@openlfcp/client 0.1.0-rc.1

package/dist/resource-state.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The §65 per-Resource client sync state machine (LFCP-WIRE-01 §65) as a
+ * pure transition function: exactly the drawn edges, plus the close edge
+ * from every state but CLOSED (§65: "Every state moves to CLOSED on
+ * RESOURCE_CLOSE or when the connection is lost"; CLOSED → CLOSED is
+ * illegal). An event without an edge returns undefined.
+ */
+export type ResourcePhase = "CLOSED" | "OPENING" | "CONTROL_SYNC" | "CONTROL_CONFLICT" | "KEY_SYNC" | "KEY_BLOCKED" | "DATA_SYNC" | "LIVE";
+export type ResourcePhaseEvent = 
+/** RESOURCE_OPEN sent */
+"OPEN"
+/** RESOURCE_OPENED received */
+ | "OPENED"
+/** multiple valid Control Heads */
+ | "FORK"
+/** Control Chain complete */
+ | "CONTROL_COMPLETE"
+/** the required DEK is available */
+ | "DEK_AVAILABLE"
+/** a required Key Package is unavailable */
+ | "KEY_UNAVAILABLE"
+/** a Key Package arrived (KEY_BLOCKED → KEY_SYNC) */
+ | "PACKAGE_ARRIVED"
+/** snapshot/replay reached the known frontier */
+ | "FRONTIER_REACHED"
+/** missing ranges detected while LIVE */
+ | "MISSING_RANGES"
+/** a new Control Record received while LIVE */
+ | "CONTROL_RECORD"
+/** RESOURCE_CLOSE, a manual close, or the connection was lost */
+ | "CLOSE";
+/** The §65 transition, or undefined when `event` has no edge from `state`. */
+export declare function resourcePhaseTransition(state: ResourcePhase, event: ResourcePhaseEvent): ResourcePhase | undefined;
+//# sourceMappingURL=resource-state.d.ts.map

package/dist/resource-state.js

@@ -0,0 +1,24 @@
+/**
+ * The §65 per-Resource client sync state machine (LFCP-WIRE-01 §65) as a
+ * pure transition function: exactly the drawn edges, plus the close edge
+ * from every state but CLOSED (§65: "Every state moves to CLOSED on
+ * RESOURCE_CLOSE or when the connection is lost"; CLOSED → CLOSED is
+ * illegal). An event without an edge returns undefined.
+ */
+const EDGES = {
+    CLOSED: { OPEN: "OPENING" },
+    OPENING: { OPENED: "CONTROL_SYNC" },
+    CONTROL_SYNC: { FORK: "CONTROL_CONFLICT", CONTROL_COMPLETE: "KEY_SYNC" },
+    CONTROL_CONFLICT: {},
+    KEY_SYNC: { DEK_AVAILABLE: "DATA_SYNC", KEY_UNAVAILABLE: "KEY_BLOCKED" },
+    KEY_BLOCKED: { PACKAGE_ARRIVED: "KEY_SYNC" },
+    DATA_SYNC: { FRONTIER_REACHED: "LIVE" },
+    LIVE: { MISSING_RANGES: "DATA_SYNC", CONTROL_RECORD: "CONTROL_SYNC" },
+};
+/** The §65 transition, or undefined when `event` has no edge from `state`. */
+export function resourcePhaseTransition(state, event) {
+    if (event === "CLOSE")
+        return state === "CLOSED" ? undefined : "CLOSED";
+    return EDGES[state][event];
+}
+//# sourceMappingURL=resource-state.js.map

package/dist/snapshot.d.ts

@@ -0,0 +1,42 @@
+import { type DataEpoch, type Hash32 } from "@openlfcp/core";
+import { type ResourceDEK } from "@openlfcp/crypto";
+import type { SnapshotSequenceGuard, SnapshotSequenceReservation } from "@openlfcp/storage";
+import { type ControlView, type DataProfileCodec, type LiveHaveEntry, type Signer } from "@openlfcp/wire";
+/**
+ * Publishing an encrypted, signed Snapshot (LFCP-WIRE-01 §29). The Data
+ * Profile's Snapshot codec turns the application state into plaintext;
+ * LFCP encrypts and signs it. Only the opaque bytes are ever sent.
+ */
+export interface CreateSnapshotOptions<T> {
+    readonly view: ControlView;
+    /** The Control Head the Snapshot is authorized at (usually the latest one). */
+    readonly controlHead: Uint8Array;
+    readonly publisher: Signer;
+    /** The DEK of the current Data Epoch at `controlHead`. */
+    readonly dek: ResourceDEK;
+    /** The only source of Snapshot Sequences (§29): durable in production (LFCP-034, LFCP-035). */
+    readonly sequences: SnapshotSequenceReservation;
+    readonly guard?: SnapshotSequenceGuard;
+    /** The Data Plane holdings the Snapshot includes; normalized and canonicalized here (§28.2). */
+    readonly frontier: readonly LiveHaveEntry[];
+    /** The Data Profile's Snapshot codec. */
+    readonly profile: DataProfileCodec<T>;
+    readonly value: T;
+}
+export interface CreatedSnapshot {
+    /** The exact signed bytes: opaque, the only form sent to servers and peers. */
+    readonly bytes: Uint8Array;
+    readonly snapshotId: Hash32;
+    readonly seq: bigint;
+    readonly epoch: DataEpoch;
+}
+/**
+ * Creates a Snapshot. Before a sequence is reserved, it checks the head,
+ * the profile, snapshot/publish at the head (§29.2), the DEK against the
+ * head's current epoch, and that a closed epoch's Snapshot covers nothing
+ * beyond its final frontier (§29, G-EP4; refused locally with
+ * INVALID_STRUCTURE, the receiver's code is STALE_DATA_EPOCH). The frontier
+ * is normalized into canonical form before it is encrypted and signed.
+ */
+export declare function createSnapshot<T>(options: CreateSnapshotOptions<T>): Promise<CreatedSnapshot>;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/snapshot.js

@@ -0,0 +1,40 @@
+import { bytesEqual, LfcpError } from "@openlfcp/core";
+import { dekCommitment } from "@openlfcp/crypto";
+import { ABILITY, beyondCutoff, hasAbility, normalizeLiveHaves, sealSnapshot, } from "@openlfcp/wire";
+/**
+ * Creates a Snapshot. Before a sequence is reserved, it checks the head,
+ * the profile, snapshot/publish at the head (§29.2), the DEK against the
+ * head's current epoch, and that a closed epoch's Snapshot covers nothing
+ * beyond its final frontier (§29, G-EP4; refused locally with
+ * INVALID_STRUCTURE, the receiver's code is STALE_DATA_EPOCH). The frontier
+ * is normalized into canonical form before it is encrypted and signed.
+ */
+export async function createSnapshot(options) {
+    const atHead = options.view.stateAt(options.controlHead);
+    if (atHead === undefined)
+        throw new LfcpError("MISSING_DEPENDENCY", "the Control Head is not on the validated chain");
+    if (options.profile.dataProfile !== atHead.dataProfile)
+        throw new LfcpError("DATA_PROFILE_MISMATCH", `the profile codec is for ${options.profile.dataProfile}, the Resource uses ${atHead.dataProfile}`);
+    const publisher = options.publisher.descriptor.principalId;
+    if (!hasAbility(atHead, publisher, ABILITY.SNAPSHOT_PUBLISH))
+        throw new LfcpError("AUTHORIZATION_FAILED", "the publisher does not hold snapshot/publish at the Control Head (§29.2)");
+    const epoch = atHead.epoch.epoch;
+    if (!bytesEqual(dekCommitment(atHead.resourceId, epoch, options.dek), atHead.epoch.dekCommitment))
+        throw new LfcpError("DEK_COMMITMENT_MISMATCH", `the DEK is not the one committed for epoch ${epoch} at the Control Head`);
+    const frontier = normalizeLiveHaves(options.frontier);
+    const beyond = beyondCutoff(options.view, epoch, frontier);
+    if (beyond !== undefined)
+        throw new LfcpError("INVALID_STRUCTURE", beyond);
+    const plaintext = options.profile.encode(options.value);
+    const seq = await options.sequences.reserveNext(atHead.resourceId, epoch, publisher);
+    options.guard?.claim(atHead.resourceId, epoch, publisher, seq);
+    const sealed = sealSnapshot({
+        resourceId: atHead.resourceId,
+        dataEpoch: epoch,
+        snapshotSeq: seq,
+        controlHead: atHead.head,
+        frontier,
+    }, plaintext, options.dek, options.publisher);
+    return Object.freeze({ bytes: sealed.bytes, snapshotId: sealed.snapshotId, seq, epoch });
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/storage.d.ts

@@ -0,0 +1,96 @@
+import { type ActorSequence, type ControlRecordId, type DataEpoch, type DataUnitId, type PrincipalId, type ResourceId } from "@openlfcp/core";
+import { type ResourceDEK } from "@openlfcp/crypto";
+import { type CommitResult, type DataUnitRow, type LfcpStorage, type SecretStore, type StorageWrite } from "@openlfcp/storage";
+import { type ChainResult, type SeenRecord, type SeenUnits } from "@openlfcp/wire";
+import { type CreateDataUnitOptions, type CreatedDataUnit } from "./data-unit.js";
+/**
+ * The client code on top of the storage interfaces (LFCP-034), so that a
+ * durable adapter (LFCP-035) is all a platform has to write.
+ */
+/** A Data Unit's storage row: its exact bytes and header indexes. Throws for bytes that do not parse. */
+export declare function dataUnitRow(bytes: Uint8Array): DataUnitRow;
+/**
+ * The wire SeenUnits over LfcpStorage, durable and with un-accept
+ * (set-accepted false). A unit is stored only once its signature verifies:
+ * the receiver announces the row with expect() before verification, and
+ * recordSignatureValid stores it.
+ */
+export declare class StoredSeenUnits implements SeenUnits {
+    #private;
+    constructor(storage: Pick<LfcpStorage, "dataUnits" | "commit">);
+    /** The row of a unit about to be verified (kept in memory until it is). */
+    expect(row: DataUnitRow): void;
+    recordSignatureValid(_resource: ResourceId, _actor: PrincipalId, _seq: ActorSequence, unitId: DataUnitId): Promise<SeenRecord>;
+    acceptedAt(resource: ResourceId, actor: PrincipalId, seq: ActorSequence): Promise<DataUnitId | undefined>;
+    acceptedIn(resource: ResourceId, actor: PrincipalId, from: ActorSequence, to: ActorSequence): Promise<readonly {
+        readonly seq: ActorSequence;
+        readonly unitId: DataUnitId;
+    }[]>;
+    markAccepted(_resource: ResourceId, _actor: PrincipalId, _seq: ActorSequence, unitId: DataUnitId): Promise<void>;
+}
+/**
+ * The stored Control Chain of `resource`, validated: the records from the
+ * stored head back to Genesis. Undefined when nothing is stored.
+ */
+export declare function loadControlChain(storage: Pick<LfcpStorage, "control">, resource: ResourceId): Promise<ChainResult | undefined>;
+/**
+ * Persists a validated linear chain in one atomic batch: its exact records,
+ * the head (compare-and-set against `expected`), the epoch history (keeping
+ * known DEK references), the route, and no conflict. A head that moved
+ * meanwhile writes nothing and returns CONTROL_HEAD_MISMATCH.
+ */
+export declare function saveControlChain(storage: Pick<LfcpStorage, "control" | "commit">, chain: Extract<ChainResult, {
+    kind: "linear";
+}>, expected: ControlRecordId | null): Promise<CommitResult>;
+/** Records a Control Chain fork (CONTROL_CONFLICT): its competing heads, sorted by bytes. */
+export declare function saveControlConflict(storage: Pick<LfcpStorage, "commit">, resource: ResourceId, conflict: Extract<ChainResult, {
+    kind: "conflict";
+}>): Promise<CommitResult>;
+/**
+ * Epoch rows of `chain` with no DEK reference take a DEK this client
+ * already holds under the epoch's standard reference (dekSecretRef): one
+ * it created (queueKeyEpoch), or one a Key Package delivered before the
+ * row was stored. A DEK is adopted only if it matches the epoch's
+ * commitment in the validated chain. Returns the adopted epochs. Called
+ * whenever a chain is saved, so the row and its key meet without waiting
+ * for another Key Package request.
+ */
+export declare function adoptStoredDeks(storage: Pick<LfcpStorage, "control" | "commit">, secrets: SecretStore, chain: Extract<ChainResult, {
+    kind: "linear";
+}>): Promise<DataEpoch[]>;
+/**
+ * The DEK lookup for a receiver or writer: the epoch's stored DEK reference,
+ * resolved in the SecretStore. Undefined when this client has no DEK for it.
+ */
+export declare function dekResolver(storage: Pick<LfcpStorage, "control">, secrets: SecretStore, resource: ResourceId): (epoch: DataEpoch) => Promise<ResourceDEK | undefined>;
+/**
+ * Creates this client's Data Unit with a sequence from the storage's
+ * reservation, then commits in one batch: the exact unit (merged and
+ * accepted: it is this client's own history), its outbound entry, and any
+ * `also` writes (e.g. the profile checkpoint containing the change). A
+ * crash before the commit leaves only an abandoned sequence, never a
+ * reused one; a retry sends the queued bytes, never a re-created unit.
+ */
+/**
+ * §26.2 (G-DP1-GAP): the unit a writer's next unit names as `previous`:
+ * its latest own unit it still holds as accepted, or null before its
+ * first. Local units are stored accepted in the commit that queues them,
+ * so this is its last published unit, except one it has itself seen
+ * excluded by a cutoff (G-EP7) or as equivocation (G-DP5): no receiver
+ * accepts those either, so the next unit (e.g. stale work re-applied,
+ * G-EP5) names the unit before them and links. After an abandoned
+ * sequence N the next unit names N - 1. Read from storage, so a restart
+ * chooses the same unit.
+ */
+export declare function latestAcceptedOwnUnit(storage: Pick<LfcpStorage, "dataUnits">, resource: ResourceId, actor: PrincipalId): Promise<DataUnitId | null>;
+export declare function createQueuedDataUnit<T>(storage: Pick<LfcpStorage, "actorSequences" | "commit" | "dataUnits">, options: Omit<CreateDataUnitOptions<T>, "sequences" | "previousUnitId"> & {
+    /** The previous unit (§26.2); default the writer's latest own unit still accepted (latestAcceptedOwnUnit). */
+    readonly previousUnitId?: DataUnitId | null;
+    /**
+     * Called once the unit is sealed, before the commit: e.g. the Data
+     * Profile records which change the unit carries (recordLocal), so that
+     * a function `also` can put the updated checkpoint in the same batch.
+     */
+    readonly onCreated?: (created: CreatedDataUnit, value: T) => void;
+}, also?: readonly StorageWrite[] | ((created: CreatedDataUnit) => readonly StorageWrite[])): Promise<CreatedDataUnit>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.js

@@ -0,0 +1,289 @@
+import { actorSequence, bytesEqual, hash32, LfcpError, toHex, } from "@openlfcp/core";
+import { dekCommitment, importResourceDEK } from "@openlfcp/crypto";
+import { dekSecretRef, } from "@openlfcp/storage";
+import { parseDataUnit, validateControlChain, } from "@openlfcp/wire";
+import { createDataUnit } from "./data-unit.js";
+/**
+ * The client code on top of the storage interfaces (LFCP-034), so that a
+ * durable adapter (LFCP-035) is all a platform has to write.
+ */
+/** A Data Unit's storage row: its exact bytes and header indexes. Throws for bytes that do not parse. */
+export function dataUnitRow(bytes) {
+    const parsed = parseDataUnit(bytes);
+    const p = parsed.payload;
+    return {
+        unitId: parsed.signed.id,
+        resourceId: p.resourceId,
+        dataEpoch: p.dataEpoch,
+        actor: p.actor,
+        actorSeq: p.actorSeq,
+        prevDataUnitId: p.prevDataUnitId,
+        controlHead: p.controlHead,
+        bytes: parsed.signed.bytes,
+    };
+}
+/**
+ * The wire SeenUnits over LfcpStorage, durable and with un-accept
+ * (set-accepted false). A unit is stored only once its signature verifies:
+ * the receiver announces the row with expect() before verification, and
+ * recordSignatureValid stores it.
+ */
+export class StoredSeenUnits {
+    #storage;
+    #expected = new Map();
+    constructor(storage) {
+        this.#storage = storage;
+    }
+    /** The row of a unit about to be verified (kept in memory until it is). */
+    expect(row) {
+        this.#expected.set(toHex(row.unitId), row);
+    }
+    async recordSignatureValid(_resource, _actor, _seq, unitId) {
+        const key = toHex(unitId);
+        const row = this.#expected.get(key) ?? (await this.#storage.dataUnits.get(unitId));
+        if (row === undefined)
+            throw new Error(`StoredSeenUnits: no row for unit ${key}; call expect() first`);
+        this.#expected.delete(key);
+        return this.#storage.dataUnits.recordSeen(row);
+    }
+    acceptedAt(resource, actor, seq) {
+        return this.#storage.dataUnits.acceptedAt(resource, actor, seq);
+    }
+    async acceptedIn(resource, actor, from, to) {
+        return (await this.#storage.dataUnits.range(resource, actor, from, to))
+            .filter((u) => u.accepted)
+            .map((u) => ({ seq: u.actorSeq, unitId: u.unitId }));
+    }
+    async markAccepted(_resource, _actor, _seq, unitId) {
+        const r = await this.#storage.commit([{ op: "set-accepted", unitId, accepted: true }]);
+        if (!r.ok)
+            throw new Error("set-accepted has no precondition");
+    }
+}
+/**
+ * The stored Control Chain of `resource`, validated: the records from the
+ * stored head back to Genesis. Undefined when nothing is stored.
+ */
+export async function loadControlChain(storage, resource) {
+    const head = await storage.control.head(resource);
+    if (head === undefined)
+        return undefined;
+    const byId = new Map((await storage.control.records(resource)).map((r) => [toHex(r.recordId), r]));
+    const chain = [];
+    for (let at = head.head; at !== null;) {
+        const r = byId.get(toHex(at));
+        if (r === undefined)
+            throw new LfcpError("INVALID_CONTROL_CHAIN", `stored Control Record ${toHex(at)} is missing (local corruption)`);
+        chain.unshift(r.bytes);
+        at = r.prevControlId;
+    }
+    const result = validateControlChain(chain);
+    // Fail closed on local corruption: the records must validate to exactly the
+    // stored head and sequence; an older or different state is never used silently.
+    if (result.kind === "linear" &&
+        (!bytesEqual(result.state.head, head.head) || result.state.seq !== head.controlSeq))
+        throw new LfcpError("INVALID_CONTROL_CHAIN", `the stored Control Records validate to sequence ${result.state.seq}, not the stored head at ${head.controlSeq} (local corruption)`);
+    return result;
+}
+/**
+ * Persists a validated linear chain in one atomic batch: its exact records,
+ * the head (compare-and-set against `expected`), the epoch history (keeping
+ * known DEK references), the route, and no conflict. A head that moved
+ * meanwhile writes nothing and returns CONTROL_HEAD_MISMATCH.
+ */
+export async function saveControlChain(storage, chain, expected) {
+    const s = chain.state;
+    const known = new Map((await storage.control.epochs(s.resourceId)).map((e) => [String(e.epoch), e]));
+    const epochs = [...s.epochs.values()].map((e) => ({
+        op: "put-epoch",
+        resourceId: s.resourceId,
+        epoch: {
+            epoch: e.epoch,
+            dekCommitment: e.dekCommitment,
+            openedBy: e.openedBy,
+            closedBy: e.closedBy,
+            dekRef: known.get(String(e.epoch))?.dekRef ?? null,
+        },
+    }));
+    return storage.commit([
+        {
+            op: "put-control-records",
+            records: chain.records.map((r) => ({
+                recordId: r.signed.id,
+                resourceId: r.payload.resourceId,
+                controlSeq: r.payload.controlSeq,
+                prevControlId: r.payload.prevControlId,
+                bytes: r.signed.bytes,
+            })),
+        },
+        {
+            op: "set-control-head",
+            resourceId: s.resourceId,
+            expected,
+            head: { head: s.head, controlSeq: s.seq },
+        },
+        ...epochs,
+        {
+            op: "put-route",
+            resourceId: s.resourceId,
+            route: {
+                routeVersion: s.routeVersion,
+                endpoints: s.route.endpoints.map((e) => ({
+                    url: e.url,
+                    priority: e.priority,
+                    ...(e.flags === undefined ? {} : { flags: e.flags }),
+                })),
+                coordinatorUrl: s.route.coordinatorUrl,
+                source: s.head,
+            },
+        },
+        { op: "set-control-conflict", resourceId: s.resourceId, conflict: null },
+    ]);
+}
+/** Records a Control Chain fork (CONTROL_CONFLICT): its competing heads, sorted by bytes. */
+export async function saveControlConflict(storage, resource, conflict) {
+    return storage.commit([
+        { op: "set-control-conflict", resourceId: resource, conflict: { heads: conflict.competing } },
+    ]);
+}
+/**
+ * Epoch rows of `chain` with no DEK reference take a DEK this client
+ * already holds under the epoch's standard reference (dekSecretRef): one
+ * it created (queueKeyEpoch), or one a Key Package delivered before the
+ * row was stored. A DEK is adopted only if it matches the epoch's
+ * commitment in the validated chain. Returns the adopted epochs. Called
+ * whenever a chain is saved, so the row and its key meet without waiting
+ * for another Key Package request.
+ */
+export async function adoptStoredDeks(storage, secrets, chain) {
+    const R = chain.state.resourceId;
+    const writes = [];
+    const adopted = [];
+    for (const row of await storage.control.epochs(R)) {
+        if (row.dekRef !== null)
+            continue;
+        const epoch = chain.state.epochs.get(String(row.epoch));
+        if (epoch === undefined)
+            continue;
+        const ref = dekSecretRef(R, row.epoch);
+        const bytes = await secrets.get(ref);
+        if (bytes === undefined)
+            continue;
+        const matches = bytesEqual(dekCommitment(R, row.epoch, importResourceDEK(bytes)), epoch.dekCommitment);
+        bytes.fill(0);
+        if (!matches)
+            continue;
+        // put-epoch merges inside the commit: a concurrent close is kept.
+        writes.push({ op: "put-epoch", resourceId: R, epoch: { ...row, dekRef: ref } });
+        adopted.push(row.epoch);
+    }
+    if (writes.length > 0) {
+        const r = await storage.commit(writes);
+        if (!r.ok)
+            throw new Error(`the DEK references were not stored: ${r.reason}`);
+    }
+    return adopted;
+}
+/**
+ * The DEK lookup for a receiver or writer: the epoch's stored DEK reference,
+ * resolved in the SecretStore. Undefined when this client has no DEK for it.
+ */
+export function dekResolver(storage, secrets, resource) {
+    return async (epoch) => {
+        const row = (await storage.control.epochs(resource)).find((e) => e.epoch === epoch);
+        if (row?.dekRef == null)
+            return undefined;
+        const bytes = await secrets.get(row.dekRef);
+        return bytes === undefined ? undefined : importResourceDEK(bytes);
+    };
+}
+/**
+ * Creates this client's Data Unit with a sequence from the storage's
+ * reservation, then commits in one batch: the exact unit (merged and
+ * accepted: it is this client's own history), its outbound entry, and any
+ * `also` writes (e.g. the profile checkpoint containing the change). A
+ * crash before the commit leaves only an abandoned sequence, never a
+ * reused one; a retry sends the queued bytes, never a re-created unit.
+ */
+/**
+ * §26.2 (G-DP1-GAP): the unit a writer's next unit names as `previous`:
+ * its latest own unit it still holds as accepted, or null before its
+ * first. Local units are stored accepted in the commit that queues them,
+ * so this is its last published unit, except one it has itself seen
+ * excluded by a cutoff (G-EP7) or as equivocation (G-DP5): no receiver
+ * accepts those either, so the next unit (e.g. stale work re-applied,
+ * G-EP5) names the unit before them and links. After an abandoned
+ * sequence N the next unit names N - 1. Read from storage, so a restart
+ * chooses the same unit.
+ */
+export async function latestAcceptedOwnUnit(storage, resource, actor) {
+    const mine = await storage.dataUnits.range(resource, actor, actorSequence(1n), actorSequence(2n ** 64n - 1n));
+    return mine.filter((u) => u.accepted).at(-1)?.unitId ?? null;
+}
+/**
+ * Local units of one (storage, Resource, actor) are created one at a time
+ * in this process: each must name the previous one (§26.2). Across
+ * processes sharing a store, the commit's expect-previous-unit refuses a
+ * unit whose previous was superseded meanwhile.
+ */
+const localWriters = new WeakMap();
+function serialized(storage, key, run) {
+    let tails = localWriters.get(storage);
+    if (tails === undefined) {
+        tails = new Map();
+        localWriters.set(storage, tails);
+    }
+    const done = (tails.get(key) ?? Promise.resolve()).then(run, run);
+    const tail = done.then(() => undefined, () => undefined);
+    tails.set(key, tail);
+    void tail.then(() => {
+        if (tails.get(key) === tail)
+            tails.delete(key);
+    });
+    return done;
+}
+export async function createQueuedDataUnit(storage, options, also = []) {
+    const resource = options.view.state.resourceId;
+    const actor = options.actor.descriptor.principalId;
+    return serialized(storage, `${toHex(resource)}:${toHex(actor)}`, () => createQueuedDataUnitNow(storage, options, also, resource, actor));
+}
+async function createQueuedDataUnitNow(storage, options, also, resource, actor) {
+    const { onCreated, previousUnitId, ...create } = options;
+    const previous = previousUnitId !== undefined
+        ? previousUnitId
+        : await latestAcceptedOwnUnit(storage, resource, actor);
+    const created = await createDataUnit({
+        ...create,
+        previousUnitId: previous,
+        sequences: storage.actorSequences,
+    });
+    onCreated?.(created, options.value);
+    const extra = typeof also === "function" ? also(created) : also;
+    const row = dataUnitRow(created.bytes);
+    const result = await storage.commit([
+        // Unless the caller named its own previous unit, it must still be the
+        // latest when this unit is stored (another writer, e.g. another process).
+        ...(previousUnitId !== undefined
+            ? []
+            : [{ op: "expect-previous-unit", resourceId: resource, actor, previous }]),
+        { op: "put-data-unit", unit: row, status: "merged", detail: "local", accepted: true },
+        {
+            op: "enqueue",
+            item: {
+                itemId: hash32(created.unitId),
+                resourceId: row.resourceId,
+                kind: "data-unit",
+                bytes: created.bytes,
+                attempts: 0,
+                lastAttempt: null,
+                nextAttempt: null,
+                blocked: null,
+            },
+        },
+        ...extra,
+    ]);
+    if (!result.ok)
+        throw new Error(`the local unit was not stored: ${result.reason}`);
+    return created;
+}
+//# sourceMappingURL=storage.js.map