@openlfcp/client 0.1.1 → 0.1.3

package/README.md

@@ -12,9 +12,9 @@ ESM only; Node.js 24 or later (browsers and Electron for every package except `@
 
 Part of the OpenLFCP TypeScript SDK, which implements the OpenLFCP MVP 0.1
 subset of [LFCP-WIRE-01](https://github.com/openlfcp/spec/blob/main/wire/LFCP-WIRE-01.md)
-at `mvp-0.1-baseline.8`, not every deferred WIRE-01 feature. It does not
+at `mvp-0.1-baseline.9`, not every deferred WIRE-01 feature. It does not
 claim full LFCP-WIRE-01 conformance. This is the MVP 0.1 release
-(`0.1.1`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+(`0.1.3`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
 
 ## Links
 

package/dist/apply.d.ts

@@ -60,6 +60,12 @@ export interface ProfileApplyResult {
     readonly diagnostics: readonly ProfileDiagnostic[];
     /** Why the unit is buffered by the profile when it did not merge now. */
     readonly pending?: string;
+    /**
+     * Why the profile holds the unit (SHARED-OBJECTS-PROFILE-01 §14.1): a
+     * different change has its actor and sequence number. Never merged until
+     * a rebuild frees them.
+     */
+    readonly held?: string;
 }
 /** What a handler's applyBatch reports: per unit merged, pending or rejected, and the objects once. */
 export interface ProfileBatchResult {
@@ -67,6 +73,8 @@ export interface ProfileBatchResult {
     readonly merged: readonly DataUnitId[];
     /** Units buffered by the profile (the batch's, and earlier ones still waiting). */
     readonly pending: readonly DataUnitId[];
+    /** Units the profile holds (§14.1): a different change has their actor and sequence number. */
+    readonly held?: readonly DataUnitId[];
     /** Units the profile refused, with the code and message apply would have thrown. */
     readonly rejected: readonly {
         readonly unitId: DataUnitId;
@@ -81,6 +89,8 @@ export interface ProfileExcludeResult {
     readonly objects: readonly string[];
     /** Merged units that now wait for an excluded unit's content (profile-pending). */
     readonly pending: readonly DataUnitId[];
+    /** Held units (§14.1) that merged after the rebuild freed their actor sequence. */
+    readonly released?: readonly DataUnitId[];
 }
 /** The application side of one Data Profile. Implemented by profile packages. */
 export interface DataProfileHandler<T> {
@@ -169,6 +179,16 @@ export type ApplyOutcome =
     readonly kind: "profile-pending";
     readonly detail: string;
 })
+/**
+ * Accepted by LFCP and kept (a holding: advertised and relayed); the
+ * profile holds it because a different change has its actor and sequence
+ * number (SHARED-OBJECTS-PROFILE-01 §14.1, POST-001). It is retried after
+ * every rebuild that removes changes, and reported as applied then.
+ */
+ | (Applied & {
+    readonly kind: "profile-held";
+    readonly detail: string;
+})
 /** Accepted by LFCP, refused by the profile when merging: never merged. */
  | {
     readonly kind: "profile-rejected";

package/dist/apply.js

@@ -14,7 +14,8 @@ const unreachableCodec = (dataProfile) => ({
         throw new Error("no codec for a malformed unit");
     },
 });
-const LFCP_ACCEPTED = ["merged", "profile-pending"];
+const LFCP_ACCEPTED = ["merged", "profile-pending", "profile-held"];
+const HELD = "held: a different change has its actor and sequence number (SHARED-OBJECTS-PROFILE-01 §14.1)";
 const CRASHED = "this unit crashed the profile engine twice, applied alone; it is not applied again on this device (local only)";
 const profileUnit = (view, r) => ({
     unitId: r.unitId,
@@ -247,6 +248,7 @@ export class DataUnitApplier {
             return out;
         }
         const merged = new Set(batch.merged.map((id) => toHex(id)));
+        const heldNow = new Set((batch.held ?? []).map((id) => toHex(id)));
         const rejected = new Map(batch.rejected.map((x) => [toHex(x.unitId), x]));
         const inBatch = new Set(staged.map(({ r }) => toHex(r.unitId)));
         const unblocked = batch.merged.filter((id) => !inBatch.has(toHex(id)));
@@ -273,7 +275,11 @@ export class DataUnitApplier {
                     merged: [...(now ? [r.unitId] : []), ...(k === 0 ? unblocked : [])],
                     objects: k === last ? batch.objects : [],
                     diagnostics: k === last ? batch.diagnostics : [],
-                    ...(now ? {} : { pending: "buffered by the profile" }),
+                    ...(now
+                        ? {}
+                        : heldNow.has(key)
+                            ? { held: HELD }
+                            : { pending: "buffered by the profile" }),
                 }, false),
             ]);
         }
@@ -323,15 +329,23 @@ export class DataUnitApplier {
         const dataProfile = handler.dataProfile;
         const mergedNow = result.merged.some((id) => bytesEqual(id, r.unitId));
         const alsoMerged = result.merged.filter((id) => !bytesEqual(id, r.unitId));
+        const held = !mergedNow && result.held !== undefined;
         await this.#write([
             mergedNow
                 ? { op: "set-data-unit-status", unitId: r.unitId, status: "merged" }
-                : {
-                    op: "set-data-unit-status",
-                    unitId: r.unitId,
-                    status: "profile-pending",
-                    detail: result.pending ?? "buffered by the profile",
-                },
+                : held
+                    ? {
+                        op: "set-data-unit-status",
+                        unitId: r.unitId,
+                        status: "profile-held",
+                        detail: result.held ?? null,
+                    }
+                    : {
+                        op: "set-data-unit-status",
+                        unitId: r.unitId,
+                        status: "profile-pending",
+                        detail: result.pending ?? "buffered by the profile",
+                    },
             ...alsoMerged.map((unitId) => ({ op: "set-data-unit-status", unitId, status: "merged" })),
         ]);
         // §26.2 (G-DP1, G-DP1-GAP): a held unit of this actor above it may link now, across a gap.
@@ -360,6 +374,8 @@ export class DataUnitApplier {
             alsoMerged: Object.freeze(alsoMerged),
             released: Object.freeze(released),
         };
+        if (held)
+            return Object.freeze({ ...base, kind: "profile-held", detail: result.held });
         return Object.freeze(mergedNow
             ? {
                 ...base,
@@ -394,9 +410,13 @@ export class DataUnitApplier {
                 status: "profile-pending",
                 detail: "builds on an equivocating unit",
             })),
+            ...this.#freedWrites(result),
         ]);
         // The actor's latest accepted unit may now be lower: held units can link (G-DP1-GAP).
-        const released = merged.length > 0 ? await this.#retryHeld(view, [r.actor]) : [];
+        const released = [
+            ...(merged.length > 0 ? await this.#retryHeld(view, [r.actor]) : []),
+            ...(await this.#freed(handler, result)),
+        ];
         return Object.freeze({
             ...r,
             excluded: Object.freeze(merged),
@@ -435,6 +455,7 @@ export class DataUnitApplier {
         const stored = [
             ...(await this.#storage.dataUnits.withStatus(resource, "merged")),
             ...(await this.#storage.dataUnits.withStatus(resource, "profile-pending")),
+            ...(await this.#storage.dataUnits.withStatus(resource, "profile-held")),
             ...(await this.#storage.dataUnits.withStatus(resource, "seen")),
             ...(await this.#storage.dataUnits.withStatus(resource, "held")),
         ]
@@ -442,18 +463,28 @@ export class DataUnitApplier {
             .sort((a, b) => (a.actorSeq < b.actorSeq ? -1 : a.actorSeq > b.actorSeq ? 1 : 0));
         const merged = [];
         const pendingNow = [];
+        const heldNow = [];
         // Suspects of an earlier crash replay alone, each under its own record.
         const suspect = (u) => this.#guard.suspicion(resource, unitItem(u.unitId)) > 0;
         const groups = [...stored.filter(suspect).map((u) => [u]), stored.filter((u) => !suspect(u))];
         for (const group of groups)
             if (group.length > 0)
-                await this.#guard.run(resource, group.map((u) => unitItem(u.unitId)), () => this.#replayGroup(handler, group, { merged, pendingNow, replayed, skipped }));
+                await this.#guard.run(resource, group.map((u) => unitItem(u.unitId)), () => this.#replayGroup(handler, group, { merged, pendingNow, heldNow, replayed, skipped }));
+        const isHeld = (id) => heldNow.some((h) => bytesEqual(h, id));
         await this.#write([
-            ...pendingNow
+            ...heldNow
                 .filter((id) => !merged.some((m) => bytesEqual(m, id)))
                 .map((unitId) => ({
                 op: "set-data-unit-status",
                 unitId,
+                status: "profile-held",
+                detail: HELD,
+            })),
+            ...pendingNow
+                .filter((id) => !merged.some((m) => bytesEqual(m, id)) && !isHeld(id))
+                .map((unitId) => ({
+                op: "set-data-unit-status",
+                unitId,
                 status: "profile-pending",
                 detail: "replayed; waiting for content it builds on",
             })),
@@ -467,7 +498,7 @@ export class DataUnitApplier {
     }
     /** Decrypts, decodes and applies replayed units (replayStored), adding to `acc`. */
     async #replayGroup(handler, group, acc) {
-        const { merged, pendingNow, replayed, skipped } = acc;
+        const { merged, pendingNow, heldNow, replayed, skipped } = acc;
         const decoded = [];
         for (const u of group) {
             const dek = await this.#options.dek(u.dataEpoch);
@@ -504,6 +535,7 @@ export class DataUnitApplier {
             const batch = handler.applyBatch(decoded);
             const refused = new Map(batch.rejected.map((x) => [toHex(x.unitId), x]));
             merged.push(...batch.merged);
+            heldNow.push(...(batch.held ?? []));
             for (const { unit } of decoded) {
                 const no = refused.get(toHex(unit.unitId));
                 if (no !== undefined) {
@@ -520,6 +552,8 @@ export class DataUnitApplier {
                 try {
                     const r = handler.apply(unit, value);
                     merged.push(...r.merged);
+                    if (r.held !== undefined)
+                        heldNow.push(unit.unitId);
                     if (!r.merged.some((id) => bytesEqual(id, unit.unitId)))
                         pendingNow.push(unit.unitId);
                     replayed.push(unit.unitId);
@@ -658,6 +692,33 @@ export class DataUnitApplier {
         }
         return [...byHex.values()];
     }
+    /** Status writes for the held units (§14.1) a rebuild merged. */
+    #freedWrites(result) {
+        return (result.released ?? []).map((unitId) => ({ op: "set-data-unit-status", unitId, status: "merged" }));
+    }
+    /** The held units (§14.1) a rebuild merged, reported as applied. */
+    async #freed(handler, result) {
+        const out = [];
+        for (const unitId of result.released ?? []) {
+            const u = await this.#storage.dataUnits.get(unitId);
+            if (u === undefined)
+                continue;
+            out.push(Object.freeze({
+                kind: "applied",
+                unitId,
+                dataProfile: handler.dataProfile,
+                actor: u.actor,
+                seq: u.actorSeq,
+                epoch: u.dataEpoch,
+                haveEligible: false,
+                alsoMerged: Object.freeze([]),
+                released: Object.freeze([]),
+                objects: Object.freeze([]),
+                diagnostics: Object.freeze([]),
+            }));
+        }
+        return out;
+    }
     /**
      * §26.2 (G-DP1-GAP): after units of `actors` stopped being accepted, a
      * held unit may now name the actor's latest accepted unit. Every held
@@ -697,6 +758,7 @@ export class DataUnitApplier {
         const candidates = [
             ...(await this.#storage.dataUnits.withStatus(resource, "merged")),
             ...(await this.#storage.dataUnits.withStatus(resource, "profile-pending")),
+            ...(await this.#storage.dataUnits.withStatus(resource, "profile-held")),
         ].filter((u) => u.accepted);
         const excluded = [];
         for (const u of candidates) {
@@ -726,9 +788,13 @@ export class DataUnitApplier {
                 status: "profile-pending",
                 detail: "builds on an excluded unit",
             })),
+            ...this.#freedWrites(result),
         ]);
         const actors = await this.#actorsOf(excluded.map((e) => e.unitId));
-        const released = await this.#retryHeld(view, actors);
+        const released = [
+            ...(await this.#retryHeld(view, actors)),
+            ...(await this.#freed(handler, result)),
+        ];
         return Object.freeze({
             snapshotDropped,
             excluded: Object.freeze(excluded),

package/dist/invite.d.ts

@@ -95,6 +95,13 @@ export interface AcceptInvitationOptions {
     readonly secrets: SecretStore;
     /** Abilities to claim; default the grant's, without invite/claim unless it is delegable (§18.1 rule 4). */
     readonly abilities?: readonly bigint[];
+    /**
+     * The Data Profiles the caller can open (§27). When given, the Resource's
+     * Genesis profile must be one of them: otherwise the join stops with
+     * "profile-unsupported" before the Key Package is fetched and before the
+     * claim, so the invitation stays unused. Default: no check.
+     */
+    readonly dataProfiles?: readonly string[];
     /** The endpoint to use; default the link's first. */
     readonly url?: string;
     readonly now: () => number;
@@ -131,6 +138,17 @@ export type AcceptedInvitation = {
     readonly resourceId: ResourceId;
     readonly code: string;
     readonly attempts: readonly string[];
+} | {
+    /**
+     * The Resource's Data Profile is not in the caller's dataProfiles: no
+     * Key Package was fetched, no claim was made and nothing was stored,
+     * so the invitation can still be used by a client that implements it.
+     */
+    readonly kind: "profile-unsupported";
+    readonly resourceId: ResourceId;
+    readonly code: "PROFILE_UNSUPPORTED";
+    /** The Resource's Data Profile, from its Genesis. */
+    readonly dataProfile: string;
 } | {
     /**
      * The claim could not be attempted or answered: the connection failed
@@ -144,7 +162,9 @@ export type AcceptedInvitation = {
 /**
  * The joiner's side (§18.1, §18.2, §73). On "claimed" the claimant's
  * storage holds the chain with the claimant's grant and its secrets the
- * DEK: open the Resource with a SyncClient for the claimant. Throws
+ * DEK: open the Resource with a SyncClient for the claimant. With
+ * `dataProfiles`, a Resource of another Data Profile is
+ * "profile-unsupported" before the Key Package and the claim. Throws
  * INVALID_INVITATION for a link without a secret or a secret that is not
  * the grant's subject, MISSING_DEPENDENCY when the grant is not on the
  * chain, and KEY_PACKAGE_OPEN_FAILED when no package delivers the current

package/dist/invite.js

@@ -246,7 +246,9 @@ async function fetchChain(s, R, have, until) {
 /**
  * The joiner's side (§18.1, §18.2, §73). On "claimed" the claimant's
  * storage holds the chain with the claimant's grant and its secrets the
- * DEK: open the Resource with a SyncClient for the claimant. Throws
+ * DEK: open the Resource with a SyncClient for the claimant. With
+ * `dataProfiles`, a Resource of another Data Profile is
+ * "profile-unsupported" before the Key Package and the claim. Throws
  * INVALID_INVITATION for a link without a secret or a secret that is not
  * the grant's subject, MISSING_DEPENDENCY when the grant is not on the
  * chain, and KEY_PACKAGE_OPEN_FAILED when no package delivers the current
@@ -281,6 +283,15 @@ export async function acceptInvitation(options) {
         const claimSigner = verifyInvitationSecret(chain.state, invitation.grantId, secret);
         const grant = chain.state.grants.get(toHex(invitation.grantId)) ??
             fail("MISSING_DEPENDENCY", "the invitation grant is not on the chain");
+        // §27: a profile the caller cannot open is refused before the DEK and the claim.
+        if (options.dataProfiles !== undefined &&
+            !options.dataProfiles.includes(chain.state.dataProfile))
+            return Object.freeze({
+                kind: "profile-unsupported",
+                resourceId: R,
+                code: "PROFILE_UNSUPPORTED",
+                dataProfile: chain.state.dataProfile,
+            });
         // §73, §25.2: the invitation's Key Package delivers the DEK.
         progress("retrieving-key");
         const batch = await s.request(createMessage("KEY_PACKAGE_GET", {

package/dist/outbound.d.ts

@@ -111,6 +111,18 @@ export type NackOutcome =
     readonly kind: "needs-control-sync";
     readonly items: readonly Hash32[];
 }
+/**
+ * The server lacks the unit a Data Unit names as its `previous`
+ * (UNKNOWN_PREVIOUS, §51.1): it lost what it acknowledged. Retried once
+ * the client offered what the server lacks (§68.1, `offered`), or, when
+ * that unit is our own and still queued, once it is acknowledged.
+ */
+ | {
+    readonly kind: "needs-offer";
+    readonly resourceId: ResourceId;
+    readonly previous: Hash32 | null;
+    readonly items: readonly Hash32[];
+}
 /** Transient or unknown: retried after the RetryPolicy delay. */
  | {
     readonly kind: "retry";
@@ -145,7 +157,7 @@ export interface OutboundQueueOptions {
     /**
      * How long a sent message waits for its answer on a live connection
      * before its items are due again (a lost request or reply, §70
-     * at-least-once): `baseMs`, doubling per attempt of the item, at most
+     * at-least-once): `baseMs`, doubling per unanswered send in a row, at most
      * `maxMs`. Default 10 s to 60 s. A re-put is harmless: the server answers
      * a repeated object with the same ACK (§47, §70).
      */
@@ -187,6 +199,7 @@ export declare class OutboundQueue {
      * MESSAGE_TOO_LARGE → blocked "too-large";
      * CONTROL_HEAD_MISMATCH → blocked "repropose" with the current head;
      * MISSING_DEPENDENCY → retried after the next controlSynced();
+     * UNKNOWN_PREVIOUS → retried after the next offered() (§51.1, §68.1);
      * anything else → retried after the RetryPolicy delay.
      */
     onNack(message: LfcpMessage<"NACK">, now: string): Promise<NackOutcome>;
@@ -198,6 +211,11 @@ export declare class OutboundQueue {
     connectionLost(now: string): Promise<Hash32[]>;
     /** The Control Plane of `resource` was synchronized: items held for MISSING_DEPENDENCY are due again. */
     controlSynced(resource: ResourceId): Promise<void>;
+    /**
+     * What the server of `resource` lacked was offered (§68.1): items held
+     * for UNKNOWN_PREVIOUS are due again, behind the offered objects.
+     */
+    offered(resource: ResourceId): Promise<void>;
     /**
      * §88 step 7, G-EP5: with a newly validated Control view, our queued
      * Data Units of a closed epoch beyond its final frontier are never sent;

package/dist/outbound.js

@@ -1,6 +1,6 @@
-import { bytesEqual, dataUnitId, hash32, toHex, } from "@openlfcp/core";
+import { bytesEqual, dataUnitId, fromHex, hash32, toHex, } from "@openlfcp/core";
 import { sha256 } from "@openlfcp/crypto";
-import { addSequence, canonicalFrontierFromCbor, classifyDataUnit, createMessage, DEFAULT_MAX_MESSAGE_BYTES, ERROR_CODE, encodeMessage, MESSAGE_TYPE, parseControlRecord, unionHaves, } from "@openlfcp/wire";
+import { addSequence, canonicalFrontierFromCbor, classifyDataUnit, createMessage, DEFAULT_MAX_MESSAGE_BYTES, ERROR_CODE, encodeMessage, MESSAGE_TYPE, parseControlRecord, parseDataUnit, unionHaves, } from "@openlfcp/wire";
 import { decodeDeterministic } from "@openlfcp/wire/cbor";
 /** Exponential backoff from `baseMs`, doubling per attempt, capped at `maxMs`. */
 export function exponentialBackoff(baseMs, maxMs) {
@@ -37,6 +37,22 @@ const CODE_NAMES = new Map(Object.entries(ERROR_CODE).map(([name, code]) => [cod
 /** Room left in a message for the envelope and body around the objects. */
 const OVERHEAD = 1024;
 const AT_ONCE = { nextAttempt: () => null };
+/** Data Units by actor, then actor sequence; unparsable bytes last (they are blocked when sent). */
+function unitOrder(a, b) {
+    const key = (o) => {
+        try {
+            const p = parseDataUnit(o.bytes).payload;
+            return [toHex(p.actor), p.actorSeq];
+        }
+        catch {
+            return ["~", 0n];
+        }
+    };
+    const [x, y] = [key(a), key(b)];
+    if (x[0] !== y[0])
+        return x[0] < y[0] ? -1 : 1;
+    return x[1] < y[1] ? -1 : x[1] > y[1] ? 1 : 0;
+}
 export class OutboundQueue {
     #storage;
     #retry;
@@ -51,10 +67,18 @@ export class OutboundQueue {
     #flights = new Map();
     /** item ID hex → message ID hex */
     #inFlight = new Map();
+    /**
+     * Unanswered sends in a row per item (request timeouts), for the
+     * timeout backoff: an answered send (ACK or NACK) starts it again, so
+     * refusals the client recovers from never lengthen the wait.
+     */
+    #unanswered = new Map();
     /** Items to send one per message (to find which one a per-object NACK meant). */
     #solo = new Set();
     /** Items waiting for a Control sync (MISSING_DEPENDENCY). */
     #awaitingControl = new Set();
+    /** Items waiting until what the server lacks was offered (UNKNOWN_PREVIOUS, §68.1). */
+    #awaitingOffer = new Map();
     constructor(options) {
         this.#storage = options.storage;
         this.#retry = options.retry ?? AT_ONCE;
@@ -78,6 +102,7 @@ export class OutboundQueue {
             for (const id of flight.itemIds)
                 if (this.#inFlight.get(toHex(id)) === key) {
                     this.#inFlight.delete(toHex(id));
+                    this.#unanswered.set(toHex(id), (this.#unanswered.get(toHex(id)) ?? 0) + 1);
                     overdue.push(id);
                 }
         }
@@ -108,12 +133,18 @@ export class OutboundQueue {
         const due = (await this.#storage.outbound.list(resource)).filter((o) => o.blocked === null &&
             !this.#inFlight.has(toHex(o.itemId)) &&
             !this.#awaitingControl.has(toHex(o.itemId)) &&
+            !this.#awaitingOffer.has(toHex(o.itemId)) &&
             (o.nextAttempt === null || o.nextAttempt <= now));
         const out = [];
         const writes = [];
         const limit = this.#maxMessageBytes - OVERHEAD;
         for (const kind of KIND_ORDER) {
+            // §51, §51.1: a server checks a DATA_PUT's units in message order, so
+            // each actor's units go oldest first (the `previous` link of a unit
+            // can then be an earlier unit of the same message).
             const items = due.filter((o) => o.kind === kind);
+            if (kind === "data-unit")
+                items.sort(unitOrder);
             let batch = [];
             let size = 0;
             const flush = () => {
@@ -172,8 +203,8 @@ export class OutboundQueue {
         await this.#commit(writes);
         for (const m of out) {
             const key = toHex(m.message.messageId);
-            const attempts = Math.max(...m.itemIds.map((id) => (due.find((o) => bytesEqual(o.itemId, id))?.attempts ?? 0) + 1));
-            const wait = Math.min(this.#timeout.maxMs, this.#timeout.baseMs * 2 ** (attempts - 1));
+            const unanswered = Math.max(...m.itemIds.map((id) => this.#unanswered.get(toHex(id)) ?? 0));
+            const wait = Math.min(this.#timeout.maxMs, this.#timeout.baseMs * 2 ** unanswered);
             this.#flights.set(key, {
                 resourceId: resource,
                 type: m.message.type,
@@ -233,9 +264,11 @@ export class OutboundQueue {
         if (flight === undefined)
             return undefined;
         this.#flights.delete(key);
-        for (const id of flight.itemIds)
+        for (const id of flight.itemIds) {
             if (this.#inFlight.get(toHex(id)) === key)
                 this.#inFlight.delete(toHex(id));
+            this.#unanswered.delete(toHex(id));
+        }
         return flight;
     }
     async #retryLater(ids, reason, now, code) {
@@ -289,6 +322,11 @@ export class OutboundQueue {
             this.#forget(item.itemId);
         }
         const writes = acked.map((itemId) => ({ op: "dequeue", itemId }));
+        // Units held for UNKNOWN_PREVIOUS behind one of ours that is now on the server.
+        const landed = new Set(acked.map((id) => toHex(id)));
+        for (const [key, wait] of [...this.#awaitingOffer])
+            if (wait.previous !== null && landed.has(wait.previous))
+                this.#awaitingOffer.delete(key);
         for (const ids of byResource.values()) {
             const resourceId = (await this.#storage.outbound.get(ids[0]))?.resourceId;
             if (resourceId === undefined)
@@ -327,6 +365,8 @@ export class OutboundQueue {
         this.#inFlight.delete(key);
         this.#solo.delete(key);
         this.#awaitingControl.delete(key);
+        this.#awaitingOffer.delete(key);
+        this.#unanswered.delete(key);
     }
     async #block(ids, reason, detail) {
         const out = [];
@@ -352,6 +392,7 @@ export class OutboundQueue {
      * MESSAGE_TOO_LARGE → blocked "too-large";
      * CONTROL_HEAD_MISMATCH → blocked "repropose" with the current head;
      * MISSING_DEPENDENCY → retried after the next controlSynced();
+     * UNKNOWN_PREVIOUS → retried after the next offered() (§51.1, §68.1);
      * anything else → retried after the RetryPolicy delay.
      */
     async onNack(message, now) {
@@ -406,6 +447,38 @@ export class OutboundQueue {
                 for (const id of items)
                     this.#awaitingControl.add(toHex(id));
                 return Object.freeze({ kind: "needs-control-sync", items: Object.freeze(items) });
+            case "UNKNOWN_PREVIOUS": {
+                const d = message.body.details;
+                const previous = d instanceof Uint8Array && d.length === 32 ? hash32(d) : null;
+                // Each unit waits on its OWN previous: the details name only the
+                // first refused unit's, and a later unit of the message may name
+                // one that is itself waiting here.
+                for (const id of items) {
+                    const item = await this.#storage.outbound.get(id);
+                    let own = null;
+                    try {
+                        const p = item === undefined ? null : parseDataUnit(item.bytes).payload.prevDataUnitId;
+                        own = p === null || p === undefined ? null : toHex(p);
+                    }
+                    catch {
+                        own = null;
+                    }
+                    this.#awaitingOffer.set(toHex(id), { resource: toHex(flight.resourceId), previous: own });
+                }
+                // The server lacks a unit of ours we sent before: on one connection
+                // it would have handled that message first, so it was lost. It is
+                // due again now rather than after its request timeout (a late ACK
+                // still removes it).
+                for (const wait of this.#awaitingOffer.values())
+                    if (wait.previous !== null && this.#inFlight.has(wait.previous))
+                        this.#inFlight.delete(wait.previous);
+                return Object.freeze({
+                    kind: "needs-offer",
+                    resourceId: flight.resourceId,
+                    previous,
+                    items: Object.freeze(items),
+                });
+            }
             default:
                 await this.#retryLater(items, "transient", now, code);
                 return Object.freeze({ kind: "retry", code, items: Object.freeze(items) });
@@ -428,6 +501,25 @@ export class OutboundQueue {
         for (const item of await this.#storage.outbound.list(resource))
             this.#awaitingControl.delete(toHex(item.itemId));
     }
+    /**
+     * What the server of `resource` lacked was offered (§68.1): items held
+     * for UNKNOWN_PREVIOUS are due again, behind the offered objects.
+     */
+    async offered(resource) {
+        for (const [key, wait] of [...this.#awaitingOffer]) {
+            if (wait.resource !== toHex(resource))
+                continue;
+            // The unit the server lacks is our own, still queued (e.g. its
+            // message was lost): its successors wait for its ACK (onAck), or the
+            // server would refuse them again.
+            if (wait.previous !== null) {
+                const own = await this.#storage.outbound.get(hash32(fromHex(wait.previous)));
+                if (own !== undefined && own.blocked === null)
+                    continue;
+            }
+            this.#awaitingOffer.delete(key);
+        }
+    }
     /**
      * §88 step 7, G-EP5: with a newly validated Control view, our queued
      * Data Units of a closed epoch beyond its final frontier are never sent;
@@ -484,7 +576,14 @@ export async function resourceSyncState(storage, resource) {
     // Every LFCP-accepted unit is held here, whatever its profile status: a
     // crash between accepting and recording the merge leaves it "seen" or
     // "held" until replayStored applies it.
-    for (const status of ["merged", "profile-pending", "profile-rejected", "seen", "held"])
+    for (const status of [
+        "merged",
+        "profile-pending",
+        "profile-held",
+        "profile-rejected",
+        "seen",
+        "held",
+    ])
         for (const u of await storage.dataUnits.withStatus(resource, status))
             if (u.accepted)
                 have = addSequence(have, u.actor, u.actorSeq);

package/dist/sync-client.d.ts

@@ -154,6 +154,20 @@ export type SyncEvent = {
     readonly code: string;
     readonly message: string;
 }
+/**
+ * The server answered RESOURCE_OPEN with RESOURCE_NOT_HOSTED although it
+ * hosted the Resource before (it lost it, e.g. restored from an older
+ * store): the client hosted it again from its Genesis (§41.1), or the
+ * server refused that ("refused", with the §62 code; the Resource is then
+ * refused for good, see resource-refused).
+ */
+ | {
+    readonly type: "rehost";
+    readonly resourceId: ResourceId;
+    readonly url: string;
+    readonly outcome: "hosted" | "refused";
+    readonly code?: string;
+}
 /**
  * The server refused the Resource for good (see ResourceRefusal): it is
  * CLOSED and is not opened again until open() is called for it.

package/dist/sync-client.js

@@ -1,7 +1,7 @@
-import { actorSequence, dataEpoch, LfcpError, toHex, } from "@openlfcp/core";
+import { actorSequence, dataEpoch, hash32, LfcpError, toHex, } from "@openlfcp/core";
 import { exportSecretKeyBytes, sha256 } from "@openlfcp/crypto";
-import { dekSecretRef } from "@openlfcp/storage";
-import { addRange, addSequence, batchDataRanges, canonicalFrontierToCbor, createMessage, ERROR_CODE, hasSequence, localControlOf, MESSAGE_TYPE, missingFrom, normalizeLiveHaves, parseControlRecord, parseDataUnit, planControlSync, receiveKeyPackage, receiveSnapshot, validateControlChain, } from "@openlfcp/wire";
+import { dekSecretRef, } from "@openlfcp/storage";
+import { addRange, addSequence, batchDataRanges, canonicalFrontierToCbor, createMessage, ERROR_CODE, hasSequence, haveDifference, localControlOf, MESSAGE_TYPE, missingFrom, normalizeLiveHaves, parseControlRecord, parseDataUnit, parseKeyPackage, planControlSync, receiveKeyPackage, receiveSnapshot, validateControlChain, } from "@openlfcp/wire";
 import { encode } from "@openlfcp/wire/cbor";
 import { LfcpConnection } from "./connection.js";
 import { EngineGuard, isEngineTrap, snapshotItem } from "./engine-guard.js";
@@ -32,6 +32,23 @@ export const TERMINAL_RESOURCE_CODES = new Set([
     "PROFILE_UNSUPPORTED",
 ]);
 const NACK_NAME = new Map(Object.entries(ERROR_CODE).map(([k, v]) => [v, k]));
+/**
+ * Data Unit statuses whose units this client has accepted and may offer to
+ * a server that lacks them (§68.1): never a unit held for its `previous`
+ * link, a quarantined or equivocating one, or one that failed locally.
+ */
+const OFFERABLE = [
+    "merged",
+    "profile-pending",
+    "profile-held",
+    "profile-rejected",
+    "profile-unsupported",
+    "seen",
+];
+/** At most this many objects per offered DATA_PUT or KEY_PACKAGE_PUT. */
+const OFFER_BATCH = 64;
+/** The local mark that a route hosted (or opened) a Resource for this client (§41.1). */
+const hostedMark = (resource, url) => `hosted-route:${toHex(resource)}:${url}`;
 const SUBSCRIBE_DATA_AND_CONTROL = 3n;
 const iso = (ms) => new Date(ms).toISOString();
 const haveToLive = (vector) => vector.map((h) => ({
@@ -56,6 +73,8 @@ export class SyncClient {
     #trapped = false;
     #attempt = 0;
     #reconnectAt = null;
+    /** READY's maximum message size, for offered batches (§31). */
+    #maxMessageBytes = 8 * 1024 * 1024;
     /** Serializes message handling: each message is handled after the previous one finished. */
     #queue = Promise.resolve();
     constructor(options) {
@@ -171,6 +190,9 @@ export class SyncClient {
                 refusal: null,
                 refusedAttempt: 0,
                 reopenAt: null,
+                offering: new Set(),
+                keysOffered: false,
+                rehosted: false,
             };
             this.#resources.set(key, ctx);
         }
@@ -197,7 +219,7 @@ export class SyncClient {
     host(genesis, credential) {
         return new Promise((resolve, reject) => {
             try {
-                this.#request({ kind: "host", resolve, reject }, createMessage("RESOURCE_HOST", {
+                this.#request({ kind: "host", genesis, resolve, reject }, createMessage("RESOURCE_HOST", {
                     genesis,
                     ...(credential === undefined ? {} : { credential }),
                 }));
@@ -281,6 +303,15 @@ export class SyncClient {
                 request.reject(new Error("RESOURCE_HOST got no answer within the request timeout"));
                 continue;
             }
+            if (request.kind === "offer-data") {
+                // Offered again on the next DATA_HAVE (§68.1).
+                const ctx = this.#resources.get(request.resource);
+                for (const u of request.units)
+                    ctx?.offering.delete(u.id);
+                continue;
+            }
+            if (request.kind === "offer-control" || request.kind === "offer-keys")
+                continue;
             if ("resource" in request)
                 resend.set(`${request.kind}:${request.resource}`, request);
         }
@@ -294,6 +325,10 @@ export class SyncClient {
                 this.#move(ctx, "CLOSE");
                 this.#serial(() => this.#sendOpen(ctx));
             }
+            else if (request.kind === "rehost" && ctx.state === "CLOSED") {
+                ctx.rehosted = false; // a lost answer: open again, which re-hosts again if needed
+                this.#serial(() => this.#sendOpen(ctx));
+            }
             else if (request.kind === "control" && ctx.state === "CONTROL_SYNC") {
                 this.#serial(() => this.#controlRound(ctx, ctx.lastHeads));
             }
@@ -317,8 +352,10 @@ export class SyncClient {
         if (next === undefined)
             return false;
         ctx.state = next;
-        if (next === "LIVE")
+        if (next === "LIVE") {
             ctx.refusedAttempt = 0;
+            ctx.rehosted = false;
+        }
         this.#emit({ type: "resource-state", resourceId: ctx.binding.resourceId, state: next });
         if (next === "LIVE" && ctx.controlStale) {
             ctx.controlStale = false;
@@ -341,6 +378,7 @@ export class SyncClient {
     }
     async #onReady(ready) {
         this.#attempt = 0;
+        this.#maxMessageBytes = Number(ready.maxMessageBytes);
         this.#o.outbound.session({
             durability: ready.durability,
             maxMessageBytes: ready.maxMessageBytes,
@@ -359,6 +397,7 @@ export class SyncClient {
         for (const ctx of this.#resources.values()) {
             this.#move(ctx, "CLOSE"); // §65, G-SM1: every Resource closes with the connection
             ctx.view = null;
+            ctx.offering.clear();
         }
         await this.#o.outbound.connectionLost(iso(this.#o.now()));
         if (this.#stopped)
@@ -378,6 +417,7 @@ export class SyncClient {
         ctx.controlTarget = null;
         ctx.early = [];
         ctx.reopenAt = null;
+        ctx.keysOffered = false;
         this.#request({ kind: "open", resource: toHex(R) }, createMessage("RESOURCE_OPEN", {
             resourceId: R,
             heads,
@@ -394,8 +434,23 @@ export class SyncClient {
             case "RESOURCE_HOSTED":
                 if (request?.kind === "host") {
                     this.#requests.delete(toHex(m.correlationId));
+                    await this.#markHosted(parseControlRecord(request.genesis).payload.resourceId);
                     request.resolve(m.body.durability);
                 }
+                else if (request?.kind === "rehost") {
+                    this.#requests.delete(toHex(m.correlationId));
+                    const ctx = this.#resources.get(request.resource);
+                    if (ctx === undefined)
+                        return;
+                    this.#emit({
+                        type: "rehost",
+                        resourceId: ctx.binding.resourceId,
+                        url: this.#o.url,
+                        outcome: "hosted",
+                    });
+                    if (ctx.wanted)
+                        await this.#sendOpen(ctx);
+                }
                 return;
             case "RESOURCE_OPENED": {
                 const ctx = this.#ctx(m.body.resourceId);
@@ -404,7 +459,11 @@ export class SyncClient {
                 this.#done(m);
                 ctx.remoteHave = normalizeLiveHaves(m.body.haves);
                 ctx.offered = m.body.snapshot ?? null;
+                await this.#markHosted(ctx.binding.resourceId);
                 this.#move(ctx, "OPENED");
+                // §68.1, §88 step 6: what the server lacks goes first, Control Records before units.
+                await this.#offerControl(ctx, m.body.heads);
+                await this.#offerData(ctx);
                 await this.#controlRound(ctx, m.body.heads);
                 return;
             }
@@ -457,6 +516,7 @@ export class SyncClient {
                 if (ctx === undefined)
                     return;
                 ctx.remoteHave = normalizeLiveHaves(m.body.haves);
+                await this.#offerData(ctx); // §68.1: both directions
                 if (ctx.state === "LIVE")
                     await this.#dataRound(ctx);
                 return;
@@ -464,6 +524,9 @@ export class SyncClient {
             case "ACK":
                 if (request !== undefined) {
                     this.#done(m);
+                    if (request.kind === "offer-data")
+                        for (const u of request.units)
+                            this.#resources.get(request.resource)?.offering.delete(u.id);
                     return;
                 }
                 await this.#onAck(m);
@@ -471,7 +534,7 @@ export class SyncClient {
             case "NACK":
                 if (request !== undefined) {
                     this.#done(m);
-                    this.#onRequestNack(request, m);
+                    await this.#onRequestNack(request, m);
                     return;
                 }
                 await this.#onNack(m);
@@ -488,9 +551,41 @@ export class SyncClient {
         if (m.correlationId !== undefined && m.type !== "CONTROL_BATCH" && m.type !== "DATA_BATCH")
             this.#requests.delete(toHex(m.correlationId));
     }
-    #onRequestNack(request, m) {
+    async #onRequestNack(request, m) {
         // The §62 name (e.g. AUTHORIZATION_FAILED), so applications can explain it; unknown codes keep their number.
         const code = NACK_NAME.get(m.body.code) ?? `NACK ${m.body.code}`;
+        if (request.kind === "offer-control" ||
+            request.kind === "offer-data" ||
+            request.kind === "offer-keys") {
+            this.#onOfferNack(request, code, m.body.diagnostic);
+            return;
+        }
+        if (request.kind === "open" && code === "RESOURCE_NOT_HOSTED") {
+            const ctx = this.#resources.get(request.resource);
+            if (ctx !== undefined && (await this.#rehost(ctx)))
+                return;
+        }
+        if (request.kind === "rehost") {
+            const ctx = this.#resources.get(request.resource);
+            if (ctx === undefined)
+                return;
+            this.#emit({
+                type: "rehost",
+                resourceId: ctx.binding.resourceId,
+                url: this.#o.url,
+                outcome: "refused",
+                code,
+            });
+            this.#error(code, `re-hosting refused${m.body.diagnostic ? `: ${m.body.diagnostic}` : ""}`, ctx.binding.resourceId);
+            // §41.1: stop re-hosting on this route and tell the user; never retried by itself.
+            this.#refuse(ctx, {
+                code,
+                url: this.#o.url,
+                request: "rehost",
+                ...(m.body.diagnostic === undefined ? {} : { diagnostic: m.body.diagnostic }),
+            });
+            return;
+        }
         if (request.kind === "host") {
             request.reject(new Error(`RESOURCE_HOST refused: NACK ${code}${m.body.diagnostic ? ` (${m.body.diagnostic})` : ""}`));
             return;
@@ -548,6 +643,8 @@ export class SyncClient {
         const chain = await loadControlChain(this.#o.storage, ctx.binding.resourceId);
         const local = chain?.kind === "linear" ? localControlOf(chain) : null;
         const plan = planControlSync(local, heads);
+        if (plan.kind === "peer-behind")
+            await this.#offerControl(ctx, heads); // §68.1
         if (plan.kind === "in-sync" || plan.kind === "peer-behind" || plan.kind === "peer-empty")
             return;
         this.#move(ctx, "CONTROL_RECORD");
@@ -717,14 +814,31 @@ export class SyncClient {
                 this.#error(r.kind === "rejected" ? r.wireCode : r.code, `a Key Package was not used (${r.kind})`, R);
                 continue;
             }
-            // Secret first, then the row that references it (LFCP-034).
+            // Secret first, then the row that references it (LFCP-034). The
+            // package itself is kept while we keep the Resource (§86), to
+            // re-supply a server that lost it (§68.1).
             const ref = dekSecretRef(R, r.epoch);
             await this.#o.secrets.put(ref, exportSecretKeyBytes(r.dek));
+            const parsed = parseKeyPackage(bytes);
+            const writes = [
+                {
+                    op: "put-key-package",
+                    row: {
+                        packageId: hash32(parsed.signed.id),
+                        resourceId: R,
+                        dataEpoch: parsed.payload.dataEpoch,
+                        recipient: parsed.payload.recipient,
+                        sender: parsed.payload.sender,
+                        bytes: parsed.signed.bytes,
+                    },
+                },
+            ];
             const row = (await this.#o.storage.control.epochs(R)).find((e) => e.epoch === r.epoch);
             if (row !== undefined) {
                 const next = { ...row, dekRef: ref };
-                await this.#o.storage.commit([{ op: "put-epoch", resourceId: R, epoch: next }]);
+                writes.push({ op: "put-epoch", resourceId: R, epoch: next });
             }
+            await this.#o.storage.commit(writes);
         }
         const missing = await this.#epochsWithoutDek(ctx);
         const current = view.state.epoch.epoch;
@@ -1092,6 +1206,186 @@ export class SyncClient {
             for (const ctx of this.#resources.values())
                 if (ctx.state === "LIVE")
                     this.#refreshControl(ctx);
+        // §51.1: the server lost what our unit names. Its DATA_HAVE answer
+        // starts the offer (§68.1), which releases the held items.
+        if (outcome.kind === "needs-offer") {
+            const ctx = this.#ctx(outcome.resourceId);
+            if (ctx !== undefined && (ctx.state === "LIVE" || ctx.state === "DATA_SYNC"))
+                this.#sendHave(ctx, this.#o.now());
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Offering what the server lacks (§68.1) and re-hosting (§41.1)
+    async #markHosted(resource) {
+        const key = hostedMark(resource, this.#o.url);
+        if ((await this.#o.storage.localMarks.get(key)) !== undefined)
+            return;
+        await this.#o.storage.commit([{ op: "put-local-mark", key, value: "1" }]);
+    }
+    /**
+     * §41.1: RESOURCE_NOT_HOSTED from a route in the Resource's route set that
+     * hosted or opened it for us before: host it again from the exact Genesis
+     * bytes, then open it. False when re-hosting is not allowed here.
+     */
+    async #rehost(ctx) {
+        if (ctx.rehosted || this.#connection.state !== "READY")
+            return false;
+        const R = ctx.binding.resourceId;
+        const chain = await loadControlChain(this.#o.storage, R);
+        if (chain?.kind !== "linear")
+            return false;
+        const route = chain.state.route;
+        const url = this.#o.url;
+        if (!route.endpoints.some((e) => e.url === url) && route.coordinatorUrl !== url)
+            return false;
+        if ((await this.#o.storage.localMarks.get(hostedMark(R, url))) === undefined)
+            return false;
+        const genesis = chain.records[0];
+        if (genesis === undefined || genesis.payload.controlSeq !== 0n)
+            return false;
+        ctx.rehosted = true;
+        this.#move(ctx, "CLOSE");
+        this.#request({ kind: "rehost", resource: toHex(R) }, createMessage("RESOURCE_HOST", { genesis: genesis.signed.bytes }));
+        return true;
+    }
+    /**
+     * §68.1: the server's Control Head is a record we hold below our own head:
+     * upload the records above it, one CONTROL_PUT each, in order, each
+     * expecting the record before it.
+     */
+    async #offerControl(ctx, heads) {
+        if (this.#connection.state !== "READY")
+            return;
+        const R = ctx.binding.resourceId;
+        const chain = await loadControlChain(this.#o.storage, R);
+        if (chain?.kind !== "linear")
+            return;
+        const plan = planControlSync(localControlOf(chain), heads);
+        if (plan.kind !== "peer-behind")
+            return;
+        for (const record of chain.records) {
+            if (record.payload.controlSeq <= plan.peerSeq)
+                continue;
+            const previous = record.payload.prevControlId;
+            if (previous === null)
+                continue;
+            this.#request({ kind: "offer-control", resource: toHex(R) }, createMessage("CONTROL_PUT", {
+                resourceId: R,
+                expectedHead: previous,
+                record: record.signed.bytes,
+            }));
+        }
+        await this.#offerKeys(ctx);
+    }
+    /**
+     * §68.1: the accepted units the server's Have Vector lacks, ours and
+     * other actors' (relay), per actor in ascending sequence. Units still in
+     * our outbound queue go through it instead. Then the queued items held
+     * for UNKNOWN_PREVIOUS are released behind them.
+     */
+    async #offerData(ctx) {
+        if (this.#connection.state !== "READY")
+            return;
+        const R = ctx.binding.resourceId;
+        const queued = new Set((await this.#o.storage.outbound.list(R)).map((o) => toHex(o.itemId)));
+        let local = [];
+        for (const status of OFFERABLE)
+            for (const u of await this.#o.storage.dataUnits.withStatus(R, status))
+                if (u.accepted)
+                    local = addSequence(local, u.actor, u.actorSeq);
+        const { offer } = haveDifference(local, ctx.remoteHave);
+        const offerable = new Set(OFFERABLE);
+        let sent = 0;
+        for (const range of offer) {
+            const units = (await this.#o.storage.dataUnits.range(R, range.actor, actorSequence(range.start), actorSequence(range.end))).filter((u) => u.accepted &&
+                offerable.has(u.status) &&
+                !queued.has(toHex(u.unitId)) &&
+                !ctx.offering.has(toHex(u.unitId)));
+            sent += units.length;
+            this.#offerUnits(ctx, units.map((u) => ({ id: toHex(u.unitId), bytes: u.bytes })));
+        }
+        await this.#o.outbound.offered(R);
+        if (sent > 0)
+            await this.#offerKeys(ctx);
+        await this.#flush(ctx);
+    }
+    /** DATA_PUTs of one actor's units in order, within the message size and object limits. */
+    #offerUnits(ctx, units) {
+        const R = ctx.binding.resourceId;
+        const limit = this.#maxMessageBytes - 1024;
+        let batch = [];
+        let size = 0;
+        const send = () => {
+            if (batch.length === 0)
+                return;
+            for (const u of batch)
+                ctx.offering.add(u.id);
+            this.#request({ kind: "offer-data", resource: toHex(R), units: batch }, createMessage("DATA_PUT", { resourceId: R, objects: batch.map((u) => u.bytes) }));
+            batch = [];
+            size = 0;
+        };
+        for (const u of units) {
+            if (batch.length >= OFFER_BATCH || size + u.bytes.length > limit)
+                send();
+            batch.push(u);
+            size += u.bytes.length;
+        }
+        send();
+    }
+    /**
+     * §68.1, §86: a server that lacked Control Records or units may have lost
+     * Key Packages too: the ones we sent or that are addressed to us are
+     * uploaded again, once per open. A package the server stores is answered
+     * as the first time (§70).
+     */
+    async #offerKeys(ctx) {
+        if (ctx.keysOffered || this.#connection.state !== "READY")
+            return;
+        ctx.keysOffered = true;
+        const R = ctx.binding.resourceId;
+        const me = toHex(this.#o.signer.descriptor.principalId);
+        const packages = (await this.#o.storage.keyPackages.list(R)).filter((k) => toHex(k.sender) === me || toHex(k.recipient) === me);
+        const limit = this.#maxMessageBytes - 1024;
+        for (let i = 0; i < packages.length;) {
+            const batch = [];
+            let size = 0;
+            while (i < packages.length && batch.length < OFFER_BATCH) {
+                const bytes = packages[i].bytes;
+                if (batch.length > 0 && size + bytes.length > limit)
+                    break;
+                batch.push(bytes);
+                size += bytes.length;
+                i++;
+            }
+            this.#request({ kind: "offer-keys", resource: toHex(R) }, createMessage("KEY_PACKAGE_PUT", { resourceId: R, objects: batch }));
+        }
+    }
+    /**
+     * A refused offer. A DATA_PUT is all-or-nothing (§51): each unit of a
+     * refused batch is offered again alone. ACTOR_EQUIVOCATION for a relayed
+     * unit is expected when the server holds the other unit of a pair, and
+     * UNKNOWN_PREVIOUS when it lacks an earlier unit we do not hold either:
+     * neither is an alarm. A refused Control Record (the server's head moved)
+     * is caught up by the next Control round.
+     */
+    #onOfferNack(request, code, diagnostic) {
+        const ctx = this.#resources.get(request.resource);
+        if (ctx === undefined)
+            return;
+        if (request.kind === "offer-data") {
+            for (const u of request.units)
+                ctx.offering.delete(u.id);
+            if (request.units.length > 1) {
+                for (const u of request.units)
+                    this.#offerUnits(ctx, [u]);
+                return;
+            }
+            if (code === "ACTOR_EQUIVOCATION" || code === "UNKNOWN_PREVIOUS")
+                return;
+        }
+        if (request.kind === "offer-control" && code === "CONTROL_HEAD_MISMATCH")
+            return;
+        this.#error(code, `an object offered to the server was refused (§68.1)${diagnostic ? `: ${diagnostic}` : ""}`, ctx.binding.resourceId);
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/client",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "LFCP client: session, Control Plane and Data Plane synchronization.",
   "keywords": [
     "openlfcp",
@@ -42,9 +42,9 @@
     "tag": "latest"
   },
   "dependencies": {
-    "@openlfcp/core": "^0.1.1",
-    "@openlfcp/storage": "^0.1.1",
-    "@openlfcp/crypto": "^0.1.1",
-    "@openlfcp/wire": "^0.1.1"
+    "@openlfcp/core": "^0.1.3",
+    "@openlfcp/crypto": "^0.1.3",
+    "@openlfcp/storage": "^0.1.3",
+    "@openlfcp/wire": "^0.1.3"
   }
 }