {
+        detail: 'DR-038 effectively-once delivery is wired against the IN-MEMORY reference ' +
+            'store driver — a process crash loses every queued outbox entry and every ' +
+            'undrained inbox entry (the exact failure DR-038 exists to fix). The retry/' +
+            'dedup LOGIC is correct; durability across a crash requires the DR-008 ' +
+            'disk-spool driver (devops-owned), not yet wired in. See delivery/driver.ts.',
+    });
+    return {
+        outboxStore: createInMemoryOutboxStore(),
+        inboxStore: createInMemoryInboxStore(),
+    };
+}
+//# sourceMappingURL=driver.js.map

package/dist/delivery/driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../src/delivery/driver.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAU3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAe;IACzD,MAAM,EAAE,IAAI,CAAC,sCAAsC,EAAE;QACnD,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,4EAA4E;YAC5E,wEAAwE;YACxE,6EAA6E;KAChF,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,yBAAyB,EAAE;QACxC,UAAU,EAAE,wBAAwB,EAAE;KACvC,CAAC;AACJ,CAAC"}

package/dist/delivery/in-memory-store.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Reference `OutboxStore` / `InboxStore` drivers backed by an in-process
+ * `Map`. NOT the real driver — the real drivers (VM disk-spool, K8s
+ * PVC/broker) are devops-owned per DR-008. This is:
+ *
+ *   1. what the effectively-once logic (`outbox.ts` / `inbox.ts`) is
+ *      exercised against in this slice's tests, and
+ *   2. the reference shape a disk-backed driver mirrors — the exact same
+ *      dedup-atomicity / persist-then-X ordering invariants apply, just
+ *      against `fs` instead of a `Map`.
+ *
+ * Every method returns a fresh shallow copy of stored entries (never a live
+ * reference into the internal `Map`) so a caller mutating a returned object
+ * can't silently corrupt store state behind the mutate-only API surface
+ * (`enqueue` / `reschedule` / `markAcked` / `deadLetter` / `persist` /
+ * `markProcessed`) — consistent with this repo's "immutable interfaces"
+ * convention (CLAUDE.md § Conventions).
+ */
+import type { OutboxStore, InboxStore } from '@groundnuty/macf-core';
+/** Create a fresh in-memory `OutboxStore`. Each call is an independent store. */
+export declare function createInMemoryOutboxStore(): OutboxStore;
+/** Create a fresh in-memory `InboxStore`. Each call is an independent store. */
+export declare function createInMemoryInboxStore(): InboxStore;
+//# sourceMappingURL=in-memory-store.d.ts.map

package/dist/delivery/in-memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.d.ts","sourceRoot":"","sources":["../../src/delivery/in-memory-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAe,UAAU,EAAc,MAAM,uBAAuB,CAAC;AAE9F,iFAAiF;AACjF,wBAAgB,yBAAyB,IAAI,WAAW,CA0BvD;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,IAAI,UAAU,CAoCrD"}

package/dist/delivery/in-memory-store.js

@@ -0,0 +1,60 @@
+/** Create a fresh in-memory `OutboxStore`. Each call is an independent store. */
+export function createInMemoryOutboxStore() {
+    const entries = new Map();
+    return {
+        async enqueue(entry) {
+            entries.set(entry.id, { ...entry });
+        },
+        async listPending() {
+            return Array.from(entries.values()).map((e) => ({ ...e }));
+        },
+        async reschedule(id, nextAttemptAt, attemptCount) {
+            const existing = entries.get(id);
+            if (existing === undefined)
+                return; // already acked/dead-lettered elsewhere — no-op
+            entries.set(id, { ...existing, nextAttemptAt, attemptCount });
+        },
+        async markAcked(id) {
+            entries.delete(id);
+        },
+        async deadLetter(id) {
+            entries.delete(id);
+        },
+    };
+}
+/** Create a fresh in-memory `InboxStore`. Each call is an independent store. */
+export function createInMemoryInboxStore() {
+    const entries = new Map();
+    return {
+        async persist(entry) {
+            // Atomic dedup-and-persist: a single synchronous check + set against
+            // the Map, with no `await` between them — no TOCTOU window is
+            // reachable in-process. A disk-backed driver must preserve this same
+            // atomicity (e.g. an exclusive-create file write) rather than a
+            // separate exists-check + write.
+            if (entries.has(entry.id))
+                return false;
+            entries.set(entry.id, { ...entry });
+            return true;
+        },
+        async has(id) {
+            return entries.has(id);
+        },
+        async get(id) {
+            const existing = entries.get(id);
+            return existing === undefined ? undefined : { ...existing };
+        },
+        async listUndrained() {
+            return Array.from(entries.values())
+                .filter((e) => !e.processed)
+                .map((e) => ({ ...e }));
+        },
+        async markProcessed(id) {
+            const existing = entries.get(id);
+            if (existing === undefined)
+                return; // unknown id — no-op
+            entries.set(id, { ...existing, processed: true });
+        },
+    };
+}
+//# sourceMappingURL=in-memory-store.js.map

package/dist/delivery/in-memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.js","sourceRoot":"","sources":["../../src/delivery/in-memory-store.ts"],"names":[],"mappings":"AAoBA,iFAAiF;AACjF,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAkB;YAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,WAAW;YACf,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,aAAqB,EAAE,YAAoB;YACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,gDAAgD;YACpF,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,EAAU;YACxB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAU;YACzB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAiB;YAC7B,qEAAqE;YACrE,8DAA8D;YAC9D,qEAAqE;YACrE,gEAAgE;YAChE,iCAAiC;YACjC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAU;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,aAAa;YACjB,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;iBAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;iBAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAU;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,qBAAqB;YACzD,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/delivery/inbox-drain-driver.d.ts

@@ -0,0 +1,150 @@
+/**
+ * DR-038 Decision 5 follow-on (groundnuty/macf#744) — the live, in-process
+ * RE-FIRE logic for the receiver-side inbox's orphan class: an entry that
+ * `inbox.accept()` persisted (`wasNew: true`) but whose `onNotify` call threw
+ * BEFORE `inbox.markProcessed()` ran (see `https.ts`'s on-receipt wiring
+ * around the `/notify` + `message/send` recv edges). The sender's own retry
+ * dedups the same message-id (Decision 1) and never re-fires `onNotify` for
+ * it, so absent this driver the entry sits `processed:false` for the rest of
+ * the channel-server's process lifetime — recoverable only by the SEPARATE,
+ * short-lived plugin SessionStart `startup_check` drain (Decision 5's
+ * "on-startup" trigger), which runs against a FRESH, empty in-memory store
+ * and therefore can never see THIS process's own orphans (only a future
+ * process's, and only once a durable store driver — DR-008 — lands).
+ *
+ * `inbox-ticker.ts` drives this function periodically over the channel-
+ * server's OWN lifetime, so a transient `onNotify` failure (the common case
+ * — a momentarily-unavailable mcp_push / tmux-wake) self-recovers within the
+ * SAME process, well before any restart or plugin-drain would ever see it.
+ *
+ * Kept as a standalone module — not folded into `inbox.ts` — so `inbox.ts`
+ * stays the primitive-only persist/dedup/drain-read module. Mirrors the
+ * `outbox.ts` / `outbox-ticker.ts` split: `outbox.ts` doesn't know about
+ * ticking, `outbox-ticker.ts` doesn't know about persistence. Here,
+ * `inbox.ts` doesn't know about re-firing `onNotify` or attempt-bookkeeping;
+ * `inbox-ticker.ts` doesn't know about any of THIS module's drive logic.
+ *
+ * Four contract constraints (science-blessed, groundnuty/macf#744):
+ *
+ *   1. Grace-before-drain — an entry younger than `graceMs` is left alone;
+ *      it may still be genuinely mid-flight in the ORIGINAL
+ *      accept()→onNotify()→markProcessed() sequence, not yet an orphan.
+ *   2. `markProcessed` ONLY on a successful re-fire — never mark-then-fire.
+ *      Marking before a confirmed onNotify success would reintroduce the
+ *      persist-then-ACK silent-drop shape, inverted (silent-fallback-
+ *      hazards.md). A failed re-fire leaves the entry exactly as undrained
+ *      as it was, for a later tick (or eventual give-up, #3) to see.
+ *   3. Bounded push-retries — `maxAttempts` OR `ttlMs` (whichever comes
+ *      first) caps how many times a persistently-failing entry gets
+ *      re-fired. Attempt counts are tracked in a `Map` keyed by entry id,
+ *      driver-locally — NEVER added to the frozen `InboxEntry` /
+ *      `InboxStore` `@groundnuty/macf-core` schema (devops's disk-spool
+ *      driver depends on that exact contract). Once given up, the entry is
+ *      left `processed:false` forever — there is no delete/dead-letter
+ *      primitive on `InboxStore` — this driver simply stops re-firing it.
+ *      The FUTURE plugin startup-drain's surface-as-text path (Decision 5's
+ *      other trigger) is the intended eventual consumer of a given-up
+ *      entry, once it too can see this process's store (post-DR-008).
+ *      Forward-note (DR-008, science #747 review): the attempt `Map` is
+ *      process-local, so once a DURABLE store survives restarts a given-up
+ *      entry gets a FRESH `maxAttempts` budget on every process restart (the
+ *      Map resets while the entry persists) until the surface-as-text path
+ *      consumes it. The durable-driver integration should define how a
+ *      given-up entry is FINALLY resolved (dead-letter, or surfaced-once) so
+ *      it can't be re-attempted indefinitely across restart generations.
+ *      Moot today: the in-memory store loses the entry on restart too.
+ *   4. Drainer ownership / no double-surface — this driver ONLY re-fires
+ *      `onNotify` + marks-on-success, or gives up silently. It NEVER
+ *      surfaces anything as text itself; that split keeps it composable
+ *      with the plugin's (future) startup-drain without either one
+ *      duplicating the other's job.
+ */
+import type { Logger, NotifyPayload } from '@groundnuty/macf-core';
+import type { Inbox } from './inbox.js';
+/**
+ * Grace window before an undrained entry is considered a genuine orphan
+ * (constraint 1). Deliberately >= the ticker's own tick interval — the
+ * accept()→onNotify()→markProcessed() sequence on the ORIGINAL receive path
+ * completes in well under a second in practice, so an interval comfortably
+ * larger than one tick cycle can never mistake a mid-flight entry for an
+ * orphan.
+ */
+export declare const DEFAULT_INBOX_DRAIN_GRACE_MS = 30000;
+/**
+ * Attempt cap (constraint 3). Small + finite — unlike the outbox's
+ * wall-clock-only retry budget (Decision 4 explicitly rejects an attempt
+ * count there, because restart gaps make attempt-count meaningless across
+ * process lifetimes), THIS driver's retries are only ever in-process (a
+ * fresh process gets a fresh, empty attempts `Map` + — today — a fresh,
+ * empty in-memory inbox), so a small attempt cap is the right complementary
+ * bound to the TTL below: it stops hammering a persistently-broken
+ * `onNotify` path quickly, without waiting a full day to give up.
+ */
+export declare const DEFAULT_INBOX_MAX_ATTEMPTS = 5;
+/**
+ * Wall-clock TTL (constraint 3), mirroring the outbox's `DEFAULT_TTL_MS`
+ * (`outbox.ts`) — same 24h budget, same rationale (an 8h-class outage fits
+ * comfortably; anything longer legitimately downgrades to the give-up path).
+ */
+export declare const DEFAULT_INBOX_TTL_MS: number;
+/** Per-tick counters, mainly for test assertions + operator diagnostics. */
+export interface InboxDriveSummary {
+    /** Entries whose `onNotify` was actually invoked this tick. */
+    readonly attempted: number;
+    /** Entries successfully re-fired + marked processed this tick. */
+    readonly drained: number;
+    /** `onNotify` invocations that threw this tick (entry stays undrained). */
+    readonly failed: number;
+    /**
+     * Entries in the exhausted (attempts-cap OR TTL) state as of this tick —
+     * counted whether they crossed the threshold just now or were already
+     * past it. There is no store-side "remove" primitive to stop re-counting
+     * them; skipping the re-fire (constraint 3/4), not the counting, is what
+     * matters.
+     */
+    readonly gaveUp: number;
+}
+export interface InboxDriveDeps {
+    readonly inbox: Inbox;
+    /**
+     * The SAME callback passed to `createHttpsServer` — re-invoked verbatim
+     * for an orphaned entry. The cast from `InboxEntry.payload` (`unknown` at
+     * the store layer by design — see `@groundnuty/macf-core`'s
+     * `delivery/store.ts`) to `NotifyPayload` is sound because BOTH
+     * `inbox.accept()` call sites in `https.ts` persist a NotifyPayload:
+     *   - the legacy `/notify` edge persists the `NotifyPayloadSchema`-
+     *     validated `result.data`;
+     *   - the A2A `message/send` edge persists `a2aMessageToNotifyPayload(msg)`
+     *     — the CONVERTED payload, NOT the raw `Message` (this uniform-persist
+     *     is the #744 correctness fix; persisting the raw `Message` would make
+     *     an A2A orphan re-fire a malformed NotifyPayload with every field
+     *     undefined).
+     * Nothing else ever calls `accept()`, so `entry.payload` is invariably a
+     * NotifyPayload by the time this driver re-fires it.
+     */
+    readonly onNotify: (payload: NotifyPayload) => Promise<void>;
+    /**
+     * Per-entry-id attempt counter, owned + persisted ACROSS calls by the
+     * CALLER (`inbox-ticker.ts` in production; a test file directly) — kept
+     * entirely out of the store (constraint 3: never touches the frozen
+     * `InboxEntry` schema). Pass the SAME `Map` on every `driveInboxOnce` call
+     * for the cap to actually accumulate across ticks.
+     */
+    readonly attempts: Map<string, number>;
+    readonly logger?: Logger;
+    /** Injectable epoch-ms clock (testing). Default `Date.now`. */
+    readonly now?: () => number;
+    readonly graceMs?: number;
+    readonly maxAttempts?: number;
+    readonly ttlMs?: number;
+}
+/**
+ * Drive one orphan-drain tick: for every undrained inbox entry, either skip
+ * it (too young — constraint 1; or already exhausted — constraint 3), give
+ * it up (TTL exceeded — constraint 3), or re-fire `onNotify` (success →
+ * `markProcessed`, constraint 2; failure → bump the attempt counter,
+ * constraint 3). Callable directly by tests with an explicit `now` + a
+ * fresh `attempts` Map, or wrapped in `inbox-ticker.ts`'s periodic timer.
+ */
+export declare function driveInboxOnce(deps: InboxDriveDeps): Promise<InboxDriveSummary>;
+//# sourceMappingURL=inbox-drain-driver.d.ts.map

package/dist/delivery/inbox-drain-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox-drain-driver.d.ts","sourceRoot":"","sources":["../../src/delivery/inbox-drain-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAsB,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgFrF"}