@real-life/trust-protocol 0.3.2 → 0.5.0

package/dist/ack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ack.js","sourceRoot":"","sources":["../src/ack.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,yEAAyE;AACzE,yEAAyE;AACzE,iEAAiE;AACjE,iDAAiD;AACjD,gCAAgC;AAChC,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,mFAAmF;AACnF,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,mCAAmC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAA;AAE5B,kEAAkE;AAClE,MAAM,CAAC,MAAM,QAAQ,GAAG,oDAAoD,CAAA;AAa5E,gEAAgE;AAChE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,gBAAwB,EAAE,mBAA2B,EAAU,EAAE,CACvF,2BAA2B,GAAG,gBAAgB,GAAG,GAAG,GAAG,mBAAmB,CAAA;AAE5E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAE,MAAkB,EAAE,gBAAwB,EAAE,mBAA2B,EAAE,MAAqB;IAC9H,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3E,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AACjF,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,GAAe,EAAE,GAAY,EAAE,MAAqB;IAChF,MAAM,CAAC,GAAG,MAAM,IAAI,cAAc,EAAE,CAAA;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3F,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnF,CAAC;AAED;uEACuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAqG,EAAe,EAAE,CAAC,CAAC;IAClJ,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;IAC9G,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE;CAC7C,CAAC,CAAA;AAEF,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,GAAgB,EAAE,GAAe,EAAE,MAAqB;IACpF,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;AAChC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAa,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACtH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;AAKzH;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAE,GAAY;IACtC,MAAM,CAAC,GAAG,GAA0B,CAAA;IACpC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACnI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC7H,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACjH,MAAM,CAAC,GAAG,CAAC,CAAC,KAAyC,CAAA;IACrD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAChK,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACpG,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACjG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAE,GAAY;IACzC,MAAM,CAAC,GAAG,GAA0B,CAAA;IACpC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACnI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC7H,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACjH,MAAM,CAAC,GAAG,CAAC,CAAC,KAAyC,CAAA;IACrD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7J,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACpG,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACjG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;AAC/D,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAA2B,EAAE;IACpE,MAAM,CAAC,GAAI,GAAkD,EAAE,KAAK,CAAA;IACpE,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpD,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC,CAAA;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,GAA4D,EAAE,GAAe,EAAE,MAAqB;IACrI,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IAC9B,OAAO,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAA;AAC1F,CAAC","sourcesContent":["// ack — the delivery acknowledgement's pure parts (Delivery §4.2, the\n// acknowledgement class rule of §4.4): the type, the deniable MAC form's\n// channel-keyed derivation, the MAC, and the context-free form checks of\n// a received ack. Used by the holder's receive core (engine.ts);\n// byte-compatible with vectors/delivery-ack.json\n// (lib/test/vectors4.test.mjs).\n//\n//   k     = HKDF-SHA-256(ikm = X25519(pairX_issuer, pairX_recipient),\n//                        salt = empty, info = \"rltp/v1/delivery/mac/ack/\"\n//                        || issuerPairAnchor || \"/\" || recipientPairAnchor,\n//                        32 bytes; an all-zero shared secret is rejected)\n//   proof = { mac: \"u\" + base64url(HMAC-SHA-256(k, JCS(document without proof))) }\n//\n// Deniable by construction: either party of the tuple derives k, so for a\n// designated-verifier payload the ack is evidence to its sender alone,\n// never an attestation (4.2). The key agreement itself is the caller's:\n// the holder asks its KeyProvider.\nimport { jcs, b64uOf, calOK, makeValidator } from './core.js'\nimport type { Json } from './core.js'\nimport { hkdf, platformSubtle } from './crypto.js'\nimport { SCHEMAS } from './schemas.js'\n\nconst te = new TextEncoder()\n\n/** The registered type of the acknowledgement (Delivery §4.2). */\nexport const ACK_TYPE = 'https://real-life.org/trust-tasks/delivery-ack/0.1'\n\n/** The ack document without its proof: the MAC preimage (4.2). */\nexport interface AckDocument {\n  id: string\n  type: typeof ACK_TYPE\n  issuer: string\n  recipient: string\n  threadId: string\n  issuedAt: string\n  payload: { ref: string, meaning: 'received' }\n}\n\n/** The HKDF info of the channel ack key, issuer first (4.2). */\nexport const ackInfo = (issuerPairAnchor: string, recipientPairAnchor: string): string =>\n  'rltp/v1/delivery/mac/ack/' + issuerPairAnchor + '/' + recipientPairAnchor\n\n/** The channel ack key from the tuple's X25519 shared secret (4.2). */\nexport async function ackKeyOf (shared: Uint8Array, issuerPairAnchor: string, recipientPairAnchor: string, subtle?: SubtleCrypto): Promise<Uint8Array> {\n  if (shared.every((b) => b === 0)) throw new Error('all-zero X25519 output')\n  return hkdf(shared, ackInfo(issuerPairAnchor, recipientPairAnchor), 32, subtle)\n}\n\n/** \"u\" + base64url HMAC-SHA-256 over the JCS of `doc` under `key`. */\nexport async function ackMac (key: Uint8Array, doc: unknown, subtle?: SubtleCrypto): Promise<string> {\n  const S = subtle ?? platformSubtle()\n  const k = await S.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  return 'u' + b64uOf(new Uint8Array(await S.sign('HMAC', k, te.encode(jcs(doc)))))\n}\n\n/** The proof-less ack of `ref` on the acked document's thread (4.2):\n *  issuer = the acked document's recipient, recipient = its issuer. */\nexport const ackDocument = (f: { id: string, issuer: string, recipient: string, threadId: string, issuedAt: string, ref: string }): AckDocument => ({\n  id: f.id, type: ACK_TYPE, issuer: f.issuer, recipient: f.recipient, threadId: f.threadId, issuedAt: f.issuedAt,\n  payload: { ref: f.ref, meaning: 'received' },\n})\n\n/** The deniable ack: `doc` with its MAC-form proof under the channel ack key. */\nexport async function macAck (doc: AckDocument, key: Uint8Array, subtle?: SubtleCrypto): Promise<AckDocument & { proof: { mac: string } }> {\n  return { ...doc, proof: { mac: await ackMac(key, doc, subtle) } }\n}\n\nconst V = makeValidator(SCHEMAS)\nconst schemaOk = (file: string, data: unknown): boolean => V.validate(data, SCHEMAS[file], SCHEMAS[file]).length === 0\nconst ACK_FIELDS = new Set(['id', 'type', 'issuer', 'recipient', 'threadId', 'issuedAt', 'payload', 'proof', 'ceremony'])\n\n/** Where a received ack's form fails, by the stage of Delivery §6.2 that names it. */\nexport type AckFormFailure = { stage: 5 | 7, reason: 'malformed' } | { stage: 8, reason: 'validation-failed' }\n\n/**\n * The context-free checks of a received MAC-form ack, in stage order\n * (Delivery §6.2): 5 document profile (schema, closed form, calendar), 7\n * payload schema, 8 the class rule's proof form (exactly `{mac}`), no\n * enactment, `meaning`. What needs the arrival context stays the\n * caller's: recipient = own anchor (5), issuer = the tuple's counterpart,\n * `ref` = a document sent on that thread, and the MAC itself (8).\n */\nexport function macAckForm (doc: unknown): { ok: true, ref: string, threadId: string } | ({ ok: false } & AckFormFailure) {\n  const d = doc as Record<string, any>\n  if (!schemaOk('rltp-delivery-document.schema.json', d) || d?.type !== ACK_TYPE) return { ok: false, stage: 5, reason: 'malformed' }\n  if (Object.keys(d).some((k) => !ACK_FIELDS.has(k)) || !calOK(d.issuedAt)) return { ok: false, stage: 5, reason: 'malformed' }\n  if (!schemaOk('payload-delivery-ack.schema.json', d.payload)) return { ok: false, stage: 7, reason: 'malformed' }\n  const p = d.proof as Record<string, Json> | undefined\n  if (p === null || typeof p !== 'object' || Object.keys(p).length !== 1 || typeof p.mac !== 'string') return { ok: false, stage: 8, reason: 'validation-failed' }\n  if (d.ceremony?.enactment !== undefined) return { ok: false, stage: 8, reason: 'validation-failed' }\n  if (d.payload.meaning !== 'received') return { ok: false, stage: 8, reason: 'validation-failed' }\n  return { ok: true, ref: d.payload.ref, threadId: d.threadId }\n}\n\n/**\n * The context-free checks of a received SIGNED ack (the class rule's\n * form for a signature-class payload, 4.2/4.4), in stage order: 5 the\n * document profile, 7 the payload schema, 8 the proof form (an\n * eddsa-jcs-2022 DataIntegrityProof, no `mac`, calendar-valid), no\n * enactment, `meaning`. The signature itself (under `issuer`) and the\n * consistency against what the holder sent stay the caller's.\n */\nexport function signedAckForm (doc: unknown): { ok: true, ref: string, threadId: string } | ({ ok: false } & AckFormFailure) {\n  const d = doc as Record<string, any>\n  if (!schemaOk('rltp-delivery-document.schema.json', d) || d?.type !== ACK_TYPE) return { ok: false, stage: 5, reason: 'malformed' }\n  if (Object.keys(d).some((k) => !ACK_FIELDS.has(k)) || !calOK(d.issuedAt)) return { ok: false, stage: 5, reason: 'malformed' }\n  if (!schemaOk('payload-delivery-ack.schema.json', d.payload)) return { ok: false, stage: 7, reason: 'malformed' }\n  const p = d.proof as Record<string, Json> | undefined\n  if (p === null || typeof p !== 'object' || p.mac !== undefined || p.type !== 'DataIntegrityProof' || p.cryptosuite !== 'eddsa-jcs-2022' || !calOK(p.created)) {\n    return { ok: false, stage: 8, reason: 'validation-failed' }\n  }\n  if (d.ceremony?.enactment !== undefined) return { ok: false, stage: 8, reason: 'validation-failed' }\n  if (d.payload.meaning !== 'received') return { ok: false, stage: 8, reason: 'validation-failed' }\n  return { ok: true, ref: d.payload.ref, threadId: d.threadId }\n}\n\n/** The proof form a received ack carries: the MAC object, a signature, or neither. */\nexport const ackProofForm = (doc: unknown): 'mac' | 'signed' | null => {\n  const p = (doc as { proof?: Record<string, unknown> } | null)?.proof\n  if (p === null || typeof p !== 'object') return null\n  return typeof p.mac === 'string' ? 'mac' : typeof p.proofValue === 'string' ? 'signed' : null\n}\n\n/** Does the ack's MAC verify under `key`? (4.2; over JCS of the document without proof) */\nexport async function macAckValid (doc: { proof?: { mac?: unknown } } & Record<string, unknown>, key: Uint8Array, subtle?: SubtleCrypto): Promise<boolean> {\n  const { proof, ...rest } = doc\n  return typeof proof?.mac === 'string' && (await ackMac(key, rest, subtle)) === proof.mac\n}\n"]}

package/dist/adapters/vti-mediator.d.ts

@@ -0,0 +1,169 @@
+import type { CarrierPrincipal, CarrierScopedIdentity } from '../carrier-identity.js';
+import type { DeliveryReport, Outbound, ReceiverRefusalCode, SubmissionRef } from '../ports.js';
+import type { ReceiveResult } from '../results.js';
+export type { ReceiverRefusalCode } from '../ports.js';
+export declare const DECLARED: Readonly<{
+    readonly giveUpHorizonMs: number;
+    readonly statusHorizonMs: 60000;
+    readonly queueFloorCount: 64;
+    readonly queueFloorBytes: 1048576;
+    readonly maxQueueBytes: 16777216;
+    readonly duplicateWindowMs: number;
+}>;
+export type WireErrorKind = 'unreachable' | 'refused-retriable' | 'refused-admission' | 'oversize';
+export declare class WireError extends Error {
+    kind: WireErrorKind;
+    constructor(kind: WireErrorKind, message?: string);
+}
+export interface MediatorWire {
+    authChallenge(did: string): Promise<{
+        challenge: string;
+        sessionId: string;
+    }>;
+    authenticate(answer: {
+        did: string;
+        challenge: string;
+        sessionId: string;
+    }): Promise<TokenSet>;
+    refresh(refreshToken: string): Promise<TokenSet>;
+    keylistUpdate(accessToken: string, rkids: string[]): Promise<void>;
+    deposit(accessToken: string, bytes: Uint8Array, egressDid: string): Promise<void>;
+    ackReceived(accessToken: string, queueIds: string[]): Promise<void>;
+    onDeliver(cb: (bytes: Uint8Array) => Promise<void>): void;
+    /** Optional truthful connectivity signal; absent means unknown. */
+    offline?(): boolean;
+}
+export interface TokenSet {
+    accessToken: string;
+    accessExpiresAt: number;
+    refreshToken: string;
+    refreshExpiresAt: number;
+}
+export type SubmissionState = {
+    state: 'awaiting-transport';
+    reason: 'offline' | 'transport-unreachable' | 'carrier-refused-retriable';
+} | {
+    state: 'accepted';
+} | {
+    state: 'delivered';
+    late: boolean;
+} | {
+    state: 'failed';
+    reason: 'unroutable' | 'oversize' | 'expired-by-adapter-policy';
+} | {
+    state: 'failed';
+    reason: 'rejected-by-receiver';
+    code: ReceiverRefusalCode;
+};
+/** The ports' DeliveryReport for a document `digest` in adapter state `st`
+ *  (Delivery §6.1): one-to-one, `late` and the refusal code carried over. */
+export declare function deliveryReportOf(digest: string, st: SubmissionState): DeliveryReport;
+/** Whether a receive outcome is terminal and its item may be concluded
+ *  (Delivery 5a.8): every disposition but `failed(rate-limited)`, the one
+ *  failure that is transient (RLTP-DEL-5820). An InfraError of the
+ *  holder's store is transient as well (RLTP-DEL-5810): an item whose
+ *  receive threw is kept, too. */
+export declare function concludable(r: ReceiveResult): boolean;
+export interface CollectedItem {
+    bytes: Uint8Array;
+    queueId: string;
+}
+export interface Collection {
+    id: string;
+    items: CollectedItem[];
+}
+/** Ack state for the host to persist (profile §4). Invariant: every
+ *  pending id names a concluded entry; violations are refused at
+ *  construction (fail-closed). */
+export interface AckState {
+    concluded: Array<{
+        queueId: string;
+        concludedAt: number;
+    }>;
+    pending: string[];
+}
+export declare class MediatorCarrierAdapter {
+    #private;
+    get principal(): string;
+    get connectionDid(): string;
+    get egressDid(): string;
+    /** The only way to build an adapter: the trio is DERIVED here from
+     *  one root, one carrier, one nonce — so principal, connection DID
+     *  and egress identity cannot come from different relationships
+     *  (R7-B2: the coupling is enforced by construction, not by
+     *  inspecting caller-supplied identities). */
+    static create(rootIkm: Uint8Array, carrier: string, nonce: Uint8Array, wire: MediatorWire, restored?: AckState, restoredAt?: number): Promise<MediatorCarrierAdapter>;
+    constructor(key: symbol, principal: CarrierPrincipal, connection: CarrierScopedIdentity, egress: CarrierScopedIdentity, wire: MediatorWire, restored?: AckState, restoredAt?: number);
+    /** Records the desired keylist and returns; synchronization runs
+     *  as a tracked background task and advance retries it until it
+     *  lands (review-4 B1). */
+    register(rkids: string[], rawNow: number): void;
+    get keylistSynced(): boolean;
+    /** Returns the submission id synchronously. Before the first
+     *  honest report exists, status() returns null — §6.1's own
+     *  pre-report window, represented as absence, not as a value. */
+    submit(envelopeBytes: Uint8Array, rawNow: number): string;
+    /** Files an Outbound (its envelope as JCS bytes) and returns the
+     *  SubmissionRef the holder's reports are keyed by: submission id ↔
+     *  document digest (note §4.3). */
+    submitOutbound(outbound: Pick<Outbound, 'digest' | 'envelope'>, rawNow: number): SubmissionRef;
+    /** The current state as the ports' DeliveryReport for holder.report(),
+     *  or null while no honest report exists (and for an unknown id). A
+     *  submission filed without a digest (submit) has no report form. */
+    report(id: string): DeliveryReport | null;
+    has(id: string): boolean;
+    /** Host teardown aid, NOT a port operation (profile §6): awaits
+     *  the in-flight background tasks so a host can drain before
+     *  persisting ackState. On a hanging wire it waits as long as the
+     *  wire does — a host bounds it externally (Promise.race) exactly
+     *  because this library holds no clock of its own. */
+    settle(): Promise<void>;
+    /** The §6.1 report, or null while none exists yet (has()
+     *  distinguishes an unknown id). status is a PORT: after close it
+     *  refuses like every other port operation (R5-B3).
+     *
+     *  The pre-transport report is an HONEST SNAPSHOT, derived at the
+     *  moment of observation by one precedence order (Option B of the
+     *  round-14 halt) — never a stored patchwork:
+     *    (a) the wire knows itself offline      → offline
+     *    (b) an attempt is overdue              → transport-unreachable
+     *    (c) the last completed attempt's kind  → its report
+     *    (d) otherwise                          → no report yet (null)
+     *  Terminal states and `accepted` are stored and stand. */
+    status(id: string): SubmissionState | null;
+    acknowledged(id: string): void;
+    /** Refusals act on live submissions only (§6.1 knows exactly one
+     *  late correction — the valid ack). The code set is closed and
+     *  TERMINAL: retryable counterpart conditions (unavailable,
+     *  internalError) are transport outcomes, never receiver verdicts
+     *  — they have no entry here, and an unknown code is refused
+     *  fail-closed rather than minted into a verdict (R6-B2). */
+    receiverRefused(id: string, code: ReceiverRefusalCode): void;
+    drainTransitions(): Array<{
+        id: string;
+        to: 'delivered';
+    }>;
+    collect(rawNow: number): Collection;
+    /** Concludes a collection (profile §4, Delivery 5a.8): its items'
+     *  digests become ack intent. `keep` names the items whose disposition
+     *  is transient (Delivery RLTP-DEL-5810, 5820: `failed(rate-limited)`,
+     *  or a transaction that could not commit, see `concludable`): they are
+     *  not concluded and not acknowledged, they go back to the buffer and the
+     *  next collect offers them again, and the mediator keeps its copy. */
+    conclude(collection: {
+        id: string;
+    }, rawNow: number, opts?: {
+        keep?: readonly string[];
+    }): void;
+    ackState(): AckState;
+    advance(rawNow: number): void;
+    /** §5a.10 lifecycle boundary: after close, every state port is
+     *  inert — port operations refuse, inbound reports (acknowledged,
+     *  receiverRefused) are no-ops, late wire resolutions mutate
+     *  nothing. Only ackState() stays readable for the host's final
+     *  persist. */
+    close(): void;
+    get closed(): boolean;
+}
+export declare const queueIdOf: (bytes: Uint8Array) => Promise<string>;
+//# sourceMappingURL=vti-mediator.d.ts.map

package/dist/adapters/vti-mediator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vti-mediator.d.ts","sourceRoot":"","sources":["../../src/adapters/vti-mediator.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,QAAQ;;;;;;;EAOV,CAAA;AAGX,MAAM,MAAM,aAAa,GACrB,aAAa,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,UAAU,CAAA;AAE1E,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,aAAa,CAAA;gBACN,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E,YAAY,CAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAI/F,OAAO,CAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjD,aAAa,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,WAAW,CAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,SAAS,CAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1D,mEAAmE;IACnE,OAAO,CAAC,IAAK,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AASD,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,uBAAuB,GAAG,2BAA2B,CAAA;CAAE,GAC1G;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,2BAA2B,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAElF;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,cAAc,CASrF;AAED;;;;kCAIkC;AAClC,wBAAgB,WAAW,CAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEtD;AAKD,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE;AAElE;;kCAEkC;AAClC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAmBD,qBAAa,sBAAsB;;IAOjC,IAAI,SAAS,IAAK,MAAM,CAA2B;IACnD,IAAI,aAAa,IAAK,MAAM,CAA+B;IAC3D,IAAI,SAAS,IAAK,MAAM,CAA2B;IA2BnD;;;;kDAI8C;WACjC,MAAM,CACjB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EACvD,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAC3D,OAAO,CAAC,sBAAsB,CAAC;gBAahC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,YAAY,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM;IAsIrB;;+BAE2B;IAC3B,QAAQ,CAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQhD,IAAI,aAAa,IAAK,OAAO,CAG5B;IAyBD;;qEAEiE;IACjE,MAAM,CAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAkB1D;;uCAEmC;IACnC,cAAc,CAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa;IAQ/F;;yEAEqE;IACrE,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQ1C,GAAG,CAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwCzB;;;;0DAIsD;IAChD,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;;;;;+DAW2D;IAC3D,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3C,YAAY,CAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAU/B;;;;;iEAK6D;IAC7D,eAAe,CAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAgB7D,gBAAgB,IAAK,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,WAAW,CAAA;KAAE,CAAC;IAM3D,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,UAAU;IAepC;;;;;2EAKuE;IACvE,QAAQ,CAAE,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,IAAI;IAsBpG,QAAQ,IAAK,QAAQ;IAmErB,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IA8C9B;;;;mBAIe;IACf,KAAK,IAAK,IAAI;IAEd,IAAI,MAAM,IAAK,OAAO,CAAwB;CAC/C;AAED,eAAO,MAAM,SAAS,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,MAAM,CAA0B,CAAA"}