@real-life/trust-protocol 0.3.1 → 0.4.0

package/dist/prompts.js

@@ -0,0 +1,69 @@
+import { handlerPrepared } from './receive.js';
+/** The command name of the decision. */
+export const DECIDE = 'prompt.decide';
+const KINDS = ['encounter-confirm', 'group-invite', 'introduction'];
+/** The decision handlers of the modules, one per kind at most. */
+export function collectDecisions(modules) {
+    const out = new Map();
+    for (const m of modules) {
+        for (const [kind, h] of Object.entries(m?.decisions ?? {})) {
+            if (!KINDS.includes(kind))
+                throw new Error(`unknown prompt kind ${kind} (module ${m.name})`);
+            if (out.has(kind))
+                throw new Error(`duplicate decision handler ${kind} (module ${m.name})`);
+            if (typeof h !== 'function' && (h === null || typeof h !== 'object' || typeof h.apply !== 'function' || (h.prepare !== undefined && typeof h.prepare !== 'function'))) {
+                throw new TypeError(`decision handler ${kind} (module ${m.name}) must be a function or {prepare?, apply}`);
+            }
+            out.set(kind, h);
+        }
+    }
+    return out;
+}
+const validInput = (input) => input !== null && typeof input === 'object' && typeof input.promptId === 'string' && (input.choice === 'accept' || input.choice === 'decline');
+const decideDef = (decisions) => ({
+    human: true,
+    // a prepared handler's preparation, against the snapshot apply sees;
+    // nothing for an unknown, expired or malformed decision (apply answers it)
+    async prepare(ctx, input) {
+        if (!validInput(input) || !Object.hasOwn(ctx.snapshot.prompts, input.promptId))
+            return undefined;
+        const p = ctx.snapshot.prompts[input.promptId];
+        if (p.expiresAt !== undefined && p.expiresAt <= ctx.when)
+            return undefined;
+        const h = decisions.get(p.kind);
+        return h && typeof h !== 'function' && h.prepare ? h.prepare(ctx, p, input.choice) : undefined;
+    },
+    apply(state, prepared, input, when) {
+        if (input === null || typeof input !== 'object' || typeof input.promptId !== 'string')
+            throw new TypeError('prompt.decide needs {promptId: string, choice}');
+        if (input.choice !== 'accept' && input.choice !== 'decline')
+            throw new TypeError(`prompt.decide: choice must be accept or decline, got ${String(input.choice)}`);
+        const { promptId, choice } = input;
+        if (!Object.hasOwn(state.prompts, promptId))
+            return { ok: false, code: 'unknown-prompt' };
+        const p = state.prompts[promptId];
+        if (p.expiresAt !== undefined && p.expiresAt <= when)
+            return { ok: false, code: 'prompt-expired' };
+        const handler = decisions.get(p.kind);
+        const r = !handler ? { state: state }
+            : typeof handler === 'function' ? handler(state, p, choice, when)
+                : handler.apply(state, p, choice, when, handlerPrepared(prepared, prepared.value));
+        if (r.ok === false)
+            return r;
+        const done = r;
+        const prompts = { ...done.state.prompts };
+        delete prompts[promptId];
+        const decided = { type: 'prompt.decided', promptId, kind: p.kind, choice };
+        return {
+            state: { ...done.state, prompts },
+            ...(done.outbound ? { outbound: done.outbound } : {}),
+            ...(done.duties ? { duties: done.duties } : {}),
+            events: [...(done.events ?? []), decided],
+        };
+    },
+});
+/** The prompts module createHolder registers, over the modules' decision handlers. */
+export function promptsModule(decisions = new Map()) {
+    return Object.freeze({ name: 'prompts', commands: Object.freeze({ [DECIDE]: decideDef(decisions) }) });
+}
+//# sourceMappingURL=prompts.js.map

package/dist/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAG9C,wCAAwC;AACxC,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CAAA;AAIrC,MAAM,KAAK,GAA0B,CAAC,mBAAmB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;AAI1F,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAE,OAAgC;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+B,CAAA;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YACnH,IAAI,GAAG,CAAC,GAAG,CAAC,IAAkB,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YACzG,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAiB,CAAC,KAAK,KAAK,UAAU,IAAI,CAAE,CAAiB,CAAC,OAAO,KAAK,SAAS,IAAI,OAAQ,CAAiB,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC;gBACzN,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,YAAY,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAA;YAC5G,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,IAAkB,EAAE,CAAC,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAW,EAAE,CACjD,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;AAEhJ,MAAM,SAAS,GAAG,CAAC,SAAoB,EAAoC,EAAE,CAAC,CAAC;IAC7E,KAAK,EAAE,IAAI;IACX,qEAAqE;IACrE,2EAA2E;IAC3E,KAAK,CAAC,OAAO,CAAE,GAAG,EAAE,KAAK;QACvB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAA;QAChG,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC9C,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,SAAS,CAAA;QAC1E,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAChG,CAAC;IACD,KAAK,CAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI;QACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;QAC5J,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,wDAAwD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;QACzF,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;QAClG,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,GAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAoB,EAAE;YACrE,CAAC,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC;gBAC/D,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACtF,IAAK,CAAa,CAAC,EAAE,KAAK,KAAK;YAAE,OAAO,CAAY,CAAA;QACpD,MAAM,IAAI,GAAG,CAAY,CAAA;QACzB,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACzC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;QACxB,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;QACtF,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC;SAC1C,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAE,YAAuB,IAAI,GAAG,EAAE;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AACxG,CAAC","sourcesContent":["// prompts — the human's open decisions and the act that closes them\n// (lib Stage 2, note §2.1 prompts, §4.4, §4.5).\n//\n// Domain modules open prompts (encounter-confirm, group-invite,\n// introduction) inside their own transitions and announce prompt.opened;\n// this module closes them. `prompt.decide` is one human act (journaled\n// under the app's actId). createHolder registers this module beside the\n// domain modules, so its command name is taken.\n//\n// What a choice does in its domain (joining the group, confirming the\n// encounter, accepting the introduction) belongs to the module that opens\n// that kind of prompt: it registers a DecisionHandler for the kind\n// (HolderModule.decisions). The decision runs that handler in its own\n// transition, so the domain effect, its outbound and duties, and the\n// closing of the prompt commit together or not at all; a handler's\n// refusal refuses the decision. A kind without a handler is only closed.\n// The events are the handler's, then prompt.decided. At most one handler\n// per kind across all modules; a second, an unknown kind or a handler\n// that is no function throws when the holder is built.\n//\n// Expiry: a prompt with expiresAt <= when is refused as prompt-expired;\n// the refusal commits nothing, so the prompt stays until tick removes it\n// (engine.ts, built-in tick). An id without an open prompt is\n// unknown-prompt. A malformed input (a promptId that is no string, a\n// choice other than accept or decline) is a programming error and throws.\n//\n// A handler that signs or seals (PR 7: the counter-step, the membership\n// accept, the introduction's consent) is the prepared form {prepare?,\n// apply}: its preparation runs in the decision's own preparation, against\n// the snapshot its apply then sees (engine.ts, step 2).\nimport type { Applied, CommandDef, DecisionDef, DecisionHandler, EventDraft, HolderModule, Refusal } from './engine.js'\nimport { handlerPrepared } from './receive.js'\nimport type { HolderState, PromptChoice, PromptKind } from './state.js'\n\n/** The command name of the decision. */\nexport const DECIDE = 'prompt.decide'\n\nexport interface DecideInput { promptId: string, choice: PromptChoice }\n\nconst KINDS: readonly PromptKind[] = ['encounter-confirm', 'group-invite', 'introduction']\n\nexport type Decisions = ReadonlyMap<PromptKind, DecisionHandler>\n\n/** The decision handlers of the modules, one per kind at most. */\nexport function collectDecisions (modules: readonly HolderModule[]): Decisions {\n  const out = new Map<PromptKind, DecisionHandler>()\n  for (const m of modules) {\n    for (const [kind, h] of Object.entries(m?.decisions ?? {})) {\n      if (!(KINDS as readonly string[]).includes(kind)) throw new Error(`unknown prompt kind ${kind} (module ${m.name})`)\n      if (out.has(kind as PromptKind)) throw new Error(`duplicate decision handler ${kind} (module ${m.name})`)\n      if (typeof h !== 'function' && (h === null || typeof h !== 'object' || typeof (h as DecisionDef).apply !== 'function' || ((h as DecisionDef).prepare !== undefined && typeof (h as DecisionDef).prepare !== 'function'))) {\n        throw new TypeError(`decision handler ${kind} (module ${m.name}) must be a function or {prepare?, apply}`)\n      }\n      out.set(kind as PromptKind, h)\n    }\n  }\n  return out\n}\n\nconst validInput = (input: DecideInput): boolean =>\n  input !== null && typeof input === 'object' && typeof input.promptId === 'string' && (input.choice === 'accept' || input.choice === 'decline')\n\nconst decideDef = (decisions: Decisions): CommandDef<DecideInput, unknown> => ({\n  human: true,\n  // a prepared handler's preparation, against the snapshot apply sees;\n  // nothing for an unknown, expired or malformed decision (apply answers it)\n  async prepare (ctx, input) {\n    if (!validInput(input) || !Object.hasOwn(ctx.snapshot.prompts, input.promptId)) return undefined\n    const p = ctx.snapshot.prompts[input.promptId]\n    if (p.expiresAt !== undefined && p.expiresAt <= ctx.when) return undefined\n    const h = decisions.get(p.kind)\n    return h && typeof h !== 'function' && h.prepare ? h.prepare(ctx, p, input.choice) : undefined\n  },\n  apply (state, prepared, input, when) {\n    if (input === null || typeof input !== 'object' || typeof input.promptId !== 'string') throw new TypeError('prompt.decide needs {promptId: string, choice}')\n    if (input.choice !== 'accept' && input.choice !== 'decline') throw new TypeError(`prompt.decide: choice must be accept or decline, got ${String(input.choice)}`)\n    const { promptId, choice } = input\n    if (!Object.hasOwn(state.prompts, promptId)) return { ok: false, code: 'unknown-prompt' }\n    const p = state.prompts[promptId]\n    if (p.expiresAt !== undefined && p.expiresAt <= when) return { ok: false, code: 'prompt-expired' }\n    const handler = decisions.get(p.kind)\n    const r: Applied | Refusal = !handler ? { state: state as HolderState }\n      : typeof handler === 'function' ? handler(state, p, choice, when)\n        : handler.apply(state, p, choice, when, handlerPrepared(prepared, prepared.value))\n    if ((r as Refusal).ok === false) return r as Refusal\n    const done = r as Applied\n    const prompts = { ...done.state.prompts }\n    delete prompts[promptId]\n    const decided: EventDraft = { type: 'prompt.decided', promptId, kind: p.kind, choice }\n    return {\n      state: { ...done.state, prompts },\n      ...(done.outbound ? { outbound: done.outbound } : {}),\n      ...(done.duties ? { duties: done.duties } : {}),\n      events: [...(done.events ?? []), decided],\n    }\n  },\n})\n\n/** The prompts module createHolder registers, over the modules' decision handlers. */\nexport function promptsModule (decisions: Decisions = new Map()): HolderModule {\n  return Object.freeze({ name: 'prompts', commands: Object.freeze({ [DECIDE]: decideDef(decisions) }) })\n}\n"]}

package/dist/receive.d.ts

@@ -0,0 +1,133 @@
+import type { Json } from './core.js';
+import type { HolderState, Millis, Relationship, StoredAck, Tuple } from './state.js';
+/** An ack as sealed in the preparation; the engine adds its schedule. */
+export type SealedAck = Pick<StoredAck, 'digest' | 'envelope' | 'threadId' | 'recipient'>;
+import type { Outbound } from './ports.js';
+import type { ReceiveResult } from './results.js';
+import type { EventDraft, PrepareCtx, Prepared } from './engine.js';
+/** Where and when a document arrived: the own rkid it was sealed to, its
+ *  thread, its digest and the receive's `when`. */
+export interface Arrival {
+    rkid: string;
+    threadId: string;
+    digest: string;
+    when: Millis;
+}
+/** Why a task handler refuses a document; the stage follows from where:
+ *  decode 'malformed' → 7, decode or prepare otherwise → 8, apply → 9. */
+export type TaskFailure = 'malformed' | 'validation-failed' | 'stale-issuance' | 'gate-future' | 'consumed-challenge';
+/** A handler's refusal: nothing commits, the digest stays uncached and
+ *  a redelivery is evaluated afresh (Delivery 6.2 stage 4) — with one
+ *  narrow, enumerated exception, the Encounter aging latch: an apply that
+ *  refuses because its authoritative resolution found an own challenge past
+ *  its age bound (Encounter 5260, 5270, 5290; Delivery 4.1 check 5) returns
+ *  `latch`, the state with that challenge removed, and the engine commits
+ *  exactly it (and the raised lastWhen): no cache entry, no ack, no event;
+ *  the disposition stays failed. A latch that touches anything beyond
+ *  encounter.challenges is a programming error and throws (engine.ts). */
+export interface TaskRefusal {
+    ok: false;
+    reason: TaskFailure;
+    ref?: string;
+    latch?: HolderState;
+}
+/** A discard at a resource limit (Trust 5365/5366), answered by apply:
+ *  `state` commits (assembly dropped, lower bound held), the disposition
+ *  is `discarded`, with no cache entry, no ack and no event. */
+export interface TaskDiscarded {
+    discarded: true;
+    reason: DiscardReason;
+    state: HolderState;
+    ref?: string;
+}
+/** Why an assembly was discarded: a local resource limit (5365), or an
+ *  authenticated violation of the assembly rules that rejects the delivery. */
+export type DiscardReason = 'resource-limit' | 'rejected';
+export declare const isTaskDiscarded: (x: unknown) => x is TaskDiscarded;
+/** A received document after stage 7: the profile fields, its payload
+ *  as the handler's decode returned it. Read-only. */
+export interface ReceivedDocument<T = unknown> {
+    readonly id: string;
+    readonly type: string;
+    readonly issuer: string;
+    readonly recipient: string;
+    readonly threadId: string;
+    readonly issuedAt: string;
+    readonly payload: T;
+    readonly ceremony?: Json;
+    readonly proof?: Json;
+}
+/** A sealed ack as the outbound the app sends, at the given attempt. */
+export declare const ackOutbound: (a: Readonly<SealedAck>, attempt: number) => Outbound;
+/** Signature-class types (Delivery 4.2/4.4): payloads whose authenticity
+ *  is a transferable signature; their acks are signed, not MACed. The
+ *  `x-` slugs are this library's own experimental, unregistered forms
+ *  for what the specifications leave to the application (the membership
+ *  prelude, Membership 1.2; the welcome until the Access envelope is
+ *  built; the introduction offer that conveys the target designator,
+ *  Trust 8.3): signed documents as well. A receiver that does not know
+ *  them answers unknown-type (Delivery §6.2). */
+export declare const SIGNATURE_CLASS: ReadonlySet<string>;
+/** The counterpart a `channel` binding names: the key agreement the ack
+ *  is sealed to and the contact it is filed under. */
+/** The binding a document arrives under: the counterpart's key and the
+ *  contact; `via`, where the arrival key is no tuple's (a member key), the
+ *  own rkid of the tuple the contact was named through (Recipient.via). */
+export interface Channel {
+    keyAgreement: string;
+    contactId: string;
+    via?: string;
+}
+export declare const isTaskRefusal: (x: unknown) => x is TaskRefusal;
+type Failed = Extract<ReceiveResult, {
+    disposition: 'failed';
+}>;
+/** What stages 1–8 decided, bound to the snapshot they ran against. */
+export type ReceivePlan = {
+    kind: 'failed';
+    result: Failed;
+} | {
+    kind: 'duplicate';
+    digest: string;
+} | {
+    kind: 'ack';
+    digest: string;
+    ref: string;
+} | {
+    kind: 'task';
+    digest: string;
+    type: string;
+    doc: ReceivedDocument;
+    arrival: Arrival;
+    value: unknown;
+    ack: SealedAck;
+};
+/** The handler surface the core needs (engine.ts TaskHandler). */
+export interface TaskEntry {
+    proof: 'absent' | 'required';
+    decode(payload: unknown): unknown;
+    channel?(state: Readonly<HolderState>, doc: ReceivedDocument, rkid: string): Channel | TaskRefusal;
+    /** may arrive on a deactivated tuple an act pinned (engine TaskHandler) */
+    pinned?: true;
+    prepare?(ctx: PrepareCtx, doc: ReceivedDocument, arrival: Arrival): Promise<unknown>;
+}
+/** The tuple whose own rkid is `rkid`, with its relationship. */
+export declare function tupleByRkid(state: Readonly<HolderState>, rkid: string): {
+    rel: Relationship;
+    tuple: Tuple;
+} | null;
+/**
+ * Stages 1–8 against the preparation's snapshot. Never throws for
+ * anything the envelope carries; port failures surface as InfraError.
+ */
+export declare function prepareReceive(ctx: PrepareCtx, env: unknown, tasks: ReadonlyMap<string, TaskEntry>): Promise<ReceivePlan>;
+/** The outbox after a valid ack of `ref` (4.2, 6.1): delivered, late after
+ *  failed; unchanged when already delivered. Shared with report(). */
+export declare function markDelivered(state: Readonly<HolderState>, ref: string, when: Millis): {
+    outbox: HolderState['outbox'];
+    event: EventDraft | null;
+};
+/** Prepared for a handler: its own value under the receive's binding. */
+export declare const handlerPrepared: <P>(p: Prepared<unknown>, value: P) => Prepared<P>;
+export {};
+//# sourceMappingURL=receive.d.ts.map

package/dist/receive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.d.ts","sourceRoot":"","sources":["../src/receive.ts"],"names":[],"mappings":"AAiGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAQrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAc,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEjG,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,CAAA;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C,OAAO,KAAK,EAAkB,aAAa,EAAkB,MAAM,cAAc,CAAA;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAInE;mDACmD;AACnD,MAAM,WAAW,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAEzF;0EAC0E;AAC1E,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,aAAa,GAAG,oBAAoB,CAAA;AAErH;;;;;;;;0EAQ0E;AAC1E,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE;AAElG;;gEAEgE;AAChE,MAAM,WAAW,aAAa;IAAG,SAAS,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;AAE3G;+EAC+E;AAC/E,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,UAAU,CAAA;AAEzD,eAAO,MAAM,eAAe,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,aAC8B,CAAA;AAEhF;sDACsD;AACtD,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAA;CACtB;AAED,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,KAAG,QAC8D,CAAA;AAGpI;;;;;;;iDAOiD;AACjD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAe9C,CAAA;AAEF;sDACsD;AACtD;;2EAE2E;AAC3E,MAAM,WAAW,OAAO;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;AAElF,eAAO,MAAM,aAAa,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,WACyE,CAAA;AAIzH,KAAK,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAA;AAE/D,uEAAuE;AACvE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,CAAA;AAE3H,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAA;IAC5B,MAAM,CAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAA;IAClC,OAAO,CAAC,CAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;IACnG,2EAA2E;IAC3E,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,OAAO,CAAC,CAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtF;AAUD,iEAAiE;AACjE,wBAAgB,WAAW,CAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG,IAAI,CAMnH;AAYD;;;GAGG;AACH,wBAAsB,cAAc,CAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CA8FhI;AAED;sEACsE;AACtE,wBAAgB,aAAa,CAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,CASnJ;AAED,yEAAyE;AACzE,eAAO,MAAM,eAAe,GAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,CAAC,CACR,CAAA"}

package/dist/receive.js

@@ -0,0 +1,298 @@
+// receive — the holder's receive core (lib Stage 2, note §4.3; Delivery
+// §6.2, §4.2, §4.4). The engine runs it as its built-in `receive`: the
+// preparation (async) walks stages 1–8, the transition (sync) is stage 9.
+//
+//   1–4  once, here, through delivery.receiveByAgreement: the key agreement
+//        is the KeyProvider's `agree` under the engine's release from
+//        `addresses` (a tombstone answers retired: stage 3; an rkid never
+//        issued answers unknown: stage 2); the completed-effect cache is
+//        `state.effects`
+//   5    the document profile (schema, calendar-valid issuedAt) and
+//        recipient = the own anchor of the label the arrival rkid derives
+//        under (addresses)
+//   6    dispatch by the full type URI with version: the built-in
+//        delivery-ack path, else the task register, else unknown-type;
+//        then the entry's proof declaration. Delivery §3 wants `proof`
+//        absent on every type but delivery-ack and registry-declaration,
+//        and §4.4 puts the declaration into the registry entry; the
+//        profile schema can name only the types it knows, so for
+//        companion types the rule is enforced here, the earliest stage at
+//        which the receiver holds the entry: a mismatch is
+//        failed(validation-failed)
+//   7–8  the handler's decode (malformed at 7, any other refusal at 8),
+//        the core's closed acceptance binding (Delivery 4.4: the arrival
+//        tuple is selected by rkid, the document's issuer is its
+//        counterpart anchor), the handler's prepare, and the ack: sealed
+//        here, before the transaction, from fresh entropy
+//   9    the handler's apply; the core files the effect-cache entry with
+//        the ack in the same commit (the handler never writes `effects`)
+//        and hands the ack out first among the outbound
+//
+// Acks (delivery-ack/0.1) are no registered task: one common path checks
+// the form (ack.ts macAckForm), then the consistency of 4.2 against the
+// outbox — `ref` is a document this holder sent on that thread, on the
+// arrival tuple (outbox item rkid = arrival rkid), the issuer is that
+// tuple's counterpart, the referenced document's type is of the
+// designated-verifier class (a MAC ack of a signature-class document is
+// the wrong class), and the MAC verifies under the arrival tuple's ack
+// key. A valid ack marks the item delivered (late after failed) and
+// earns a terminal cache entry, no ack of its own.
+//
+// The stage-9 lock set (Delivery 6.2): the engine serializes every
+// operation of a holder in one queue and commits by CAS — a strictly
+// stronger serialization than the lock set asks for (it holds every key
+// of the holder, not only the overlapping ones), which is how this
+// library implements it under Stage 2's one-writer contract. The lock set
+// — the digest, and for star and group-star chunks additionally the
+// assembly key (tuple, type, salt) of 4.4 — is held for the whole
+// evaluation; a CAS conflict re-reads and re-enters at stage 1, which
+// re-checks the cache at stage 4. The chunk types (trust/star.ts,
+// trust/group-star.ts, PR 4b) need no key of their own here: every
+// chunk of one tuple and type is evaluated against, and committed over,
+// the one state version its preparation read, so the completing chunk's
+// effect (validated assembly, accepted snapshot, completed-salt advance)
+// commits with the cache entry and the ack in one transaction.
+//
+// A refusal (TaskRefusal) never commits anything, at any stage.
+//
+// A handler's apply may answer a TaskDiscarded: the receiver discarded an
+// open assembly and holds its salt as the lower bound (5366), for one of
+// two reasons: `resource-limit` (Trust 5365), or `rejected` — an
+// authenticated chunk (its MAC verified) violates the assembly rules
+// (5260–5310, 5500, 5510), and the spec rejects the whole delivery, so it
+// must not complete from any later chunk. That is a spec-mandated state
+// effect, not a failure of the document: its state commits and the result
+// is the disposition `discarded` with the reason and the rule — no
+// effect-cache entry (a redelivery is evaluated afresh and meets the lower
+// bound), no ack (the delivery must not complete), no event; the completed
+// high-water mark stays. A chunk that does not authenticate is a plain
+// refusal and touches nothing. DELIVERY GAP: Delivery §6.2 names no
+// disposition for a document whose processing ends in such a discard;
+// `discarded` (both reasons) is this library's, to be registered in
+// Delivery 0.82.
+//
+// A verified ack runs the ack handler a module registered for the
+// acknowledged item's type, in the ack's transaction (engine.ts
+// AckHandler): the sender side of 5660, completion by verified acks only.
+//
+// Ack class (4.4): the class follows the payload's audience class. The
+// types of SIGNATURE_CLASS carry transferable signatures (the encounter
+// carriers, the membership documents, the signed introduction artifacts,
+// the registry declaration): their ack is SIGNED, an eddsa-jcs-2022 proof
+// under the ack's issuer anchor through the KeyProvider (`sign` with the
+// arrival key's label). Every other type is designated-verifier and earns
+// the MAC form under the channel ack key of the arrival rkid and the
+// counterpart key. A received ack is checked in the form its referenced
+// outbox item's class selects; the other form is validation-failed.
+//
+// The acceptance binding before a tuple exists (PR 7): a handler with a
+// `channel` binds its document itself, from the document, where it may
+// arrive on an own key no tuple carries yet — the encounter bundle on the
+// displayed card's key (Delivery 4.1: the bundle establishes the tuple,
+// its issuer bound to card.anchor = credential.issuer), the membership
+// documents on member keys (Membership 3.1, 3.2). `channel` names the
+// counterpart's key agreement the ack is sealed to and the contact it is
+// filed under, or refuses (stage 7 for malformed, else 8). Every other
+// handler keeps the tuple binding of Delivery 4.4.
+import { calOK, iso, makeValidator, toU } from './core.js';
+import { diSignWith, diVerify, digestDoc, xRawOfMk } from './crypto.js';
+import { receiveByAgreement, seal } from './delivery.js';
+import { ACK_TYPE, ackDocument, ackKeyOf, ackProofForm, macAck, macAckForm, macAckValid, signedAckForm } from './ack.js';
+import { SCHEMAS } from './schemas.js';
+import { triasOf } from './state.js';
+import { entryOf, liveRel } from './trust/state.js';
+import { InfraError } from './results.js';
+export const isTaskDiscarded = (x) => x !== null && typeof x === 'object' && x.discarded === true;
+/** A sealed ack as the outbound the app sends, at the given attempt. */
+export const ackOutbound = (a, attempt) => structuredClone({ digest: a.digest, envelope: a.envelope, type: ACK_TYPE, threadId: a.threadId, recipient: a.recipient, attempt });
+const TT = 'https://real-life.org/trust-tasks/';
+/** Signature-class types (Delivery 4.2/4.4): payloads whose authenticity
+ *  is a transferable signature; their acks are signed, not MACed. The
+ *  `x-` slugs are this library's own experimental, unregistered forms
+ *  for what the specifications leave to the application (the membership
+ *  prelude, Membership 1.2; the welcome until the Access envelope is
+ *  built; the introduction offer that conveys the target designator,
+ *  Trust 8.3): signed documents as well. A receiver that does not know
+ *  them answers unknown-type (Delivery §6.2). */
+export const SIGNATURE_CLASS = new Set([
+    TT + 'encounter-bundle/0.1',
+    TT + 'encounter-credential-delivery/0.1',
+    TT + 'membership-invite/0.2',
+    TT + 'membership-accept/0.2',
+    TT + 'membership-evidence/0.1',
+    TT + 'membership-evidence/0.2',
+    TT + 'registry-declaration/0.1',
+    TT + 'introduction-request/0.1',
+    TT + 'introduction-forward/0.1',
+    TT + 'introduction-reply/0.1',
+    TT + 'x-membership-prelude-request/0.1',
+    TT + 'x-membership-prelude-reply/0.1',
+    TT + 'x-membership-welcome/0.1',
+    TT + 'x-introduction-offer/0.1',
+]);
+export const isTaskRefusal = (x) => x !== null && typeof x === 'object' && x.ok === false && typeof x.reason === 'string';
+const V = makeValidator(SCHEMAS);
+const profileOk = (doc) => V.validate(doc, SCHEMAS['rltp-delivery-document.schema.json'], SCHEMAS['rltp-delivery-document.schema.json']).length === 0 &&
+    calOK(doc.issuedAt);
+const failed = (reason, stage, extra = {}) => ({ kind: 'failed', result: { disposition: 'failed', reason, stage, ...extra } });
+/** The tuple whose own rkid is `rkid`, with its relationship. */
+export function tupleByRkid(state, rkid) {
+    for (const id of Object.keys(state.relationships).sort()) {
+        const rel = state.relationships[id];
+        for (const tuple of rel.tuples)
+            if (tuple.rkid === rkid)
+                return { rel, tuple };
+    }
+    return null;
+}
+/** The arrival channel's ack key (4.2): X25519 of the own key behind
+ *  `rkid` and the counterpart key, HKDF under issuer/recipient. */
+async function ackKey(ctx, rkid, counterpartKeyAgreement, issuer, recipient) {
+    const raw = xRawOfMk(counterpartKeyAgreement);
+    if (!raw)
+        return null;
+    const a = await ctx.keys.agree(rkid, raw, ctx.release);
+    if (a.status !== 'available')
+        return null;
+    try {
+        return await ackKeyOf(a.shared, issuer, recipient, ctx.crypto.subtle);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Stages 1–8 against the preparation's snapshot. Never throws for
+ * anything the envelope carries; port failures surface as InfraError.
+ */
+export async function prepareReceive(ctx, env, tasks) {
+    const S = ctx.crypto.subtle;
+    const state = ctx.snapshot;
+    // 1–4
+    const agree = (rkid, epk) => ctx.keys.agree(rkid, epk, ctx.release);
+    const r = await receiveByAgreement(env, agree, (d) => Object.hasOwn(state.effects, d), S);
+    if (r.disposition === 'duplicate-known')
+        return { kind: 'duplicate', digest: r.digest };
+    if (r.disposition !== 'unique') {
+        const stage = r.stages[r.stages.length - 1].stage;
+        const reason = r.disposition.slice('failed('.length, -1);
+        return failed(reason, stage, r.key ? { key: r.key } : {});
+    }
+    const doc = r.document;
+    const digest = r.digest;
+    const rkid = env.rkid;
+    // 5 — profile, then recipient = own anchor under the arrival key's label
+    if (!profileOk(doc))
+        return failed('malformed', 5, { digest });
+    const release = ctx.release(rkid);
+    if (release.status !== 'live')
+        throw new InfraError('key-provider', 'agree answered for an rkid the release does not hold live');
+    const own = await ctx.keys.anchorOf(release.label);
+    if (doc.recipient !== own.anchor)
+        return failed('wrong-recipient', 5, { digest });
+    const at = tupleByRkid(state, rkid);
+    // 6 — the built-in ack path, in the form the acked document's class selects
+    if (doc.type === ACK_TYPE) {
+        const signed = ackProofForm(doc) === 'signed';
+        const f = signed ? signedAckForm(doc) : macAckForm(doc);
+        if (!f.ok)
+            return failed(f.reason, f.stage, { digest });
+        // 8 — consistency against what this holder sent (4.2): the document on
+        // that thread, sent from the arrival rkid, of the class the proof form
+        // claims; the issuer its recipient (the tuple's counterpart, or the
+        // anchor it went to where no tuple carried it)
+        // the ref in either rendering (u or z, 4.2) names the outbox item by its digest bytes
+        const ref = toU(f.ref) ?? f.ref;
+        const item = Object.hasOwn(state.outbox, ref) ? state.outbox[ref] : undefined;
+        if (!item || item.threadId !== f.threadId || item.recipient.rkid !== rkid || SIGNATURE_CLASS.has(item.type) !== signed)
+            return failed('validation-failed', 8, { digest });
+        const expected = at ? at.tuple.counterpartAnchor : item.recipient.anchor;
+        if (expected === undefined || doc.issuer !== expected)
+            return failed('validation-failed', 8, { digest });
+        if (signed) {
+            if (!(await diVerify(doc, doc.issuer, S)))
+                return failed('validation-failed', 8, { digest });
+        }
+        else {
+            const key = await ackKey(ctx, rkid, item.recipient.keyAgreement, doc.issuer, doc.recipient);
+            if (!key || !(await macAckValid(doc, key, S)))
+                return failed('validation-failed', 8, { digest });
+        }
+        return { kind: 'ack', digest, ref };
+    }
+    // 6 — the task register, by the full type URI (no prefix, no fallback)
+    const h = tasks.get(doc.type);
+    if (!h)
+        return failed('unknown-type', 6, { digest });
+    if ((h.proof === 'absent') !== (doc.proof === undefined))
+        return failed('validation-failed', 6, { digest });
+    // 7–8 — decode, the closed acceptance binding, the handler's preparation
+    const payload = h.decode(doc.payload);
+    const refused = (r, stage) => failed(r.reason, stage, { digest, ...(r.ref !== undefined ? { ref: r.ref } : {}) });
+    if (isTaskRefusal(payload))
+        return refused(payload, payload.reason === 'malformed' ? 7 : 8);
+    const rdoc = Object.freeze({ ...doc, payload });
+    // the binding: the arrival tuple (4.4), or the handler's own channel
+    // where its document may arrive before any tuple (4.1, Membership)
+    let peer;
+    if (h.channel) {
+        const c = h.channel(state, rdoc, rkid);
+        if (isTaskRefusal(c))
+            return refused(c, c.reason === 'malformed' ? 7 : 8);
+        peer = c;
+    }
+    else {
+        if (!at || doc.issuer !== at.tuple.counterpartAnchor)
+            return failed('validation-failed', 8, { digest });
+        // a deactivated tuple takes nothing new (6190, 6240): the arrival tuple is
+        // the active head of a live relationship, unless the handler binds its
+        // artifacts to the tuples an act pinned before a chaining (8270)
+        if (!h.pinned && (!liveRel(at.rel) || at.rel.activeHead !== at.tuple.ownPairLabel))
+            return failed('validation-failed', 8, { digest, ref: 'RLTP-TRU-6240' });
+        // the entry the arrival's relationship sends under (2146), by its current id
+        peer = { keyAgreement: at.tuple.counterpartKeyAgreement, contactId: entryOf(state, at.rel)?.id ?? at.rel.contactId };
+    }
+    const arrival = Object.freeze({ rkid, threadId: doc.threadId, digest, when: ctx.when });
+    const value = h.prepare ? await h.prepare(ctx, rdoc, arrival) : undefined;
+    if (isTaskRefusal(value))
+        return refused(value, 8);
+    // the ack, sealed before the transaction (4.2: created inside the
+    // effect's transaction — it commits with the cache entry or not at all),
+    // in the form the document's class selects (4.4)
+    const base = ackDocument({
+        id: ctx.entropy.id('ack.id'), issuer: own.anchor, recipient: doc.issuer,
+        threadId: arrival.threadId, issuedAt: iso(ctx.when), ref: digest,
+    });
+    let ackDoc;
+    if (SIGNATURE_CLASS.has(doc.type)) {
+        ackDoc = await diSignWith(own.anchor, (b) => ctx.keys.sign(release.label, b), base, base.issuedAt, S);
+    }
+    else {
+        const key = await ackKey(ctx, rkid, peer.keyAgreement, own.anchor, doc.issuer);
+        if (!key)
+            return failed('validation-failed', 8, { digest });
+        ackDoc = await macAck(base, key, S);
+    }
+    const envelope = await seal(ackDoc, peer.keyAgreement, { ephSeed: ctx.entropy.bytes('seal.eph', 32), nonce: ctx.entropy.bytes('seal.nonce', 12) }, S);
+    const ack = {
+        digest: await digestDoc(ackDoc, S), envelope, threadId: arrival.threadId,
+        recipient: { contactId: peer.contactId, rkid, keyAgreement: peer.keyAgreement, ...(peer.via !== undefined ? { via: peer.via } : {}) },
+    };
+    return { kind: 'task', digest, type: doc.type, doc: rdoc, arrival, value, ack };
+}
+/** The outbox after a valid ack of `ref` (4.2, 6.1): delivered, late after
+ *  failed; unchanged when already delivered. Shared with report(). */
+export function markDelivered(state, ref, when) {
+    const it = state.outbox[ref];
+    if (it.history.some((s) => s.status === 'delivered'))
+        return { outbox: state.outbox, event: null };
+    const late = triasOf(it) === 'failed';
+    const { nextAttemptAt: _, ...rest } = it;
+    return {
+        outbox: { ...state.outbox, [ref]: { ...rest, history: [...it.history, { status: 'delivered', at: when, late }] } },
+        event: { type: 'delivery.status', digest: ref, threadId: it.threadId, status: 'delivered', late },
+    };
+}
+/** Prepared for a handler: its own value under the receive's binding. */
+export const handlerPrepared = (p, value) => Object.freeze({ value, version: p.version, commitSeq: p.commitSeq });
+//# sourceMappingURL=receive.js.map

package/dist/receive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.js","sourceRoot":"","sources":["../src/receive.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,0EAA0E;AAC1E,yEAAyE;AACzE,yBAAyB;AACzB,oEAAoE;AACpE,0EAA0E;AAC1E,2BAA2B;AAC3B,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,iEAAiE;AACjE,0EAA0E;AAC1E,2DAA2D;AAC3D,mCAAmC;AACnC,wEAAwE;AACxE,yEAAyE;AACzE,iEAAiE;AACjE,yEAAyE;AACzE,0DAA0D;AAC1D,yEAAyE;AACzE,yEAAyE;AACzE,wDAAwD;AACxD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,mDAAmD;AACnD,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,wEAAwE;AACxE,mEAAmE;AACnE,0EAA0E;AAC1E,oEAAoE;AACpE,kEAAkE;AAClE,sEAAsE;AACtE,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,iEAAiE;AACjE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,oEAAoE;AACpE,iBAAiB;AACjB,EAAE;AACF,kEAAkE;AAClE,gEAAgE;AAChE,0EAA0E;AAC1E,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AACvE,mDAAmD;AACnD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAE1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAMnD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAkCzC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAU,EAAsB,EAAE,CAChE,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAmB,CAAC,SAAS,KAAK,IAAI,CAAA;AAgBhF,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAsB,EAAE,OAAe,EAAY,EAAE,CAC/E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;AAEpI,MAAM,EAAE,GAAG,oCAAoC,CAAA;AAC/C;;;;;;;iDAOiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,EAAE,GAAG,sBAAsB;IAC3B,EAAE,GAAG,mCAAmC;IACxC,EAAE,GAAG,uBAAuB;IAC5B,EAAE,GAAG,uBAAuB;IAC5B,EAAE,GAAG,yBAAyB;IAC9B,EAAE,GAAG,yBAAyB;IAC9B,EAAE,GAAG,0BAA0B;IAC/B,EAAE,GAAG,0BAA0B;IAC/B,EAAE,GAAG,0BAA0B;IAC/B,EAAE,GAAG,wBAAwB;IAC7B,EAAE,GAAG,kCAAkC;IACvC,EAAE,GAAG,gCAAgC;IACrC,EAAE,GAAG,0BAA0B;IAC/B,EAAE,GAAG,0BAA0B;CAChC,CAAC,CAAA;AASF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAU,EAAoB,EAAE,CAC5D,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAiB,CAAC,EAAE,KAAK,KAAK,IAAI,OAAQ,CAAiB,CAAC,MAAM,KAAK,QAAQ,CAAA;AAuBzH,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;AAChC,MAAM,SAAS,GAAG,CAAC,GAAY,EAAW,EAAE,CAC1C,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,oCAAoC,CAAC,EAAE,OAAO,CAAC,oCAAoC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;IAC1H,KAAK,CAAE,GAA8B,CAAC,QAAQ,CAAC,CAAA;AAEjD,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAE,KAAqB,EAAE,QAAwE,EAAE,EAAe,EAAE,CACxJ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAA;AAElF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAE,KAA4B,EAAE,IAAY;IACrE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QACnC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM;YAAE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAChF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;mEACmE;AACnE,KAAK,UAAU,MAAM,CAAE,GAAe,EAAE,IAAY,EAAE,uBAA+B,EAAE,MAAc,EAAE,SAAiB;IACtH,MAAM,GAAG,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAA;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AACrG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAE,GAAe,EAAE,GAAY,EAAE,KAAqC;IACxG,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAA;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAA;IAC1B,MAAM;IACN,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,GAAe,EAAsB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3G,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACzF,IAAI,CAAC,CAAC,WAAW,KAAK,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,CAAA;IACxF,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAA;QACjD,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAmB,CAAA;QAC1E,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAgC,CAAA;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAO,CAAA;IACxB,MAAM,IAAI,GAAI,GAAwB,CAAC,IAAI,CAAA;IAC3C,yEAAyE;IACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,2DAA2D,CAAC,CAAA;IAChI,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACjF,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACnC,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAA;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACvD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACvD,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,+CAA+C;QAC/C,sFAAsF;QACtF,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAA;QAC/B,MAAM,IAAI,GAA2B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACzK,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAA;QACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACxG,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAgB,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,MAAgB,EAAE,GAAG,CAAC,SAAmB,CAAC,CAAA;YAC/G,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAClG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACrC,CAAC;IACD,uEAAuE;IACvE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAc,CAAC,CAAA;IACvC,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACpD,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC3G,yEAAyE;IACzE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,CAAC,CAAc,EAAE,KAAqB,EAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3J,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAqB,CAAA;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACtC,IAAI,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,IAAI,GAAG,CAAC,CAAA;IACV,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,iBAAiB;YAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACvG,2EAA2E;QAC3E,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;QAC3J,6EAA6E;QAC7E,IAAI,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,CAAA;IACtH,CAAC;IACD,MAAM,OAAO,GAAY,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1G,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAClD,kEAAkE;IAClE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAgB;QACjF,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM;KACjE,CAAC,CAAA;IACF,IAAI,MAAY,CAAA;IAChB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAuC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAoB,CAAA;IAC7J,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAgB,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3D,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAoB,CAAA;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACrJ,MAAM,GAAG,GAAc;QACrB,MAAM,EAAE,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QACxE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACtI,CAAA;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAc,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AAC3F,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,aAAa,CAAE,KAA4B,EAAE,GAAW,EAAE,IAAY;IACpF,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClG,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAA;IACrC,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;QAClH,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;KAClG,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,CAAoB,EAAE,KAAQ,EAAe,EAAE,CAChF,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA","sourcesContent":["// receive — the holder's receive core (lib Stage 2, note §4.3; Delivery\n// §6.2, §4.2, §4.4). The engine runs it as its built-in `receive`: the\n// preparation (async) walks stages 1–8, the transition (sync) is stage 9.\n//\n//   1–4  once, here, through delivery.receiveByAgreement: the key agreement\n//        is the KeyProvider's `agree` under the engine's release from\n//        `addresses` (a tombstone answers retired: stage 3; an rkid never\n//        issued answers unknown: stage 2); the completed-effect cache is\n//        `state.effects`\n//   5    the document profile (schema, calendar-valid issuedAt) and\n//        recipient = the own anchor of the label the arrival rkid derives\n//        under (addresses)\n//   6    dispatch by the full type URI with version: the built-in\n//        delivery-ack path, else the task register, else unknown-type;\n//        then the entry's proof declaration. Delivery §3 wants `proof`\n//        absent on every type but delivery-ack and registry-declaration,\n//        and §4.4 puts the declaration into the registry entry; the\n//        profile schema can name only the types it knows, so for\n//        companion types the rule is enforced here, the earliest stage at\n//        which the receiver holds the entry: a mismatch is\n//        failed(validation-failed)\n//   7–8  the handler's decode (malformed at 7, any other refusal at 8),\n//        the core's closed acceptance binding (Delivery 4.4: the arrival\n//        tuple is selected by rkid, the document's issuer is its\n//        counterpart anchor), the handler's prepare, and the ack: sealed\n//        here, before the transaction, from fresh entropy\n//   9    the handler's apply; the core files the effect-cache entry with\n//        the ack in the same commit (the handler never writes `effects`)\n//        and hands the ack out first among the outbound\n//\n// Acks (delivery-ack/0.1) are no registered task: one common path checks\n// the form (ack.ts macAckForm), then the consistency of 4.2 against the\n// outbox — `ref` is a document this holder sent on that thread, on the\n// arrival tuple (outbox item rkid = arrival rkid), the issuer is that\n// tuple's counterpart, the referenced document's type is of the\n// designated-verifier class (a MAC ack of a signature-class document is\n// the wrong class), and the MAC verifies under the arrival tuple's ack\n// key. A valid ack marks the item delivered (late after failed) and\n// earns a terminal cache entry, no ack of its own.\n//\n// The stage-9 lock set (Delivery 6.2): the engine serializes every\n// operation of a holder in one queue and commits by CAS — a strictly\n// stronger serialization than the lock set asks for (it holds every key\n// of the holder, not only the overlapping ones), which is how this\n// library implements it under Stage 2's one-writer contract. The lock set\n// — the digest, and for star and group-star chunks additionally the\n// assembly key (tuple, type, salt) of 4.4 — is held for the whole\n// evaluation; a CAS conflict re-reads and re-enters at stage 1, which\n// re-checks the cache at stage 4. The chunk types (trust/star.ts,\n// trust/group-star.ts, PR 4b) need no key of their own here: every\n// chunk of one tuple and type is evaluated against, and committed over,\n// the one state version its preparation read, so the completing chunk's\n// effect (validated assembly, accepted snapshot, completed-salt advance)\n// commits with the cache entry and the ack in one transaction.\n//\n// A refusal (TaskRefusal) never commits anything, at any stage.\n//\n// A handler's apply may answer a TaskDiscarded: the receiver discarded an\n// open assembly and holds its salt as the lower bound (5366), for one of\n// two reasons: `resource-limit` (Trust 5365), or `rejected` — an\n// authenticated chunk (its MAC verified) violates the assembly rules\n// (5260–5310, 5500, 5510), and the spec rejects the whole delivery, so it\n// must not complete from any later chunk. That is a spec-mandated state\n// effect, not a failure of the document: its state commits and the result\n// is the disposition `discarded` with the reason and the rule — no\n// effect-cache entry (a redelivery is evaluated afresh and meets the lower\n// bound), no ack (the delivery must not complete), no event; the completed\n// high-water mark stays. A chunk that does not authenticate is a plain\n// refusal and touches nothing. DELIVERY GAP: Delivery §6.2 names no\n// disposition for a document whose processing ends in such a discard;\n// `discarded` (both reasons) is this library's, to be registered in\n// Delivery 0.82.\n//\n// A verified ack runs the ack handler a module registered for the\n// acknowledged item's type, in the ack's transaction (engine.ts\n// AckHandler): the sender side of 5660, completion by verified acks only.\n//\n// Ack class (4.4): the class follows the payload's audience class. The\n// types of SIGNATURE_CLASS carry transferable signatures (the encounter\n// carriers, the membership documents, the signed introduction artifacts,\n// the registry declaration): their ack is SIGNED, an eddsa-jcs-2022 proof\n// under the ack's issuer anchor through the KeyProvider (`sign` with the\n// arrival key's label). Every other type is designated-verifier and earns\n// the MAC form under the channel ack key of the arrival rkid and the\n// counterpart key. A received ack is checked in the form its referenced\n// outbox item's class selects; the other form is validation-failed.\n//\n// The acceptance binding before a tuple exists (PR 7): a handler with a\n// `channel` binds its document itself, from the document, where it may\n// arrive on an own key no tuple carries yet — the encounter bundle on the\n// displayed card's key (Delivery 4.1: the bundle establishes the tuple,\n// its issuer bound to card.anchor = credential.issuer), the membership\n// documents on member keys (Membership 3.1, 3.2). `channel` names the\n// counterpart's key agreement the ack is sealed to and the contact it is\n// filed under, or refuses (stage 7 for malformed, else 8). Every other\n// handler keeps the tuple binding of Delivery 4.4.\nimport { calOK, iso, makeValidator, toU } from './core.js'\nimport type { Json } from './core.js'\nimport { diSignWith, diVerify, digestDoc, xRawOfMk } from './crypto.js'\nimport { receiveByAgreement, seal } from './delivery.js'\nimport type { KeyAnswer } from './delivery.js'\nimport { ACK_TYPE, ackDocument, ackKeyOf, ackProofForm, macAck, macAckForm, macAckValid, signedAckForm } from './ack.js'\nimport { SCHEMAS } from './schemas.js'\nimport { triasOf } from './state.js'\nimport { entryOf, liveRel } from './trust/state.js'\nimport type { HolderState, Millis, OutboxItem, Relationship, StoredAck, Tuple } from './state.js'\n\n/** An ack as sealed in the preparation; the engine adds its schedule. */\nexport type SealedAck = Pick<StoredAck, 'digest' | 'envelope' | 'threadId' | 'recipient'>\nimport type { Outbound } from './ports.js'\nimport { InfraError } from './results.js'\nimport type { ReceiveFailure, ReceiveResult, ReceiveStageNo } from './results.js'\nimport type { EventDraft, PrepareCtx, Prepared } from './engine.js'\n\n// ── the task handler contract ──────────────────────────────────────────\n\n/** Where and when a document arrived: the own rkid it was sealed to, its\n *  thread, its digest and the receive's `when`. */\nexport interface Arrival { rkid: string, threadId: string, digest: string, when: Millis }\n\n/** Why a task handler refuses a document; the stage follows from where:\n *  decode 'malformed' → 7, decode or prepare otherwise → 8, apply → 9. */\nexport type TaskFailure = 'malformed' | 'validation-failed' | 'stale-issuance' | 'gate-future' | 'consumed-challenge'\n\n/** A handler's refusal: nothing commits, the digest stays uncached and\n *  a redelivery is evaluated afresh (Delivery 6.2 stage 4) — with one\n *  narrow, enumerated exception, the Encounter aging latch: an apply that\n *  refuses because its authoritative resolution found an own challenge past\n *  its age bound (Encounter 5260, 5270, 5290; Delivery 4.1 check 5) returns\n *  `latch`, the state with that challenge removed, and the engine commits\n *  exactly it (and the raised lastWhen): no cache entry, no ack, no event;\n *  the disposition stays failed. A latch that touches anything beyond\n *  encounter.challenges is a programming error and throws (engine.ts). */\nexport interface TaskRefusal { ok: false, reason: TaskFailure, ref?: string, latch?: HolderState }\n\n/** A discard at a resource limit (Trust 5365/5366), answered by apply:\n *  `state` commits (assembly dropped, lower bound held), the disposition\n *  is `discarded`, with no cache entry, no ack and no event. */\nexport interface TaskDiscarded { discarded: true, reason: DiscardReason, state: HolderState, ref?: string }\n\n/** Why an assembly was discarded: a local resource limit (5365), or an\n *  authenticated violation of the assembly rules that rejects the delivery. */\nexport type DiscardReason = 'resource-limit' | 'rejected'\n\nexport const isTaskDiscarded = (x: unknown): x is TaskDiscarded =>\n  x !== null && typeof x === 'object' && (x as TaskDiscarded).discarded === true\n\n/** A received document after stage 7: the profile fields, its payload\n *  as the handler's decode returned it. Read-only. */\nexport interface ReceivedDocument<T = unknown> {\n  readonly id: string\n  readonly type: string\n  readonly issuer: string\n  readonly recipient: string\n  readonly threadId: string\n  readonly issuedAt: string\n  readonly payload: T\n  readonly ceremony?: Json\n  readonly proof?: Json\n}\n\n/** A sealed ack as the outbound the app sends, at the given attempt. */\nexport const ackOutbound = (a: Readonly<SealedAck>, attempt: number): Outbound =>\n  structuredClone({ digest: a.digest, envelope: a.envelope, type: ACK_TYPE, threadId: a.threadId, recipient: a.recipient, attempt })\n\nconst TT = 'https://real-life.org/trust-tasks/'\n/** Signature-class types (Delivery 4.2/4.4): payloads whose authenticity\n *  is a transferable signature; their acks are signed, not MACed. The\n *  `x-` slugs are this library's own experimental, unregistered forms\n *  for what the specifications leave to the application (the membership\n *  prelude, Membership 1.2; the welcome until the Access envelope is\n *  built; the introduction offer that conveys the target designator,\n *  Trust 8.3): signed documents as well. A receiver that does not know\n *  them answers unknown-type (Delivery §6.2). */\nexport const SIGNATURE_CLASS: ReadonlySet<string> = new Set([\n  TT + 'encounter-bundle/0.1',\n  TT + 'encounter-credential-delivery/0.1',\n  TT + 'membership-invite/0.2',\n  TT + 'membership-accept/0.2',\n  TT + 'membership-evidence/0.1',\n  TT + 'membership-evidence/0.2',\n  TT + 'registry-declaration/0.1',\n  TT + 'introduction-request/0.1',\n  TT + 'introduction-forward/0.1',\n  TT + 'introduction-reply/0.1',\n  TT + 'x-membership-prelude-request/0.1',\n  TT + 'x-membership-prelude-reply/0.1',\n  TT + 'x-membership-welcome/0.1',\n  TT + 'x-introduction-offer/0.1',\n])\n\n/** The counterpart a `channel` binding names: the key agreement the ack\n *  is sealed to and the contact it is filed under. */\n/** The binding a document arrives under: the counterpart's key and the\n *  contact; `via`, where the arrival key is no tuple's (a member key), the\n *  own rkid of the tuple the contact was named through (Recipient.via). */\nexport interface Channel { keyAgreement: string, contactId: string, via?: string }\n\nexport const isTaskRefusal = (x: unknown): x is TaskRefusal =>\n  x !== null && typeof x === 'object' && (x as TaskRefusal).ok === false && typeof (x as TaskRefusal).reason === 'string'\n\n// ── the plan a preparation hands to stage 9 ────────────────────────────\n\ntype Failed = Extract<ReceiveResult, { disposition: 'failed' }>\n\n/** What stages 1–8 decided, bound to the snapshot they ran against. */\nexport type ReceivePlan =\n  | { kind: 'failed', result: Failed }\n  | { kind: 'duplicate', digest: string }\n  | { kind: 'ack', digest: string, ref: string }\n  | { kind: 'task', digest: string, type: string, doc: ReceivedDocument, arrival: Arrival, value: unknown, ack: SealedAck }\n\n/** The handler surface the core needs (engine.ts TaskHandler). */\nexport interface TaskEntry {\n  proof: 'absent' | 'required'\n  decode (payload: unknown): unknown\n  channel? (state: Readonly<HolderState>, doc: ReceivedDocument, rkid: string): Channel | TaskRefusal\n  /** may arrive on a deactivated tuple an act pinned (engine TaskHandler) */\n  pinned?: true\n  prepare? (ctx: PrepareCtx, doc: ReceivedDocument, arrival: Arrival): Promise<unknown>\n}\n\nconst V = makeValidator(SCHEMAS)\nconst profileOk = (doc: unknown): boolean =>\n  V.validate(doc, SCHEMAS['rltp-delivery-document.schema.json'], SCHEMAS['rltp-delivery-document.schema.json']).length === 0 &&\n  calOK((doc as { issuedAt?: unknown }).issuedAt)\n\nconst failed = (reason: ReceiveFailure, stage: ReceiveStageNo, extra: { digest?: string, key?: 'unknown' | 'retired', ref?: string } = {}): ReceivePlan =>\n  ({ kind: 'failed', result: { disposition: 'failed', reason, stage, ...extra } })\n\n/** The tuple whose own rkid is `rkid`, with its relationship. */\nexport function tupleByRkid (state: Readonly<HolderState>, rkid: string): { rel: Relationship, tuple: Tuple } | null {\n  for (const id of Object.keys(state.relationships).sort()) {\n    const rel = state.relationships[id]\n    for (const tuple of rel.tuples) if (tuple.rkid === rkid) return { rel, tuple }\n  }\n  return null\n}\n\n/** The arrival channel's ack key (4.2): X25519 of the own key behind\n *  `rkid` and the counterpart key, HKDF under issuer/recipient. */\nasync function ackKey (ctx: PrepareCtx, rkid: string, counterpartKeyAgreement: string, issuer: string, recipient: string): Promise<Uint8Array | null> {\n  const raw = xRawOfMk(counterpartKeyAgreement)\n  if (!raw) return null\n  const a = await ctx.keys.agree(rkid, raw, ctx.release)\n  if (a.status !== 'available') return null\n  try { return await ackKeyOf(a.shared, issuer, recipient, ctx.crypto.subtle) } catch { return null }\n}\n\n/**\n * Stages 1–8 against the preparation's snapshot. Never throws for\n * anything the envelope carries; port failures surface as InfraError.\n */\nexport async function prepareReceive (ctx: PrepareCtx, env: unknown, tasks: ReadonlyMap<string, TaskEntry>): Promise<ReceivePlan> {\n  const S = ctx.crypto.subtle\n  const state = ctx.snapshot\n  // 1–4\n  const agree = (rkid: string, epk: Uint8Array): Promise<KeyAnswer> => ctx.keys.agree(rkid, epk, ctx.release)\n  const r = await receiveByAgreement(env, agree, (d) => Object.hasOwn(state.effects, d), S)\n  if (r.disposition === 'duplicate-known') return { kind: 'duplicate', digest: r.digest! }\n  if (r.disposition !== 'unique') {\n    const stage = r.stages[r.stages.length - 1].stage\n    const reason = r.disposition.slice('failed('.length, -1) as ReceiveFailure\n    return failed(reason, stage, r.key ? { key: r.key } : {})\n  }\n  const doc = r.document as Record<string, Json>\n  const digest = r.digest!\n  const rkid = (env as { rkid: string }).rkid\n  // 5 — profile, then recipient = own anchor under the arrival key's label\n  if (!profileOk(doc)) return failed('malformed', 5, { digest })\n  const release = ctx.release(rkid)\n  if (release.status !== 'live') throw new InfraError('key-provider', 'agree answered for an rkid the release does not hold live')\n  const own = await ctx.keys.anchorOf(release.label)\n  if (doc.recipient !== own.anchor) return failed('wrong-recipient', 5, { digest })\n  const at = tupleByRkid(state, rkid)\n  // 6 — the built-in ack path, in the form the acked document's class selects\n  if (doc.type === ACK_TYPE) {\n    const signed = ackProofForm(doc) === 'signed'\n    const f = signed ? signedAckForm(doc) : macAckForm(doc)\n    if (!f.ok) return failed(f.reason, f.stage, { digest })\n    // 8 — consistency against what this holder sent (4.2): the document on\n    // that thread, sent from the arrival rkid, of the class the proof form\n    // claims; the issuer its recipient (the tuple's counterpart, or the\n    // anchor it went to where no tuple carried it)\n    // the ref in either rendering (u or z, 4.2) names the outbox item by its digest bytes\n    const ref = toU(f.ref) ?? f.ref\n    const item: OutboxItem | undefined = Object.hasOwn(state.outbox, ref) ? state.outbox[ref] : undefined\n    if (!item || item.threadId !== f.threadId || item.recipient.rkid !== rkid || SIGNATURE_CLASS.has(item.type) !== signed) return failed('validation-failed', 8, { digest })\n    const expected = at ? at.tuple.counterpartAnchor : item.recipient.anchor\n    if (expected === undefined || doc.issuer !== expected) return failed('validation-failed', 8, { digest })\n    if (signed) {\n      if (!(await diVerify(doc, doc.issuer as string, S))) return failed('validation-failed', 8, { digest })\n    } else {\n      const key = await ackKey(ctx, rkid, item.recipient.keyAgreement, doc.issuer as string, doc.recipient as string)\n      if (!key || !(await macAckValid(doc, key, S))) return failed('validation-failed', 8, { digest })\n    }\n    return { kind: 'ack', digest, ref }\n  }\n  // 6 — the task register, by the full type URI (no prefix, no fallback)\n  const h = tasks.get(doc.type as string)\n  if (!h) return failed('unknown-type', 6, { digest })\n  if ((h.proof === 'absent') !== (doc.proof === undefined)) return failed('validation-failed', 6, { digest })\n  // 7–8 — decode, the closed acceptance binding, the handler's preparation\n  const payload = h.decode(doc.payload)\n  const refused = (r: TaskRefusal, stage: ReceiveStageNo): ReceivePlan => failed(r.reason, stage, { digest, ...(r.ref !== undefined ? { ref: r.ref } : {}) })\n  if (isTaskRefusal(payload)) return refused(payload, payload.reason === 'malformed' ? 7 : 8)\n  const rdoc = Object.freeze({ ...doc, payload }) as ReceivedDocument\n  // the binding: the arrival tuple (4.4), or the handler's own channel\n  // where its document may arrive before any tuple (4.1, Membership)\n  let peer: Channel\n  if (h.channel) {\n    const c = h.channel(state, rdoc, rkid)\n    if (isTaskRefusal(c)) return refused(c, c.reason === 'malformed' ? 7 : 8)\n    peer = c\n  } else {\n    if (!at || doc.issuer !== at.tuple.counterpartAnchor) return failed('validation-failed', 8, { digest })\n    // a deactivated tuple takes nothing new (6190, 6240): the arrival tuple is\n    // the active head of a live relationship, unless the handler binds its\n    // artifacts to the tuples an act pinned before a chaining (8270)\n    if (!h.pinned && (!liveRel(at.rel) || at.rel.activeHead !== at.tuple.ownPairLabel)) return failed('validation-failed', 8, { digest, ref: 'RLTP-TRU-6240' })\n    // the entry the arrival's relationship sends under (2146), by its current id\n    peer = { keyAgreement: at.tuple.counterpartKeyAgreement, contactId: entryOf(state, at.rel)?.id ?? at.rel.contactId }\n  }\n  const arrival: Arrival = Object.freeze({ rkid, threadId: doc.threadId as string, digest, when: ctx.when })\n  const value = h.prepare ? await h.prepare(ctx, rdoc, arrival) : undefined\n  if (isTaskRefusal(value)) return refused(value, 8)\n  // the ack, sealed before the transaction (4.2: created inside the\n  // effect's transaction — it commits with the cache entry or not at all),\n  // in the form the document's class selects (4.4)\n  const base = ackDocument({\n    id: ctx.entropy.id('ack.id'), issuer: own.anchor, recipient: doc.issuer as string,\n    threadId: arrival.threadId, issuedAt: iso(ctx.when), ref: digest,\n  })\n  let ackDoc: Json\n  if (SIGNATURE_CLASS.has(doc.type as string)) {\n    ackDoc = await diSignWith(own.anchor, (b) => ctx.keys.sign(release.label, b), base as unknown as Record<string, Json>, base.issuedAt, S) as unknown as Json\n  } else {\n    const key = await ackKey(ctx, rkid, peer.keyAgreement, own.anchor, doc.issuer as string)\n    if (!key) return failed('validation-failed', 8, { digest })\n    ackDoc = await macAck(base, key, S) as unknown as Json\n  }\n  const envelope = await seal(ackDoc, peer.keyAgreement, { ephSeed: ctx.entropy.bytes('seal.eph', 32), nonce: ctx.entropy.bytes('seal.nonce', 12) }, S)\n  const ack: SealedAck = {\n    digest: await digestDoc(ackDoc, S), envelope, threadId: arrival.threadId,\n    recipient: { contactId: peer.contactId, rkid, keyAgreement: peer.keyAgreement, ...(peer.via !== undefined ? { via: peer.via } : {}) },\n  }\n  return { kind: 'task', digest, type: doc.type as string, doc: rdoc, arrival, value, ack }\n}\n\n/** The outbox after a valid ack of `ref` (4.2, 6.1): delivered, late after\n *  failed; unchanged when already delivered. Shared with report(). */\nexport function markDelivered (state: Readonly<HolderState>, ref: string, when: Millis): { outbox: HolderState['outbox'], event: EventDraft | null } {\n  const it = state.outbox[ref]\n  if (it.history.some((s) => s.status === 'delivered')) return { outbox: state.outbox, event: null }\n  const late = triasOf(it) === 'failed'\n  const { nextAttemptAt: _, ...rest } = it\n  return {\n    outbox: { ...state.outbox, [ref]: { ...rest, history: [...it.history, { status: 'delivered', at: when, late }] } },\n    event: { type: 'delivery.status', digest: ref, threadId: it.threadId, status: 'delivered', late },\n  }\n}\n\n/** Prepared for a handler: its own value under the receive's binding. */\nexport const handlerPrepared = <P>(p: Prepared<unknown>, value: P): Prepared<P> =>\n  Object.freeze({ value, version: p.version, commitSeq: p.commitSeq })\n"]}