@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/app-host/log-pump.js

@@ -0,0 +1,326 @@
+/** First-party Worker log-drive plumbing, not a network authenticator or signer.
+ * Only Core-generated sealed frames cross this boundary. The immutable transport
+ * binding owns authentication and direct transfers; Rust validates all replies.
+ * Discarded generations never feed a successor or infer an append outcome. */
+import { sha256 } from "@noble/hashes/sha2.js";
+import { decode } from "../cbor.js";
+import { uuidToBytes } from "../codec.js";
+import { appServerOutcome, isAppServerProblem } from "./cp-problem.js";
+const MAX_FRAME = 16 * 1024 * 1024;
+const MAX_OBJECT = 9 * 1024 * 1024;
+const MAX_CALLS = 64;
+const MAX_BATCH_BYTES = 64 * 1024 * 1024;
+const METHODS = new Set([
+    "append", "read", "head", "subscribe", "unsubscribe", "put_object", "get_object", "has_objects",
+    "put_snapshot", "get_snapshot", "endorse_snapshot", "stream_join", "stream_leave", "stream_send",
+]);
+export class AppLogHostError extends Error {
+    reason;
+    constructor(reason) {
+        super(`app log host: ${reason}`);
+        this.reason = reason;
+        this.name = "AppLogHostError";
+    }
+}
+function uint(v) {
+    if ((typeof v !== "number" || !Number.isSafeInteger(v)) && typeof v !== "bigint")
+        throw new AppLogHostError("invalid_call");
+    const n = BigInt(v);
+    if (n < 0n || n > (1n << 64n) - 1n)
+        throw new AppLogHostError("invalid_call");
+    return n;
+}
+function equal(a, b) { return a.length === b.length && a.every((x, i) => x === b[i]); }
+/** Calls whose effects do not depend on the order they reach the log: a round
+ * sends each maximal run of them together (each RPC with its own nonce). Every
+ * other method is a barrier, sent alone after everything before it answered.
+ * Replies still reach Rust in call order. */
+const UNORDERED = new Set(["read", "head", "subscribe", "get_object", "has_objects", "put_object", "get_snapshot"]);
+const MAX_CONCURRENT = 6;
+function serverOf(e) { try {
+    return e.server;
+}
+catch {
+    return null; /* hostile getter */
+} }
+function reasonOf(e) { try {
+    return e.reason;
+}
+catch {
+    return null;
+} }
+/** Classify a send failure. A fenced or shape failure says nothing about the network. */
+export function appLogHealth(e, online = globalThis.navigator?.onLine) {
+    const server = serverOf(e);
+    if (isAppServerProblem(server)) {
+        const retryAfterMs = server.retryAfterMs;
+        if (server.status === 429)
+            return { kind: "rate_limited", retryAfterMs };
+        if (server.status >= 500)
+            return { kind: "server_busy", retryAfterMs };
+        if (server.status === 401 || server.status === 403)
+            return { kind: "auth" };
+        return null;
+    }
+    if (reasonOf(e) !== "unavailable")
+        return null;
+    return online === false ? { kind: "offline" } : { kind: "unreachable" };
+}
+/** One pump is permanently bound to one runtime/transport generation. The caller
+ * supplies actual authenticated initialization; this helper does not manufacture
+ * it or create sessions. Worker's owner stop must await close(), or terminate the
+ * Worker if transport shutdown hangs, BEFORE releasing its writer lease. */
+export class AppLogPump {
+    runtime;
+    transport;
+    abort = new AbortController();
+    endpoint;
+    collection;
+    rounds;
+    work = null;
+    closed = false;
+    failed = false;
+    retired = false;
+    problem = null;
+    terminal = null;
+    health = null;
+    sent = 0;
+    readAfter = [-1n, -1n];
+    readAdvances = 0;
+    constructor(runtime, transport, binding) {
+        this.runtime = runtime;
+        this.transport = transport;
+        try {
+            this.endpoint = uint(binding.endpoint);
+            this.collection = uuidToBytes(binding.collection);
+            if (uint(transport.endpoint) !== this.endpoint || !equal(uuidToBytes(transport.collection), this.collection))
+                throw new Error();
+        }
+        catch {
+            throw new AppLogHostError("invalid_binding");
+        }
+        this.rounds = binding.maxRounds ?? 64;
+        if (!Number.isSafeInteger(this.rounds) || this.rounds < 1 || this.rounds > 64)
+            throw new RangeError("invalid app log pump rounds");
+    }
+    get fenced() { return this.failed; }
+    /** Calls this pump has sent so far; a host compares it across a turn to
+     * learn whether the turn did log work. */
+    get callsSent() { return this.sent; }
+    /** Native-accepted advancing READ cursors (data/control separately). Unlike
+     * sent/accepted call counts, retries at the same cursor and head heartbeats
+     * cannot extend initial-sync inactivity. No remote result is decoded in JS. */
+    get readProgress() { return this.readAdvances; }
+    responseProgress() { return this.transport.responseProgress?.() ?? []; }
+    /** The server's latest specific refusal (migrating, moved, suspended) for
+     * this live collection; null once a reply is accepted again. Display only. */
+    get serverProblem() { return this.problem; }
+    /** Initial admission must not lose a genuine non-retryable refusal when a
+     * concurrent call succeeds. Bound to this pump generation; never a retry key. */
+    get terminalProblem() { return this.terminal; }
+    /** Typed transport health from the latest failed call; null once a reply is accepted. */
+    get transportHealth() { return this.health; }
+    current() {
+        if (this.closed || this.failed)
+            return false;
+        if (uint(this.transport.endpoint) !== this.endpoint || !equal(uuidToBytes(this.transport.collection), this.collection)) {
+            throw new AppLogHostError("invalid_binding");
+        }
+        if (this.transport.isCurrent() === true)
+            return true;
+        this.retire();
+        return false;
+    }
+    retire() {
+        this.closed = true;
+        this.abort.abort();
+        if (this.retired)
+            return;
+        this.retired = true;
+        try {
+            this.runtime.retireLog();
+        }
+        catch {
+            this.failed = true;
+            throw new AppLogHostError("fenced");
+        }
+    }
+    capture(calls) {
+        if (!Array.isArray(calls) || calls.length > MAX_CALLS)
+            throw new AppLogHostError("invalid_call");
+        let bytes = 0;
+        const ids = new Set();
+        const captured = [];
+        try {
+            for (const call of calls) {
+                if (uint(call.endpoint) !== this.endpoint || !(call.frame instanceof Uint8Array) || call.frame.length > MAX_FRAME
+                    || (call.sidecar !== undefined && (!(call.sidecar instanceof Uint8Array) || call.sidecar.length > MAX_OBJECT)))
+                    throw new AppLogHostError("invalid_call");
+                bytes += call.frame.length + (call.sidecar?.length ?? 0);
+                if (bytes > MAX_BATCH_BYTES)
+                    throw new AppLogHostError("invalid_call");
+                // Trusted Rust-produced request, not a remotely supplied reply tree.
+                const decoded = decode(call.frame);
+                if (!(decoded instanceof Map))
+                    throw new AppLogHostError("invalid_call");
+                const frame = decoded;
+                if (frame.size !== 4 || frame.get(0) !== 0 || !METHODS.has(frame.get(2)))
+                    throw new AppLogHostError("invalid_call");
+                const id = uint(frame.get(1));
+                if (ids.has(id))
+                    throw new AppLogHostError("invalid_call");
+                ids.add(id);
+                const params = frame.get(3);
+                const scope = params instanceof Map ? params.get(0) : undefined;
+                if (!(scope instanceof Uint8Array) || !equal(scope, this.collection)
+                    || (call.sidecar !== undefined && frame.get(2) !== "put_object"))
+                    throw new AppLogHostError("invalid_call");
+                if (call.sidecar !== undefined) {
+                    const fields = params;
+                    const checksum = fields.get(4);
+                    if (call.sidecar.length <= 1024 * 1024 || uint(fields.get(3)) !== BigInt(call.sidecar.length) || fields.has(5)
+                        || !(checksum instanceof Uint8Array) || !equal(checksum, sha256(call.sidecar)))
+                        throw new AppLogHostError("invalid_call");
+                }
+                // Capture all calls before the first await; later queue mutation cannot
+                // alter the bytes, sidecar, endpoint or correlation this turn sends.
+                const read = frame.get(2) === "read" ? { after: uint(params.get(1)), control: params.get(3) === 1 } : undefined;
+                captured.push({ id, method: frame.get(2), ...(read ? { read } : {}), call: { endpoint: this.endpoint, frame: call.frame.slice(), ...(call.sidecar ? { sidecar: call.sidecar.slice() } : {}) } });
+            }
+            return captured;
+        }
+        catch {
+            for (const c of captured)
+                this.wipe(c);
+            throw new AppLogHostError("invalid_call");
+        }
+    }
+    wipe(c) { c.call.frame.fill(0); c.call.sidecar?.fill(0); }
+    /** Coalesces concurrent kicks. Bounded turns return quiet:false when the caller
+     * should schedule another turn; no background timer or autonomous retry loop. */
+    pump() {
+        if (this.work)
+            return this.work;
+        if (this.failed)
+            return Promise.reject(new AppLogHostError("fenced"));
+        if (this.closed)
+            return Promise.resolve({ quiet: true });
+        this.work = Promise.resolve().then(() => this.drive()).finally(() => { this.work = null; });
+        return this.work;
+    }
+    async drive() {
+        try {
+            for (let round = 0; round < this.rounds; round++) {
+                if (!this.current())
+                    return { quiet: true };
+                const calls = this.capture(this.runtime.takeLogCalls());
+                if (!calls.length)
+                    return { quiet: true };
+                this.sent += calls.length;
+                const all = [];
+                try {
+                    for (let at = 0; at < calls.length;) {
+                        if (!this.current())
+                            return { quiet: true };
+                        let end = at + 1;
+                        const unordered = (i) => UNORDERED.has(calls[i].method);
+                        if (unordered(at))
+                            while (end < calls.length && end - at < MAX_CONCURRENT && unordered(end))
+                                end++;
+                        const run = calls.slice(at, end);
+                        at = end;
+                        const sent = run.map(c => this.transport.send(c.call, { signal: this.abort.signal }).then(reply => ({ reply, error: null }), (error) => ({ reply: null, error })));
+                        all.push(...sent);
+                        for (const [i, c] of run.entries()) {
+                            const { reply, error } = await sent[i];
+                            if (reply === null) {
+                                if (!this.current())
+                                    return { quiet: true };
+                                const server = serverOf(error);
+                                if (isAppServerProblem(server)) {
+                                    const outcome = appServerOutcome(server);
+                                    if (outcome)
+                                        this.problem = server;
+                                    // An HTTP status alone is not final: 401 invalidates a stale
+                                    // token; Core can then request again with fresh token/proof.
+                                    // Preserve NoResponse recovery for opaque/routing/timeouts.
+                                    // Only explicit authority outcomes or typed permission denial
+                                    // prevent admission. Native Query auth errors still fail there.
+                                    if (outcome || (server.status === 403 && server.code === "forbidden"))
+                                        this.terminal ??= server;
+                                }
+                                const health = appLogHealth(error);
+                                if (health)
+                                    this.health = health;
+                                this.runtime.logNoResponse(c.id);
+                                continue;
+                            }
+                            try {
+                                if (!this.current())
+                                    return { quiet: true };
+                                if (!(reply instanceof Uint8Array) || reply.length > MAX_FRAME) {
+                                    this.runtime.logNoResponse(c.id);
+                                    continue;
+                                }
+                                // No JS decode/materialization of the remote result; Rust remains
+                                // the policy/schema/correlation authority. It borrows these bytes.
+                                if (this.runtime.acceptLogReply(c.id, reply) !== true)
+                                    this.runtime.logNoResponse(c.id);
+                                else {
+                                    this.problem = null;
+                                    this.health = null;
+                                    if (c.read) {
+                                        const lane = c.read.control ? 1 : 0;
+                                        if (c.read.after > this.readAfter[lane]) {
+                                            this.readAfter[lane] = c.read.after;
+                                            this.readAdvances++;
+                                        }
+                                    }
+                                }
+                            }
+                            finally {
+                                if (reply instanceof Uint8Array)
+                                    reply.fill(0);
+                            }
+                        }
+                    }
+                }
+                finally {
+                    // A fenced turn may leave sends in flight (aborted): close() still
+                    // drains them, and late replies are wiped, never fed to Rust.
+                    for (const r of await Promise.all(all))
+                        if (r.reply instanceof Uint8Array)
+                            r.reply.fill(0);
+                    for (const c of calls)
+                        this.wipe(c);
+                }
+            }
+            return { quiet: false };
+        }
+        catch {
+            this.failed = true;
+            this.retire();
+            throw new AppLogHostError("fenced");
+        }
+    }
+    /** HOST ONLY: fence/abort this pump and drain BEFORE the authenticated host
+     * replaces the native session. Native replacement MUST classify originals as
+     * unknown; on failure host MUST retire runtime. Same owners/lease stay held.
+     * This is not close/lease release/Saved. May hang; terminate Worker first. */
+    async drainForAuthenticatedReconnect() {
+        if (this.closed || this.failed || this.retired)
+            throw new AppLogHostError("fenced");
+        this.closed = true;
+        this.abort.abort();
+        this.retired = true;
+        await this.work?.catch(() => { });
+        if (this.failed)
+            throw new AppLogHostError("fenced");
+    }
+    /** Retire immediately, abort I/O, then drain without feeding late replies. */
+    async close() {
+        this.retire();
+        await this.work?.catch(() => { });
+    }
+}
+//# sourceMappingURL=log-pump.js.map

package/dist/app-host/log-pump.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-pump.js","sourceRoot":"","sources":["../../src/app-host/log-pump.ts"],"names":[],"mappings":"AAAA;;;8EAG8E;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAkB,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAyB,MAAM,iBAAiB,CAAC;AAE9F,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa;IAC/F,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa;CACjG,CAAC,CAAC;AAkCH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,MAAqD;QACxE,KAAK,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;QADd,WAAM,GAAN,MAAM,CAA+C;QAExE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AACD,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5H,MAAM,CAAC,GAAG,MAAM,CAAC,CAAoB,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,KAAK,CAAC,CAAa,EAAE,CAAa,IAAa,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExH;;;6CAG6C;AAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;AACpH,MAAM,cAAc,GAAG,CAAC,CAAC;AASzB,SAAS,QAAQ,CAAC,CAAU,IAAa,IAAI,CAAC;IAAC,OAAQ,CAA0B,CAAC,MAAM,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,IAAI,CAAC,CAAC,oBAAoB;AAAC,CAAC,CAAC,CAAC;AACzI,SAAS,QAAQ,CAAC,CAAU,IAAa,IAAI,CAAC;IAAC,OAAQ,CAA0B,CAAC,MAAM,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,IAAI,CAAC;AAAC,CAAC,CAAC,CAAC;AACpH,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,SAA8B,UAAU,CAAC,SAAS,EAAE,MAAM;IACjG,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC1E,CAAC;AAED;;;4EAG4E;AAC5E,MAAM,OAAO,UAAU;IAgBF;IACA;IAhBF,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9B,QAAQ,CAAS;IACjB,UAAU,CAAa;IACvB,MAAM,CAAS;IACxB,IAAI,GAAuC,IAAI,CAAC;IAChD,MAAM,GAAG,KAAK,CAAC;IACf,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAA4B,IAAI,CAAC;IACxC,QAAQ,GAA4B,IAAI,CAAC;IACzC,MAAM,GAAwB,IAAI,CAAC;IACnC,IAAI,GAAG,CAAC,CAAC;IACA,SAAS,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,YAAY,GAAG,CAAC,CAAC;IACzB,YACmB,OAAsB,EACtB,SAA0B,EAC3C,OAA8E;QAF7D,YAAO,GAAP,OAAO,CAAe;QACtB,cAAS,GAAT,SAAS,CAAiB;QAG3C,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClI,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,MAAM,KAAc,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C;8CAC0C;IAC1C,IAAI,SAAS,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C;;mFAE+E;IAC/E,IAAI,YAAY,KAAa,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,gBAAgB,KAA+C,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClH;kFAC8E;IAC9E,IAAI,aAAa,KAA8B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE;qFACiF;IACjF,IAAI,eAAe,KAA8B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,yFAAyF;IACzF,IAAI,eAAe,KAA0B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO;QACb,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvH,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACO,MAAM;QACZ,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;IACtG,CAAC;IACO,OAAO,CAAC,KAA4B;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;QACjG,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS;uBAC5G,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBAC5J,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;gBACzD,IAAI,KAAK,GAAG,eAAe;oBAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBACvE,qEAAqE;gBACrE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBACzE,MAAM,KAAK,GAAG,OAAiC,CAAC;gBAChD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBAC9H,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,GAAG,CAAC,CAAC,CAAE,MAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5F,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC;uBAC/D,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBAC9G,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAG,MAA8B,CAAC;oBAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;2BACzG,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAAE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBAC9H,CAAC;gBACD,wEAAwE;gBACxE,qEAAqE;gBACrE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,IAAI,CAAE,MAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAG,MAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtK,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3M,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACO,IAAI,CAAC,CAAW,IAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElF;qFACiF;IACjF,IAAI;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACO,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC;YACH,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC1B,MAAM,GAAG,GAA4C,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;wBACpC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;4BAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;wBAC5C,IAAI,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;wBACjB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;wBACjE,IAAI,SAAS,CAAC,EAAE,CAAC;4BAAE,OAAO,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,cAAc,IAAI,SAAS,CAAC,GAAG,CAAC;gCAAE,GAAG,EAAE,CAAC;wBACnG,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;wBACjC,EAAE,GAAG,GAAG,CAAC;wBACT,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACvF,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAe,EAAE,CAAC,EAC5C,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAC7C,CAAC,CAAC;wBACH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;wBAClB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;4BACnC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAE,CAAC;4BACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gCACnB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;oCAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gCAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;gCAC/B,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;oCAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;oCACzC,IAAI,OAAO;wCAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;oCACnC,6DAA6D;oCAC7D,6DAA6D;oCAC7D,4DAA4D;oCAC5D,8DAA8D;oCAC9D,gEAAgE;oCAChE,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC;wCAAE,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC;gCAClG,CAAC;gCACD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gCACnC,IAAI,MAAM;oCAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gCACjC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gCACjC,SAAS;4BACX,CAAC;4BACD,IAAI,CAAC;gCACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;oCAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gCAC5C,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;oCAC/D,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oCACjC,SAAS;gCACX,CAAC;gCACD,kEAAkE;gCAClE,mEAAmE;gCACnE,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,IAAI;oCAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;qCACnF,CAAC;oCACJ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oCAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;oCACxC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wCACX,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wCACpC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAE,EAAE,CAAC;4CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;4CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;wCAAC,CAAC;oCACzG,CAAC;gCACH,CAAC;4BACH,CAAC;oCAAS,CAAC;gCAAC,IAAI,KAAK,YAAY,UAAU;oCAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;4BAAC,CAAC;wBAC/D,CAAC;oBACH,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,mEAAmE;oBACnE,8DAA8D;oBAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU;4BAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3F,KAAK,MAAM,CAAC,IAAI,KAAK;wBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD;;;kFAG8E;IAC9E,KAAK,CAAC,8BAA8B;QAClC,IAAG,IAAI,CAAC,MAAM,IAAE,IAAI,CAAC,MAAM,IAAE,IAAI,CAAC,OAAO;YAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,GAAC,IAAI,CAAC;QAAA,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAA,IAAI,CAAC,OAAO,GAAC,IAAI,CAAC;QACtD,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;QAC/B,IAAG,IAAI,CAAC,MAAM;YAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IACD,8EAA8E;IAC9E,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/app-host/log-push.d.ts

@@ -0,0 +1,90 @@
+/** Close codes set by the log (`deploy/cloudflare-do`). */
+export declare const LOG_CLOSE_EXPIRED = 4401, LOG_CLOSE_FORBIDDEN = 4403, LOG_CLOSE_GONE = 4410;
+/** `forbidden`: removed from the collection (or the device by policy);
+ * `revoked`: this device's sign-in was revoked; `gone`: the collection is deleted. */
+export type AppLogPushEnd = "forbidden" | "revoked" | "gone";
+export interface AppLogPushSource {
+    /** The log's HTTPS origin (the same one RPCs go to). */
+    readonly origin: string;
+    readonly collection: string;
+    readonly deviceId: string;
+    isCurrent(): boolean;
+    accessToken(options: {
+        signal: AbortSignal;
+    }): Promise<string>;
+    invalidateToken?(token: string): void;
+    /** A fresh single-use nonce from `GET /v1/nonce`. */
+    nonce(options: {
+        signal: AbortSignal;
+    }): Promise<Uint8Array>;
+    /** Fixed-purpose `hello` proof by the native runtime; null when unsupported. */
+    signHello(nonce: Uint8Array, token: string): Uint8Array | null;
+}
+export interface AppLogPushEvents {
+    /** A push frame (`LsFrame::Push` bytes) for the replica. On every (re)subscribe
+     * a `head` push is synthesized from the subscription's head: that is catch-up. */
+    push(frame: Uint8Array): void;
+    /** The socket became live or stopped being live. */
+    live(live: boolean): void;
+    /** Access ended (removed, revoked, or the collection is gone). Terminal. */
+    ended(reason: AppLogPushEnd): void;
+}
+export interface AppLogPushOptions {
+    WebSocket?: typeof globalThis.WebSocket;
+    random?: () => number;
+    now?: () => number;
+    allowLoopbackHttp?: boolean;
+}
+export declare class AppLogPushChannel {
+    private readonly source;
+    private readonly events;
+    private readonly base;
+    private readonly collectionBytes;
+    private readonly Ws;
+    private readonly random;
+    private readonly now;
+    private socket;
+    private connecting;
+    private closed;
+    private finished;
+    private unsupported;
+    private paused;
+    private isLive;
+    private attempts;
+    private liveSince;
+    private retry;
+    private ping;
+    private pongDue;
+    private opening;
+    private unsigned;
+    private life;
+    private token;
+    constructor(source: AppLogPushSource, events: AppLogPushEvents, options?: AppLogPushOptions);
+    /** Live: subscribed, so other devices' changes arrive as they commit. */
+    get live(): boolean;
+    /** Push is not available (an older runtime); callers fall back to event wakes. */
+    get available(): boolean;
+    /** Closed on purpose while every tab is hidden; `resume` reconnects. */
+    get suspended(): boolean;
+    start(): void;
+    /** Focus, visibility or `online`: reconnect now if not connected. */
+    nudge(): void;
+    /** Every tab hidden and nothing left to send: close the socket (code 1000)
+     * and stop reconnecting. Nothing is lost: `resume` catches up from the head. */
+    suspend(): void;
+    resume(): void;
+    close(): void;
+    private clearRetry;
+    private clearPing;
+    private setLive;
+    private end;
+    private drop;
+    /** Full-jitter backoff, 1 s → 60 s; reset after a minute of a healthy socket. */
+    private schedule;
+    private connect;
+    private message;
+    private deliver;
+    private refused;
+    private startPing;
+    private lost;
+}