@plane31/blind-relay 0.0.0-stage → 0.1.2

package/dist/outbox.d.ts

@@ -0,0 +1,96 @@
+import { type RetentionPolicy } from "./policy.js";
+import type { Store, Tx } from "./store.js";
+import type { AppendOutcome, Relay } from "./transport.js";
+import { type RecordKind } from "./codec.js";
+export interface OutboxEvents {
+    queued?(recordId: Uint8Array, kind: RecordKind): void;
+    accepted?(recordId: Uint8Array): void;
+    cancelled?(recordId: Uint8Array, reason: string): void;
+    /** A record of a kind with a newest slot was cancelled or is in doubt: the app may resend its current state of that kind. */
+    refresh?(reason: string): void;
+    securityError?(code: string, detail: string): void;
+}
+export interface OutboxDeps {
+    readonly store: Store;
+    readonly relay: Relay;
+    readonly policy: RetentionPolicy;
+    readonly now: () => bigint;
+    readonly author: () => {
+        streamId: Uint8Array;
+        signingSecretKey: Uint8Array;
+        generation: bigint;
+        identityId: Uint8Array;
+    };
+    readonly events?: OutboxEvents;
+}
+export interface EnqueueOptions {
+    /**
+     * A caller-chosen key for this hand-over, derived from the sample itself (its fix time and
+     * source, say). The guarantee: a keyed enqueue that returns has committed its record and the
+     * key in one transaction; a second enqueue under the same key, from a retry after a crash or
+     * from another runtime on the same store, returns that record with `duplicate: true` and seals
+     * nothing, concurrent calls included, since the store's writer lock orders them; a refused
+     * enqueue stores no key, so its retry is checked again. The key is kept for the delivery
+     * window and covers the hand-over, not delivery: the record it names can still be cancelled by
+     * a rotation, which the `cancelled` event reports as for any record. Up to 128 characters.
+     */
+    readonly idempotencyKey?: string;
+    /**
+     * The event time of what the record describes (a fix time, say), carried in the encrypted
+     * envelope. A reader orders the kind's newest slot by it, clamped to the send time. Absent for a
+     * kind with no natural event time; the slot then orders by send time. Zero means absent: the
+     * envelope has no other way to say "none", and the sender's own slot follows the same reading.
+     */
+    readonly eventTime?: bigint;
+}
+export interface Enqueued {
+    recordId: Uint8Array;
+    counter: number;
+    epoch: number;
+    /** True when the idempotency key matched an earlier enqueue and this call made no record. */
+    duplicate: boolean;
+    /** True when this record took the sender's own newest slot for its kind. */
+    own: boolean;
+}
+export declare const MAX_IDEMPOTENCY_KEY = 128;
+/**
+ * T6: require a usable active epoch under the current desired revision, enforce the queue limits,
+ * seal once, write the outbox row and the own history row, and advance the counter. The record
+ * id is returned only after commit. A kind declared latestWins cancels a queued record of the same
+ * kind when a newer one is enqueued, never a sent one; a slot-only kind writes no history row. An
+ * idempotency key is answered before any check: its record is already durable, whatever has
+ * happened to the queue since.
+ */
+export declare function enqueue(deps: OutboxDeps, kind: RecordKind, payload: Uint8Array, options?: EnqueueOptions): Promise<Enqueued>;
+export interface DrainSummary {
+    sent: number;
+    accepted: number;
+    cancelled: number;
+    unknown: number;
+    retry: number;
+}
+/**
+ * The single serialised sender: one record in flight per stream, drained in (epoch, counter)
+ * order. Each handoff is T6h: re-check eligibility, mark in flight, start the send inside the
+ * transaction, commit; the response is awaited outside and recorded in a new transaction that
+ * revalidates first.
+ */
+export declare function drain(deps: OutboxDeps, maxRecords?: number): Promise<DrainSummary>;
+type Final = "accepted" | "cancelled" | "unknown" | "retry";
+export declare function recordOutcome(deps: OutboxDeps, key: string, outcome: AppendOutcome | undefined): Promise<Final>;
+/** Retention for rows that will not be sent again: they go once the delivery window has passed. */
+export declare function purgeOutbox(store: Store, policy: RetentionPolicy, now: bigint): Promise<number>;
+export interface OutboxCounts {
+    readonly queued: number;
+    readonly inflight: number;
+    readonly cancelled: number;
+    readonly unknown: number;
+    /** Age of the oldest row still to send, when there is one. */
+    readonly oldestPendingAgeMs: bigint | undefined;
+}
+/** Rows by state, for diagnostics. */
+export declare function outboxCounts(tx: Pick<Tx, "list">, now: bigint): OutboxCounts;
+/** Rows still waiting, for state reporting. */
+export declare function outboxCount(store: Store): Promise<number>;
+export {};
+//# sourceMappingURL=outbox.d.ts.map

package/dist/outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../src/outbox.ts"],"names":[],"mappings":"AAQA,OAAO,EAAU,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAI3D,OAAO,KAAK,EAAyB,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IACtC,SAAS,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,6HAA6H;IAC7H,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM;QAAE,QAAQ,EAAE,UAAU,CAAC;QAAC,gBAAgB,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,CAAC;IAC1H,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AASD,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,SAAS,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,GAAG,EAAE,OAAO,CAAC;CACd;AAED,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8GtI;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,SAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAuBtF;AA6DD,KAAK,KAAK,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAE5D,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAyCrH;AAED,mGAAmG;AACnG,wBAAsB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAarG;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD;AAED,sCAAsC;AACtC,wBAAgB,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAY5E;AAED,+CAA+C;AAC/C,wBAAsB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D"}

package/dist/outbox.js

@@ -0,0 +1,339 @@
+/**
+ * The outbox and the sender (protocol section 10, publishing; transactions T6 and T6h).
+ */
+import { fromHex, toHex } from "./bytes.js";
+import { rotationReason, MAX_COUNTER } from "./epoch.js";
+import { bodyHash } from "./crypto.js";
+import { KavachError } from "./errors.js";
+import { indexHistory } from "./historyIndex.js";
+import { kindOf } from "./policy.js";
+import { clampEventTime, takeSlot } from "./slots.js";
+import { sealRecord } from "./record.js";
+import { big, unbig } from "./rows.js";
+import { META, REVISION, STREAM, currentRevision, t3ApplyChange } from "./transactions.js";
+import { recordWireBytes } from "./codec.js";
+function requireReady(tx) {
+    const meta = tx.get("meta", META);
+    if (!meta)
+        throw new KavachError("RECOVERY_REQUIRED", "enqueue", "no header");
+    if (meta.state === "RETIRED")
+        throw new KavachError("SUPERSEDED_DEVICE", "enqueue", "this device is retired");
+    if (meta.state !== "ACTIVE")
+        throw new KavachError("ACCOUNT_RECOVERY_REQUIRED", "enqueue", `store is ${meta.state}`);
+}
+export const MAX_IDEMPOTENCY_KEY = 128;
+/**
+ * T6: require a usable active epoch under the current desired revision, enforce the queue limits,
+ * seal once, write the outbox row and the own history row, and advance the counter. The record
+ * id is returned only after commit. A kind declared latestWins cancels a queued record of the same
+ * kind when a newer one is enqueued, never a sent one; a slot-only kind writes no history row. An
+ * idempotency key is answered before any check: its record is already durable, whatever has
+ * happened to the queue since.
+ */
+export async function enqueue(deps, kind, payload, options = {}) {
+    const stage = "enqueue";
+    const declared = kindOf(deps.policy, kind);
+    if (!declared)
+        throw new KavachError("MALFORMED", stage, `kind ${kind} is not declared in the retention policy`);
+    const key = options.idempotencyKey;
+    if (key !== undefined && (key.length === 0 || key.length > MAX_IDEMPOTENCY_KEY))
+        throw new KavachError("MALFORMED", stage, "idempotency key must be 1 to 128 characters");
+    // One reading of the event time for the envelope, the own slot and the history row: zero is none.
+    const eventTime = options.eventTime === undefined || options.eventTime === 0n ? undefined : options.eventTime;
+    if (eventTime !== undefined && eventTime < 0n)
+        throw new KavachError("MALFORMED", stage, "event time before the epoch");
+    const superseded = [];
+    const result = await deps.store.transaction((tx) => {
+        requireReady(tx);
+        if (key !== undefined) {
+            const seen = tx.get("enqueueKeys", key);
+            if (seen)
+                return { recordId: fromHex(seen.recordId), counter: seen.counter, epoch: seen.epoch, duplicate: true, own: false };
+        }
+        const revision = tx.get("revision", REVISION);
+        if (revision?.paused === "metadata")
+            throw new KavachError("METADATA_REQUIRED", stage);
+        if (revision?.paused === "limit")
+            throw new KavachError("RECIPIENT_LIMIT", stage);
+        const stream = tx.get("stream", STREAM);
+        if (!stream || stream.activeEpoch === undefined || revision?.paused === "rotation")
+            throw new KavachError("ROTATION_REQUIRED", stage, "no active epoch");
+        const epoch = tx.get("epochs", String(stream.activeEpoch));
+        if (!epoch || epoch.status !== "active")
+            throw new KavachError("ROTATION_REQUIRED", stage, "epoch not active");
+        const now = deps.now();
+        const reason = rotationReason({ createdAt: unbig(epoch.createdAt), nextCounter: epoch.nextCounter, lastSentAt: epoch.lastSentAt === undefined ? undefined : unbig(epoch.lastSentAt) }, now, deps.policy.hygieneRotationMs);
+        if (reason) {
+            // Commit the invalidation (T3) and report the rotation after the transaction, so the
+            // burned counters and cancelled rows are durable even though nothing was enqueued.
+            t3ApplyChange(tx, { kind: reason });
+            return { rotate: reason };
+        }
+        let count = 0;
+        let bytes = 0;
+        for (const [key, row] of tx.list("outbox")) {
+            if (declared.queue === "latestWins" && row.kind === kind && row.status === "queued") {
+                tx.put("outbox", key, terminal(row, "cancelled", "superseded"));
+                superseded.push(fromHex(row.recordId));
+                continue;
+            }
+            if (row.status === "queued" || row.status === "inflight") {
+                count++;
+                bytes += row.wire.length / 2;
+            }
+        }
+        if (count >= deps.policy.maxOutboxRecords || bytes + recordWireBytes(payload.length) > deps.policy.maxOutboxBytes)
+            throw new KavachError("QUEUE_FULL", stage);
+        const a = deps.author();
+        const sealed = sealRecord({
+            streamId: a.streamId,
+            epoch: epoch.epoch,
+            nextCounter: epoch.nextCounter,
+            kind,
+            eventTime,
+            headerClass: declared.headerClass,
+            payload,
+            sentAt: now,
+            epochKey: fromHex(epoch.epochKey),
+            signingSecretKey: a.signingSecretKey
+        });
+        const id = toHex(sealed.recordId);
+        tx.put("outbox", id, {
+            recordId: id,
+            wire: toHex(sealed.wire),
+            epoch: epoch.epoch,
+            counter: sealed.counter,
+            kind,
+            sentAt: big(now),
+            desiredRevision: big(currentRevision(tx)),
+            status: "queued",
+            attempts: 0,
+            reason: undefined
+        });
+        if (key !== undefined)
+            tx.put("enqueueKeys", key, { recordId: id, epoch: epoch.epoch, counter: sealed.counter, sentAt: big(now) });
+        // The sender's own row, under the rules a reader applies (section 10): history when the kind
+        // keeps it, and the own newest slot when the kind has one, so `newest` answers for self.
+        const self = toHex(a.identityId);
+        const hash = toHex(bodyHash(sealed.wire.subarray(0, sealed.wire.length - 64)));
+        const own = declared.newest ? takeSlot(tx, self, kind, { generation: a.generation, eventTime: clampEventTime(eventTime, now), epoch: epoch.epoch, counter: sealed.counter, recordId: id, bodyHash: hash, sentAt: now, receivedAt: now, payload }, toHex) : false;
+        if (declared.history) {
+            const ownRow = {
+                recordId: id,
+                authorIdentityId: toHex(a.identityId),
+                streamId: toHex(a.streamId),
+                generation: big(a.generation),
+                epoch: epoch.epoch,
+                counter: sealed.counter,
+                kind,
+                sentAt: big(now),
+                receivedAt: big(now),
+                plaintext: toHex(payload),
+                superseded: false,
+                own: true,
+                ...(eventTime === undefined ? {} : { eventTime: big(eventTime) })
+            };
+            tx.put("history", id, ownRow);
+            indexHistory(tx, ownRow);
+        }
+        const nextCounter = epoch.nextCounter + 1;
+        tx.put("epochs", String(epoch.epoch), { ...epoch, nextCounter, lastSentAt: big(now) });
+        if (nextCounter > MAX_COUNTER) {
+            // The final counter was just used: the next enqueue rotates.
+        }
+        return { recordId: sealed.recordId, counter: sealed.counter, epoch: epoch.epoch, duplicate: false, own };
+    });
+    if ("rotate" in result) {
+        throw new KavachError(result.rotate === "counterExhausted" ? "COUNTER_EXHAUSTED" : "ROTATION_REQUIRED", stage, result.rotate);
+    }
+    if (result.duplicate)
+        return result;
+    for (const id of superseded)
+        deps.events?.cancelled?.(id, "superseded");
+    deps.events?.queued?.(result.recordId, kind);
+    return result;
+}
+/**
+ * The single serialised sender: one record in flight per stream, drained in (epoch, counter)
+ * order. Each handoff is T6h: re-check eligibility, mark in flight, start the send inside the
+ * transaction, commit; the response is awaited outside and recorded in a new transaction that
+ * revalidates first.
+ */
+export async function drain(deps, maxRecords = 1000) {
+    const summary = { sent: 0, accepted: 0, cancelled: 0, unknown: 0, retry: 0 };
+    for (let i = 0; i < maxRecords; i++) {
+        const step = await handoffNext(deps, summary);
+        if (step.kind === "none")
+            break;
+        if (step.kind === "skipped")
+            continue; // a cancelled row counts against the limit, never ends the drain
+        summary.sent++;
+        let outcome;
+        try {
+            outcome = await step.outcome;
+        }
+        catch {
+            outcome = undefined; // lost response
+        }
+        const final = await recordOutcome(deps, step.key, outcome);
+        if (final === "accepted")
+            summary.accepted++;
+        else if (final === "cancelled")
+            summary.cancelled++;
+        else if (final === "unknown")
+            summary.unknown++;
+        else {
+            summary.retry++;
+            break; // a retryable failure ends this drain; the next sync re-enters T6h
+        }
+    }
+    return summary;
+}
+/** Dead rows cancelled per handoff transaction; a larger backlog is finished over the next handoffs. */
+const CANCEL_BATCH = 500;
+/** A row that will not be sent again keeps its summary and sheds the ciphertext. */
+function terminal(row, status, reason) {
+    return { ...row, wire: "", status, reason };
+}
+async function handoffNext(deps, summary) {
+    // Application events fire after the commit, never from inside it: a subscriber cannot roll a
+    // transition back, and never sees state the store has not kept yet.
+    const after = [];
+    const step = await deps.store.transaction((tx) => {
+        const meta = tx.get("meta", META);
+        if (!meta || meta.state !== "ACTIVE")
+            return { kind: "none" };
+        const now = deps.now();
+        const revision = currentRevision(tx);
+        // One pass: every row that is no longer sendable (its revision moved on, or its window has
+        // passed) is cancelled here, in bounded batches, and the first sendable row goes out in the
+        // same transaction. A backlog of dead rows costs one scan, not one transaction per row.
+        const live = [];
+        let cancelled = 0;
+        let refresh = false;
+        for (const [key, row] of [...tx.list("outbox")].sort(([, a], [, b]) => a.epoch - b.epoch || a.counter - b.counter)) {
+            if (row.status !== "queued" && row.status !== "inflight")
+                continue;
+            const reason = cancelled >= CANCEL_BATCH ? undefined : unbig(row.desiredRevision) !== revision ? "rotation" : unbig(row.sentAt) + deps.policy.deliveryWindowMs <= now ? "expired" : undefined;
+            if (!reason) {
+                live.push([key, row]);
+                continue;
+            }
+            tx.put("outbox", key, terminal(row, "cancelled", reason));
+            cancelled++;
+            after.push(() => deps.events?.cancelled?.(fromHex(row.recordId), reason));
+            if (reason === "rotation" && kindOf(deps.policy, row.kind)?.newest)
+                refresh = true;
+        }
+        summary.cancelled += cancelled;
+        if (refresh)
+            after.push(() => deps.events?.refresh?.("rotation"));
+        // A full batch means unchecked rows remain: finish them in the next handoff before sending.
+        if (cancelled >= CANCEL_BATCH)
+            return { kind: "skipped" };
+        const next = live.find(([, r]) => r.status === "inflight") ?? live[0];
+        if (!next)
+            return { kind: "none" };
+        const [key, row] = next;
+        const marked = { ...row, status: "inflight", attempts: row.attempts + 1 };
+        tx.put("outbox", key, marked);
+        let outcome;
+        try {
+            outcome = tx.handoff(() => deps.relay.appendRecord(fromHex(row.recordId), fromHex(row.wire)));
+        }
+        catch {
+            // A synchronous transport failure: roll the in-flight mark back and stop this drain.
+            tx.put("outbox", key, { ...row, attempts: row.attempts + 1 });
+            summary.retry++;
+            return { kind: "none" };
+        }
+        return { kind: "sent", key, row: marked, outcome };
+    });
+    for (const fire of after)
+        fire();
+    return step;
+}
+export async function recordOutcome(deps, key, outcome) {
+    const after = [];
+    const final = await deps.store.transaction((tx) => {
+        const row = tx.get("outbox", key);
+        if (!row || row.status !== "inflight")
+            return "retry";
+        const id = fromHex(row.recordId);
+        const requeue = () => tx.put("outbox", key, { ...row, status: "queued", reason: undefined });
+        const cancel = (reason) => tx.put("outbox", key, terminal(row, "cancelled", reason));
+        if (!outcome) {
+            requeue(); // lost response: retry the identical bytes; the relay answers from its checkpoint
+            return "retry";
+        }
+        switch (outcome.status) {
+            case "ACCEPTED":
+            case "ALREADY_ACCEPTED":
+                tx.delete("outbox", key);
+                after.push(() => deps.events?.accepted?.(id));
+                return "accepted";
+            case "RETRYABLE":
+                requeue();
+                return "retry";
+            case "STALE_APPEND":
+                tx.put("outbox", key, terminal(row, "unknown", "STALE_APPEND"));
+                after.push(() => deps.events?.cancelled?.(id, "acceptanceUnknown"));
+                if (kindOf(deps.policy, row.kind)?.newest)
+                    after.push(() => deps.events?.refresh?.("acceptanceUnknown"));
+                return "unknown";
+            case "EQUIVOCATION":
+                cancel("EQUIVOCATION");
+                after.push(() => deps.events?.securityError?.("EQUIVOCATION", "the relay holds a different record under this id"));
+                return "cancelled";
+            case "EPOCH_FENCED":
+            case "SUPERSEDED_DEVICE":
+            case "UNAUTHORIZED":
+                cancel(outcome.status);
+                after.push(() => deps.events?.cancelled?.(id, outcome.status));
+                if (kindOf(deps.policy, row.kind)?.newest)
+                    after.push(() => deps.events?.refresh?.(outcome.status));
+                return "cancelled";
+        }
+    });
+    for (const fire of after)
+        fire();
+    return final;
+}
+/** Retention for rows that will not be sent again: they go once the delivery window has passed. */
+export async function purgeOutbox(store, policy, now) {
+    return store.transaction((tx) => {
+        let purged = 0;
+        for (const [key, row] of tx.list("outbox")) {
+            if ((row.status === "cancelled" || row.status === "unknown") && unbig(row.sentAt) + policy.deliveryWindowMs <= now) {
+                tx.delete("outbox", key);
+                purged++;
+            }
+        }
+        // Idempotency keys outlive the delivery window by nothing: a replay later is a new record.
+        for (const [key, row] of tx.list("enqueueKeys"))
+            if (unbig(row.sentAt) + policy.deliveryWindowMs <= now)
+                tx.delete("enqueueKeys", key);
+        return purged;
+    });
+}
+/** Rows by state, for diagnostics. */
+export function outboxCounts(tx, now) {
+    const counts = { queued: 0, inflight: 0, cancelled: 0, unknown: 0 };
+    let oldest;
+    for (const [, r] of tx.list("outbox")) {
+        if (r.status === "accepted")
+            continue;
+        counts[r.status]++;
+        if (r.status === "queued" || r.status === "inflight") {
+            const sentAt = unbig(r.sentAt);
+            if (oldest === undefined || sentAt < oldest)
+                oldest = sentAt;
+        }
+    }
+    return { ...counts, oldestPendingAgeMs: oldest === undefined ? undefined : now - oldest };
+}
+/** Rows still waiting, for state reporting. */
+export async function outboxCount(store) {
+    return store.read((tx) => tx.list("outbox").filter(([, r]) => r.status === "queued" || r.status === "inflight").length);
+}
+//# sourceMappingURL=outbox.js.map

package/dist/outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../src/outbox.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAwB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EAAE,eAAe,EAAmB,MAAM,YAAY,CAAC;AAoB9D,SAAS,YAAY,CAAC,EAAmB;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC9G,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,2BAA2B,EAAE,SAAS,EAAE,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AACvH,CAAC;AAiCD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAgB,EAAE,OAAmB,EAAE,UAA0B,EAAE;IACjH,MAAM,KAAK,GAAG,SAAS,CAAC;IACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,IAAI,0CAA0C,CAAC,CAAC;IACjH,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,mBAAmB,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC1K,kGAAkG;IAClG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9G,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACxH,MAAM,UAAU,GAAiB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACjD,YAAY,CAAC,EAAE,CAAC,CAAC;QACjB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,IAAI;gBAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAW,CAAC;QACxI,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACvF,IAAI,QAAQ,EAAE,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,EAAE,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACzJ,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC3N,IAAI,MAAM,EAAE,CAAC;YACX,qFAAqF;YACrF,mFAAmF;YACnF,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAW,CAAC;QACrC,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpF,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;gBAChE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACzD,KAAK,EAAE,CAAC;gBACR,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC9J,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI;YACJ,SAAS;YACT,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,OAAO;YACP,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE;YACnB,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI;YACJ,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC;YAChB,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnI,6FAA6F;QAC7F,yFAAyF;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,MAAM,GAAe;gBACzB,QAAQ,EAAE,EAAE;gBACZ,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;gBACrC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3B,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI;gBACJ,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC;gBAChB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC;gBACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;gBACzB,UAAU,EAAE,KAAK;gBACjB,GAAG,EAAE,IAAI;gBACT,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;aAClE,CAAC;YACF,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9B,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;QAC1C,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;YAC9B,6DAA6D;QAC/D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAW,CAAC;IACpH,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IACpC,KAAK,MAAM,EAAE,IAAI,UAAU;QAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAgB,EAAE,UAAU,GAAG,IAAI;IAC7D,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,iEAAiE;QACxG,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAkC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC,CAAC,gBAAgB;QACvC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aACxC,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,EAAE,CAAC;aAC3C,CAAC;YACJ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,mEAAmE;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wGAAwG;AACxG,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,oFAAoF;AACpF,SAAS,QAAQ,CAAC,GAAc,EAAE,MAA+B,EAAE,MAAc;IAC/E,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,OAAqB;IAChE,6FAA6F;IAC7F,oEAAoE;IACpE,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAe,EAAE;QAC5D,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACrC,2FAA2F;QAC3F,4FAA4F;QAC5F,wFAAwF;QACxF,MAAM,IAAI,GAA0B,EAAE,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACnH,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;gBAAE,SAAS;YACnE,MAAM,MAAM,GAAG,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9L,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,SAAS,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1E,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM;gBAAE,OAAO,GAAG,IAAI,CAAC;QACrF,CAAC;QACD,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC;QAC/B,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,4FAA4F;QAC5F,IAAI,SAAS,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;QACxB,MAAM,MAAM,GAAc,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACrF,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,EAAE,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB,EAAE,GAAW,EAAE,OAAkC;IACnG,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAS,EAAE;QACvD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC;QACtD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC,CAAC,kFAAkF;YAC7F,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,UAAU,CAAC;YAChB,KAAK,kBAAkB;gBACrB,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9C,OAAO,UAAU,CAAC;YACpB,KAAK,WAAW;gBACd,OAAO,EAAE,CAAC;gBACV,OAAO,OAAO,CAAC;YACjB,KAAK,cAAc;gBACjB,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACzG,OAAO,SAAS,CAAC;YACnB,KAAK,cAAc;gBACjB,MAAM,CAAC,cAAc,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,kDAAkD,CAAC,CAAC,CAAC;gBACnH,OAAO,WAAW,CAAC;YACrB,KAAK,cAAc,CAAC;YACpB,KAAK,mBAAmB,CAAC;YACzB,KAAK,cAAc;gBACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpG,OAAO,WAAW,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAY,EAAE,MAAuB,EAAE,GAAW;IAClF,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,EAAE,CAAC;gBACnH,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACzB,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QACD,2FAA2F;QAC3F,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG;gBAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACvI,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAWD,sCAAsC;AACtC,MAAM,UAAU,YAAY,CAAC,EAAoB,EAAE,GAAW;IAC5D,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpE,IAAI,MAA0B,CAAC;IAC/B,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QACtC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,kBAAkB,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC;AAC5F,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAY;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1H,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,33 @@
+/** How the SDK treats one record kind; what the kind means is the product's. */
+export interface KindDeclaration {
+    /** The kind number carried by the record. Until revision 8 the wire carries 0, 1 or 2. */
+    readonly kind: number;
+    /** How long a reader keeps records and the newest slot's payload, from `sentAt`. */
+    readonly retentionMs: bigint;
+    /** `keepAll`: every queued record is sent. `latestWins`: a newer queued record of this kind cancels the older one (`superseded`). */
+    readonly queue: "keepAll" | "latestWins";
+    /** Whether records are kept in indexed, pageable history. */
+    readonly history: boolean;
+    /** Whether one newest-per-author slot is kept, from the author's current device, ordered by event time. */
+    readonly newest: boolean;
+    /** The two header bits the relay may see for this kind (0 to 3, 0 when absent), for routing and notifications without content. */
+    readonly headerClass: 0 | 1 | 2 | 3;
+}
+export interface RetentionPolicy {
+    readonly version: number;
+    readonly deliveryWindowMs: bigint;
+    readonly appendRetryWindowMs: bigint;
+    readonly hygieneRotationMs: bigint;
+    readonly maxOutboxRecords: number;
+    readonly maxOutboxBytes: number;
+    readonly kinds: readonly KindDeclaration[];
+}
+/** The largest kind the envelope carries. */
+export declare const MAX_WIRE_KIND = 255;
+/** A missing or malformed policy is rejected; the SDK never substitutes defaults. */
+export declare function validatePolicy(policy: unknown): RetentionPolicy;
+/** The declaration of a kind, or `undefined` for one the product did not declare. */
+export declare function kindOf(policy: RetentionPolicy, kind: number): KindDeclaration | undefined;
+/** The kinds kept in history, in declaration order. */
+export declare function historyKinds(policy: RetentionPolicy): readonly number[];
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAOA,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qIAAqI;IACrI,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2GAA2G;IAC3G,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,kIAAkI;IAClI,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AAED,6CAA6C;AAC7C,eAAO,MAAM,aAAa,MAAM,CAAC;AAIjC,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAsC/D;AAED,qFAAqF;AACrF,wBAAgB,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEzF;AAED,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAEvE"}

package/dist/policy.js

@@ -0,0 +1,71 @@
+/**
+ * The versioned retention policy a profile passes to `open()` (protocol section 13): the global
+ * windows, and one declaration per record kind the product uses. The SDK treats a kind as an
+ * opaque small integer whose behaviour is what the declaration says. No defaults.
+ */
+import { KavachError } from "./errors.js";
+/** The largest kind the envelope carries. */
+export const MAX_WIRE_KIND = 255;
+const FIELDS = ["version", "deliveryWindowMs", "appendRetryWindowMs", "hygieneRotationMs", "maxOutboxRecords", "maxOutboxBytes", "kinds"];
+/** A missing or malformed policy is rejected; the SDK never substitutes defaults. */
+export function validatePolicy(policy) {
+    const stage = "policy";
+    if (typeof policy !== "object" || policy === null)
+        throw new KavachError("MALFORMED", stage, "retention policy missing");
+    const p = policy;
+    for (const f of FIELDS)
+        if (!(f in p))
+            throw new KavachError("MALFORMED", stage, `retention policy lacks ${f}`);
+    const big = (f, v) => {
+        if (typeof v !== "bigint" || v <= 0n)
+            throw new KavachError("MALFORMED", stage, `${f} must be a positive bigint`);
+        return v;
+    };
+    const int = (f, v) => {
+        if (typeof v !== "number" || !Number.isInteger(v) || v <= 0)
+            throw new KavachError("MALFORMED", stage, `${f} must be a positive integer`);
+        return v;
+    };
+    if (!Array.isArray(p.kinds) || p.kinds.length === 0)
+        throw new KavachError("MALFORMED", stage, "kinds must declare at least one kind");
+    const seen = new Set();
+    const kinds = p.kinds.map((raw, i) => {
+        if (typeof raw !== "object" || raw === null)
+            throw new KavachError("MALFORMED", stage, `kinds[${i}] must be an object`);
+        const k = raw;
+        const kind = k.kind;
+        if (typeof kind !== "number" || !Number.isInteger(kind) || kind < 0 || kind > MAX_WIRE_KIND)
+            throw new KavachError("MALFORMED", stage, `kinds[${i}].kind must be an integer from 0 to ${MAX_WIRE_KIND}`);
+        if (seen.has(kind))
+            throw new KavachError("MALFORMED", stage, `kind ${kind} declared twice`);
+        seen.add(kind);
+        if (k.queue !== "keepAll" && k.queue !== "latestWins")
+            throw new KavachError("MALFORMED", stage, `kinds[${i}].queue must be keepAll or latestWins`);
+        if (typeof k.history !== "boolean" || typeof k.newest !== "boolean")
+            throw new KavachError("MALFORMED", stage, `kinds[${i}].history and .newest must be booleans`);
+        if (!k.history && !k.newest)
+            throw new KavachError("MALFORMED", stage, `kinds[${i}] keeps nothing: declare history or newest`);
+        const headerClass = k.headerClass ?? 0;
+        if (headerClass !== 0 && headerClass !== 1 && headerClass !== 2 && headerClass !== 3)
+            throw new KavachError("MALFORMED", stage, `kinds[${i}].headerClass must be 0 to 3`);
+        return { kind, retentionMs: big(`kinds[${i}].retentionMs`, k.retentionMs), queue: k.queue, history: k.history, newest: k.newest, headerClass };
+    });
+    return {
+        version: int("version", p.version),
+        deliveryWindowMs: big("deliveryWindowMs", p.deliveryWindowMs),
+        appendRetryWindowMs: big("appendRetryWindowMs", p.appendRetryWindowMs),
+        hygieneRotationMs: big("hygieneRotationMs", p.hygieneRotationMs),
+        maxOutboxRecords: int("maxOutboxRecords", p.maxOutboxRecords),
+        maxOutboxBytes: int("maxOutboxBytes", p.maxOutboxBytes),
+        kinds
+    };
+}
+/** The declaration of a kind, or `undefined` for one the product did not declare. */
+export function kindOf(policy, kind) {
+    return policy.kinds.find((k) => k.kind === kind);
+}
+/** The kinds kept in history, in declaration order. */
+export function historyKinds(policy) {
+    return policy.kinds.filter((k) => k.history).map((k) => k.kind);
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B1C,6CAA6C;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,MAAM,MAAM,GAAuC,CAAC,SAAS,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAE9K,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC;IACvB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACzH,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAChH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAU,EAAU,EAAE;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAClH,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAU,EAAU,EAAE;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC1I,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,sCAAsC,CAAC,CAAC;IACvI,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAsB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,CAAS,EAAE,EAAE;QACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACxH,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,aAAa;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,uCAAuC,aAAa,EAAE,CAAC,CAAC;QACzM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,IAAI,iBAAiB,CAAC,CAAC;QAC7F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACpJ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,wCAAwC,CAAC,CAAC;QACnK,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,4CAA4C,CAAC,CAAC;QAC/H,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACvC,IAAI,WAAW,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,8BAA8B,CAAC,CAAC;QAC1K,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IACjJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;QAClC,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,gBAAgB,CAAC;QAC7D,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC;QACtE,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,iBAAiB,CAAC;QAChE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,gBAAgB,CAAC;QAC7D,cAAc,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,MAAM,CAAC,MAAuB,EAAE,IAAY;IAC1D,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC"}

package/dist/record.d.ts

@@ -0,0 +1,49 @@
+import { type EncryptedRecord, type HeaderClass, type Parsed, type RecordKind } from "./codec.js";
+import type { AuthorView } from "./epoch.js";
+export interface SealedRecord {
+    readonly wire: Uint8Array;
+    readonly recordId: Uint8Array;
+    readonly counter: number;
+    readonly kind: RecordKind;
+}
+/** Seal one record under the active epoch. The caller persists the result and the next counter (T6). */
+export declare function sealRecord(input: {
+    readonly streamId: Uint8Array;
+    readonly epoch: number;
+    readonly nextCounter: number;
+    readonly kind: RecordKind;
+    /** The product's event time for the record, carried in the envelope; absent when the kind has none. */
+    readonly eventTime?: bigint | undefined;
+    /** The declared header class of the kind, the one thing the relay sees of it. */
+    readonly headerClass: HeaderClass;
+    readonly payload: Uint8Array;
+    readonly sentAt: bigint;
+    readonly epochKey: Uint8Array;
+    readonly signingSecretKey: Uint8Array;
+    readonly nonce?: Uint8Array;
+}): SealedRecord;
+export interface OpenedRecord {
+    readonly record: Parsed<EncryptedRecord>;
+    readonly recordId: Uint8Array;
+    /** From the envelope: the kind, the event time if the sender gave one, and the payload. */
+    readonly kind: RecordKind;
+    readonly eventTime: bigint | undefined;
+    readonly payload: Uint8Array;
+    /** The record comes from a device of the author that is no longer current: history only. */
+    readonly superseded: boolean;
+}
+/**
+ * Verify and open a record. The author view supplies the certificate for the record's stream
+ * (the current one, or an archived one for history); `epochKeyFor` returns the stored key for
+ * (stream, epoch) or `undefined`, which is `KEY_PENDING`.
+ */
+export declare function openRecordWire(wire: Uint8Array, author: AuthorView, epochKeyFor: (streamId: Uint8Array, epoch: number) => Uint8Array | undefined): OpenedRecord;
+/** (generation, epoch, counter) ordering for the live pin. */
+export interface PinSlot {
+    readonly generation: bigint;
+    readonly epoch: number;
+    readonly counter: number;
+}
+export declare function compareSlots(a: PinSlot, b: PinSlot): number;
+export declare function slotKey(streamId: Uint8Array, epoch: number, counter: number): string;
+//# sourceMappingURL=record.d.ts.map

package/dist/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAKA,OAAO,EAQL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAChC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,uGAAuG;IACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B,GAAG,YAAY,CAWf;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,GAC3E,YAAY,CAUd;AAED,8DAA8D;AAC9D,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI3D;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpF"}