@opendatalabs/personal-server-ts-core 1.34.2 → 1.35.0

package/dist/replication/rebaseline.d.ts

@@ -0,0 +1,33 @@
+import { type ReplicaOperation } from "./envelope.js";
+type WithoutRevision<T> = T extends ReplicaOperation ? Omit<T, "revision"> : never;
+type Declared = Extract<ReplicaOperation, {
+    declaration: unknown;
+}>;
+/** `upsert:<hex>` of a record body, as `replicaOperationEffect` names it. */
+export declare function replicaUpsertEffect(data: unknown): string;
+/** What a record or completion operation leaves in the canonical state. */
+export declare function replicaOperationEffect(op: WithoutRevision<ReplicaOperation> | ReplicaOperation): string;
+/**
+ * The revision and declaration a copy of `source` keeps: its counter, that
+ * operation (or its own origin) as origin, and its declaration, so after a
+ * rebinding the copy validates exactly where the original did.
+ */
+export declare function reissuedFrom(source: Declared): {
+    revision: {
+        counter: number;
+        origin: {
+            writerId: string;
+            operationId: string;
+        };
+    };
+    declaration: {
+        digest: string;
+        version: string;
+        stream: string;
+        semantics: "append_only" | "mutable_state";
+        primaryKey: string[];
+        schemaDigest: string;
+    };
+};
+export {};
+//# sourceMappingURL=rebaseline.d.ts.map

package/dist/replication/rebaseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebaseline.d.ts","sourceRoot":"","sources":["../../src/replication/rebaseline.ts"],"names":[],"mappings":"AAcA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAErE,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAChD,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,GACnB,KAAK,CAAC;AACV,KAAK,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAEpE,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,eAAe,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,GACvD,MAAM,CAIR;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ;;;;;;;;;;;;;;;;EAM5C"}

package/dist/replication/rebaseline.js

@@ -0,0 +1,40 @@
+/**
+ * The rule a rebaseline re-issues canonical state by, shared by every host.
+ * A new writer identity re-captures the current state under its own writer
+ * before it publishes, so a peer that missed the old writer's batches still
+ * converges. Each host walks its own canonical state; this module names a
+ * state's effect and the order and binding its copy keeps.
+ *
+ * Only the operation the merge chose explains a state. A higher operation
+ * with the same effect may be one the merge rejected or keeps pending;
+ * copying its order or binding would publish a baseline that a peer with
+ * this device's trust refuses.
+ */
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@noble/hashes/utils";
+import { canonicalJson } from "./envelope.js";
+/** `upsert:<hex>` of a record body, as `replicaOperationEffect` names it. */
+export function replicaUpsertEffect(data) {
+    return `upsert:${bytesToHex(sha256(new TextEncoder().encode(canonicalJson(data))))}`;
+}
+/** What a record or completion operation leaves in the canonical state. */
+export function replicaOperationEffect(op) {
+    if (op.kind === "upsert")
+        return replicaUpsertEffect(op.data);
+    if (op.kind === "stream-complete")
+        return `complete:${op.snapshotSha256}`;
+    return op.kind;
+}
+/**
+ * The revision and declaration a copy of `source` keeps: its counter, that
+ * operation (or its own origin) as origin, and its declaration, so after a
+ * rebinding the copy validates exactly where the original did.
+ */
+export function reissuedFrom(source) {
+    const { counter, writerId, operationId, origin } = source.revision;
+    return {
+        revision: { counter, origin: origin ?? { writerId, operationId } },
+        declaration: source.declaration,
+    };
+}
+//# sourceMappingURL=rebaseline.js.map

package/dist/replication/rebaseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebaseline.js","sourceRoot":"","sources":["../../src/replication/rebaseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAyB,MAAM,eAAe,CAAC;AAOrE,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,UAAU,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CACpC,EAAwD;IAExD,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC;IAC1E,OAAO,EAAE,CAAC,IAAI,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnE,OAAO;QACL,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;QAClE,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC"}

package/dist/replication/rebinding.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Declaration rebinding: what a changed set of retained declarations does to
+ * a replicating database (host contract §4.5).
+ *
+ * Every operation carries the exact declaration binding it was written
+ * under, so a binding is its own version tag. A rebinding therefore journals
+ * nothing. The database records a new binding generation, keeps trusting
+ * every binding it ever retained, and writes new operations under the new
+ * one. Older operations, own or received, in flight or retained, keep their
+ * binding and validate against its schema. Versions of one stream merge by
+ * revision (`declarationShape`), so devices that upgrade at different times
+ * converge once each trusts the bindings the other wrote.
+ *
+ * A changed shape (semantics or primary key) of a stream the database ever
+ * retained changes record identity. That is refused: the database keeps its
+ * current generation and the host reports the reason.
+ */
+import { type DeclarationBinding } from "./envelope.js";
+export interface ReplicaBindingEntry {
+    sourceId: string;
+    binding: DeclarationBinding;
+}
+export type ReplicaRebinding = {
+    tag: "unchanged";
+} | {
+    tag: "rebind";
+    /** Bindings no generation retained before. */
+    added: ReplicaBindingEntry[];
+    /** Bindings of the current generation the next one drops. Still trusted. */
+    retired: ReplicaBindingEntry[];
+} | {
+    tag: "refused";
+    reason: string;
+};
+/**
+ * Decide the move from the current generation to `next`.
+ *
+ * @param current The bindings of the current generation.
+ * @param history Every binding any generation retained (`current` included).
+ * @param next The host's bindings for this boot.
+ */
+export declare function planReplicaRebinding(current: readonly ReplicaBindingEntry[], history: readonly ReplicaBindingEntry[], next: readonly ReplicaBindingEntry[]): ReplicaRebinding;
+//# sourceMappingURL=rebinding.d.ts.map

package/dist/replication/rebinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebinding.d.ts","sourceRoot":"","sources":["../../src/replication/rebinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,GAAG,EAAE,WAAW,CAAA;CAAE,GACpB;IACE,GAAG,EAAE,QAAQ,CAAC;IACd,8CAA8C;IAC9C,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC,GACD;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAOvC;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS,mBAAmB,EAAE,EACvC,OAAO,EAAE,SAAS,mBAAmB,EAAE,EACvC,IAAI,EAAE,SAAS,mBAAmB,EAAE,GACnC,gBAAgB,CAyBlB"}

package/dist/replication/rebinding.js

@@ -0,0 +1,52 @@
+/**
+ * Declaration rebinding: what a changed set of retained declarations does to
+ * a replicating database (host contract §4.5).
+ *
+ * Every operation carries the exact declaration binding it was written
+ * under, so a binding is its own version tag. A rebinding therefore journals
+ * nothing. The database records a new binding generation, keeps trusting
+ * every binding it ever retained, and writes new operations under the new
+ * one. Older operations, own or received, in flight or retained, keep their
+ * binding and validate against its schema. Versions of one stream merge by
+ * revision (`declarationShape`), so devices that upgrade at different times
+ * converge once each trusts the bindings the other wrote.
+ *
+ * A changed shape (semantics or primary key) of a stream the database ever
+ * retained changes record identity. That is refused: the database keeps its
+ * current generation and the host reports the reason.
+ */
+import { canonicalJson, declarationShape, } from "./envelope.js";
+const entryKey = (e) => canonicalJson([e.sourceId, e.binding]);
+const streamKey = (e) => canonicalJson([e.sourceId, e.binding.stream]);
+/**
+ * Decide the move from the current generation to `next`.
+ *
+ * @param current The bindings of the current generation.
+ * @param history Every binding any generation retained (`current` included).
+ * @param next The host's bindings for this boot.
+ */
+export function planReplicaRebinding(current, history, next) {
+    const nextKeys = new Set(next.map(entryKey));
+    const currentKeys = new Set(current.map(entryKey));
+    if (nextKeys.size === currentKeys.size &&
+        [...nextKeys].every((key) => currentKeys.has(key)))
+        return { tag: "unchanged" };
+    const shapes = new Map();
+    for (const entry of history)
+        shapes.set(streamKey(entry), declarationShape(entry.binding));
+    for (const entry of next) {
+        const prior = shapes.get(streamKey(entry));
+        if (prior !== undefined && prior !== declarationShape(entry.binding))
+            return {
+                tag: "refused",
+                reason: `replication rebinding refused: ${entry.sourceId} stream ${entry.binding.stream} changed its semantics or primary key`,
+            };
+    }
+    const known = new Set(history.map(entryKey));
+    return {
+        tag: "rebind",
+        added: next.filter((entry) => !known.has(entryKey(entry))),
+        retired: current.filter((entry) => !nextKeys.has(entryKey(entry))),
+    };
+}
+//# sourceMappingURL=rebinding.js.map

package/dist/replication/rebinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebinding.js","sourceRoot":"","sources":["../../src/replication/rebinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,aAAa,EACb,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AAkBvB,MAAM,QAAQ,GAAG,CAAC,CAAsB,EAAE,EAAE,CAC1C,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACzC,MAAM,SAAS,GAAG,CAAC,CAAsB,EAAE,EAAE,CAC3C,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAuC,EACvC,OAAuC,EACvC,IAAoC;IAEpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,IACE,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAClC,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAElD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO;QACzB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;YAClE,OAAO;gBACL,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,kCAAkC,KAAK,CAAC,QAAQ,WAAW,KAAK,CAAC,OAAO,CAAC,MAAM,uCAAuC;aAC/H,CAAC;IACN,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC"}

package/dist/replication/receive.d.ts

@@ -0,0 +1,57 @@
+import { type Hex } from "viem";
+export { REPLICA_RECEIVE_TIMEOUT_MS } from "./dpv2.js";
+import { ReplicaManifestRefused, type ReplicaManifest, type ReplicaFragment } from "./transport.js";
+interface ReplicaObjectInput {
+    maxBytes: number;
+    signal?: AbortSignal;
+    read(signal: AbortSignal): Promise<Uint8Array>;
+    decrypt(encrypted: Uint8Array): Promise<Uint8Array>;
+}
+export type ReplicaManifestReceipt = {
+    tag: "manifest";
+    manifest: ReplicaManifest;
+    dataHash: Hex;
+    metadataHash: Hex;
+}
+/** Terminal for the slot: the bytes can never be a valid manifest there. */
+ | {
+    tag: "refused";
+    reason: ReplicaManifestRefused["reason"];
+}
+/** The bytes are not the slot's finalized commitment; storage may repair them. */
+ | {
+    tag: "mismatch";
+};
+/**
+ * The one decode boundary for a manifest a peer supplied, in this order: a
+ * read bounded by `maxBytes`, the transport's packet check and decryption, a
+ * bounded JSON parse, the finalized commitment, then decoding.
+ *
+ * Before the commitment, bytes that no writer makes (over the bound,
+ * compressed, outside the OpenPGP profile, JSON over its bounds) are refused
+ * as `manifest_invalid`: their cost is the attack, and the data hash is over
+ * plaintext they would have to produce. Other bytes that fail before it are
+ * a mismatch, or a thrown read or decrypt error, which the caller retries.
+ * After the commitment the bytes are authentic and do not change on retry,
+ * so every failure is a refusal.
+ */
+export declare function receiveReplicaManifest(input: ReplicaObjectInput & {
+    scope: string;
+    owner: string;
+    /** Whether this hash pair is the slot's finalized commitment. */
+    committed(dataHash: Hex, metadataHash: Hex): boolean;
+}): Promise<ReplicaManifestReceipt>;
+/** Same receive boundary, authenticated by the signed manifest's ciphertext entry. */
+export declare function receiveReplicaFragment(input: ReplicaObjectInput & {
+    scope: string;
+    owner: string;
+    manifest: ReplicaManifest;
+    index: number;
+}): Promise<{
+    tag: "fragment";
+    fragment: ReplicaFragment;
+} | {
+    tag: "refused";
+    reason: "fragment_mismatch";
+}>;
+//# sourceMappingURL=receive.d.ts.map

package/dist/replication/receive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.d.ts","sourceRoot":"","sources":["../../src/replication/receive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAML,sBAAsB,EAItB,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrD;AAwDD,MAAM,MAAM,sBAAsB,GAC9B;IACE,GAAG,EAAE,UAAU,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,GAAG,CAAC;IACd,YAAY,EAAE,GAAG,CAAC;CACnB;AACH,4EAA4E;GAC1E;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAA;CAAE;AAC9D,kFAAkF;GAChF;IAAE,GAAG,EAAE,UAAU,CAAA;CAAE,CAAC;AAExB;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,kBAAkB,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC;CACtD,GACA,OAAO,CAAC,sBAAsB,CAAC,CAmCjC;AAED,sFAAsF;AACtF,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,kBAAkB,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GACA,OAAO,CACN;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GAC9C;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAClD,CAuBA"}

package/dist/replication/receive.js

@@ -0,0 +1,114 @@
+import { keccak256 } from "viem";
+import { ReplicaObjectRefused, REPLICA_RECEIVE_TIMEOUT_MS } from "./dpv2.js";
+export { REPLICA_RECEIVE_TIMEOUT_MS } from "./dpv2.js";
+import { abortable } from "./coordinator.js";
+import { decodeParsedReplicaFragment, decodeParsedReplicaManifest, fragmentMatchesManifest, parseReplicaJson, ReplicaJsonRefused, ReplicaManifestRefused, replicaMetadataHash, replicaDigest, } from "./transport.js";
+/**
+ * The shared boundary for every peer object. Fragments have a ciphertext
+ * commitment, which can be checked before decryption. Once it matches, any
+ * decrypt/parse failure is terminal. Manifest commitments need parsed JSON.
+ */
+async function receiveReplicaJson(input, ciphertextCommitted) {
+    const timeout = AbortSignal.timeout(REPLICA_RECEIVE_TIMEOUT_MS);
+    const signal = input.signal
+        ? AbortSignal.any([input.signal, timeout])
+        : timeout;
+    let plaintext;
+    let committed = false;
+    try {
+        const encrypted = await abortable(signal, () => input.read(signal));
+        if (encrypted.length > input.maxBytes)
+            throw new ReplicaObjectRefused("oversize");
+        if (ciphertextCommitted) {
+            if (!ciphertextCommitted(encrypted))
+                return { tag: "mismatch" };
+            committed = true;
+        }
+        plaintext = await abortable(signal, () => input.decrypt(encrypted));
+        if (plaintext.length > input.maxBytes)
+            throw new ReplicaObjectRefused("oversize");
+        return {
+            tag: "parsed",
+            encrypted,
+            plaintext,
+            parsed: parseReplicaJson(plaintext),
+        };
+    }
+    catch (error) {
+        signal.throwIfAborted();
+        if (committed ||
+            error instanceof ReplicaObjectRefused ||
+            error instanceof ReplicaJsonRefused)
+            return { tag: "refused" };
+        if (plaintext !== undefined)
+            return { tag: "mismatch" };
+        throw error;
+    }
+}
+/**
+ * The one decode boundary for a manifest a peer supplied, in this order: a
+ * read bounded by `maxBytes`, the transport's packet check and decryption, a
+ * bounded JSON parse, the finalized commitment, then decoding.
+ *
+ * Before the commitment, bytes that no writer makes (over the bound,
+ * compressed, outside the OpenPGP profile, JSON over its bounds) are refused
+ * as `manifest_invalid`: their cost is the attack, and the data hash is over
+ * plaintext they would have to produce. Other bytes that fail before it are
+ * a mismatch, or a thrown read or decrypt error, which the caller retries.
+ * After the commitment the bytes are authentic and do not change on retry,
+ * so every failure is a refusal.
+ */
+export async function receiveReplicaManifest(input) {
+    const received = await receiveReplicaJson(input);
+    if (received.tag === "refused")
+        return { tag: "refused", reason: "manifest_invalid" };
+    if (received.tag === "mismatch")
+        return received;
+    const { encrypted, plaintext, parsed } = received;
+    const { value } = parsed;
+    const collectedAt = typeof value === "object" && value !== null
+        ? value.collectedAt
+        : undefined;
+    if (typeof collectedAt !== "string")
+        return { tag: "mismatch" };
+    const dataHash = keccak256(plaintext);
+    const metadataHash = replicaMetadataHash(input.scope, collectedAt, encrypted.length);
+    if (!input.committed(dataHash, metadataHash))
+        return { tag: "mismatch" };
+    try {
+        return {
+            tag: "manifest",
+            manifest: decodeParsedReplicaManifest(parsed, input.scope, input.owner),
+            dataHash,
+            metadataHash,
+        };
+    }
+    catch (error) {
+        return {
+            tag: "refused",
+            reason: error instanceof ReplicaManifestRefused
+                ? error.reason
+                : "manifest_invalid",
+        };
+    }
+}
+/** Same receive boundary, authenticated by the signed manifest's ciphertext entry. */
+export async function receiveReplicaFragment(input) {
+    const entry = input.manifest.fragments[input.index];
+    if (!entry)
+        return { tag: "refused", reason: "fragment_mismatch" };
+    const received = await receiveReplicaJson(input, (encrypted) => encrypted.length === entry.bytes &&
+        replicaDigest(encrypted) === entry.digest);
+    if (received.tag !== "parsed")
+        return { tag: "refused", reason: "fragment_mismatch" };
+    try {
+        const fragment = decodeParsedReplicaFragment(received.parsed, input.scope, input.owner);
+        if (!fragmentMatchesManifest(fragment, input.manifest, input.index))
+            return { tag: "refused", reason: "fragment_mismatch" };
+        return { tag: "fragment", fragment };
+    }
+    catch {
+        return { tag: "refused", reason: "fragment_mismatch" };
+    }
+}
+//# sourceMappingURL=receive.js.map

package/dist/replication/receive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.js","sourceRoot":"","sources":["../../src/replication/receive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAY,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,aAAa,GAId,MAAM,gBAAgB,CAAC;AASxB;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAyB,EACzB,mBAAwD;IAWxD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC;IACZ,IAAI,SAAiC,CAAC;IACtC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ;YACnC,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YAChE,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,IAAI,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ;YACnC,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC7C,OAAO;YACL,GAAG,EAAE,QAAQ;YACb,SAAS;YACT,SAAS;YACT,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC;SACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IACE,SAAS;YACT,KAAK,YAAY,oBAAoB;YACrC,KAAK,YAAY,kBAAkB;YAEnC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACxD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAKC;IAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS;QAC5B,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxD,IAAI,QAAQ,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACjD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAClD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,WAAW,GACf,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAAmC,CAAC,WAAW;QAClD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,mBAAmB,CACtC,KAAK,CAAC,KAAK,EACX,WAAW,EACX,SAAS,CAAC,MAAM,CACjB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACzE,IAAI,CAAC;QACH,OAAO;YACL,GAAG,EAAE,UAAU;YACf,QAAQ,EAAE,2BAA2B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACvE,QAAQ;YACR,YAAY;SACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,EAAE,SAAS;YACd,MAAM,EACJ,KAAK,YAAY,sBAAsB;gBACrC,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,kBAAkB;SACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAKC;IAKD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,KAAK,EACL,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK;QAChC,aAAa,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,MAAM,CAC5C,CAAC;IACF,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,QAAQ,CAAC,MAAM,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;YACjE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/replication/record-reducer.d.ts

@@ -0,0 +1,16 @@
+import { type ReplicaOperation, type RecordOperation } from "./envelope.js";
+import { type MergeContext, type MergedRecord } from "./merge-plan.js";
+/**
+ * Bounded materialization evidence for ONE key. Original operations, including
+ * losers, stay in the durable journal; this is not compaction. Every decision is
+ * made by planReplicaMerge. The reducer cannot see a cross-key or
+ * cross-connection operation-id collision or a binding conflict: the caller
+ * supplies those as `ConnectionFacts` and uses the reducer only while
+ * `connectionFromFacts` (visibility-engine.ts) says the connection is active.
+ * `lifecycle` must be that connection's globally unique lifecycle operations.
+ */
+export declare function createReplicaRecordReducer(context: MergeContext, lifecycle: readonly ReplicaOperation[]): {
+    push(operation: RecordOperation): void;
+    readonly record: MergedRecord | undefined;
+};
+//# sourceMappingURL=record-reducer.d.ts.map

package/dist/replication/record-reducer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-reducer.d.ts","sourceRoot":"","sources":["../../src/replication/record-reducer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,SAAS,gBAAgB,EAAE;oBAMpB,eAAe;;EAiClC"}

package/dist/replication/record-reducer.js

@@ -0,0 +1,52 @@
+import { canonicalJson, } from "./envelope.js";
+import { planReplicaMerge, } from "./merge-plan.js";
+/**
+ * Bounded materialization evidence for ONE key. Original operations, including
+ * losers, stay in the durable journal; this is not compaction. Every decision is
+ * made by planReplicaMerge. The reducer cannot see a cross-key or
+ * cross-connection operation-id collision or a binding conflict: the caller
+ * supplies those as `ConnectionFacts` and uses the reducer only while
+ * `connectionFromFacts` (visibility-engine.ts) says the connection is active.
+ * `lifecycle` must be that connection's globally unique lifecycle operations.
+ */
+export function createReplicaRecordReducer(context, lifecycle) {
+    let identity;
+    let evidence = [];
+    let record;
+    return {
+        push(operation) {
+            const key = canonicalJson([
+                operation.owner,
+                operation.sourceId,
+                operation.connectionId,
+                operation.declaration.stream,
+                operation.recordKey,
+            ]);
+            if (identity !== undefined && identity !== key)
+                throw new Error("mixed replica record partition");
+            identity = key;
+            const plan = planReplicaMerge(context, [
+                ...lifecycle,
+                ...evidence,
+                operation,
+            ]);
+            record = plan.records[0];
+            if (record?.winner)
+                evidence = [record.winner];
+            else if (record?.quarantined) {
+                const first = record.losers[0];
+                const witness = record.losers.find((candidate) => planReplicaMerge(context, [...lifecycle, first, candidate])
+                    .records[0]?.quarantined);
+                if (!witness)
+                    throw new Error("missing replica conflict witness");
+                evidence = [first, witness];
+            }
+            else
+                evidence = [];
+        },
+        get record() {
+            return record;
+        },
+    };
+}
+//# sourceMappingURL=record-reducer.js.map

package/dist/replication/record-reducer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-reducer.js","sourceRoot":"","sources":["../../src/replication/record-reducer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAGd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAqB,EACrB,SAAsC;IAEtC,IAAI,QAA4B,CAAC;IACjC,IAAI,QAAQ,GAAsB,EAAE,CAAC;IACrC,IAAI,MAAgC,CAAC;IACrC,OAAO;QACL,IAAI,CAAC,SAA0B;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC;gBACxB,SAAS,CAAC,KAAK;gBACf,SAAS,CAAC,QAAQ;gBAClB,SAAS,CAAC,YAAY;gBACtB,SAAS,CAAC,WAAW,CAAC,MAAM;gBAC5B,SAAS,CAAC,SAAS;aACpB,CAAC,CAAC;YACH,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,GAAG;gBAC5C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,QAAQ,GAAG,GAAG,CAAC;YACf,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE;gBACrC,GAAG,SAAS;gBACZ,GAAG,QAAQ;gBACX,SAAS;aACV,CAAC,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,MAAM,EAAE,MAAM;gBAAE,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;iBAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAChC,CAAC,SAAS,EAAE,EAAE,CACZ,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;qBACxD,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,CAC7B,CAAC;gBACF,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAClE,QAAQ,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9B,CAAC;;gBAAM,QAAQ,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,MAAM;YACR,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/replication/revision.d.ts

@@ -0,0 +1,24 @@
+/** Persist with the mutation, never derive from a local query version or timestamp. */
+export interface ReplicaRevision {
+    counter: number;
+    writerId: string;
+    operationId: string;
+    /**
+     * Set on an operation a new writer identity re-issues in its rebaseline:
+     * the original operation, whose counter it keeps. It orders as that
+     * operation, so a re-issue neither outranks a newer write nor loses a tie
+     * the original won.
+     */
+    origin?: {
+        writerId: string;
+        operationId: string;
+    };
+}
+/**
+ * Counter, then the original writer and operation ids, then the operation's
+ * own. Code-unit ordering is independent of runtime locale.
+ */
+export declare function compareRevisions(a: ReplicaRevision, b: ReplicaRevision): number;
+/** Caller must persist the result atomically with its new local operation. */
+export declare function nextLamportCounter(local: number, observed: readonly number[]): number;
+//# sourceMappingURL=revision.d.ts.map

package/dist/replication/revision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revision.d.ts","sourceRoot":"","sources":["../../src/replication/revision.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,eAAe,EAClB,CAAC,EAAE,eAAe,GACjB,MAAM,CAeR;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAUR"}

package/dist/replication/revision.js

@@ -0,0 +1,35 @@
+/**
+ * Counter, then the original writer and operation ids, then the operation's
+ * own. Code-unit ordering is independent of runtime locale.
+ */
+export function compareRevisions(a, b) {
+    for (const [left, right] of [
+        [a.counter, b.counter],
+        [a.origin?.writerId ?? a.writerId, b.origin?.writerId ?? b.writerId],
+        [
+            a.origin?.operationId ?? a.operationId,
+            b.origin?.operationId ?? b.operationId,
+        ],
+        [a.writerId, b.writerId],
+        [a.operationId, b.operationId],
+    ]) {
+        if (left < right)
+            return -1;
+        if (left > right)
+            return 1;
+    }
+    return 0;
+}
+/** Caller must persist the result atomically with its new local operation. */
+export function nextLamportCounter(local, observed) {
+    let maximum = local;
+    for (const counter of [local, ...observed]) {
+        if (!Number.isSafeInteger(counter) || counter < 0)
+            throw new Error("invalid Lamport counter");
+        maximum = Math.max(maximum, counter);
+    }
+    if (maximum === Number.MAX_SAFE_INTEGER)
+        throw new Error("Lamport counter exhausted");
+    return maximum + 1;
+}
+//# sourceMappingURL=revision.js.map

package/dist/replication/revision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revision.js","sourceRoot":"","sources":["../../src/replication/revision.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,CAAkB,EAClB,CAAkB;IAElB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;QACtB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;QACpE;YACE,CAAC,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC,WAAW;YACtC,CAAC,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC,WAAW;SACvC;QACD,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC;QACxB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;KACtB,EAAE,CAAC;QACX,IAAI,IAAI,GAAG,KAAK;YAAE,OAAO,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,GAAG,KAAK;YAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,QAA2B;IAE3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,CAAC,gBAAgB;QACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,OAAO,OAAO,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/replication/roster.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Replica membership: the owner's ServerRegistration roster at the gateway.
+ * A receiver imports only from servers that are registered now. It never
+ * accepts on an unknown roster: an unavailable answer is a Wait, not absence.
+ */
+/** The gateway record of one server, as membership reads it. */
+export interface ReplicaRosterRecord {
+    /** The owner wallet the server is registered under. */
+    owner: string;
+    /** The gateway registration id (bytes32). A new id is a new incarnation. */
+    id: string;
+    revokedAt: string | null;
+}
+export interface ReplicaRosterCall {
+    signal?: AbortSignal;
+}
+export interface ReplicaRosterPort {
+    /** null only for a proven absent registration; unavailable answers throw. */
+    server(address: `0x${string}`, call?: ReplicaRosterCall): Promise<ReplicaRosterRecord | null>;
+}
+/** The roster could not be read and no fresh answer is cached. Never absence. */
+export declare class ReplicaRosterUnavailableError extends Error {
+    readonly code = "replica_roster_unavailable";
+    constructor(options?: {
+        cause?: unknown;
+    });
+}
+/** The longest a receiver acts on one roster answer. */
+export declare const REPLICA_ROSTER_MAX_AGE_MS: number;
+/**
+ * A bounded roster cache. An answer, including a proven absence, is served
+ * for at most `maxAgeMs` after it was read. After that the next lookup reads
+ * the port again; if that read fails, the lookup throws
+ * ReplicaRosterUnavailableError. An expired answer is never served, so a
+ * deregistration reaches every check within `maxAgeMs` plus the gateway CDN TTL.
+ */
+export declare function createCachedReplicaRoster(port: ReplicaRosterPort, options?: {
+    maxAgeMs?: number;
+    maxEntries?: number;
+    now?: () => number;
+}): ReplicaRosterPort & {
+    invalidate(address?: string): void;
+};
+/**
+ * GET /v1/servers/:address. Only the gateway's JSON "Server not found" 404
+ * proves absence; any other status or shape is unavailable, so a generic
+ * route or CDN 404 cannot refuse a registered server.
+ */
+export declare function createGatewayReplicaRoster(input: {
+    gatewayUrl: string;
+    fetch?: typeof fetch;
+}): ReplicaRosterPort;
+//# sourceMappingURL=roster.d.ts.map

package/dist/replication/roster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roster.d.ts","sourceRoot":"","sources":["../../src/replication/roster.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,MAAM,CACJ,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,gCAAgC;gBACjC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI1C;AAED,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAGpD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GAC3E,iBAAiB,GAAG;IAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA4C5D;AAID;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,iBAAiB,CAyCpB"}