@mnemom/mnemom 0.17.34 → 0.17.36

package/dist/vendor/shared/durable-contract/inbox.js

@@ -0,0 +1,462 @@
+// GENERATED from shared/durable-contract/src/inbox.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The durable inbox (S1 amendment 60, signed off by Wassim 2026-11-02): how work reaches a locked session
+ * without anyone typing into its seat. The owner, or an agent on the owner's allowlist for the
+ * recipient agent, sends a message to the session (ROUTES.own_inbox_send); the api stores it
+ * (encrypted, as a charter contract is) and journals inbox.admitted. The session's executor takes it
+ * (ROUTES.exec_inbox_take: the api marks it delivered at the live epoch and journals
+ * inbox.delivered), pastes the delivery text into the seat, and acks it when the turn that answered
+ * it ends (ROUTES.exec_inbox_ack: inbox.acked). Between take and ack the message's sha is in the
+ * resolver's `inbox_open`, which is what lets amendment 60 (e) admit the seat's `inbox=<sha>` turn
+ * unattended.
+ *
+ * Every inbox.* kind stays api-written (writerOf): delivered and acked are written by the api inside
+ * the take and ack routes, in the transaction that moves the inbox row, never through exec_append.
+ * So an executor cannot journal a delivery the api did not make, and the gateway can never see a
+ * turn whose sha is not yet open.
+ *
+ * This file holds the limits, the message sha and delivery text recipes, and the closed wire shapes
+ * of the inbox routes (routes.ts lists the routes). Nothing here carries message text into the
+ * journal: refs are ids, shas and enums only.
+ */
+import { fieldOk, INBOX_OPEN_MAX } from "./admission.js";
+import { canonicalJson, HEX64_RE, sha256Hex, utf8, UUID_RE } from "./canonical.js";
+// ---- limits ---------------------------------------------------------------------------------
+/** A message body is 1..this many UTF-8 bytes. */
+export const INBOX_BODY_MAX_BYTES = 16384;
+/** An admitted or delivered message nobody acks is dead (reason expired) this long after it was sent. */
+export const INBOX_TTL_S = 7 * 24 * 60 * 60;
+/** A message taken this many times without an ack is dead (reason delivery_limit) instead of taken again. */
+export const INBOX_DELIVERY_LIMIT = 5;
+/** exec_inbox_take returns at most this many messages; `limit` defaults to 1. */
+export const INBOX_TAKE_LIMIT_MAX = 8;
+/** own_inbox_list returns at most this many messages, newest first. */
+export const INBOX_LIST_LIMIT = 100;
+/** At most this many live (unrevoked) allowlisted senders per recipient agent. */
+export const INBOX_SENDERS_MAX = 32;
+/** The open-message cap: a send that would open more than this is refused (inbox_full). */
+export const INBOX_OPEN_CAP = INBOX_OPEN_MAX;
+/**
+ * Take re-offers a message delivered at the LIVE epoch once its last delivery is this old and it was
+ * neither acked nor released (the executor lost track of it: it died between the take and its own
+ * record, or gave up on a paste). The executor takes only while it tracks nothing for the seat and
+ * the seat is idle, so a re-offer never lands inside the turn answering it. At-least-once.
+ */
+export const INBOX_REOFFER_S = 15 * 60;
+/** idempotency_key: 1..200 of letters, digits and `_ . : -` (a Slack key is `slack:<channel>:<ts>`). */
+export const INBOX_IDEMPOTENCY_KEY_RE = /^[A-Za-z0-9_.:-]{1,200}$/;
+/** An agents.id as the inbox takes it: opaque text, letters, digits, `_` and `-`, at most 64. */
+export const INBOX_AGENT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+/** A sender label: one line of printable ASCII without `[` or `]`, 1..128 characters. */
+export const INBOX_SENDER_LABEL_RE = /^[ -Z\\^-~]{1,128}$/;
+// ---- vocabularies ---------------------------------------------------------------------------
+/** durable_inbox.status. admitted and delivered are open; acked and dead are final. */
+export const INBOX_STATUSES = ["admitted", "delivered", "acked", "dead"];
+/** Who sent a message: the session's owner, or an agent on the owner's allowlist. */
+export const INBOX_SENDER_KINDS = ["owner", "agent"];
+/** inbox.rejected refs.reason: why a send by an authenticated sender that can see the session was refused. */
+export const INBOX_REJECT_REASONS = [
+    "not_allowlisted",
+    "not_locked",
+    "ended",
+    "unsealed",
+    "inbox_full",
+    "body_too_large",
+    "body_invalid",
+    "unattended_off",
+];
+/** inbox.dead refs.reason and durable_inbox.dead_reason. */
+export const INBOX_DEAD_REASONS = ["expired", "delivery_limit", "session_ended"];
+/**
+ * exec_inbox_release body.reason and inbox.reverted refs.reason: why the executor hands a delivered
+ * message back undone, instead of acking it.
+ *  - unconfirmed: pasted, never reached the transcript;
+ *  - refused: the turn it started ended on a gateway refusal (an API-error turn): no work was done;
+ *  - undeliverable: the executor will not paste the text.
+ */
+export const INBOX_RELEASE_REASONS = ["unconfirmed", "refused", "undeliverable"];
+/**
+ * The `reason` of a 422 durable_inbox_sender_invalid: `sender` / `on_behalf_of` (a send whose
+ * sender identity is inconsistent), `agent_id` / `label` (a malformed allowlist change), `self` (the
+ * recipient itself), `not_found`, `other_org`, `not_owned` (not one of the owner's agents in the
+ * session's org), `too_many` (INBOX_SENDERS_MAX live senders already).
+ */
+export const INBOX_SENDER_INVALID_REASONS = [
+    "sender",
+    "on_behalf_of",
+    "agent_id",
+    "label",
+    "self",
+    "not_found",
+    "other_org",
+    "not_owned",
+    "too_many",
+];
+/**
+ * The refusal code and HTTP status of each INBOX_REJECT_REASONS value (codes.ts DURABLE_CODES). Each
+ * refused send by a sender that may see the session journals inbox.rejected {reason, sender_kind};
+ * a caller who cannot see it is refused before anything is read or written.
+ */
+export const INBOX_REJECT_CODES = Object.freeze({
+    not_allowlisted: { code: "durable_inbox_not_allowlisted", status: 403 },
+    not_locked: { code: "durable_inbox_closed", status: 409 },
+    ended: { code: "durable_inbox_closed", status: 409 },
+    unsealed: { code: "durable_inbox_closed", status: 409 },
+    inbox_full: { code: "durable_inbox_full", status: 429 },
+    body_too_large: { code: "durable_inbox_body_invalid", status: 422 },
+    body_invalid: { code: "durable_inbox_body_invalid", status: 422 },
+    unattended_off: { code: "durable_inbox_closed", status: 409 },
+});
+/** The kinds amendment 60 gives an emitter (they stay in the frozen NO_M1_EMITTER_KINDS M1 baseline). */
+export const A60_EMITTED_KINDS = [
+    "inbox.admitted",
+    "inbox.rejected",
+    "inbox.coalesced",
+    "inbox.delivered",
+    "inbox.acked",
+    "inbox.reverted",
+    "inbox.dead",
+];
+/** The sha preimage: canonicalJson of the identity plus `v: 1`. */
+export function inboxShaPreimage(m) {
+    return canonicalJson({
+        v: 1,
+        session_id: m.session_id,
+        sender_kind: m.sender_kind,
+        sender_agent_id: m.sender_agent_id ?? null,
+        on_behalf_of: m.on_behalf_of ?? null,
+        in_reply_to: m.in_reply_to ?? null,
+        body: m.body,
+    });
+}
+/**
+ * A message's sha: sha256 of inboxShaPreimage, lowercase hex. The api computes it at send. The same
+ * sender sending the same body to the same session while an earlier copy is still open gets that
+ * copy back (coalesced); it is the value the seat stamps as `inbox=<sha>` and the resolver lists in
+ * `inbox_open`.
+ */
+export async function inboxSha(m) {
+    return sha256Hex(inboxShaPreimage(m));
+}
+/**
+ * A body may carry TAB, LF and CR, and no other control character: no C0 (NUL, ESC, ...), DEL or C1.
+ * The daemon pastes a delivery into a terminal, where ESC[201~ would end the bracketed paste and the
+ * bytes after it would be typed as keys.
+ */
+// eslint-disable-next-line no-control-regex
+const INBOX_BODY_CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/;
+/** A UTF-8 body within the limits: 1..INBOX_BODY_MAX_BYTES bytes, no control character but TAB, LF, CR. */
+export function inboxBodyOk(body) {
+    if (typeof body !== "string" || body.length === 0 || INBOX_BODY_CONTROL_RE.test(body))
+        return false;
+    return utf8(body).length <= INBOX_BODY_MAX_BYTES;
+}
+/** The first line of every delivery text: `[mnemom inbox <sha>]`, then who sent it. */
+export const INBOX_MARKER_RE = /^\[mnemom inbox ([0-9a-f]{64})\]/;
+/**
+ * The exact text the seat is given (the api renders it in exec_inbox_take; the daemon pastes it
+ * verbatim). Line 1 is the marker and the sender, line 2 is empty, the body follows unchanged:
+ *   `[mnemom inbox <sha>] from the owner`
+ *   `[mnemom inbox <sha>] from agent <label> on behalf of the owner`
+ * and ` (answer to question <approval_id>)` when the message answers one. The marker is read from
+ * line 1 only (inboxMarkerOf), so a body cannot pose as another message.
+ */
+export function inboxDeliveryText(m) {
+    if (!HEX64_RE.test(m.sha))
+        throw new RangeError("inbox sha must be 64 lowercase hex");
+    let who = "the owner";
+    if (m.sender_kind === "agent") {
+        const label = m.sender_label ?? "";
+        if (!INBOX_SENDER_LABEL_RE.test(label))
+            throw new RangeError("inbox sender label invalid");
+        who = `agent ${label} on behalf of the owner`;
+    }
+    if (m.in_reply_to !== null && !UUID_RE.test(m.in_reply_to))
+        throw new RangeError("in_reply_to must be a lowercase uuid");
+    const reply = m.in_reply_to === null ? "" : ` (answer to question ${m.in_reply_to})`;
+    return `[mnemom inbox ${m.sha}] from ${who}${reply}\n\n${m.body}`;
+}
+/**
+ * The sha a prompt carries, read from its first line only, or null. The seat proxy stamps
+ * `inbox=<sha>` on the turn entry whose text this returns non-null for. Restrict-only: a stamp only
+ * makes a turn unattended, and the gateway admits it only while the sha is in `inbox_open`.
+ */
+export function inboxMarkerOf(text) {
+    const nl = text.indexOf("\n");
+    return INBOX_MARKER_RE.exec(nl < 0 ? text : text.slice(0, nl))?.[1] ?? null;
+}
+// ---- wire shapes ----------------------------------------------------------------------------
+const isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const keysExactly = (o, keys) => Object.keys(o).length === keys.length && keys.every((k) => k in o);
+const keysWithin = (o, required, optional) => required.every((k) => k in o) &&
+    Object.keys(o).every((k) => required.includes(k) || optional.includes(k));
+const str = (v, re) => typeof v === "string" && re.test(v);
+const uuid = (v, nullable = false) => fieldOk({ type: "uuid", nullable }, v);
+const ts = (v, nullable = false) => fieldOk({ type: "timestamp", nullable }, v);
+const int = (v, min = 0) => Number.isSafeInteger(v) && v >= min;
+const oneOf = (v, values) => typeof v === "string" && values.includes(v);
+const agentId = (v) => str(v, INBOX_AGENT_ID_RE);
+const nonEmpty = (v) => typeof v === "string" && v.length > 0;
+/** POST own_inbox_send body: exactly {text, idempotency_key}. Sender and on_behalf_of come from the credential and the allowlist, never the body. */
+export const INBOX_SEND_BODY_KEYS = ["text", "idempotency_key"];
+/** A send body: exactly INBOX_SEND_BODY_KEYS, text passing inboxBodyOk, idempotency_key INBOX_IDEMPOTENCY_KEY_RE. */
+export function inboxSendBodyOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, INBOX_SEND_BODY_KEYS) &&
+        inboxBodyOk(v.text) &&
+        str(v.idempotency_key, INBOX_IDEMPOTENCY_KEY_RE));
+}
+/**
+ * The 200 answer of own_inbox_send, exactly these keys:
+ *  - inbox_id, sha: the message (a coalesced or deduped send names the earlier, still-open copy);
+ *  - status: its INBOX_STATUSES value now;
+ *  - coalesced: an open message with this sha already existed, nothing new was stored;
+ *  - deduped: this idempotency_key was sent before, this is that send's message;
+ *  - sender_kind, sender_agent_id, on_behalf_of: as stored (the owner's user id for an agent send);
+ *  - expires_at: when an unacked message goes dead.
+ * A refusal is a durable error (INBOX_REJECT_CODES), never a 200.
+ */
+export const INBOX_SEND_RESPONSE = Object.freeze({
+    inbox_id: "uuid",
+    sha: "hex64",
+    status: "inbox_status",
+    coalesced: "boolean",
+    deduped: "boolean",
+    sender_kind: "inbox_sender_kind",
+    sender_agent_id: "agent_id|null",
+    on_behalf_of: "string|null",
+    expires_at: "timestamp",
+});
+const senderOk = (v) => oneOf(v.sender_kind, INBOX_SENDER_KINDS) &&
+    (v.sender_kind === "owner"
+        ? v.sender_agent_id === null && v.on_behalf_of === null
+        : agentId(v.sender_agent_id) && nonEmpty(v.on_behalf_of));
+export function inboxSendResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, Object.keys(INBOX_SEND_RESPONSE)) &&
+        uuid(v.inbox_id) &&
+        str(v.sha, HEX64_RE) &&
+        oneOf(v.status, INBOX_STATUSES) &&
+        typeof v.coalesced === "boolean" &&
+        typeof v.deduped === "boolean" &&
+        senderOk(v) &&
+        ts(v.expires_at));
+}
+/**
+ * One own_inbox_list item, exactly these keys; content-free (no body). GET own_inbox_list answers
+ * `{messages: [item, ...]}`, newest first, at most INBOX_LIST_LIMIT.
+ */
+export const INBOX_LIST_ITEM = Object.freeze({
+    inbox_id: "uuid",
+    sha: "hex64",
+    status: "inbox_status",
+    sender_kind: "inbox_sender_kind",
+    sender_agent_id: "agent_id|null",
+    on_behalf_of: "string|null",
+    in_reply_to: "uuid|null",
+    body_bytes: "integer>=1",
+    delivery_count: "integer",
+    dead_reason: "inbox_dead_reason|null",
+    created_at: "timestamp",
+    delivered_at: "timestamp|null",
+    acked_at: "timestamp|null",
+    expires_at: "timestamp",
+});
+export function inboxListItemOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, Object.keys(INBOX_LIST_ITEM)) &&
+        uuid(v.inbox_id) &&
+        str(v.sha, HEX64_RE) &&
+        oneOf(v.status, INBOX_STATUSES) &&
+        senderOk(v) &&
+        uuid(v.in_reply_to, true) &&
+        int(v.body_bytes, 1) &&
+        v.body_bytes <= INBOX_BODY_MAX_BYTES &&
+        int(v.delivery_count) &&
+        (v.status === "dead" ? oneOf(v.dead_reason, INBOX_DEAD_REASONS) : v.dead_reason === null) &&
+        ts(v.created_at) &&
+        ts(v.delivered_at, true) &&
+        ts(v.acked_at, true) &&
+        ts(v.expires_at));
+}
+export function inboxListResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, ["messages"]) &&
+        Array.isArray(v.messages) &&
+        v.messages.length <= INBOX_LIST_LIMIT &&
+        v.messages.every(inboxListItemOk));
+}
+/** POST own_inbox_sender_add body: agent_id required, label optional. */
+export const INBOX_SENDER_ADD_BODY_KEYS = ["agent_id", "label"];
+export function inboxSenderAddBodyOk(v) {
+    return (isObj(v) &&
+        keysWithin(v, ["agent_id"], ["label"]) &&
+        str(v.agent_id, INBOX_AGENT_ID_RE) &&
+        (!("label" in v) || str(v.label, INBOX_SENDER_LABEL_RE)));
+}
+/** DELETE own_inbox_sender_remove body: exactly {agent_id}. */
+export const INBOX_SENDER_REMOVE_BODY_KEYS = ["agent_id"];
+export function inboxSenderRemoveBodyOk(v) {
+    return isObj(v) && keysExactly(v, INBOX_SENDER_REMOVE_BODY_KEYS) && str(v.agent_id, INBOX_AGENT_ID_RE);
+}
+/**
+ * One allowlisted sender, exactly these keys. The allowlist belongs to the recipient AGENT (it
+ * outlives any one session); the routes reach it through a session the owner owns. added_by is the
+ * owner's user id (null only after a DSR erase).
+ */
+export const INBOX_SENDER_ITEM = Object.freeze({
+    sender_agent_id: "agent_id",
+    label: "label|null",
+    added_by: "string|null",
+    created_at: "timestamp",
+});
+export function inboxSenderItemOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, Object.keys(INBOX_SENDER_ITEM)) &&
+        agentId(v.sender_agent_id) &&
+        (v.label === null || str(v.label, INBOX_SENDER_LABEL_RE)) &&
+        (v.added_by === null || nonEmpty(v.added_by)) &&
+        ts(v.created_at));
+}
+/** GET own_inbox_senders: exactly {recipient_agent_id, senders}, the live (unrevoked) rows. */
+export function inboxSendersResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, ["recipient_agent_id", "senders"]) &&
+        agentId(v.recipient_agent_id) &&
+        Array.isArray(v.senders) &&
+        v.senders.length <= INBOX_SENDERS_MAX &&
+        v.senders.every(inboxSenderItemOk));
+}
+/**
+ * POST own_inbox_sender_add / DELETE own_inbox_sender_remove answer: exactly
+ * {recipient_agent_id, sender_agent_id, changed}; changed false when the row was already live
+ * (add) or already absent or revoked (remove).
+ */
+export function inboxSenderChangeResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, ["recipient_agent_id", "sender_agent_id", "changed"]) &&
+        agentId(v.recipient_agent_id) &&
+        agentId(v.sender_agent_id) &&
+        v.recipient_agent_id !== v.sender_agent_id &&
+        typeof v.changed === "boolean");
+}
+/**
+ * GET exec_inbox: a content-free summary for a session the executor is home to or holds, exactly
+ * {admitted, delivered, oldest_admitted_at}. The daemon reads it to decide whether a parked homed
+ * session has work to claim; it marks nothing delivered.
+ */
+export function inboxSummaryResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, ["admitted", "delivered", "oldest_admitted_at"]) &&
+        int(v.admitted) &&
+        int(v.delivered) &&
+        (v.admitted === 0 ? v.oldest_admitted_at === null : ts(v.oldest_admitted_at)));
+}
+/** POST exec_inbox_take body: epoch and nonce (the live lease's) required, limit optional. */
+export const INBOX_TAKE_BODY_KEYS = ["epoch", "nonce", "limit"];
+export function inboxTakeBodyOk(v) {
+    return (isObj(v) &&
+        keysWithin(v, ["epoch", "nonce"], ["limit"]) &&
+        int(v.epoch) &&
+        nonEmpty(v.nonce) &&
+        (!("limit" in v) || (int(v.limit, 1) && v.limit <= INBOX_TAKE_LIMIT_MAX)));
+}
+/**
+ * One taken message, exactly these keys. `text` is inboxDeliveryText of the message, rendered by
+ * the api; the daemon pastes it verbatim. attempt is the message's delivery_count after this take.
+ */
+export const INBOX_TAKE_ITEM = Object.freeze({
+    inbox_id: "uuid",
+    sha: "hex64",
+    text: "string",
+    attempt: "integer>=1",
+    sender_kind: "inbox_sender_kind",
+    sender_agent_id: "agent_id|null",
+    on_behalf_of: "string|null",
+    in_reply_to: "uuid|null",
+    created_at: "timestamp",
+});
+export function inboxTakeItemOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, Object.keys(INBOX_TAKE_ITEM)) &&
+        uuid(v.inbox_id) &&
+        str(v.sha, HEX64_RE) &&
+        typeof v.text === "string" &&
+        inboxMarkerOf(v.text) === v.sha &&
+        int(v.attempt, 1) &&
+        v.attempt <= INBOX_DELIVERY_LIMIT &&
+        senderOk(v) &&
+        uuid(v.in_reply_to, true) &&
+        ts(v.created_at));
+}
+/** POST exec_inbox_take answer: exactly {messages}, oldest first, at most the body's limit. */
+export function inboxTakeResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, ["messages"]) &&
+        Array.isArray(v.messages) &&
+        v.messages.length <= INBOX_TAKE_LIMIT_MAX &&
+        v.messages.every(inboxTakeItemOk));
+}
+/** POST exec_inbox_ack body: exactly {epoch, nonce, inbox_id, sha}. */
+export const INBOX_ACK_BODY_KEYS = ["epoch", "nonce", "inbox_id", "sha"];
+export function inboxAckBodyOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, INBOX_ACK_BODY_KEYS) &&
+        int(v.epoch) &&
+        nonEmpty(v.nonce) &&
+        uuid(v.inbox_id) &&
+        str(v.sha, HEX64_RE));
+}
+/**
+ * POST exec_inbox_ack answer: exactly {inbox_id, sha, status: "acked", deduped}. A message that is
+ * not delivered to this session at this epoch with this sha is 409 durable_inbox_not_open.
+ */
+export function inboxAckResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, ["inbox_id", "sha", "status", "deduped"]) &&
+        uuid(v.inbox_id) &&
+        str(v.sha, HEX64_RE) &&
+        v.status === "acked" &&
+        typeof v.deduped === "boolean");
+}
+/** POST exec_inbox_release body: exactly {epoch, nonce, inbox_id, sha, reason}. */
+export const INBOX_RELEASE_BODY_KEYS = ["epoch", "nonce", "inbox_id", "sha", "reason"];
+export function inboxReleaseBodyOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, INBOX_RELEASE_BODY_KEYS) &&
+        int(v.epoch) &&
+        nonEmpty(v.nonce) &&
+        uuid(v.inbox_id) &&
+        str(v.sha, HEX64_RE) &&
+        oneOf(v.reason, INBOX_RELEASE_REASONS));
+}
+/**
+ * POST exec_inbox_release answer: exactly {inbox_id, sha, status}. The api moves a message delivered
+ * to this session at this epoch back to `admitted` and journals inbox.reverted {inbox_id, sha,
+ * reason}, so the next take offers it again; when its delivery_count already reached
+ * INBOX_DELIVERY_LIMIT it goes `dead` instead (inbox.dead delivery_limit). Either way its sha leaves
+ * `inbox_open` in the same transaction. Anything else is 409 durable_inbox_not_open.
+ */
+export function inboxReleaseResponseOk(v) {
+    return (isObj(v) &&
+        keysExactly(v, ["inbox_id", "sha", "status"]) &&
+        uuid(v.inbox_id) &&
+        str(v.sha, HEX64_RE) &&
+        (v.status === "admitted" || v.status === "dead"));
+}
+/** The journal idempotency keys the api uses for inbox events (one event per fact). */
+export const inboxIdempotencyKeys = {
+    admitted: (inboxId) => `inbox:${inboxId}:admitted`,
+    coalesced: (inboxId, idempotencyKey) => `inbox:${inboxId}:coalesced:${idempotencyKey}`,
+    /**
+     * A refused send: keyed on the caller's idempotency_key when it is well-formed, else on the api's
+     * own request id (a body_invalid refusal may carry no usable key).
+     */
+    rejected: (sessionId, idempotencyKey, requestId) => typeof idempotencyKey === "string" && INBOX_IDEMPOTENCY_KEY_RE.test(idempotencyKey)
+        ? `inbox:${sessionId}:rejected:${idempotencyKey}`
+        : `inbox:${sessionId}:rejected:request:${requestId}`,
+    delivered: (inboxId, epoch, attempt) => `inbox:${inboxId}:delivered:${epoch}:${attempt}`,
+    acked: (inboxId) => `inbox:${inboxId}:acked`,
+    reverted: (inboxId, epoch, attempt) => `inbox:${inboxId}:reverted:${epoch}:${attempt}`,
+    dead: (inboxId) => `inbox:${inboxId}:dead`,
+};

package/dist/vendor/shared/durable-contract/index.d.ts

@@ -27,6 +27,8 @@ export * from "./seal.js";
 export * from "./paths.js";
 export * from "./executor-state.js";
 export * from "./routes.js";
+export * from "./inbox.js";
+export * from "./question.js";
 export * from "./doors.js";
 export * from "./journal-approvals.js";
 export * from "./secret-scope.js";

package/dist/vendor/shared/durable-contract/index.js

@@ -28,6 +28,8 @@ export * from "./seal.js";
 export * from "./paths.js";
 export * from "./executor-state.js";
 export * from "./routes.js";
+export * from "./inbox.js";
+export * from "./question.js";
 export * from "./doors.js";
 export * from "./journal-approvals.js";
 export * from "./secret-scope.js";