@openlfcp/client 0.1.0-rc.1

package/dist/outbound.js

@@ -0,0 +1,508 @@
+import { bytesEqual, dataUnitId, hash32, toHex, } from "@openlfcp/core";
+import { sha256 } from "@openlfcp/crypto";
+import { addSequence, canonicalFrontierFromCbor, classifyDataUnit, createMessage, DEFAULT_MAX_MESSAGE_BYTES, ERROR_CODE, encodeMessage, MESSAGE_TYPE, parseControlRecord, unionHaves, } from "@openlfcp/wire";
+import { decodeDeterministic } from "@openlfcp/wire/cbor";
+/** Exponential backoff from `baseMs`, doubling per attempt, capped at `maxMs`. */
+export function exponentialBackoff(baseMs, maxMs) {
+    return {
+        nextAttempt: ({ item, now }) => {
+            const delay = Math.min(maxMs, baseMs * 2 ** Math.max(0, item.attempts - 1));
+            return new Date(Date.parse(now) + delay).toISOString();
+        },
+    };
+}
+const KIND_TYPE = {
+    "control-record": "CONTROL_PUT",
+    "key-package": "KEY_PACKAGE_PUT",
+    "data-unit": "DATA_PUT",
+    snapshot: "SNAPSHOT_PUT",
+};
+/** §88: Control Plane first, then Key Packages, Data Units, Snapshots. */
+const KIND_ORDER = [
+    "control-record",
+    "key-package",
+    "data-unit",
+    "snapshot",
+];
+/** NACK codes that concern one object: a multi-object message is split to find it. */
+const PER_OBJECT = new Set([
+    "STALE_DATA_EPOCH",
+    "ACTOR_EQUIVOCATION",
+    "AUTHORIZATION_FAILED",
+    "MESSAGE_TOO_LARGE",
+    "INVALID_SIGNATURE",
+    "MALFORMED_MESSAGE",
+]);
+const CODE_NAMES = new Map(Object.entries(ERROR_CODE).map(([name, code]) => [code, name]));
+/** Room left in a message for the envelope and body around the objects. */
+const OVERHEAD = 1024;
+const AT_ONCE = { nextAttempt: () => null };
+export class OutboundQueue {
+    #storage;
+    #retry;
+    #maxObjects;
+    #minimumDurability;
+    #recentAckLimit;
+    #timeout;
+    /** Session parameters from READY. */
+    #durability = 0n;
+    #maxMessageBytes = DEFAULT_MAX_MESSAGE_BYTES;
+    /** message ID hex → what it carried */
+    #flights = new Map();
+    /** item ID hex → message ID hex */
+    #inFlight = new Map();
+    /** Items to send one per message (to find which one a per-object NACK meant). */
+    #solo = new Set();
+    /** Items waiting for a Control sync (MISSING_DEPENDENCY). */
+    #awaitingControl = new Set();
+    constructor(options) {
+        this.#storage = options.storage;
+        this.#retry = options.retry ?? AT_ONCE;
+        this.#maxObjects = Math.max(1, options.maxObjectsPerMessage ?? 64);
+        this.#minimumDurability = options.minimumDurability ?? 0n;
+        this.#recentAckLimit = options.recentAckLimit ?? 256;
+        this.#timeout = options.requestTimeout ?? { baseMs: 10_000, maxMs: 60_000 };
+    }
+    /**
+     * Messages whose answer is overdue: their items leave flight and are due
+     * again, after the RetryPolicy's delay for a "timeout". A late answer
+     * still removes the items it names (onAck matches by object ID).
+     */
+    async #expire(now) {
+        const at = Date.parse(now);
+        const overdue = [];
+        for (const [key, flight] of this.#flights) {
+            if (flight.deadline > at)
+                continue;
+            this.#flights.delete(key);
+            for (const id of flight.itemIds)
+                if (this.#inFlight.get(toHex(id)) === key) {
+                    this.#inFlight.delete(toHex(id));
+                    overdue.push(id);
+                }
+        }
+        if (overdue.length > 0)
+            await this.#retryLater(overdue, "timeout", now);
+    }
+    /** READY: the server's durability level and maximum message size for this session (§37). */
+    session(ready) {
+        this.#durability = ready.durability;
+        this.#maxMessageBytes = Number(ready.maxMessageBytes);
+    }
+    async #commit(writes) {
+        if (writes.length === 0)
+            return;
+        const r = await this.#storage.commit(writes);
+        if (!r.ok)
+            throw new Error(`unexpected storage precondition failure: ${r.reason}`);
+    }
+    /**
+     * The messages to send now for `resource`: every unblocked item that is
+     * not in flight, not waiting for a Control sync and due by `now`, in §88
+     * order, batched where the message type allows. Each item's attempt is
+     * recorded durably before the messages are returned. An item too large
+     * for any message is blocked ("too-large") instead.
+     */
+    async next(resource, now) {
+        await this.#expire(now);
+        const due = (await this.#storage.outbound.list(resource)).filter((o) => o.blocked === null &&
+            !this.#inFlight.has(toHex(o.itemId)) &&
+            !this.#awaitingControl.has(toHex(o.itemId)) &&
+            (o.nextAttempt === null || o.nextAttempt <= now));
+        const out = [];
+        const writes = [];
+        const limit = this.#maxMessageBytes - OVERHEAD;
+        for (const kind of KIND_ORDER) {
+            const items = due.filter((o) => o.kind === kind);
+            let batch = [];
+            let size = 0;
+            const flush = () => {
+                if (batch.length === 0)
+                    return;
+                out.push(this.#message(resource, kind, batch));
+                batch = [];
+                size = 0;
+            };
+            for (const item of items) {
+                // Fail closed on local corruption: an object ID is the SHA-256 of its
+                // exact bytes, so other bytes are never sent (nor "repaired").
+                if (!bytesEqual(sha256(item.bytes), item.itemId)) {
+                    writes.push({
+                        op: "update-outbound",
+                        itemId: item.itemId,
+                        blocked: {
+                            reason: "rejected",
+                            detail: "local corruption: the stored bytes do not hash to the object ID",
+                        },
+                    });
+                    continue;
+                }
+                if (item.bytes.length > limit) {
+                    writes.push({
+                        op: "update-outbound",
+                        itemId: item.itemId,
+                        blocked: { reason: "too-large", detail: `${item.bytes.length} bytes > ${limit}` },
+                    });
+                    continue;
+                }
+                const batchable = (kind === "data-unit" || kind === "key-package") && !this.#solo.has(toHex(item.itemId));
+                if (!batchable) {
+                    flush();
+                    batch = [item];
+                    flush();
+                    continue;
+                }
+                if (batch.length >= this.#maxObjects || size + item.bytes.length > limit)
+                    flush();
+                batch.push(item);
+                size += item.bytes.length;
+            }
+            flush();
+        }
+        for (const m of out)
+            for (const id of m.itemIds) {
+                const item = due.find((o) => bytesEqual(o.itemId, id));
+                writes.push({
+                    op: "update-outbound",
+                    itemId: id,
+                    attempts: item.attempts + 1,
+                    lastAttempt: now,
+                });
+            }
+        await this.#commit(writes);
+        for (const m of out) {
+            const key = toHex(m.message.messageId);
+            const attempts = Math.max(...m.itemIds.map((id) => (due.find((o) => bytesEqual(o.itemId, id))?.attempts ?? 0) + 1));
+            const wait = Math.min(this.#timeout.maxMs, this.#timeout.baseMs * 2 ** (attempts - 1));
+            this.#flights.set(key, {
+                resourceId: resource,
+                type: m.message.type,
+                itemIds: m.itemIds,
+                deadline: Date.parse(now) + wait,
+            });
+            for (const id of m.itemIds)
+                this.#inFlight.set(toHex(id), key);
+        }
+        return out;
+    }
+    /** A new message, with a new Message ID, around the exact stored bytes. */
+    #message(resource, kind, items) {
+        let message;
+        const first = items[0];
+        switch (kind) {
+            case "data-unit":
+                message = createMessage("DATA_PUT", {
+                    resourceId: resource,
+                    objects: items.map((i) => i.bytes),
+                });
+                break;
+            case "key-package":
+                message = createMessage("KEY_PACKAGE_PUT", {
+                    resourceId: resource,
+                    objects: items.map((i) => i.bytes),
+                });
+                break;
+            case "snapshot":
+                message = createMessage("SNAPSHOT_PUT", { resourceId: resource, snapshot: first.bytes });
+                break;
+            case "control-record": {
+                // §47: the expected head is the record's own previous record.
+                const prev = parseControlRecord(first.bytes).payload.prevControlId;
+                if (prev === null)
+                    throw new Error("a Genesis record is hosted with RESOURCE_HOST, not CONTROL_PUT");
+                message = createMessage("CONTROL_PUT", {
+                    resourceId: resource,
+                    expectedHead: prev,
+                    record: first.bytes,
+                });
+                break;
+            }
+        }
+        return Object.freeze({
+            resourceId: resource,
+            message,
+            bytes: encodeMessage(message),
+            itemIds: Object.freeze(items.map((i) => i.itemId)),
+        });
+    }
+    #land(messageId) {
+        if (messageId === undefined)
+            return undefined;
+        const key = toHex(messageId);
+        const flight = this.#flights.get(key);
+        if (flight === undefined)
+            return undefined;
+        this.#flights.delete(key);
+        for (const id of flight.itemIds)
+            if (this.#inFlight.get(toHex(id)) === key)
+                this.#inFlight.delete(toHex(id));
+        return flight;
+    }
+    async #retryLater(ids, reason, now, code) {
+        const writes = [];
+        for (const id of ids) {
+            const item = await this.#storage.outbound.get(id);
+            if (item === undefined)
+                continue;
+            writes.push({
+                op: "update-outbound",
+                itemId: id,
+                nextAttempt: this.#retry.nextAttempt({
+                    item,
+                    reason,
+                    now,
+                    ...(code === undefined ? {} : { code }),
+                }),
+            });
+        }
+        await this.#commit(writes);
+    }
+    /**
+     * An ACK (§59): removes the queued items whose IDs it names (field 1),
+     * and records them in the Resource's sync state. Items of the
+     * acknowledged message it does not name stay queued. Idempotent: a
+     * repeated ACK, or one for items already gone, changes nothing.
+     */
+    async onAck(message, now) {
+        const flight = this.#land(message.correlationId);
+        const named = message.body.objectIds ?? [];
+        const durability = message.body.durable === true ? this.#durability : 0n;
+        const requestType = message.body.requestType;
+        const acked = [];
+        const below = [];
+        const byResource = new Map();
+        for (const id of named) {
+            const item = await this.#storage.outbound.get(id);
+            if (item === undefined)
+                continue;
+            if (MESSAGE_TYPE[KIND_TYPE[item.kind]] !== requestType)
+                continue;
+            if (flight !== undefined && !bytesEqual(item.resourceId, flight.resourceId))
+                continue;
+            if (durability < this.#minimumDurability) {
+                below.push(item.itemId);
+                continue;
+            }
+            acked.push(item.itemId);
+            const key = toHex(item.resourceId);
+            byResource.set(key, [...(byResource.get(key) ?? []), item.itemId]);
+            this.#forget(item.itemId);
+        }
+        const writes = acked.map((itemId) => ({ op: "dequeue", itemId }));
+        for (const ids of byResource.values()) {
+            const resourceId = (await this.#storage.outbound.get(ids[0]))?.resourceId;
+            if (resourceId === undefined)
+                continue;
+            const old = await this.#storage.syncState.get(resourceId);
+            const recent = [
+                ...(old?.recentlyAcked ?? []).filter((x) => !ids.some((i) => bytesEqual(i, x))),
+                ...ids,
+            ];
+            writes.push({
+                op: "put-sync-state",
+                row: {
+                    resourceId,
+                    recentlyAcked: recent.slice(-this.#recentAckLimit),
+                    ackedDurability: durability,
+                },
+            });
+        }
+        await this.#commit(writes);
+        const notCovered = flight?.itemIds.filter((id) => !acked.some((a) => bytesEqual(a, id)) && !below.some((b) => bytesEqual(b, id))) ?? [];
+        const stillQueued = [];
+        for (const id of [...notCovered, ...below])
+            if ((await this.#storage.outbound.get(id)) !== undefined)
+                stillQueued.push(id);
+        await this.#retryLater(stillQueued, "not-acked", now);
+        return Object.freeze({
+            acked: Object.freeze(acked),
+            notCovered: Object.freeze(notCovered.filter((id) => stillQueued.some((s) => bytesEqual(s, id)))),
+            durability,
+            belowDurability: Object.freeze(below),
+            correlated: flight !== undefined,
+        });
+    }
+    #forget(itemId) {
+        const key = toHex(itemId);
+        this.#inFlight.delete(key);
+        this.#solo.delete(key);
+        this.#awaitingControl.delete(key);
+    }
+    async #block(ids, reason, detail) {
+        const out = [];
+        const writes = [];
+        for (const id of ids) {
+            const item = await this.#storage.outbound.get(id);
+            if (item === undefined)
+                continue;
+            writes.push({ op: "update-outbound", itemId: id, blocked: { reason, detail } });
+            out.push(Object.freeze({ itemId: item.itemId, kind: item.kind, reason, detail }));
+            this.#forget(id);
+        }
+        await this.#commit(writes);
+        return out;
+    }
+    /**
+     * A NACK (§60) of one of this session's messages. Per-object codes on a
+     * message of several objects resend each object alone, to learn which one
+     * the server meant. Then:
+     * STALE_DATA_EPOCH → blocked "stale-epoch" (G-EP5: never resent);
+     * ACTOR_EQUIVOCATION → blocked "equivocation", surfaced as an alarm;
+     * AUTHORIZATION_FAILED (and other per-object refusals) → blocked "rejected";
+     * MESSAGE_TOO_LARGE → blocked "too-large";
+     * CONTROL_HEAD_MISMATCH → blocked "repropose" with the current head;
+     * MISSING_DEPENDENCY → retried after the next controlSynced();
+     * anything else → retried after the RetryPolicy delay.
+     */
+    async onNack(message, now) {
+        const code = CODE_NAMES.get(message.body.code) ?? message.body.code;
+        const flight = this.#land(message.correlationId);
+        if (flight === undefined)
+            return Object.freeze({ kind: "uncorrelated", code });
+        const items = [];
+        for (const id of flight.itemIds)
+            if ((await this.#storage.outbound.get(id)) !== undefined)
+                items.push(id);
+        const detail = message.body.diagnostic ?? null;
+        if (typeof code === "string" && PER_OBJECT.has(code) && items.length > 1) {
+            for (const id of items)
+                this.#solo.add(toHex(id));
+            return Object.freeze({ kind: "isolating", code, items: Object.freeze(items) });
+        }
+        switch (code) {
+            case "STALE_DATA_EPOCH":
+                return Object.freeze({
+                    kind: "stale",
+                    items: await this.#block(items, "stale-epoch", detail),
+                });
+            case "ACTOR_EQUIVOCATION":
+                return Object.freeze({
+                    kind: "equivocation-alarm",
+                    items: await this.#block(items, "equivocation", detail),
+                });
+            case "MESSAGE_TOO_LARGE":
+                return Object.freeze({
+                    kind: "rejected",
+                    code,
+                    items: await this.#block(items, "too-large", detail),
+                });
+            case "AUTHORIZATION_FAILED":
+            case "INVALID_SIGNATURE":
+            case "MALFORMED_MESSAGE":
+                return Object.freeze({
+                    kind: "rejected",
+                    code,
+                    items: await this.#block(items, "rejected", detail),
+                });
+            case "CONTROL_HEAD_MISMATCH": {
+                const d = message.body.details;
+                const currentHead = d instanceof Uint8Array && d.length === 32
+                    ? hash32(d)
+                    : null;
+                const blocked = await this.#block(items, "repropose", currentHead === null ? detail : `current head ${toHex(currentHead)}`);
+                return Object.freeze({ kind: "repropose", items: blocked, currentHead });
+            }
+            case "MISSING_DEPENDENCY":
+                for (const id of items)
+                    this.#awaitingControl.add(toHex(id));
+                return Object.freeze({ kind: "needs-control-sync", items: Object.freeze(items) });
+            default:
+                await this.#retryLater(items, "transient", now, code);
+                return Object.freeze({ kind: "retry", code, items: Object.freeze(items) });
+        }
+    }
+    /**
+     * The connection is gone: every message in flight is unanswered, so its
+     * items are due again (same bytes, a new message) after the RetryPolicy
+     * delay. Returns the affected item IDs.
+     */
+    async connectionLost(now) {
+        const ids = [...this.#flights.values()].flatMap((f) => f.itemIds);
+        this.#flights.clear();
+        this.#inFlight.clear();
+        await this.#retryLater(ids, "connection-lost", now);
+        return ids;
+    }
+    /** The Control Plane of `resource` was synchronized: items held for MISSING_DEPENDENCY are due again. */
+    async controlSynced(resource) {
+        for (const item of await this.#storage.outbound.list(resource))
+            this.#awaitingControl.delete(toHex(item.itemId));
+    }
+    /**
+     * §88 step 7, G-EP5: with a newly validated Control view, our queued
+     * Data Units of a closed epoch beyond its final frontier are never sent;
+     * they are blocked "stale-epoch" and surfaced (also when in flight: a
+     * later ACK still removes them). Units within the cutoff stay queued and
+     * are sent as the same bytes.
+     */
+    async reconcileEpochs(view) {
+        const out = [];
+        const writes = [];
+        for (const item of await this.#storage.outbound.list(view.state.resourceId)) {
+            if (item.kind !== "data-unit" || item.blocked !== null)
+                continue;
+            const unit = await this.#storage.dataUnits.get(dataUnitId(item.itemId));
+            if (unit === undefined)
+                continue;
+            const c = classifyDataUnit(view, unit);
+            if (c.kind !== "quarantine")
+                continue;
+            writes.push({
+                op: "update-outbound",
+                itemId: item.itemId,
+                blocked: { reason: "stale-epoch", detail: c.reason },
+            });
+            this.#solo.delete(toHex(item.itemId));
+            out.push(Object.freeze({
+                itemId: item.itemId,
+                kind: item.kind,
+                reason: "stale-epoch",
+                detail: c.reason,
+                actor: unit.actor,
+                seq: unit.actorSeq,
+                epoch: unit.dataEpoch,
+            }));
+        }
+        await this.#commit(writes);
+        return out;
+    }
+    /** Removes a blocked item once the application has dealt with it (e.g. re-proposed or re-applied). */
+    async discard(itemId) {
+        const item = await this.#storage.outbound.get(itemId);
+        if (item === undefined)
+            return;
+        if (item.blocked === null)
+            throw new Error("only a blocked item can be discarded; an unsent object would be lost");
+        this.#forget(itemId);
+        await this.#commit([{ op: "dequeue", itemId }]);
+    }
+}
+/** The sync state of `resource` from storage alone (valid after a restart). */
+export async function resourceSyncState(storage, resource) {
+    // Units held through a stored (loaded or published) Snapshot count too (§29).
+    let have = await snapshotFrontier(storage, resource);
+    // Every LFCP-accepted unit is held here, whatever its profile status: a
+    // crash between accepting and recording the merge leaves it "seen" or
+    // "held" until replayStored applies it.
+    for (const status of ["merged", "profile-pending", "profile-rejected", "seen", "held"])
+        for (const u of await storage.dataUnits.withStatus(resource, status))
+            if (u.accepted)
+                have = addSequence(have, u.actor, u.actorSeq);
+    const items = await storage.outbound.list(resource);
+    const sync = await storage.syncState.get(resource);
+    return Object.freeze({
+        have,
+        outstanding: Object.freeze(items.filter((i) => i.blocked === null)),
+        blocked: Object.freeze(items.filter((i) => i.blocked !== null)),
+        recentlyAcked: sync?.recentlyAcked ?? [],
+        ackedDurability: sync?.ackedDurability ?? null,
+    });
+}
+/** The union of the frontiers of the Snapshots stored for `resource` (those loaded or published here). */
+export async function snapshotFrontier(storage, resource) {
+    let have = [];
+    for (const s of await storage.snapshots.list(resource))
+        have = unionHaves(have, canonicalFrontierFromCbor(decodeDeterministic(s.frontier)));
+    return have;
+}
+//# sourceMappingURL=outbound.js.map

package/dist/queue.d.ts

@@ -0,0 +1,38 @@
+import { type Hash32, type ResourceId } from "@openlfcp/core";
+import { type LfcpStorage, type OutboundItem, type OutboundKind, type SecretStore, type StorageWrite } from "@openlfcp/storage";
+import { type EpochRotation } from "@openlfcp/wire";
+import { type CreatedSnapshot, type CreateSnapshotOptions } from "./snapshot.js";
+/**
+ * Putting this client's immutable objects into the outbound queue
+ * (LFCP-036): each is stored with its exact bytes, and queued, in ONE
+ * atomic commit before it can be sent. The queue (OutboundQueue) sends
+ * these same bytes until an ACK names the object.
+ */
+/** A new outbound item: never attempted, not blocked. */
+export declare const outboundItem: (kind: OutboundKind, itemId: Hash32, resourceId: ResourceId, bytes: Uint8Array) => OutboundItem;
+/**
+ * Queues a Key Epoch this client created (rotateEpoch) and keeps its new
+ * DEK: the secret first, under the epoch's standard reference
+ * (dekSecretRef), then the record for CONTROL_PUT. The creator never needs
+ * a Key Package for a key it made: once the coordinator accepts the record
+ * and the chain is saved, the epoch's row takes the stored DEK
+ * (adoptStoredDeks) with no network round trip.
+ */
+export declare function queueKeyEpoch(storage: Pick<LfcpStorage, "commit">, secrets: SecretStore, rotation: EpochRotation, also?: readonly StorageWrite[]): Promise<Hash32>;
+/** Stores a sealed Key Package (§25) and queues it for KEY_PACKAGE_PUT. */
+export declare function queueKeyPackage(storage: Pick<LfcpStorage, "commit">, bytes: Uint8Array, also?: readonly StorageWrite[]): Promise<Hash32>;
+/** Stores a sealed Snapshot (§29) with its selection metadata and queues it for SNAPSHOT_PUT. */
+export declare function queueSnapshot(storage: Pick<LfcpStorage, "commit">, bytes: Uint8Array, also?: readonly StorageWrite[]): Promise<Hash32>;
+/**
+ * Creates a Snapshot with a sequence from the storage's reservation and
+ * queues it (see createSnapshot and queueSnapshot): a crash before the
+ * commit leaves only an abandoned sequence.
+ */
+export declare function createQueuedSnapshot<T>(storage: Pick<LfcpStorage, "snapshotSequences" | "commit">, options: Omit<CreateSnapshotOptions<T>, "sequences">, also?: readonly StorageWrite[]): Promise<CreatedSnapshot>;
+/**
+ * Queues a signed Control Record for CONTROL_PUT (§47); its expected head
+ * is its own previous record. It joins the stored chain only once a
+ * validated chain contains it (saveControlChain).
+ */
+export declare function queueControlRecord(storage: Pick<LfcpStorage, "commit">, bytes: Uint8Array, also?: readonly StorageWrite[]): Promise<Hash32>;
+//# sourceMappingURL=queue.d.ts.map

package/dist/queue.js

@@ -0,0 +1,116 @@
+import { hash32 } from "@openlfcp/core";
+import { exportSecretKeyBytes } from "@openlfcp/crypto";
+import { dekSecretRef, } from "@openlfcp/storage";
+import { canonicalFrontierToCbor, parseControlRecord, parseKeyPackage, parseSnapshot, } from "@openlfcp/wire";
+import { encode } from "@openlfcp/wire/cbor";
+import { createSnapshot } from "./snapshot.js";
+/**
+ * Putting this client's immutable objects into the outbound queue
+ * (LFCP-036): each is stored with its exact bytes, and queued, in ONE
+ * atomic commit before it can be sent. The queue (OutboundQueue) sends
+ * these same bytes until an ACK names the object.
+ */
+/** A new outbound item: never attempted, not blocked. */
+export const outboundItem = (kind, itemId, resourceId, bytes) => ({
+    itemId,
+    resourceId,
+    kind,
+    bytes,
+    attempts: 0,
+    lastAttempt: null,
+    nextAttempt: null,
+    blocked: null,
+});
+async function commit(storage, writes) {
+    const r = await storage.commit(writes);
+    if (!r.ok)
+        throw new Error(`the object was not queued: ${r.reason}`);
+}
+/**
+ * Queues a Key Epoch this client created (rotateEpoch) and keeps its new
+ * DEK: the secret first, under the epoch's standard reference
+ * (dekSecretRef), then the record for CONTROL_PUT. The creator never needs
+ * a Key Package for a key it made: once the coordinator accepts the record
+ * and the chain is saved, the epoch's row takes the stored DEK
+ * (adoptStoredDeks) with no network round trip.
+ */
+export async function queueKeyEpoch(storage, secrets, rotation, also = []) {
+    const resource = parseControlRecord(rotation.bytes).payload.resourceId;
+    await secrets.put(dekSecretRef(resource, rotation.epoch), exportSecretKeyBytes(rotation.dek));
+    return queueControlRecord(storage, rotation.bytes, also);
+}
+/** Stores a sealed Key Package (§25) and queues it for KEY_PACKAGE_PUT. */
+export async function queueKeyPackage(storage, bytes, also = []) {
+    const parsed = parseKeyPackage(bytes);
+    const p = parsed.payload;
+    const id = hash32(parsed.signed.id);
+    await commit(storage, [
+        {
+            op: "put-key-package",
+            row: {
+                packageId: id,
+                resourceId: p.resourceId,
+                dataEpoch: p.dataEpoch,
+                recipient: p.recipient,
+                sender: p.sender,
+                bytes: parsed.signed.bytes,
+            },
+        },
+        { op: "enqueue", item: outboundItem("key-package", id, p.resourceId, parsed.signed.bytes) },
+        ...also,
+    ]);
+    return id;
+}
+/** Stores a sealed Snapshot (§29) with its selection metadata and queues it for SNAPSHOT_PUT. */
+export async function queueSnapshot(storage, bytes, also = []) {
+    const parsed = parseSnapshot(bytes);
+    const p = parsed.payload;
+    const id = hash32(parsed.signed.id);
+    await commit(storage, [
+        {
+            op: "put-snapshot",
+            row: {
+                snapshotId: id,
+                resourceId: p.resourceId,
+                dataEpoch: p.dataEpoch,
+                publisher: p.publisher,
+                snapshotSeq: p.snapshotSeq,
+                frontier: encode(canonicalFrontierToCbor(p.frontier)),
+                bytes: parsed.signed.bytes,
+            },
+        },
+        { op: "enqueue", item: outboundItem("snapshot", id, p.resourceId, parsed.signed.bytes) },
+        ...also,
+    ]);
+    return id;
+}
+/**
+ * Creates a Snapshot with a sequence from the storage's reservation and
+ * queues it (see createSnapshot and queueSnapshot): a crash before the
+ * commit leaves only an abandoned sequence.
+ */
+export async function createQueuedSnapshot(storage, options, also = []) {
+    const created = await createSnapshot({ ...options, sequences: storage.snapshotSequences });
+    await queueSnapshot(storage, created.bytes, also);
+    return created;
+}
+/**
+ * Queues a signed Control Record for CONTROL_PUT (§47); its expected head
+ * is its own previous record. It joins the stored chain only once a
+ * validated chain contains it (saveControlChain).
+ */
+export async function queueControlRecord(storage, bytes, also = []) {
+    const parsed = parseControlRecord(bytes);
+    if (parsed.payload.prevControlId === null)
+        throw new Error("a Genesis record is hosted with RESOURCE_HOST, not CONTROL_PUT");
+    const id = hash32(parsed.signed.id);
+    await commit(storage, [
+        {
+            op: "enqueue",
+            item: outboundItem("control-record", id, parsed.payload.resourceId, parsed.signed.bytes),
+        },
+        ...also,
+    ]);
+    return id;
+}
+//# sourceMappingURL=queue.js.map