@loomwork/event-runtime 0.0.0-stage → 0.1.1

package/dist/types.js

@@ -0,0 +1,429 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPTIONAL_EVENT_STORE_METHODS = exports.RESERVED_LATE_PREFIX = exports.INBOX_LAYOUT_STREAM = exports.INBOX_REGISTRY_SUFFIX = exports.INBOX_TOPIC_SEQ_BASE = exports.QUARANTINE_STREAM_PREFIX = exports.INBOX_STREAM_PREFIX = exports.RESERVED_STREAM_PREFIX = exports.EVENT_STORE_SPI_VERSION = void 0;
+exports.isReservedStream = isReservedStream;
+exports.quarantineStreamId = quarantineStreamId;
+exports.chainIdOfFirst = chainIdOfFirst;
+exports.reservedLateKey = reservedLateKey;
+exports.reservedLateOrigin = reservedLateOrigin;
+exports.inboxTopicHash = inboxTopicHash;
+exports.inboxTopicStreamId = inboxTopicStreamId;
+exports.inboxRegistryStreamId = inboxRegistryStreamId;
+exports.hasInboxStreamShape = hasInboxStreamShape;
+exports.inboxChainOf = inboxChainOf;
+exports.archiveChainOf = archiveChainOf;
+exports.inboxStreamsOfChain = inboxStreamsOfChain;
+exports.inboxStreamsOfChainDeep = inboxStreamsOfChainDeep;
+exports.iterateExecutionIds = iterateExecutionIds;
+exports.appendBatchOf = appendBatchOf;
+exports.headOf = headOf;
+exports.readRangeOf = readRangeOf;
+const node_crypto_1 = require("node:crypto");
+/**
+ * SPI version for the {@link EventStore} contract (ADR 0033). Bump MINOR when adding an
+ * optional method, MAJOR when changing a required method's contract. Pinned by
+ * `runEventStoreConformance` in `@loomwork/testing`.
+ *
+ * 1.1.0: added optional `listExecutions()` (enumerate distinct executionIds — powers
+ *   `loom retention run` / `loom compliance report` over cold storage).
+ * 1.2.0: added optional `listExecutionsPage()` (SP-1, db-copilot infra #184 — keyset-paged
+ *   enumeration so maintenance passes run in bounded memory at year scale). Consumers use
+ *   {@link iterateExecutionIds}, which prefers pages and falls back to `listExecutions()`.
+ * 1.3.0: added optional `appendBatch()` (ADR 0074 D1 — one round-trip for many envelopes,
+ *   which is what lets `CoalescingEventStore` raise the write ceiling). Consumers use
+ *   {@link appendBatchOf}, which prefers it and falls back to a per-envelope `append` loop,
+ *   so a backend that omits it is byte-identical to before.
+ * 1.4.0: added optional `head()` (the tip as one indexed `MAX(sequence)` — `fork()` was
+ *   reading the whole parent log to validate a fork point). Consumers use {@link headOf}.
+ * 1.5.0: added optional `truncatePrefixKeeping()` (ADR 0106 — compaction that keeps an app's
+ *   pinned event kinds, ADR 0055 D1). A store that omits it never loses an event, but
+ *   `LogLifecycle.compact` then can NEVER compact past the first pinned event (it stops just
+ *   below it on every pass, and warns): a long-lived execution that records a finding early
+ *   keeps an unbounded replay tail on such a store.
+ * 2.0.0: `listExecutionsPage()` ORDER and CURSOR pinned (L10, ADR 0108). "Lexicographic"
+ *   named no one order: a Postgres store paged in the database collation (`en_US.UTF-8`:
+ *   `a_b` < `A1`) while `ShardedEventStore` merged in JavaScript's (`A1` < `a_b`), and
+ *   resuming every shard from the merged page's last id skipped executions. Ids now page in
+ *   Unicode CODE POINT order ({@link compareExecutionIds}; = UTF-8 byte order, SQL
+ *   `COLLATE "C"`, SQLite BINARY); the cursor, which was OPAQUE, is now an executionId — any
+ *   string, the page holding the ids strictly after it; and `nextCursor` MUST be the page's
+ *   last id. MAJOR because a conforming 1.x store (any order, any opaque cursor token) can
+ *   fail the kit, and `TenantScopedEventStore`/`ShardedEventStore` now depend on all three —
+ *   the same rule that made MemoryStore 2.0.0 (ADR 0091). No method was added or removed: a
+ *   store that already paged ids in that order with id cursors (SQLite; the in-memory store
+ *   on well-formed BMP ids) conforms unchanged.
+ * 2.1.0: the optional `acquireFenceIf(id, { fence, parkSeq })` (ADR 0118 R8k: an atomic
+ *   compare-and-set on the fence token AND "no answering event past the park"). The constant
+ *   moved with the rest of the Wave 2 bump (W2-0); the method, its conformance cases and the
+ *   decorator forwarding landed with R8k. It reads the classification W2-0 shipped:
+ *   {@link EVENT_KIND_CLASS} / {@link isAnsweringKind} (every kernel event kind is `answering`
+ *   or `ignorable`, a required total map). No existing method changed, so a 2.0.0 store conforms.
+ * 2.2.0: the optional `appendIfUnchanged(id, event, { head, fence, anchor })` (ADR 0116 amendment, R11:
+ *   a late reward on a finished execution). ONE atomic step: append `event` iff the execution
+ *   still EXISTS (sequence 0), its stored head is exactly `expect.head` AND its fence token is
+ *   exactly `expect.fence`; otherwise change nothing and report the current tip. It never
+ *   presents or adopts a fence token, so it can neither supersede a live holder nor be
+ *   written under one it did not observe. A store that omits it makes `recordOutcome` refuse.
+ *   No existing method changed, so a 2.1.0 store conforms.
+ * 2.3.0: a SEMANTIC minor, no signature change (ADR 0129). The `anchor` of an observation MUST
+ *   differ between two incarnations of an execution id, EVEN WHEN their sequence-0 envelopes
+ *   are byte-identical (a delete followed by a re-creation under a frozen clock). A store
+ *   claiming 2.3.0 therefore assigns a monotonic incarnation when it durably creates sequence 0
+ *   and returns it as the anchor; it lives in STORE METADATA only, never in an event, a fold, a
+ *   snapshot or a hash, so replay stays byte-identical. A log created before the store gained
+ *   that metadata may keep the legacy {@link creationMarker} (`timestamp:id`) until it is
+ *   deleted (no backfill). A store that cannot assign one keeps 2.2.0 behaviour and does not
+ *   claim 2.3.0.
+ * 2.4.0: the optional `storeNow(): Promise<number>` (ADR 0110 amendment, D10a) - the store's OWN
+ *   clock in epoch ms, the one a multi-node fleet shares (Postgres: database time), the EventStore
+ *   twin of `LeaseStore.storeNow()` (L29). It lets two nodes agree on an age (a message's TTL is
+ *   judged against the instant it was stamped) without trusting either node's wall clock. A
+ *   single-process store (memory, SQLite) need not implement it; a caller then falls back to its
+ *   injected clock. Values must be finite, non-negative, and non-decreasing across sequential
+ *   calls. Additive: no existing method changed, so a 2.3.0 store conforms.
+ * 2.5.0: the optional `sealingCapability(): SealingCapability | undefined` (ADR 0130 residuals D7,
+ *   RESERVED - no behaviour yet): what this node's store seals AND therefore opens, so the kernel
+ *   can compare it to a `metadata.seal` marker ({@link SealMarker}) on a stored envelope. Absent, or
+ *   returning `undefined`, means "seals nothing, opens nothing" (the correct reading for a store
+ *   that cannot open sealed data). Every decorator forwards, overrides or refuses it (it is listed
+ *   in {@link OPTIONAL_EVENT_STORE_METHODS}); `ShardedEventStore` returns a capability only when
+ *   every shard agrees. Also reserves the control stream prefix {@link QUARANTINE_STREAM_PREFIX}
+ *   (`__loom_quarantine__:<chainId>`). Also the optional `readAtRest(): AtRestEventReader` (ADR 0130
+ *   D9): a read-only view of the envelopes AS STORED (never decrypted), so the quarantine verbs can
+ *   step over a sealed value without asking the KeyStore; replaces a hidden symbol protocol. Every
+ *   decorator forwards it (`EncryptingEventStore` overrides it with its inner store's raw reads,
+ *   `ShardedEventStore` routes per stream). Additive: no existing method changed, so a 2.4.0 store
+ *   conforms.
+ * 2.6.0: the optional `deleteThrough(executionId, through)` (ADR 0139 D8): one atomic delete of every
+ *   event with `sequence <= through`, sequence 0 included. A caller that archived a stream up to
+ *   `through` (the terminal delete of a durable inbox) removes exactly what it archived, so a message
+ *   appended in between survives. Every decorator forwards it. Additive: no existing method changed, so a
+ *   2.5.0 store conforms (a caller then refuses the delete it cannot make safe).
+ *
+ * Every optional method is listed in {@link OPTIONAL_EVENT_STORE_METHODS}; adding one here
+ * without listing it there is a compile error. `OptionalEventStoreMethod` is derived from this
+ * interface, and `DecoratorPlan` makes every one of its keys REQUIRED, so a new optional method
+ * is also a compile error in every decorator whose plan `satisfies DecoratorPlan<EventStore,
+ * OptionalEventStoreMethod>` until it forwards, overrides or refuses it. A decorator that uses
+ * no plan at all is caught by the decorator conformance kit instead (and the `packages/spec`
+ * fitness test makes every in-repo decorator run it).
+ */
+exports.EVENT_STORE_SPI_VERSION = "2.6.0";
+/**
+ * Reserved-stream prefix. Control facts (retention `__loom_lifecycle__`, erasure
+ * `__loom_erasure__`) are stored under executionIds beginning with this, so
+ * {@link listExecutions} surfaces them too. Enumerators over *real* executions filter with
+ * {@link isReservedStream}.
+ */
+exports.RESERVED_STREAM_PREFIX = "__loom_";
+/**
+ * Whether an executionId names a reserved control stream rather than a real execution.
+ *
+ * The blank id `""` is reserved too (ADR 0107). It names no execution, and it is where the
+ * pre-ADR-0106 compaction bug wrote the events of every resume that followed a compaction.
+ * Reserving it keeps enumerators from treating that stream as an execution to recover, retain
+ * or report, and keeps every runtime entry point from writing to it again.
+ */
+function isReservedStream(executionId) {
+    return executionId === "" || executionId.startsWith(exports.RESERVED_STREAM_PREFIX);
+}
+/**
+ * The reserved control stream a chain's durable inbox lives in (ADR 0110 D1):
+ * `__loom_inbox__:<chainId>`. Defined here, beside {@link isReservedStream}, so a store decorator
+ * (the crypto plugin's `EncryptingEventStore`) and the compliance erasure can recognise it without
+ * depending on the workflow runtime.
+ */
+exports.INBOX_STREAM_PREFIX = "__loom_inbox__:";
+/**
+ * (SPI 2.5.0, ADR 0130 residuals D9; written by `quarantineInbox`): the control stream holding the
+ * verbatim copies of a chain's QUARANTINED inbox messages, `__loom_quarantine__:<chainId>`. It
+ * belongs to the same chain as the inbox, so {@link inboxChainOf} maps it to the chain (the crypto
+ * subject mapping, purge and delete-with-chain then cover it) and {@link InboxStreams.quarantine}
+ * names it. Reserved by prefix like every `__loom_` stream.
+ */
+exports.QUARANTINE_STREAM_PREFIX = "__loom_quarantine__:";
+/** The reserved stream holding `chainId`'s quarantined messages (see {@link QUARANTINE_STREAM_PREFIX}). */
+function quarantineStreamId(chainId) {
+    return `${exports.QUARANTINE_STREAM_PREFIX}${chainId}`;
+}
+/**
+ * The chain an execution belongs to, read from its sequence 0 alone (the fold's own rule: a valid `forkChain` stamp wins,
+ * else the start payload's `chainId`, else the execution itself) — so `send` needs no fold.
+ */
+function chainIdOfFirst(first, executionId) {
+    const valid = (v) => {
+        if (v === null || typeof v !== "object")
+            return undefined;
+        const { chainId, generation } = v;
+        return typeof chainId === "string" &&
+            chainId.length > 0 &&
+            Number.isSafeInteger(generation) &&
+            generation >= 0
+            ? chainId
+            : undefined;
+    };
+    return valid(first.metadata?.forkChain) ?? valid(first.payload) ?? executionId;
+}
+/**
+ * ADR 0110 amendment, D10b — per-topic inbox streams. A chain's inbox may hold one stream per topic,
+ * beside the legacy single stream:
+ *
+ *  - `__loom_inbox__:<chainId>#<16 hex>` — the messages of ONE topic (the first 16 hex digits of the
+ *    SHA-256 of the topic name);
+ *  - `__loom_inbox__:<chainId>#reg` — the chain's REGISTRY: one `INBOX_TOPIC` event per topic that
+ *    ever had a stream, so every stream of a chain is enumerable without `listExecutionsPage`.
+ *
+ * The cursors stay ONE number space (the fold is unchanged): a topic stream's sequences start at
+ * {@link INBOX_TOPIC_SEQ_BASE}, far above any legacy-stream sequence, so a legacy message of a topic
+ * (below the base) always precedes its topic-stream messages and the two can never collide.
+ */
+exports.INBOX_TOPIC_SEQ_BASE = 2 ** 40;
+/** The suffix of a chain's registry stream (see {@link INBOX_TOPIC_SEQ_BASE}). */
+exports.INBOX_REGISTRY_SUFFIX = "#reg";
+/**
+ * The control stream whose existence is the FLEET-WIDE opt-in to per-topic writing (ADR 0110 D10b):
+ * one `INBOX_LAYOUT` event, written once by `runtime.enableInboxTopicStreams`. Reserved by prefix.
+ */
+exports.INBOX_LAYOUT_STREAM = "__loom_inbox_layout__";
+const TOPIC_STREAM_SUFFIX = /#[0-9a-f]{16}$/;
+/**
+ * ADR 0139 D4: the prefix of an ARCHIVE key (never a live stream) that holds envelopes of a reserved
+ * stream which could not extend the stream's main archive run: a straggler appended at or below the
+ * archive's last sequence, for example by a send that raced the owner's terminal delete. The key is
+ * `__loom_late__:<stream>@<n>`. It begins with {@link RESERVED_STREAM_PREFIX}, which `start` refuses for
+ * every execution id, so no live chain or execution can ever have that shape, and {@link inboxChainOf}
+ * (live ids only) is untouched: an archive-key context asks {@link archiveChainOf} instead.
+ */
+exports.RESERVED_LATE_PREFIX = "__loom_late__:";
+const LATE_KEY = /^(.+)@([1-9][0-9]*)$/;
+/** The archive key of the `n`th (1-based) late run of a reserved stream (see {@link RESERVED_LATE_PREFIX}). */
+function reservedLateKey(streamId, n) {
+    return `${exports.RESERVED_LATE_PREFIX}${streamId}@${n}`;
+}
+/** The reserved stream (and run number) an archive key of {@link reservedLateKey} shape belongs to. */
+function reservedLateOrigin(key) {
+    if (!key.startsWith(exports.RESERVED_LATE_PREFIX))
+        return undefined;
+    const m = LATE_KEY.exec(key.slice(exports.RESERVED_LATE_PREFIX.length));
+    return m === null ? undefined : { streamId: m[1], n: Number(m[2]) };
+}
+/** The 16-hex-digit stream suffix of `topic` (first 8 bytes of its SHA-256). */
+function inboxTopicHash(topic) {
+    return (0, node_crypto_1.createHash)("sha256").update(topic).digest("hex").slice(0, 16);
+}
+/** The reserved stream holding `topic`'s messages for `chainId` (see {@link INBOX_TOPIC_SEQ_BASE}). */
+function inboxTopicStreamId(chainId, topic) {
+    return `${exports.INBOX_STREAM_PREFIX}${chainId}#${inboxTopicHash(topic)}`;
+}
+/** The chain's registry stream (see {@link INBOX_TOPIC_SEQ_BASE}). */
+function inboxRegistryStreamId(chainId) {
+    return `${exports.INBOX_STREAM_PREFIX}${chainId}${exports.INBOX_REGISTRY_SUFFIX}`;
+}
+/**
+ * Would an id, taken as a CHAIN id, alias a topic or registry stream of another chain
+ * (`<x>#<16 hex>` or `<x>#reg`)? Such an id is refused at `start` once the inbox is on.
+ */
+function hasInboxStreamShape(id) {
+    return id.endsWith(exports.INBOX_REGISTRY_SUFFIX) || TOPIC_STREAM_SUFFIX.test(id);
+}
+/**
+ * The chain id an inbox stream belongs to, or `undefined` when `executionId` is not an inbox
+ * stream (or names an empty chain). A chain's id is its generation-0 execution id (or a fork's
+ * fresh one), so a decorator that maps executions to erasure subjects can map the chain's streams
+ * (legacy, per-topic and registry alike) to the same subject as its owner.
+ */
+function inboxChainOf(executionId) {
+    if (executionId.startsWith(exports.QUARANTINE_STREAM_PREFIX)) {
+        // ADR 0130 residuals D9 (reserved): the quarantine copy belongs to the chain, under the same owner subject.
+        const quarantined = executionId.slice(exports.QUARANTINE_STREAM_PREFIX.length);
+        return quarantined.length > 0 ? quarantined : undefined;
+    }
+    if (!executionId.startsWith(exports.INBOX_STREAM_PREFIX))
+        return undefined;
+    let chain = executionId.slice(exports.INBOX_STREAM_PREFIX.length);
+    if (chain.endsWith(exports.INBOX_REGISTRY_SUFFIX))
+        chain = chain.slice(0, -exports.INBOX_REGISTRY_SUFFIX.length);
+    else if (TOPIC_STREAM_SUFFIX.test(chain))
+        chain = chain.slice(0, -17);
+    return chain.length > 0 ? chain : undefined;
+}
+/**
+ * {@link inboxChainOf} for an ARCHIVE key: the same chain for a reserved stream's own key, and, for a
+ * late-run key ({@link reservedLateKey}), the chain of the stream it was split from. Archive-key
+ * contexts only (the sealing subject of `EncryptingArchiveStore`, the archive listings); a live stream
+ * id is never a late key, so live code keeps calling {@link inboxChainOf}.
+ */
+function archiveChainOf(key) {
+    return inboxChainOf(reservedLateOrigin(key)?.streamId ?? key);
+}
+/**
+ * Every inbox stream a chain has on `store`: the legacy stream, the registry (when it exists) and one
+ * stream per registered topic. The registry is bounded by the per-chain topic cap, so this is one small
+ * read. Used by every site that must reach ALL of a chain's streams (retirement, erasure, lifecycle
+ * deletion) without a second copy of the naming rule. Delete `topics`, then `legacy`, then `registry`
+ * LAST: a crash midway then leaves the remaining topic streams still findable.
+ */
+async function inboxStreamsOfChain(store, chainId) {
+    const registry = inboxRegistryStreamId(chainId);
+    const entries = await store.read(registry);
+    const topics = [];
+    const seen = new Set();
+    for (const e of entries) {
+        const topic = e.payload?.topic;
+        if (typeof topic !== "string" || seen.has(topic))
+            continue;
+        seen.add(topic);
+        topics.push(inboxTopicStreamId(chainId, topic));
+    }
+    return {
+        legacy: `${exports.INBOX_STREAM_PREFIX}${chainId}`,
+        registry: entries.length > 0 ? registry : undefined,
+        topics,
+        quarantine: quarantineStreamId(chainId),
+    };
+}
+/**
+ * {@link inboxStreamsOfChain} PLUS a prefix scan: the topic streams the registry does not name (a
+ * sender that crashed between its append and its registration, a registry deleted underneath a
+ * sender, a stale "already registered" cache). Reaches them through the store's keyset-paged
+ * enumeration when it has one (`listExecutionsPage`, ids in code point order, so the chain's streams are
+ * one contiguous run after its prefix); a store without it gets the registry's answer alone. It is a
+ * BACKSTOP for erasure and the orphan sweep, not the hot path (the scan is one indexed range query).
+ */
+async function inboxStreamsOfChainDeep(store, chainId) {
+    const found = await inboxStreamsOfChain(store, chainId);
+    if (store.listExecutionsPage === undefined)
+        return found;
+    const prefix = `${exports.INBOX_STREAM_PREFIX}${chainId}#`;
+    const registry = inboxRegistryStreamId(chainId);
+    const known = new Set(found.topics);
+    let hasRegistry = found.registry !== undefined;
+    let cursor = prefix;
+    for (;;) {
+        const page = await store.listExecutionsPage({ cursor, limit: 200 });
+        let past = false;
+        for (const id of page.executionIds) {
+            if (!id.startsWith(prefix)) {
+                past = true;
+                break;
+            }
+            if (id === registry)
+                hasRegistry = true;
+            else if (TOPIC_STREAM_SUFFIX.test(id) && id.length === prefix.length + 16 && !known.has(id)) {
+                known.add(id);
+                found.topics.push(id);
+            }
+        }
+        if (past || page.nextCursor === undefined || page.nextCursor === cursor)
+            break;
+        cursor = page.nextCursor;
+    }
+    return {
+        legacy: found.legacy,
+        registry: hasRegistry ? registry : undefined,
+        topics: found.topics,
+        quarantine: found.quarantine,
+    };
+}
+/**
+ * The runtime list of {@link OptionalEventStoreMethod}, for the decorator conformance kit.
+ * The check below makes a new optional method on the interface a compile error here until it
+ * is listed — so the kit can never quietly stop checking one.
+ */
+exports.OPTIONAL_EVENT_STORE_METHODS = [
+    "appendBatch",
+    "readRange",
+    "head",
+    "acquireFence",
+    "acquireFenceIf",
+    "appendIfUnchanged",
+    "storeNow",
+    "sealingCapability",
+    "readAtRest",
+    "copyPrefix",
+    "deleteExecution",
+    "deleteThrough",
+    "truncatePrefix",
+    "truncatePrefixKeeping",
+    "listExecutions",
+    "listExecutionsPage",
+];
+// A new optional EventStore method that is not listed above makes this line a compile error.
+const _exhaustiveOptionalMethods = true;
+void _exhaustiveOptionalMethods;
+/**
+ * SP-2 — the one enumeration loop every maintenance pass shares: prefers the
+ * bounded-memory paged surface, falls back to `listExecutions()`, and REFUSES a
+ * store with neither (silent partial passes are how retention deletes evidence
+ * and read models under-index).
+ */
+async function* iterateExecutionIds(source, pageSize = 1000) {
+    if (source.listExecutionsPage !== undefined) {
+        let cursor;
+        for (;;) {
+            const page = await source.listExecutionsPage({
+                ...(cursor !== undefined && { cursor }),
+                limit: pageSize,
+            });
+            for (const id of page.executionIds)
+                yield id;
+            if (page.nextCursor === undefined)
+                return;
+            if (page.nextCursor === cursor) {
+                // Audit hardening: a buggy store returning a non-advancing cursor would
+                // spin every maintenance pass forever — refuse loudly instead.
+                throw new TypeError("iterateExecutionIds: listExecutionsPage returned a non-advancing cursor (store bug) — aborting the scan");
+            }
+            cursor = page.nextCursor;
+        }
+    }
+    if (source.listExecutions !== undefined) {
+        for (const id of await source.listExecutions())
+            yield id;
+        return;
+    }
+    throw new TypeError("iterateExecutionIds: the store supports neither listExecutionsPage() nor listExecutions() — it cannot be enumerated");
+}
+/**
+ * Append many envelopes through a store that may or may not implement the optional
+ * `appendBatch` fast-path (ADR 0074 D1). Uses the single round-trip when available, else
+ * falls back to a sequential `append` loop — so callers never branch on the capability.
+ *
+ * The fallback is deliberately **sequential**, not `Promise.all`: `append` is
+ * order-sensitive per execution, and a parallel loop would also lose the all-or-nothing
+ * property that the native path guarantees. The fallback is a correctness-preserving
+ * degradation, not a performance one — it wins nothing, and is not meant to.
+ */
+async function appendBatchOf(store, envelopes) {
+    if (envelopes.length === 0)
+        return;
+    if (store.appendBatch !== undefined)
+        return store.appendBatch(envelopes);
+    for (const envelope of envelopes)
+        await store.append(envelope);
+}
+/**
+ * Read `[fromSequence..toSequence]` from a store that may or may not implement the
+ * optional `readRange` fast-path. Uses the native indexed range when available,
+ * else falls back to `readFrom` + a bounded slice — so every caller gets the
+ * range without having to branch on the capability.
+ */
+/**
+ * The tip of an execution's log through the optional {@link EventStore.head} fast-path,
+ * falling back to reading it. `null` means the execution has no events at all.
+ */
+async function headOf(store, executionId) {
+    if (store.head)
+        return store.head(executionId);
+    const events = await store.read(executionId);
+    return events.length === 0 ? null : (events[events.length - 1]?.sequence ?? null);
+}
+async function readRangeOf(store, executionId, fromSequence, toSequence) {
+    if (toSequence < fromSequence)
+        return [];
+    if (store.readRange)
+        return store.readRange(executionId, fromSequence, toSequence);
+    const from = await store.readFrom(executionId, fromSequence);
+    return from.filter((e) => e.sequence <= toSequence);
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AAgHA,4CAEC;AAoBD,gDAEC;AAmCD,wCAYC;AAyCD,0CAEC;AAGD,gDAIC;AAGD,wCAEC;AAGD,gDAEC;AAGD,sDAEC;AAMD,kDAEC;AAQD,oCAWC;AAQD,wCAEC;AAqBD,kDAoBC;AAUD,0DAkCC;AAkZD,kDA8BC;AAgBD,sCAOC;AAYD,wBAOC;AAED,kCAUC;AAx1BD,6CAAyC;AAKzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACU,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAE/C;;;;;GAKG;AACU,QAAA,sBAAsB,GAAG,SAAS,CAAC;AAEhD;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,WAAmB;IAClD,OAAO,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,8BAAsB,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG,iBAAiB,CAAC;AAErD;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,2GAA2G;AAC3G,SAAgB,kBAAkB,CAAC,OAAe;IAChD,OAAO,GAAG,gCAAwB,GAAG,OAAO,EAAE,CAAC;AACjD,CAAC;AA+BD;;;GAGG;AACH,SAAgB,cAAc,CAAC,KAAoB,EAAE,WAAmB;IACtE,MAAM,KAAK,GAAG,CAAC,CAAU,EAAsB,EAAE;QAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAgD,CAAC;QACjF,OAAO,OAAO,OAAO,KAAK,QAAQ;YAChC,OAAO,CAAC,MAAM,GAAG,CAAC;YAClB,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YAC/B,UAAqB,IAAI,CAAC;YAC3B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,oBAAoB,GAAG,CAAC,IAAI,EAAE,CAAC;AAE5C,kFAAkF;AACrE,QAAA,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;GAGG;AACU,QAAA,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC,+GAA+G;AAC/G,SAAgB,eAAe,CAAC,QAAgB,EAAE,CAAS;IACzD,OAAO,GAAG,4BAAoB,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,uGAAuG;AACvG,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,4BAAoB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,gFAAgF;AAChF,SAAgB,cAAc,CAAC,KAAa;IAC1C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,uGAAuG;AACvG,SAAgB,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,OAAO,GAAG,2BAAmB,GAAG,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,sEAAsE;AACtE,SAAgB,qBAAqB,CAAC,OAAe;IACnD,OAAO,GAAG,2BAAmB,GAAG,OAAO,GAAG,6BAAqB,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,CAAC,6BAAqB,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,WAAmB;IAC9C,IAAI,WAAW,CAAC,UAAU,CAAC,gCAAwB,CAAC,EAAE,CAAC;QACrD,4GAA4G;QAC5G,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,gCAAwB,CAAC,MAAM,CAAC,CAAC;QACvE,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,2BAAmB,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,2BAAmB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,QAAQ,CAAC,6BAAqB,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,6BAAqB,CAAC,MAAM,CAAC,CAAC;SAC5F,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,CAAC;AAChE,CAAC;AAcD;;;;;;GAMG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA+B,EAC/B,OAAe;IAEf,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAI,CAAC,CAAC,OAAsC,EAAE,KAAK,CAAC;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG,2BAAmB,GAAG,OAAO,EAAE;QAC1C,QAAQ,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACnD,MAAM;QACN,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAAiF,EACjF,OAAe;IAEf,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,MAAM,GAAG,GAAG,2BAAmB,GAAG,OAAO,GAAG,CAAC;IACnD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,WAAW,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC;IAC/C,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM;YACR,CAAC;YACD,IAAI,EAAE,KAAK,QAAQ;gBAAE,WAAW,GAAG,IAAI,CAAC;iBACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACd,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM;YAAE,MAAM;QAC/E,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AA4VD;;;;GAIG;AACU,QAAA,4BAA4B,GAAG;IAC1C,aAAa;IACb,WAAW;IACX,MAAM;IACN,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;IACnB,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB,gBAAgB;IAChB,oBAAoB;CACkC,CAAC;AAMzD,6FAA6F;AAC7F,MAAM,0BAA0B,GAA4D,IAAI,CAAC;AACjG,KAAK,0BAA0B,CAAC;AAkBhC;;;;;GAKG;AACI,KAAK,SAAS,CAAC,CAAC,mBAAmB,CACxC,MAA2B,EAC3B,QAAQ,GAAG,IAAI;IAEf,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,MAA0B,CAAC;QAC/B,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC;gBAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvC,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,YAAY;gBAAE,MAAM,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC1C,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC/B,wEAAwE;gBACxE,+DAA+D;gBAC/D,MAAM,IAAI,SAAS,CACjB,yGAAyG,CAC1G,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,MAAM,EAAE,IAAI,MAAM,MAAM,CAAC,cAAc,EAAE;YAAE,MAAM,EAAE,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,SAAS,CACjB,qHAAqH,CACtH,CAAC;AACJ,CAAC;AAMD;;;;;;;;;GASG;AACI,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,SAAmC;IAEnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACnC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzE,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH;;;GAGG;AACI,KAAK,UAAU,MAAM,CAC1B,KAAwC,EACxC,WAAmB;IAEnB,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;AACpF,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,KAA0D,EAC1D,WAAmB,EACnB,YAAoB,EACpB,UAAkB;IAElB,IAAI,UAAU,GAAG,YAAY;QAAE,OAAO,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC;AACtD,CAAC"}

package/dist/writeConflicts.d.ts

@@ -0,0 +1,46 @@
+/**
+ * A write lost the race for a `(executionId, sequence)` slot: something else already
+ * occupies it. Every backend rejects this — SQLite and Postgres on their
+ * `UNIQUE (execution_id, sequence)` constraint, the reference in-memory store on an
+ * explicit check — and they normalize the failure to THIS type so a caller can tell a
+ * sequence conflict from an ordinary write error without matching on driver text.
+ *
+ * The sibling of {@link StaleFenceError}, and the case fencing does not cover. Fencing
+ * rejects a writer known to be superseded — it engages only once a token has been
+ * acquired for the execution. Sequences are allocated per-process from folded state
+ * (`ExecutionJournal` seeds from `vm.getState().sequence` and increments locally), so two
+ * unfenced writers recovering the same execution allocate the SAME next sequence and
+ * neither is a zombie. This is what stops the second one silently interleaving into the
+ * log.
+ */
+export declare class DuplicateSequenceError extends Error {
+    readonly executionId: string;
+    readonly sequence: number;
+    /** The driver error this was normalized from, when there was one. */
+    readonly cause?: unknown | undefined;
+    constructor(executionId: string, sequence: number, 
+    /** The driver error this was normalized from, when there was one. */
+    cause?: unknown | undefined);
+}
+/**
+ * An envelope re-used an `id` that is already in the log. Ids are unique **across the
+ * whole store**, not per execution — both SQL backends key `id` as the events table's
+ * PRIMARY KEY — and every backend rejects a collision rather than storing the second
+ * envelope or silently treating it as a re-delivery of the first.
+ *
+ * The other of the events table's two keys, and a genuinely different failure from
+ * {@link DuplicateSequenceError}: a taken SEQUENCE means another writer reached that slot
+ * in this execution's log (a lost race), while a taken ID means the same envelope identity
+ * was minted twice (a bug in whatever produced it). Reporting either as the other sends
+ * the reader hunting the wrong problem, which is why they are separate types.
+ */
+export declare class DuplicateEnvelopeIdError extends Error {
+    readonly envelopeId: string;
+    readonly executionId: string;
+    /** The driver error this was normalized from, when there was one. */
+    readonly cause?: unknown | undefined;
+    constructor(envelopeId: string, executionId: string, 
+    /** The driver error this was normalized from, when there was one. */
+    cause?: unknown | undefined);
+}
+//# sourceMappingURL=writeConflicts.d.ts.map

package/dist/writeConflicts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeConflicts.d.ts","sourceRoot":"","sources":["../src/writeConflicts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAHf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM;IACzB,qEAAqE;IAC5D,KAAK,CAAC,EAAE,OAAO,YAAA;CAQ3B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAE/C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAHf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM;IAC5B,qEAAqE;IAC5D,KAAK,CAAC,EAAE,OAAO,YAAA;CAQ3B"}

package/dist/writeConflicts.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DuplicateEnvelopeIdError = exports.DuplicateSequenceError = void 0;
+/**
+ * A write lost the race for a `(executionId, sequence)` slot: something else already
+ * occupies it. Every backend rejects this — SQLite and Postgres on their
+ * `UNIQUE (execution_id, sequence)` constraint, the reference in-memory store on an
+ * explicit check — and they normalize the failure to THIS type so a caller can tell a
+ * sequence conflict from an ordinary write error without matching on driver text.
+ *
+ * The sibling of {@link StaleFenceError}, and the case fencing does not cover. Fencing
+ * rejects a writer known to be superseded — it engages only once a token has been
+ * acquired for the execution. Sequences are allocated per-process from folded state
+ * (`ExecutionJournal` seeds from `vm.getState().sequence` and increments locally), so two
+ * unfenced writers recovering the same execution allocate the SAME next sequence and
+ * neither is a zombie. This is what stops the second one silently interleaving into the
+ * log.
+ */
+class DuplicateSequenceError extends Error {
+    executionId;
+    sequence;
+    cause;
+    constructor(executionId, sequence, 
+    /** The driver error this was normalized from, when there was one. */
+    cause) {
+        super(`duplicate sequence ${sequence} for execution "${executionId}": that slot is already occupied (another writer reached it first)`);
+        this.executionId = executionId;
+        this.sequence = sequence;
+        this.cause = cause;
+        this.name = "DuplicateSequenceError";
+        Object.setPrototypeOf(this, DuplicateSequenceError.prototype);
+    }
+}
+exports.DuplicateSequenceError = DuplicateSequenceError;
+/**
+ * An envelope re-used an `id` that is already in the log. Ids are unique **across the
+ * whole store**, not per execution — both SQL backends key `id` as the events table's
+ * PRIMARY KEY — and every backend rejects a collision rather than storing the second
+ * envelope or silently treating it as a re-delivery of the first.
+ *
+ * The other of the events table's two keys, and a genuinely different failure from
+ * {@link DuplicateSequenceError}: a taken SEQUENCE means another writer reached that slot
+ * in this execution's log (a lost race), while a taken ID means the same envelope identity
+ * was minted twice (a bug in whatever produced it). Reporting either as the other sends
+ * the reader hunting the wrong problem, which is why they are separate types.
+ */
+class DuplicateEnvelopeIdError extends Error {
+    envelopeId;
+    executionId;
+    cause;
+    constructor(envelopeId, executionId, 
+    /** The driver error this was normalized from, when there was one. */
+    cause) {
+        super(`duplicate envelope id "${envelopeId}" (execution "${executionId}"): event ids are unique across the store, and that one is already taken`);
+        this.envelopeId = envelopeId;
+        this.executionId = executionId;
+        this.cause = cause;
+        this.name = "DuplicateEnvelopeIdError";
+        Object.setPrototypeOf(this, DuplicateEnvelopeIdError.prototype);
+    }
+}
+exports.DuplicateEnvelopeIdError = DuplicateEnvelopeIdError;
+//# sourceMappingURL=writeConflicts.js.map

package/dist/writeConflicts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeConflicts.js","sourceRoot":"","sources":["../src/writeConflicts.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAEA;IAJX,YACW,WAAmB,EACnB,QAAgB;IACzB,qEAAqE;IAC5D,KAAe;QAExB,KAAK,CACH,sBAAsB,QAAQ,mBAAmB,WAAW,oEAAoE,CACjI,CAAC;QAPO,gBAAW,GAAX,WAAW,CAAQ;QACnB,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,UAAK,GAAL,KAAK,CAAU;QAKxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;CACF;AAbD,wDAaC;AAED;;;;;;;;;;;GAWG;AACH,MAAa,wBAAyB,SAAQ,KAAK;IAEtC;IACA;IAEA;IAJX,YACW,UAAkB,EAClB,WAAmB;IAC5B,qEAAqE;IAC5D,KAAe;QAExB,KAAK,CACH,0BAA0B,UAAU,iBAAiB,WAAW,0EAA0E,CAC3I,CAAC;QAPO,eAAU,GAAV,UAAU,CAAQ;QAClB,gBAAW,GAAX,WAAW,CAAQ;QAEnB,UAAK,GAAL,KAAK,CAAU;QAKxB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;CACF;AAbD,4DAaC"}

package/memory.d.ts

@@ -0,0 +1,4 @@
+export * from "./dist/InMemoryAsyncEventStore";
+export * from "./dist/InMemoryBranchRegistry";
+export { InMemoryLeaseStore } from "./dist/leases";
+export { InMemoryArchiveStore } from "./dist/InMemoryArchiveStore";

package/memory.js

@@ -0,0 +1,13 @@
+// Browser-safe subpath: only the in-memory stores, so importing it never pulls
+// the SQLite store (better-sqlite3 / node:fs) that the package barrel re-exports.
+// (These packages compile to CommonJS, which bundlers cannot tree-shake — hence a
+// dedicated subpath rather than relying on `sideEffects`.)
+// The in-memory branch registry is node-free too; a browser that forks needs it.
+module.exports = {
+  ...require("./dist/InMemoryAsyncEventStore"),
+  ...require("./dist/InMemoryBranchRegistry"),
+  // ADR 0138: the in-memory archive imports only the node-free SPI file (archiveSpi), not the digest helpers.
+  InMemoryArchiveStore: require("./dist/InMemoryArchiveStore").InMemoryArchiveStore,
+  // ADR 0130 D11: leases.ts has no imports, so the in-memory lease store is browser-safe too.
+  InMemoryLeaseStore: require("./dist/leases").InMemoryLeaseStore,
+};

package/package.json

@@ -1,6 +1,70 @@
 {
   "name": "@loomwork/event-runtime",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "Append-only event store for the Loom framework",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./memory": {
+      "types": "./memory.d.ts",
+      "require": "./memory.js",
+      "default": "./memory.js"
+    },
+    "./sequence": {
+      "types": "./sequence.d.ts",
+      "require": "./sequence.js",
+      "default": "./sequence.js"
+    }
+  },
+  "dependencies": {
+    "@loomwork/core": "^0.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.8"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chhetrisushil/loom.git",
+    "directory": "packages/event-runtime"
+  },
+  "files": [
+    "dist",
+    "src",
+    "memory.d.ts",
+    "memory.js",
+    "sequence.d.ts",
+    "sequence.js",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/**/__tests__",
+    "!src/**/__fixtures__",
+    "!src/**/__snapshots__",
+    "!src/**/__golden__",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "next"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "dev": "tsc --build --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "bench": "vitest bench --run",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "typecheck:tests": "tsc -p tsconfig.test.json"
+  }
 }