@prjct.app/pi-team 0.6.0 → 0.7.0

package/src/runtime/presence.ts

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+import { leaseExpired, sameLeaseOwner, type Lease } from '../domain/lease.ts';
+import type { Member } from '../domain/member.ts';
+import { LeaseStore } from '../storage/lease-store.ts';
+import { TeamStore } from '../storage/team-store.ts';
+
+export const DEFAULT_PRESENCE_TTL_MS = 30_000;
+
+export type PresenceOwner = {
+  readonly teamId: string;
+  readonly memberId: string;
+  readonly memberGeneration: number;
+  readonly leaseToken: string;
+  readonly leaseGeneration: number;
+};
+
+export class PresenceService {
+  private readonly ttlMs: number;
+  private readonly now: () => number;
+
+  constructor(
+    private readonly teams: TeamStore,
+    private readonly leases: LeaseStore,
+    options: { readonly ttlMs?: number; readonly now?: () => number } = {},
+  ) {
+    this.ttlMs = options.ttlMs ?? DEFAULT_PRESENCE_TTL_MS;
+    this.now = options.now ?? Date.now;
+    if (!Number.isFinite(this.ttlMs) || this.ttlMs <= 0) throw new Error('Invalid presence TTL.');
+  }
+
+  leaseId(memberId: string): string {
+    return `presence-${createHash('sha256').update(memberId).digest('hex')}`;
+  }
+  holderId(memberId: string, generation: number): string {
+    return `member-${createHash('sha256').update(`${memberId}:${generation}`).digest('hex')}`;
+  }
+
+  async acquire(teamId: string, memberId: string, memberGeneration: number): Promise<PresenceOwner> {
+    const lease = await this.leases.acquire({
+      teamId,
+      leaseId: this.leaseId(memberId),
+      kind: 'presence',
+      holderId: this.holderId(memberId, memberGeneration),
+      resourceId: memberId,
+      ttlMs: this.ttlMs,
+    });
+    return {
+      teamId,
+      memberId,
+      memberGeneration,
+      leaseToken: lease.token,
+      leaseGeneration: lease.generation,
+    };
+  }
+
+  async assertOwner(owner: PresenceOwner): Promise<{ readonly member: Member; readonly lease: Lease }> {
+    const [member, lease] = await Promise.all([
+      this.teams.readMember(owner.teamId, owner.memberId),
+      this.leases.read(owner.teamId, this.leaseId(owner.memberId)),
+    ]);
+    if (!member || member.state !== 'active' || member.generation !== owner.memberGeneration ||
+        !lease || lease.kind !== 'presence' || lease.resourceId !== owner.memberId ||
+        lease.holderId !== this.holderId(owner.memberId, owner.memberGeneration) ||
+        !sameLeaseOwner(lease, owner.leaseToken, owner.leaseGeneration) || leaseExpired(lease, this.now())) {
+      throw Object.assign(new Error('Membership ownership has been fenced.'), { code: 'FENCED' });
+    }
+    return { member, lease };
+  }
+
+  async renew(owner: PresenceOwner): Promise<Lease> {
+    await this.assertOwner(owner);
+    return this.leases.renew(
+      owner.teamId,
+      this.leaseId(owner.memberId),
+      this.holderId(owner.memberId, owner.memberGeneration),
+      owner.leaseToken,
+      owner.leaseGeneration,
+      this.ttlMs,
+    );
+  }
+
+  async release(owner: PresenceOwner): Promise<void> {
+    await this.leases.release(
+      owner.teamId,
+      this.leaseId(owner.memberId),
+      this.holderId(owner.memberId, owner.memberGeneration),
+      owner.leaseToken,
+      owner.leaseGeneration,
+    );
+  }
+
+  async online(member: Member): Promise<boolean> {
+    if (member.state !== 'active') return false;
+    const lease = await this.leases.read(member.teamId, this.leaseId(member.memberId));
+    return !!lease && lease.kind === 'presence' && lease.resourceId === member.memberId &&
+      lease.holderId === this.holderId(member.memberId, member.generation) && !leaseExpired(lease, this.now());
+  }
+}

package/src/runtime/purge.ts

@@ -0,0 +1,39 @@
+import { randomUUID } from 'node:crypto';
+import { lstat, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ensurePrivateDirectory, moveAtomic, withStorageLock } from '../storage/atomic.ts';
+import { TeamPaths } from '../storage/paths.ts';
+import { RuntimeStore } from '../supervisor/runtime-store.ts';
+import { TeamStore } from '../storage/team-store.ts';
+
+/** Human-command primitive: permanently remove a fully closed, inactive v2 team. */
+export async function purgeClosedTeam(
+  paths: TeamPaths,
+  teams: TeamStore,
+  runtimes: RuntimeStore,
+  teamId: string,
+): Promise<void> {
+  await withStorageLock(paths.teamLock(teamId), async () => {
+    const team = await teams.read(teamId);
+    if (!team) throw Object.assign(new Error(`Unknown team "${teamId}".`), { code: 'NOT_FOUND' });
+    if (team.state !== 'closed') throw new Error('Only a closed Team can be purged.');
+    const [members, runtimeRecords] = await Promise.all([
+      teams.listMembers(teamId),
+      runtimes.list(teamId),
+    ]);
+    if (members.some(member => member.state !== 'left')) throw new Error('Every member must have left before purge.');
+    if (runtimeRecords.some(runtime => runtime.state !== 'terminated')) throw new Error('Every supervised runtime must be terminated before purge.');
+    await ensurePrivateDirectory(paths.team(teamId), false);
+    for (const child of ['members', 'runtimes', 'inbox', 'receipts', 'leases']) {
+      await ensurePrivateDirectory(join(paths.team(teamId), child), false);
+    }
+    const before = await lstat(paths.team(teamId));
+    const tombstone = join(paths.teams(), `.purge-${teamId}-${randomUUID()}`);
+    await moveAtomic(paths.team(teamId), tombstone);
+    const info = await lstat(tombstone);
+    if (!info.isDirectory() || info.isSymbolicLink() || info.dev !== before.dev || info.ino !== before.ino) {
+      throw new Error('Purge tombstone identity changed.');
+    }
+    await rm(tombstone, { recursive: true });
+  });
+}

package/src/runtime/reconciler.ts

@@ -0,0 +1,112 @@
+import { messageExpired, type Envelope } from '../domain/message.ts';
+import { withStorageLock } from '../storage/atomic.ts';
+import { InboxStore, type InboxPage } from '../storage/inbox-store.ts';
+import { TeamPaths } from '../storage/paths.ts';
+import { ReceiptStore } from '../storage/receipt-store.ts';
+import { TeamStore } from '../storage/team-store.ts';
+import { DeliveryService } from './delivery.ts';
+import { PresenceService } from './presence.ts';
+import { RequestService } from './requests.ts';
+
+export type ReconcileResult = {
+  readonly offlineMembers: number;
+  readonly releasedClaims: number;
+  readonly failedClaims: number;
+  readonly expiredMessages: number;
+  readonly expiredReceipts: number;
+};
+
+export class TeamReconciler {
+  private readonly now: () => number;
+
+  constructor(
+    private readonly paths: TeamPaths,
+    private readonly teams: TeamStore,
+    private readonly inbox: InboxStore,
+    private readonly receipts: ReceiptStore,
+    private readonly presence: PresenceService,
+    private readonly delivery: DeliveryService,
+    private readonly requests: RequestService,
+    now: () => number = Date.now,
+  ) {
+    this.now = now;
+  }
+
+  private async pageAll(load: (cursor?: string) => Promise<InboxPage>, cursor?: string): Promise<readonly Envelope[]> {
+    const page = await load(cursor);
+    return page.nextCursor
+      ? [...page.messages, ...await this.pageAll(load, page.nextCursor)]
+      : page.messages;
+  }
+
+  async reconcile(teamId: string): Promise<ReconcileResult> {
+    return withStorageLock(this.paths.lock(`membership-${teamId}`), async () => {
+      const members = await this.teams.listMembers(teamId);
+      const staleMembers = (await Promise.all(members.map(async member =>
+        member.state === 'active' && !await this.presence.online(member) ? member : undefined)))
+        .filter((member): member is NonNullable<typeof member> => member !== undefined);
+      const timestamp = new Date(this.now()).toISOString();
+      await Promise.all(staleMembers.map(member => this.teams.updateMember(teamId, member.memberId, member.generation, current => ({
+        ...current,
+        state: 'left',
+        leftAt: timestamp,
+        updatedAt: timestamp,
+      }))));
+
+      const claimedByMember = await Promise.all(members.map(async member => ({
+        member,
+        messages: await this.pageAll(cursor => this.inbox.listClaimed(teamId, member.memberId, 100, cursor)),
+      })));
+      const claimed = claimedByMember.flatMap(entry => entry.messages.map(message => ({ member: entry.member, message })));
+      const pendingByMember = await Promise.all(members.map(async member => ({
+        member,
+        messages: await this.pageAll(cursor => this.inbox.listPending(teamId, member.memberId, 100, cursor)),
+      })));
+      const pending = pendingByMember.flatMap(entry => entry.messages);
+      const staleOwners = new Set(staleMembers.map(member => `${member.memberId}:${member.generation}`));
+      const staleRequests = [...claimed.map(entry => entry.message), ...pending]
+        .filter(message => message.kind === 'request' && staleOwners.has(`${message.fromMemberId}:${message.senderGeneration}`));
+      await Promise.all(staleRequests.map(message => this.requests.cancelAbandoned(message)));
+      await Promise.all([
+        ...claimed.map(async entry => {
+          if (entry.message.kind === 'request') await this.requests.repairCancellation(entry.message, 'claimed');
+          if (entry.message.kind === 'reply') await this.requests.repairReplyOutcome(entry.message);
+        }),
+        ...pending.map(async message => {
+          if (message.kind === 'request') await this.requests.repairCancellation(message, 'pending');
+          if (message.kind === 'reply') await this.requests.repairReplyOutcome(message);
+        }),
+      ]);
+      const settled = await Promise.all(claimed.map(entry =>
+        this.delivery.reconcileClaim(teamId, entry.member.memberId, entry.message.messageId)));
+      const expired = pendingByMember.flatMap(entry => entry.messages
+        .filter(message => messageExpired(message, this.now()))
+        .map(message => ({ member: entry.member, message })));
+      await Promise.all(expired.map(async entry => {
+        if (entry.message.kind === 'request') {
+          const receipt = await this.receipts.read(teamId, entry.member.memberId, entry.message.messageId);
+          if (!receipt) {
+            await this.receipts.record({
+              schemaVersion: 2,
+              teamId,
+              messageId: entry.message.messageId,
+              recipientId: entry.member.memberId,
+              status: 'expired',
+              at: timestamp,
+            });
+          }
+        }
+        await this.inbox.removePending(teamId, entry.member.memberId, entry.message.messageId);
+      }));
+      const expiredReceipts = (await Promise.all(members.map(member =>
+        this.receipts.purgeExpired(teamId, member.memberId)))).reduce((sum, count) => sum + count, 0);
+      return {
+        offlineMembers: staleMembers.length,
+        releasedClaims: settled.filter(result => result === 'released').length,
+        failedClaims: settled.filter(result => result === 'failed').length,
+        expiredMessages: expired.length + settled.filter(result => result === 'expired').length,
+        expiredReceipts,
+      };
+    });
+  }
+}

package/src/runtime/requests.ts

@@ -0,0 +1,353 @@
+import { createHash, randomUUID } from 'node:crypto';
+import type { Envelope, MessageKind, Receipt } from '../domain/message.ts';
+import { MAX_MESSAGE_TTL_MS, messageExpired } from '../domain/message.ts';
+import type { RequestState } from '../domain/request.ts';
+import { withStorageLock } from '../storage/atomic.ts';
+import { InboxStore, type InboxPage } from '../storage/inbox-store.ts';
+import { TeamPaths } from '../storage/paths.ts';
+import { ReceiptStore } from '../storage/receipt-store.ts';
+import { TeamStore } from '../storage/team-store.ts';
+import { DeliveryService } from './delivery.ts';
+import { MembershipService, type Membership } from './membership.ts';
+
+const sendKinds = new Set<MessageKind>(['info', 'question', 'proposal', 'handoff', 'blocker', 'request']);
+export type RequestRuntimeState = RequestState | 'failed';
+const terminalRequestStates = new Set<RequestRuntimeState>(['replied', 'cancelled', 'expired', 'failed']);
+
+export type ReplyResult = {
+  readonly accepted: boolean;
+  readonly message?: Envelope;
+  readonly reason?: 'cancelled' | 'expired' | 'failed' | 'sender-replaced';
+};
+
+function errorCode(error: unknown): string | undefined {
+  return (error as { code?: string }).code;
+}
+
+export class RequestService {
+  private readonly now: () => number;
+
+  constructor(
+    private readonly paths: TeamPaths,
+    private readonly teams: TeamStore,
+    private readonly memberships: MembershipService,
+    private readonly delivery: DeliveryService,
+    private readonly inbox: InboxStore,
+    private readonly receipts: ReceiptStore,
+    now: () => number = Date.now,
+  ) {
+    this.now = now;
+  }
+
+  private lockPath(teamId: string, requestId: string): string {
+    return this.paths.lock(`request-${createHash('sha256').update(`${teamId}\0${requestId}`).digest('hex')}`);
+  }
+
+  private async enqueueIdempotently(message: Envelope): Promise<void> {
+    try { await this.inbox.enqueue(message); }
+    catch (error) {
+      if (errorCode(error) !== 'ALREADY_EXISTS') throw error;
+    }
+  }
+
+  private state(receipt: Receipt | undefined, claimed: boolean): RequestRuntimeState {
+    if (!receipt) return claimed ? 'delivered' : 'queued';
+    if (receipt.status === 'delivered') return 'delivered';
+    if (receipt.status === 'read') return 'accepted';
+    if (receipt.status === 'replied') return 'replied';
+    if (receipt.status === 'cancelled') return 'cancelled';
+    if (receipt.status === 'expired') return 'expired';
+    if (receipt.status === 'failed') return 'failed';
+    return 'delivered';
+  }
+
+  async send(membership: Membership, input: {
+    readonly to: string;
+    readonly kind: Exclude<MessageKind, 'reply' | 'cancel'>;
+    readonly body: string;
+    readonly threadId?: string;
+    readonly ttlMs?: number;
+    readonly signal?: AbortSignal;
+  }): Promise<Envelope> {
+    await this.memberships.assertOwner(membership);
+    if (!sendKinds.has(input.kind)) throw new Error('Invalid outbound message kind.');
+    const peer = await this.memberships.resolveAlias(membership, input.to);
+    input.signal?.throwIfAborted();
+    if (peer.memberId === membership.memberId) throw new Error('Cannot send a message to yourself.');
+    const ttlMs = input.ttlMs ?? MAX_MESSAGE_TTL_MS;
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > MAX_MESSAGE_TTL_MS) throw new Error('Invalid message TTL.');
+    const messageId = randomUUID();
+    const timestamp = this.now();
+    const message: Envelope = {
+      schemaVersion: 2,
+      messageId,
+      teamId: membership.teamId,
+      threadId: input.threadId ?? messageId,
+      ...(input.kind === 'request' ? { requestId: messageId } : {}),
+      kind: input.kind,
+      fromMemberId: membership.memberId,
+      toMemberId: peer.memberId,
+      senderGeneration: membership.memberGeneration,
+      ...(peer.status === 'online' ? { recipientGeneration: peer.generation } : {}),
+      createdAt: new Date(timestamp).toISOString(),
+      expiresAt: new Date(timestamp + ttlMs).toISOString(),
+      body: input.body,
+    };
+    input.signal?.throwIfAborted();
+    await this.inbox.enqueue(message);
+    return message;
+  }
+
+  private async pageAll(load: (cursor?: string) => Promise<InboxPage>, cursor?: string): Promise<readonly Envelope[]> {
+    const page = await load(cursor);
+    return page.nextCursor
+      ? [...page.messages, ...await this.pageAll(load, page.nextCursor)]
+      : page.messages;
+  }
+
+  private async findRequest(teamId: string, requestId: string): Promise<{
+    readonly message: Envelope;
+    readonly location: 'pending' | 'claimed';
+  } | undefined> {
+    const members = await this.teams.listMembers(teamId);
+    const matches = await Promise.all(members.map(async member => {
+      const pending = await this.inbox.readPending(teamId, member.memberId, requestId);
+      if (pending) return { message: pending, location: 'pending' as const };
+      const claimed = await this.inbox.readClaimed(teamId, member.memberId, requestId);
+      return claimed ? { message: claimed, location: 'claimed' as const } : undefined;
+    }));
+    return matches.find((match): match is NonNullable<typeof match> => match !== undefined);
+  }
+
+  async requestState(membership: Membership, requestId: string): Promise<RequestRuntimeState> {
+    await this.memberships.assertOwner(membership);
+    const found = await this.findRequest(membership.teamId, requestId);
+    if (found && found.message.kind === 'request' && found.message.fromMemberId === membership.memberId) {
+      const receipt = await this.receipts.read(membership.teamId, found.message.toMemberId, requestId);
+      return this.state(receipt, found.location === 'claimed');
+    }
+    const members = await this.teams.listMembers(membership.teamId);
+    const receipts = await Promise.all(members.map(member =>
+      this.receipts.read(membership.teamId, member.memberId, requestId)));
+    const terminal = receipts.find(receipt => receipt && ['replied', 'cancelled', 'expired', 'failed'].includes(receipt.status));
+    if (terminal) return this.state(terminal, false);
+    throw Object.assign(new Error(`Unknown outgoing request "${requestId}".`), { code: 'NOT_FOUND' });
+  }
+
+  async cancel(membership: Membership, requestId: string, body = 'The sender cancelled this request.'): Promise<boolean> {
+    await this.memberships.assertOwner(membership);
+    return withStorageLock(this.lockPath(membership.teamId, requestId), async () => {
+      await this.memberships.assertOwner(membership);
+      const found = await this.findRequest(membership.teamId, requestId);
+      if (!found || found.message.kind !== 'request' || found.message.fromMemberId !== membership.memberId ||
+          found.message.senderGeneration !== membership.memberGeneration) {
+        throw Object.assign(new Error(`Unknown owned request "${requestId}".`), { code: 'NOT_FOUND' });
+      }
+      const current = await this.receipts.read(membership.teamId, found.message.toMemberId, requestId);
+      const state = this.state(current, found.location === 'claimed');
+      if (terminalRequestStates.has(state)) return false;
+      await this.receipts.record({
+        schemaVersion: 2,
+        teamId: membership.teamId,
+        messageId: requestId,
+        recipientId: found.message.toMemberId,
+        status: 'cancelled',
+        at: new Date(this.now()).toISOString(),
+      });
+      const timestamp = this.now();
+      const cancellation: Envelope = {
+        schemaVersion: 2,
+        messageId: `cancel-${requestId}`,
+        teamId: membership.teamId,
+        threadId: found.message.threadId,
+        requestId,
+        kind: 'cancel',
+        fromMemberId: membership.memberId,
+        toMemberId: found.message.toMemberId,
+        senderGeneration: membership.memberGeneration,
+        recipientGeneration: found.message.recipientGeneration,
+        createdAt: new Date(timestamp).toISOString(),
+        expiresAt: new Date(timestamp + MAX_MESSAGE_TTL_MS).toISOString(),
+        body,
+      };
+      try {
+        await this.enqueueIdempotently(cancellation);
+        if (found.location === 'pending') {
+          await this.inbox.removePending(membership.teamId, found.message.toMemberId, requestId);
+        }
+      } catch (error) {
+        if (!['TEAM_CLOSED', 'QUOTA_EXCEEDED'].includes(errorCode(error) ?? '')) throw error;
+      }
+      return true;
+    });
+  }
+
+  async isCancelled(membership: Membership, requestId: string): Promise<boolean> {
+    await this.memberships.assertOwner(membership);
+    const receipt = await this.receipts.read(membership.teamId, membership.memberId, requestId);
+    return receipt?.status === 'cancelled';
+  }
+
+  async reply(membership: Membership, requestId: string, body: string, signal?: AbortSignal): Promise<ReplyResult> {
+    await this.memberships.assertOwner(membership);
+    return withStorageLock(this.lockPath(membership.teamId, requestId), () =>
+      this.delivery.settle(membership, requestId, async original => {
+        if (original.kind !== 'request' || original.requestId !== requestId) {
+          throw Object.assign(new Error(`Unknown claimed request "${requestId}".`), { code: 'NOT_FOUND' });
+        }
+        const receipt = await this.receipts.read(membership.teamId, membership.memberId, requestId);
+        if (receipt?.status === 'cancelled' || receipt?.status === 'expired' || receipt?.status === 'failed') {
+          return { accepted: false, reason: receipt.status };
+        }
+        if (!receipt || !['delivered', 'read'].includes(receipt.status)) throw new Error('Read the claimed request before replying.');
+        if (messageExpired(original, this.now())) {
+          await this.receipts.record({ ...receipt, status: 'expired', at: new Date(this.now()).toISOString() });
+          return { accepted: false, reason: 'expired' };
+        }
+        const sender = await this.teams.readMember(membership.teamId, original.fromMemberId);
+        if (!sender || sender.state !== 'active' || sender.generation !== original.senderGeneration) {
+          await this.receipts.record({ ...receipt, status: 'failed', at: new Date(this.now()).toISOString() });
+          return { accepted: false, reason: 'sender-replaced' };
+        }
+        signal?.throwIfAborted();
+        const timestamp = this.now();
+        const reply: Envelope = {
+          schemaVersion: 2,
+          messageId: `reply-${requestId}`,
+          teamId: membership.teamId,
+          threadId: original.threadId,
+          requestId,
+          kind: 'reply',
+          fromMemberId: membership.memberId,
+          toMemberId: original.fromMemberId,
+          senderGeneration: membership.memberGeneration,
+          recipientGeneration: original.senderGeneration,
+          createdAt: new Date(timestamp).toISOString(),
+          expiresAt: new Date(timestamp + MAX_MESSAGE_TTL_MS).toISOString(),
+          body,
+        };
+        try { await this.enqueueIdempotently(reply); }
+        catch (error) {
+          if (errorCode(error) !== 'FENCED') throw error;
+          await this.receipts.record({ ...receipt, status: 'failed', at: new Date(this.now()).toISOString() });
+          return { accepted: false, reason: 'sender-replaced' };
+        }
+        await this.receipts.record({ ...receipt, status: 'replied', at: new Date(this.now()).toISOString() });
+        return { accepted: true, message: reply };
+      }));
+  }
+
+  async receive(membership: Membership, messageId: string, signal?: AbortSignal): Promise<{ readonly message?: Envelope; readonly discarded: boolean }> {
+    signal?.throwIfAborted();
+    const pending = await this.inbox.readPending(membership.teamId, membership.memberId, messageId);
+    if (pending) await this.delivery.claim(membership, messageId, signal);
+    return this.read(membership, messageId, signal);
+  }
+
+  async read(membership: Membership, messageId: string, signal?: AbortSignal): Promise<{ readonly message?: Envelope; readonly discarded: boolean }> {
+    const message = await this.delivery.read(membership, messageId, signal);
+    if (message.kind === 'request') return { message, discarded: false };
+    if (message.kind === 'reply' && message.requestId) {
+      const original = await this.receipts.read(membership.teamId, message.fromMemberId, message.requestId);
+      if (original && ['cancelled', 'expired', 'failed'].includes(original.status)) {
+        await this.delivery.fail(membership, messageId);
+        return { discarded: true };
+      }
+    }
+    const receipt = await this.receipts.read(membership.teamId, membership.memberId, messageId);
+    if (receipt && receipt.status === 'read') {
+      await this.receipts.record({ ...receipt, status: 'replied', at: new Date(this.now()).toISOString() });
+    }
+    await this.delivery.finish(membership, messageId);
+    return { message, discarded: false };
+  }
+
+  async cancelAbandoned(original: Envelope): Promise<boolean> {
+    if (original.kind !== 'request' || original.requestId !== original.messageId) return false;
+    return withStorageLock(this.lockPath(original.teamId, original.messageId), async () => {
+      const receipt = await this.receipts.read(original.teamId, original.toMemberId, original.messageId);
+      if (receipt && ['replied', 'cancelled', 'expired', 'failed'].includes(receipt.status)) return false;
+      await this.receipts.record(receipt ? {
+        ...receipt,
+        status: 'cancelled',
+        at: new Date(this.now()).toISOString(),
+      } : {
+        schemaVersion: 2,
+        teamId: original.teamId,
+        messageId: original.messageId,
+        recipientId: original.toMemberId,
+        status: 'cancelled',
+        at: new Date(this.now()).toISOString(),
+      });
+      return true;
+    });
+  }
+
+  async repairCancellation(original: Envelope, location: 'pending' | 'claimed'): Promise<boolean> {
+    if (original.kind !== 'request' || original.requestId !== original.messageId) return false;
+    return withStorageLock(this.lockPath(original.teamId, original.messageId), async () => {
+      const receipt = await this.receipts.read(original.teamId, original.toMemberId, original.messageId);
+      if (receipt?.status !== 'cancelled') return false;
+      const timestamp = this.now();
+      const cancellation: Envelope = {
+        schemaVersion: 2,
+        messageId: `cancel-${original.messageId}`,
+        teamId: original.teamId,
+        threadId: original.threadId,
+        requestId: original.messageId,
+        kind: 'cancel',
+        fromMemberId: original.fromMemberId,
+        toMemberId: original.toMemberId,
+        senderGeneration: original.senderGeneration,
+        recipientGeneration: original.recipientGeneration,
+        createdAt: new Date(timestamp).toISOString(),
+        expiresAt: new Date(timestamp + MAX_MESSAGE_TTL_MS).toISOString(),
+        body: 'The sender cancelled this request.',
+      };
+      try {
+        await this.enqueueIdempotently(cancellation);
+        if (location === 'pending') {
+          await this.inbox.removePending(original.teamId, original.toMemberId, original.messageId);
+        }
+        return true;
+      } catch (error) {
+        if (['TEAM_CLOSED', 'QUOTA_EXCEEDED', 'FENCED'].includes(errorCode(error) ?? '')) return false;
+        throw error;
+      }
+    });
+  }
+
+  async repairReplyOutcome(reply: Envelope): Promise<boolean> {
+    if (reply.kind !== 'reply' || !reply.requestId) return false;
+    return withStorageLock(this.lockPath(reply.teamId, reply.requestId), async () => {
+      const original = await this.inbox.readClaimed(reply.teamId, reply.fromMemberId, reply.requestId!);
+      if (!original || original.kind !== 'request' || original.fromMemberId !== reply.toMemberId ||
+          original.toMemberId !== reply.fromMemberId || original.threadId !== reply.threadId) return false;
+      const receipt = await this.receipts.read(reply.teamId, reply.fromMemberId, reply.requestId!);
+      if (!receipt || !['delivered', 'read'].includes(receipt.status)) return false;
+      await this.receipts.record({ ...receipt, status: 'replied', at: new Date(this.now()).toISOString() });
+      return true;
+    });
+  }
+
+  async leave(membership: Membership): Promise<number> {
+    const cancelled = await this.cancelOutgoing(membership);
+    await this.memberships.leave(membership);
+    return cancelled;
+  }
+
+  async cancelOutgoing(membership: Membership): Promise<number> {
+    await this.memberships.assertOwner(membership);
+    const members = await this.teams.listMembers(membership.teamId);
+    const mail = (await Promise.all(members.map(async member => [
+      ...await this.pageAll(cursor => this.inbox.listPending(membership.teamId, member.memberId, 100, cursor)),
+      ...await this.pageAll(cursor => this.inbox.listClaimed(membership.teamId, member.memberId, 100, cursor)),
+    ]))).flat();
+    const requests = mail.filter(message => message.kind === 'request' && message.fromMemberId === membership.memberId &&
+      message.senderGeneration === membership.memberGeneration && message.requestId === message.messageId);
+    const outcomes = await Promise.allSettled(requests.map(request => this.cancel(membership, request.messageId)));
+    const failures = outcomes.filter((outcome): outcome is PromiseRejectedResult => outcome.status === 'rejected');
+    if (failures.length > 0) throw new AggregateError(failures.map(failure => failure.reason), 'Some outgoing requests could not be cancelled.');
+    return outcomes.filter(outcome => outcome.status === 'fulfilled' && outcome.value).length;
+  }
+}