@novasamatech/statement-store 0.9.0 → 0.9.2

package/dist/session/core.js

@@ -0,0 +1,609 @@
+/**
+ * The session driver: turns the collaborators assembled by `createSession` /
+ * `createMultiDeviceSession` into a live {@link Session}.
+ *
+ * It never branches on single- vs multi-device. Wire format is decided by the injected
+ * {@link OutgoingBodyBuilder} and {@link StatementDecoder}; which topics to listen on by
+ * the injected {@link IncomingTopics}. Everything here is transport policy that both
+ * session kinds share: batching, dedup, the outgoing/incoming request state machine,
+ * expiry allocation, retries, and subscriber delivery.
+ */
+import { toHex } from '@novasamatech/scale';
+import { nanoid } from 'nanoid';
+import { ResultAsync, err, errAsync, fromPromise, fromThrowable, ok, okAsync } from 'neverthrow';
+import { toError } from '../helpers.js';
+import { isPriorityTooLow, submitWithRetry } from '../submit/retry.js';
+import { submitStatementOnce } from '../submit/submitStatement.js';
+import { DecodingError, DecryptionError, UnknownError } from './error.js';
+import { toMessage } from './messageMapper.js';
+import { incomingRequest, initialSessionState, liveRequestId, transition } from './stateMachine.js';
+/**
+ * The Bulletin statement store caps a statement at roughly 500 KiB of total encoded size
+ * (proof + channel + topics + expiry + data); 2 KiB leaves margin for the non-data fields.
+ * `DataTooLargeError.available` is the chain's authoritative number if this ever drifts.
+ *
+ * This is deliberately the transport's real capacity rather than an application policy.
+ * A too-small budget degrades silently — messages queue instead of batching, with no
+ * error — whereas a too-large one fails loudly and recoverably with `DataTooLargeError`.
+ * Applications that want a tighter bound (Android's chat uses 100 KiB) should pass their
+ * own `maxRequestSize`; base-spec.md leaves the choice to the Application Layer.
+ */
+export const DEFAULT_MAX_REQUEST_SIZE = 498 * 1024;
+// Rejection reason shared by dispose() and the disposed guards on submit*, so a torn-down session
+// always fails new and in-flight work the same way.
+const SESSION_DISPOSED = 'Session disposed';
+// Bounded retry for transient transport failures (the spec mandates retrying queries
+// and submit_statement on connection failure). The TS adapter doesn't expose connection
+// state, so we approximate with a short fixed backoff and an attempt cap.
+const MAX_INIT_RETRIES = 3;
+const MAX_SUBMIT_RETRIES = 3;
+const RETRY_DELAY_MS = 25;
+/**
+ * Fixed per-statement wire overhead reserved before sizing the request payload:
+ * topic (32) + channel (32) + expiry (8) + proof signature (64) + signer (32).
+ * Mirrors the Android/iOS sessions, which size message batches against
+ * `maxStatementSize - overhead` rather than the raw statement limit.
+ */
+export const STATEMENT_OVERHEAD = 32 + 32 + 8 + 64 + 32; // 168 bytes
+// nanoid() is fixed-length, so the requestId contributes a constant size; any
+// placeholder of that length yields the real encoded size.
+const SIZING_REQUEST_ID = 'x'.repeat(21);
+// A statement we could neither verify, decrypt, nor decode far enough to answer.
+const UNDECODABLE_EVENT = { tag: 'undecodable', requestId: null };
+// A response promise paired with its resolver/rejecter. The pre-attached catch
+// keeps a clearOutgoingStatement()/dispose() rejection from surfacing as an
+// unhandled rejection when no caller awaited it via waitForResponseMessage().
+function makeDeferred() {
+    let resolve;
+    let reject;
+    const promise = new Promise((res, rej) => {
+        resolve = res;
+        reject = rej;
+    });
+    promise.catch(() => undefined);
+    return { resolve, reject, promise };
+}
+export function createSessionCore({ statementStore, prover, allocator, maxRequestSize, bodyBuilder, incomingTopics, decoder, outgoingTopic, peerDevices, }) {
+    // Message bytes must fit within the statement limit minus the fixed wire overhead.
+    const maxPayloadSize = Math.max(0, maxRequestSize - STATEMENT_OVERHEAD);
+    // All batching / dedup / phase decisions are made by the reducer; this file only performs
+    // the effects it returns.
+    const transitionContext = {
+        fits: (messages) => requestPayloadSize(messages) <= maxPayloadSize,
+        newRequestId: nanoid,
+    };
+    let machineState = initialSessionState();
+    // Returns the effects performed, so a caller can tell whether the reducer acted on the
+    // event at all rather than re-deriving that decision for itself.
+    function dispatch(event) {
+        const result = transition(machineState, event, transitionContext);
+        machineState = result.state;
+        runEffects(result.effects);
+        return result.effects;
+    }
+    const pendingDelivery = new Map();
+    const seenStatements = new Set();
+    let subscribers = [];
+    // Reject callbacks for in-flight waitForRequestMessage() promises, so dispose()
+    // can settle them instead of leaving them to hang forever.
+    const requestWaiters = new Set();
+    const bufferedMessages = [];
+    // Live topic-set subscription (multi-device rosters change at runtime).
+    let topicsUnsub = null;
+    let storeUnsub = null;
+    let initRetries = 0;
+    let initRetryTimer = null;
+    let disposed = false;
+    // Id of the most recent response we initiated (responses share one channel, so only the
+    // latest is live — a retry for an older one must not resurrect it).
+    let lastResponseRequestId = null;
+    // One attempt, at the allocator's next (strictly increasing) expiry. Adopting the chain's
+    // floor after a priority rejection is the caller's job — see `submitWithSessionRetry`.
+    function submitBody(body) {
+        return submitStatementOnce({
+            statementStore,
+            prover,
+            allocator,
+            channel: body.channel,
+            topics: body.topics,
+            data: body.data,
+        });
+    }
+    // Encoded size of the statement `data` these messages would occupy — built through the
+    // real writer, so AEAD expansion and multi-device envelope fan-out are counted rather
+    // than estimated. Unbuildable → treat as "doesn't fit".
+    function requestPayloadSize(messages) {
+        return bodyBuilder
+            .buildRequest(SIZING_REQUEST_ID, messages)
+            .map(body => body.data.length)
+            .unwrapOr(Number.MAX_SAFE_INTEGER);
+    }
+    function settleTokens(tokens, settle) {
+        for (const token of tokens) {
+            const deferred = pendingDelivery.get(token);
+            if (deferred) {
+                settle(deferred);
+                pendingDelivery.delete(token);
+            }
+        }
+    }
+    function runEffects(effects) {
+        for (const effect of effects) {
+            switch (effect.type) {
+                case 'submitRequest':
+                    submitRequest(effect.requestId, effect.messages);
+                    break;
+                case 'resolveTokens': {
+                    const responseMessage = {
+                        type: 'response',
+                        localId: effect.requestId,
+                        requestId: effect.requestId,
+                        responseCode: effect.responseCode,
+                    };
+                    settleTokens(effect.tokens, deferred => deferred.resolve(responseMessage));
+                    break;
+                }
+                case 'rejectTokens':
+                    settleTokens(effect.tokens, deferred => deferred.reject(effect.error));
+                    break;
+            }
+        }
+    }
+    /**
+     * The session's submit policy, shared by requests and responses.
+     *
+     * Priority errors (ExpiryTooLow / AccountFull) mean only that our expiry lagged the chain's
+     * floor, so `onPriorityError` adopts the reported minimum and we retry without limit — they
+     * never consume the transient-failure budget and never surface to callers. Once `isLive`
+     * goes false the submission has been superseded, and a priority rejection is settled as
+     * success: it merely lost the channel race to a newer statement. Other errors keep the
+     * bounded retry and propagate when exhausted. `isLive` is re-checked before every retry, so
+     * a stale retry can never resurrect an old statement.
+     */
+    function submitWithSessionRetry(body, isLive) {
+        return submitWithRetry(() => submitBody(body), {
+            attempts: MAX_SUBMIT_RETRIES,
+            priorityAttempts: 'unbounded',
+            delaysMs: RETRY_DELAY_MS,
+            onPriorityError: error => allocator.raiseFloor(error.min),
+            shouldRetry: () => !disposed && isLive(),
+        });
+    }
+    function submitRequest(requestId, messages) {
+        bodyBuilder
+            .buildRequest(requestId, messages)
+            .asyncAndThen(body => submitWithSessionRetry(body, () => liveRequestId(machineState) === requestId))
+            .mapErr(e => {
+            // Genuine failure (priority errors never reach here). No effects means the reducer
+            // considered this submission superseded — the newer retransmit carries the waiters.
+            if (disposed)
+                return;
+            if (dispatch({ type: 'requestSubmitFailed', requestId, error: e }).length > 0) {
+                console.error('submitRequest failed:', e);
+            }
+        });
+    }
+    function deliver(event) {
+        // Buffer 'request' events unconditionally so that waitForRequestMessage
+        // registered after delivery (race condition) still receives them via subscribe() replay.
+        // Buffer everything else during initialization when there are no subscribers yet.
+        if (event.tag === 'request' || (subscribers.length === 0 && machineState.phase === 'initialization')) {
+            bufferedMessages.push(event);
+        }
+        if (subscribers.length === 0)
+            return;
+        for (const sub of subscribers) {
+            const messages = toMessage(event, sub.codec);
+            if (messages.length > 0)
+                sub.callback(messages);
+        }
+    }
+    // Proof or decryption failure leaves the payload (incl. the requestId) unreadable → drop.
+    function decodeIncoming(statement, spec) {
+        return decoder
+            .decodePeer(statement, spec)
+            .orElse(() => okAsync({ tag: 'undecodable', requestId: null }));
+    }
+    // False when the request is already known, so callers skip both delivery and NACKing.
+    function trackNewRequest(requestId) {
+        if (incomingRequest(machineState, requestId))
+            return false;
+        dispatch({ type: 'requestReceived', requestId });
+        return true;
+    }
+    function processIncomingStatement(statement, spec) {
+        if (!statement.data)
+            return;
+        const key = toHex(statement.data);
+        if (seenStatements.has(key))
+            return;
+        seenStatements.add(key);
+        void decodeIncoming(statement, spec).andTee(event => {
+            if (event.tag === 'undecodable') {
+                if (event.requestId === null) {
+                    // Proof/decryption failed, or no requestId was recoverable — nothing to NACK.
+                    console.warn('statement-store: dropping an undecodable incoming statement (no recoverable requestId)');
+                    return;
+                }
+                // Decrypted but malformed — NACK so the sender stops waiting. Only for a genuinely
+                // new id: if we already know it, a valid copy is in hand (or was answered), and
+                // NACKing now would mask the real response because `responded` is sticky.
+                if (!trackNewRequest(event.requestId))
+                    return;
+                void session
+                    .submitResponseMessage(event.requestId, 'decodingFailed')
+                    .mapErr(e => console.error('statement-store: failed to NACK an undecodable request:', e));
+                return;
+            }
+            if (event.tag === 'request') {
+                if (!trackNewRequest(event.requestId))
+                    return;
+                deliver(event);
+            }
+            else {
+                // Whether the response matches our batch is the reducer's rule to apply, not ours:
+                // no effects means it was not ours (or was already answered), so nothing to deliver.
+                const effects = dispatch({
+                    type: 'responseReceived',
+                    requestId: event.requestId,
+                    responseCode: event.responseCode,
+                });
+                if (effects.length > 0)
+                    deliver(event);
+            }
+        });
+    }
+    // Find the spec whose topic a statement arrived on, so the right sender key is used to
+    // open it. Single-topic sessions short-circuit — the store already filtered for us.
+    function specForStatement(specs, statement) {
+        if (specs.length <= 1)
+            return specs[0];
+        const topics = statement.topics ?? [];
+        return specs.find(spec => {
+            const specHex = toHex(spec.topic);
+            return topics.some(topic => (typeof topic === 'string' ? topic : toHex(topic)) === specHex);
+        });
+    }
+    // ONE subscription covering every incoming topic. A peer's requests AND its responses to
+    // our requests both arrive here (the peer publishes everything on its outgoing topic =
+    // our incoming topic). We publish on our own outgoing topic, which we don't subscribe to,
+    // so our statements are never echoed back.
+    function openStoreSubscription(specs) {
+        storeUnsub?.();
+        storeUnsub =
+            specs.length === 0
+                ? null
+                : statementStore.subscribeStatements({ matchAny: specs.map(spec => spec.topic) }, page => {
+                    for (const statement of page.statements) {
+                        const spec = specForStatement(specs, statement);
+                        if (spec)
+                            processIncomingStatement(statement, spec);
+                    }
+                });
+    }
+    function ensureStoreSubscription() {
+        if (topicsUnsub)
+            return;
+        openStoreSubscription(incomingTopics.current());
+        // A roster change (peer device added/removed) changes the topic set — re-open the
+        // single subscription rather than accumulating one per device.
+        topicsUnsub = incomingTopics.subscribe(specs => {
+            if (disposed)
+                return;
+            openStoreSubscription(specs);
+            // The same roster drives the outgoing envelope, so its size just changed: messages
+            // parked when the budget was tighter may fit now.
+            dispatch({ type: 'capacityChanged' });
+        });
+    }
+    // Both handles are cleared together: `ensureStoreSubscription` guards on `topicsUnsub`,
+    // so leaving it set while dropping `storeUnsub` would make a later subscribe() a no-op
+    // and the session would never listen again.
+    function closeStoreSubscription() {
+        topicsUnsub?.();
+        topicsUnsub = null;
+        storeUnsub?.();
+        storeUnsub = null;
+    }
+    // Once a request is answered it no longer needs to be replayed to future subscribers (and a
+    // late waitForRequestMessage must not re-receive an already-handled request). Dropping it also
+    // keeps bufferedMessages from growing unboundedly with every incoming request.
+    function pruneBufferedRequest(requestId) {
+        for (let i = bufferedMessages.length - 1; i >= 0; i--) {
+            const buffered = bufferedMessages[i];
+            if (buffered?.tag === 'request' && buffered.requestId === requestId)
+                bufferedMessages.splice(i, 1);
+        }
+    }
+    function rejectAllPending(error) {
+        for (const [, deferred] of pendingDelivery) {
+            deferred.reject(error);
+        }
+        pendingDelivery.clear();
+    }
+    function failInit(error) {
+        dispatch({ type: 'initFailed', error });
+        rejectAllPending(error);
+    }
+    async function init() {
+        const specs = incomingTopics.current();
+        // An empty topic set means nothing to listen to yet (a peer whose devices we have not
+        // learned). Skip the query rather than asking the store to match none — the node's
+        // reading of an empty `matchAny` is unspecified, and a store that took it as "match
+        // everything" would hand us the whole store to decode.
+        const result = await ResultAsync.combine([
+            statementStore.queryStatements({ matchAll: [outgoingTopic] }),
+            specs.length === 0
+                ? okAsync([])
+                : statementStore.queryStatements({ matchAny: specs.map(spec => spec.topic) }),
+        ]);
+        if (result.isErr()) {
+            if (disposed)
+                return;
+            // Transient transport failure: retry before failing terminally, preserving the queue.
+            // dispose() cancels the handle, or a late retry could re-activate a torn-down session.
+            if (initRetries < MAX_INIT_RETRIES) {
+                initRetries++;
+                initRetryTimer = setTimeout(() => {
+                    initRetryTimer = null;
+                    void init();
+                }, RETRY_DELAY_MS);
+                return;
+            }
+            failInit(result.error);
+            return;
+        }
+        initRetries = 0;
+        const [ownStatements, peerStatements] = result.value;
+        // Draw above everything already on our channel. raiseFloor is monotonic, so a statement
+        // submitted while init was in flight still keeps the counter ahead of this snapshot.
+        allocator.raiseFloor(ownStatements.reduce((max, s) => (s.expiry !== undefined && s.expiry > max ? s.expiry : max), 0n));
+        for (const s of [...ownStatements, ...peerStatements]) {
+            if (s.data)
+                seenStatements.add(toHex(s.data));
+        }
+        const isReadable = (event) => event.tag !== 'undecodable';
+        // Our own statements are read back with `decodeOwn` — a multi-device envelope carries no
+        // entry for us, so it is opened via a recipient device we wrapped it for. This is what
+        // lets the store, rather than a client-side outbox, hold the outgoing-request state.
+        const decodeOwnAll = Promise.all(ownStatements.map(s => decoder.decodeOwn(s, peerDevices()).unwrapOr(UNDECODABLE_EVENT))).then(events => events.filter(isReadable));
+        const decodePeerAll = Promise.all(peerStatements.map(s => {
+            const spec = specForStatement(specs, s);
+            return spec ? decodeIncoming(s, spec).unwrapOr(UNDECODABLE_EVENT) : Promise.resolve(UNDECODABLE_EVENT);
+        })).then(events => events.filter(isReadable));
+        const [ownDecoded, peerDecoded] = await Promise.all([decodeOwnAll, decodePeerAll]);
+        if (disposed)
+            return;
+        // Both parties publish on their own outgoing topic, so the OUTGOING query returns our
+        // requests + OUR responses, and the INCOMING query returns the peer's requests + the
+        // PEER's responses. Hence: our request is answered by a PEER response (incoming), and we
+        // have answered a peer request iff OUR response (outgoing) carries its id.
+        const ownRequest = ownDecoded.find(d => d.tag === 'request');
+        const ownResponse = ownDecoded.find(d => d.tag === 'response');
+        const peerRequest = peerDecoded.find(d => d.tag === 'request');
+        const peerResponse = peerDecoded.find(d => d.tag === 'response');
+        if (ownRequest?.tag === 'request') {
+            const hasResponse = peerResponse?.tag === 'response' && peerResponse.requestId === ownRequest.requestId;
+            if (!hasResponse)
+                dispatch({ type: 'outgoingRestored', requestId: ownRequest.requestId, messages: ownRequest.messages });
+        }
+        if (peerRequest?.tag === 'request') {
+            const requestId = peerRequest.requestId;
+            const alreadyKnown = incomingRequest(machineState, requestId) !== undefined;
+            const responded = ownResponse?.tag === 'response' && ownResponse.requestId === requestId;
+            // The reducer ignores an entry a live delivery created during the awaits above (the
+            // live one is newer/authoritative), so only notify when this one is genuinely new.
+            dispatch({ type: 'incomingRestored', requestId, responded });
+            // Notify app of an unresponded incoming request. Delivered while phase is still
+            // 'initialization' so `deliver` buffers it for replay if no subscriber is registered yet.
+            if (!alreadyKnown && !responded)
+                deliver(peerRequest);
+        }
+        dispatch({ type: 'activated' });
+    }
+    const session = {
+        request(codec, data) {
+            return session
+                .submitRequestMessage(codec, data)
+                .andThen(({ requestId }) => session.waitForResponseMessage(requestId).andThen(({ responseCode }) => mapResponseCode(responseCode)));
+        },
+        submitRequestMessage(codec, message) {
+            if (disposed)
+                return errAsync(new Error(SESSION_DISPOSED));
+            const encode = fromThrowable(codec.enc, toError);
+            const encodedResult = encode(message);
+            if (encodedResult.isErr())
+                return errAsync(encodedResult.error);
+            const encoded = encodedResult.value;
+            // Build once to size it, and keep the builder's own error: "cannot wrap without
+            // recipient devices" must not surface as "message too big".
+            const sized = bodyBuilder.buildRequest(SIZING_REQUEST_ID, [encoded]);
+            if (sized.isErr())
+                return errAsync(sized.error);
+            if (sized.value.data.length > maxPayloadSize)
+                return errAsync(new Error('message too big'));
+            if (machineState.phase === 'failed') {
+                return errAsync(machineState.initError ?? new Error('Session initialization failed'));
+            }
+            const token = nanoid();
+            pendingDelivery.set(token, makeDeferred());
+            dispatch({ type: 'messageSubmitted', encoded, token });
+            return okAsync({ requestId: token });
+        },
+        submitResponseMessage(requestId, responseCode) {
+            if (disposed)
+                return errAsync(new Error(SESSION_DISPOSED));
+            const incoming = incomingRequest(machineState, requestId);
+            if (!incoming)
+                return errAsync(new Error(`No incoming request with id ${requestId}`));
+            if (incoming.responded) {
+                pruneBufferedRequest(requestId);
+                return okAsync(undefined);
+            }
+            const body = bodyBuilder.buildResponse(requestId, responseCode);
+            if (body.isErr())
+                return errAsync(body.error);
+            const responseBody = body.value;
+            // Mark responded up-front so concurrent callers dedupe, but roll back if the
+            // submission fails — otherwise the ACK is lost forever (and a peer retransmit
+            // with a fresh id could never be answered either).
+            dispatch({ type: 'responseSubmitted', requestId });
+            lastResponseRequestId = requestId;
+            // Responses go on OUR outgoing topic/response-channel (per spec: the responder
+            // publishes on SessionId(self, peer)); the requester reads them from its incoming topic.
+            // Responses share one channel, so only the newest is live.
+            return (submitWithSessionRetry(responseBody, () => lastResponseRequestId === requestId)
+                .orElse(error => {
+                // Superseded or disposed: keep the request marked answered — re-answering would
+                // only clobber the newer response — and absorb the error. NOTE: since the shared
+                // channel exposes just the latest response, reliably ACKing several outstanding
+                // requests needs a protocol-level fix, tracked separately.
+                if (disposed || lastResponseRequestId !== requestId)
+                    return okAsync(undefined);
+                // The live response genuinely failed after exhausting retries — roll back so a later
+                // peer retransmit can still be answered, and surface the error.
+                dispatch({ type: 'responseSubmitFailed', requestId });
+                return errAsync(error);
+            })
+                // Answered (or absorbed as such): it no longer needs replaying to future subscribers.
+                .andTee(() => pruneBufferedRequest(requestId)));
+        },
+        waitForRequestMessage(codec, filter) {
+            const promise = new Promise((resolve, reject) => {
+                let settled = false;
+                // Initialised to a no-op so a synchronous buffered-replay match during
+                // subscribe() can call it without hitting the temporal dead zone; the
+                // real unsubscribe is wired in once subscribe() returns.
+                let unsubscribe = () => undefined;
+                const finish = (run) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    requestWaiters.delete(rejectWaiter);
+                    unsubscribe();
+                    run();
+                };
+                const rejectWaiter = (error) => finish(() => reject(error));
+                requestWaiters.add(rejectWaiter);
+                unsubscribe = session.subscribe(codec, messages => {
+                    for (const message of messages) {
+                        if (message.type !== 'request')
+                            continue;
+                        if (message.payload.status !== 'parsed')
+                            continue;
+                        const filtered = filter(message.payload.value);
+                        if (filtered !== undefined) {
+                            finish(() => resolve(filtered));
+                            return;
+                        }
+                    }
+                });
+                // subscribe() may have matched synchronously (buffered replay) while
+                // `unsubscribe` was still the no-op above — tear down the real one now.
+                if (settled)
+                    unsubscribe();
+            });
+            return fromPromise(promise, toError);
+        },
+        respondToRequests(codec, handler) {
+            return session.subscribe(codec, messages => {
+                for (const message of messages) {
+                    if (message.type !== 'request')
+                        continue;
+                    const handled = handler(message);
+                    const statusResult = handled instanceof ResultAsync ? handled : okAsync(handled);
+                    void statusResult
+                        .orElse(() => okAsync('unknown'))
+                        .andThen(code => session.submitResponseMessage(message.requestId, code))
+                        .mapErr(e => {
+                        console.error('respondToRequests: failed to submit response:', e);
+                    });
+                }
+            });
+        },
+        waitForResponseMessage(token) {
+            const deferred = pendingDelivery.get(token);
+            if (!deferred)
+                return errAsync(new Error(`No pending delivery for token ${token}`));
+            return fromPromise(deferred.promise, toError);
+        },
+        subscribe(codec, callback) {
+            const sub = {
+                codec: codec,
+                callback: callback,
+            };
+            subscribers.push(sub);
+            ensureStoreSubscription();
+            // Deliver buffered init messages to this subscriber
+            if (bufferedMessages.length > 0) {
+                const messages = bufferedMessages.flatMap(sd => toMessage(sd, codec));
+                if (messages.length > 0)
+                    callback(messages);
+            }
+            return () => {
+                subscribers = subscribers.filter(s => s !== sub);
+                if (subscribers.length === 0)
+                    closeStoreSubscription();
+            };
+        },
+        clearOutgoingStatement() {
+            // Always drop local outgoing state and reject pending waiters up-front, regardless of
+            // which path follows. This covers messages queued before the batch went out (e.g.
+            // during init, while there is no live batch) and guarantees cleanup even if the
+            // superseding submission below fails — the caller still receives any submission error.
+            const requestId = liveRequestId(machineState);
+            dispatch({ type: 'outgoingCleared' });
+            rejectAllPending(new Error('Outgoing batch aborted'));
+            if (requestId === null)
+                return okAsync(undefined);
+            const emptyBody = bodyBuilder.buildRequest(requestId, []);
+            if (emptyBody.isErr())
+                return errAsync(emptyBody.error);
+            // Supersede the live batch with an empty one, which goes out at a STRICTLY higher
+            // expiry — the store rejects an equal-or-lower expiry on the same channel, so reusing
+            // the last allocated expiry would leave the original request live on-chain. One shot,
+            // no retry (clearing is a supersede, not a request that must land); a priority
+            // rejection (ExpiryTooLow / AccountFull) means the channel already advanced past us,
+            // so the clear already happened → absorb it as success. No retry loop here means no
+            // onPriorityError hook, so resync the allocator inline: adopt the chain floor before
+            // absorbing, so later submits stay above it.
+            return submitBody(emptyBody.value).orElse(error => {
+                if (!isPriorityTooLow(error))
+                    return errAsync(error);
+                allocator.raiseFloor(error.min);
+                return okAsync(undefined);
+            });
+        },
+        dispose() {
+            disposed = true;
+            if (initRetryTimer) {
+                clearTimeout(initRetryTimer);
+                initRetryTimer = null;
+            }
+            closeStoreSubscription();
+            subscribers = [];
+            // Drop pending work so no in-flight retry or queue drain acts on a disposed session.
+            dispatch({ type: 'outgoingCleared' });
+            // Settle any waitForRequestMessage() promises so callers unwind instead of
+            // hanging forever. Snapshot first — rejecting mutates the set.
+            for (const rejectWaiter of [...requestWaiters])
+                rejectWaiter(new Error(SESSION_DISPOSED));
+            requestWaiters.clear();
+            rejectAllPending(new Error(SESSION_DISPOSED));
+        },
+    };
+    void init();
+    return session;
+}
+function mapResponseCode(responseCode) {
+    switch (responseCode) {
+        case 'success':
+            return ok();
+        case 'decodingFailed':
+            return err(new DecodingError());
+        case 'decryptionFailed':
+            return err(new DecryptionError());
+        case 'unknown':
+            return err(new UnknownError());
+    }
+}

package/dist/session/messageMapper.d.ts

@@ -1,4 +1,4 @@
-import type { Codec, CodecType } from 'scale-ts';
-import type { StatementData } from './scale/statementData.js';
+import type { Codec } from 'scale-ts';
+import type { ReadableEvent } from './codec/decoder.js';
 import type { Message } from './types.js';
-export declare function toMessage<T>(statementData: CodecType<typeof StatementData>, codec: Codec<T>): Message<T>[];
+export declare function toMessage<T>(event: ReadableEvent, codec: Codec<T>): Message<T>[];

package/dist/session/messageMapper.js

@@ -6,14 +6,14 @@ function decode(payload, codec) {
         return { status: 'failed', value: payload };
     }
 }
-export function toMessage(statementData, codec) {
-    switch (statementData.tag) {
+export function toMessage(event, codec) {
+    switch (event.tag) {
         case 'request': {
-            return statementData.value.data.map((payload, index) => {
+            return event.messages.map((payload, index) => {
                 return {
                     type: 'request',
-                    localId: `${statementData.value.requestId}-${index.toString()}`,
-                    requestId: statementData.value.requestId,
+                    localId: `${event.requestId}-${index.toString()}`,
+                    requestId: event.requestId,
                     payload: decode(payload, codec),
                 };
             });
@@ -22,9 +22,9 @@ export function toMessage(statementData, codec) {
             return [
                 {
                     type: 'response',
-                    localId: statementData.value.requestId,
-                    requestId: statementData.value.requestId,
-                    responseCode: statementData.value.responseCode,
+                    localId: event.requestId,
+                    requestId: event.requestId,
+                    responseCode: event.responseCode,
                 },
             ];
     }