@real-life/trust-protocol 0.3.2 → 0.5.0

package/dist/prompts.js

@@ -0,0 +1,69 @@
+import { handlerPrepared } from './receive.js';
+/** The command name of the decision. */
+export const DECIDE = 'prompt.decide';
+const KINDS = ['encounter-confirm', 'group-invite', 'introduction'];
+/** The decision handlers of the modules, one per kind at most. */
+export function collectDecisions(modules) {
+    const out = new Map();
+    for (const m of modules) {
+        for (const [kind, h] of Object.entries(m?.decisions ?? {})) {
+            if (!KINDS.includes(kind))
+                throw new Error(`unknown prompt kind ${kind} (module ${m.name})`);
+            if (out.has(kind))
+                throw new Error(`duplicate decision handler ${kind} (module ${m.name})`);
+            if (typeof h !== 'function' && (h === null || typeof h !== 'object' || typeof h.apply !== 'function' || (h.prepare !== undefined && typeof h.prepare !== 'function'))) {
+                throw new TypeError(`decision handler ${kind} (module ${m.name}) must be a function or {prepare?, apply}`);
+            }
+            out.set(kind, h);
+        }
+    }
+    return out;
+}
+const validInput = (input) => input !== null && typeof input === 'object' && typeof input.promptId === 'string' && (input.choice === 'accept' || input.choice === 'decline');
+const decideDef = (decisions) => ({
+    human: true,
+    // a prepared handler's preparation, against the snapshot apply sees;
+    // nothing for an unknown, expired or malformed decision (apply answers it)
+    async prepare(ctx, input) {
+        if (!validInput(input) || !Object.hasOwn(ctx.snapshot.prompts, input.promptId))
+            return undefined;
+        const p = ctx.snapshot.prompts[input.promptId];
+        if (p.expiresAt !== undefined && p.expiresAt <= ctx.when)
+            return undefined;
+        const h = decisions.get(p.kind);
+        return h && typeof h !== 'function' && h.prepare ? h.prepare(ctx, p, input.choice) : undefined;
+    },
+    apply(state, prepared, input, when) {
+        if (input === null || typeof input !== 'object' || typeof input.promptId !== 'string')
+            throw new TypeError('prompt.decide needs {promptId: string, choice}');
+        if (input.choice !== 'accept' && input.choice !== 'decline')
+            throw new TypeError(`prompt.decide: choice must be accept or decline, got ${String(input.choice)}`);
+        const { promptId, choice } = input;
+        if (!Object.hasOwn(state.prompts, promptId))
+            return { ok: false, code: 'unknown-prompt' };
+        const p = state.prompts[promptId];
+        if (p.expiresAt !== undefined && p.expiresAt <= when)
+            return { ok: false, code: 'prompt-expired' };
+        const handler = decisions.get(p.kind);
+        const r = !handler ? { state: state }
+            : typeof handler === 'function' ? handler(state, p, choice, when)
+                : handler.apply(state, p, choice, when, handlerPrepared(prepared, prepared.value));
+        if (r.ok === false)
+            return r;
+        const done = r;
+        const prompts = { ...done.state.prompts };
+        delete prompts[promptId];
+        const decided = { type: 'prompt.decided', promptId, kind: p.kind, choice };
+        return {
+            state: { ...done.state, prompts },
+            ...(done.outbound ? { outbound: done.outbound } : {}),
+            ...(done.duties ? { duties: done.duties } : {}),
+            events: [...(done.events ?? []), decided],
+        };
+    },
+});
+/** The prompts module createHolder registers, over the modules' decision handlers. */
+export function promptsModule(decisions = new Map()) {
+    return Object.freeze({ name: 'prompts', commands: Object.freeze({ [DECIDE]: decideDef(decisions) }) });
+}
+//# sourceMappingURL=prompts.js.map

package/dist/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAG9C,wCAAwC;AACxC,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CAAA;AAIrC,MAAM,KAAK,GAA0B,CAAC,mBAAmB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;AAI1F,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAE,OAAgC;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+B,CAAA;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YACnH,IAAI,GAAG,CAAC,GAAG,CAAC,IAAkB,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YACzG,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAiB,CAAC,KAAK,KAAK,UAAU,IAAI,CAAE,CAAiB,CAAC,OAAO,KAAK,SAAS,IAAI,OAAQ,CAAiB,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC;gBACzN,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,YAAY,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAA;YAC5G,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,IAAkB,EAAE,CAAC,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAW,EAAE,CACjD,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;AAEhJ,MAAM,SAAS,GAAG,CAAC,SAAoB,EAAoC,EAAE,CAAC,CAAC;IAC7E,KAAK,EAAE,IAAI;IACX,qEAAqE;IACrE,2EAA2E;IAC3E,KAAK,CAAC,OAAO,CAAE,GAAG,EAAE,KAAK;QACvB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAA;QAChG,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC9C,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,SAAS,CAAA;QAC1E,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAChG,CAAC;IACD,KAAK,CAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI;QACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;QAC5J,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,wDAAwD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;QACzF,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;QAClG,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,GAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAoB,EAAE;YACrE,CAAC,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC;gBAC/D,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACtF,IAAK,CAAa,CAAC,EAAE,KAAK,KAAK;YAAE,OAAO,CAAY,CAAA;QACpD,MAAM,IAAI,GAAG,CAAY,CAAA;QACzB,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACzC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;QACxB,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;QACtF,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC;SAC1C,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAE,YAAuB,IAAI,GAAG,EAAE;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AACxG,CAAC","sourcesContent":["// prompts — the human's open decisions and the act that closes them\n// (lib Stage 2, note §2.1 prompts, §4.4, §4.5).\n//\n// Domain modules open prompts (encounter-confirm, group-invite,\n// introduction) inside their own transitions and announce prompt.opened;\n// this module closes them. `prompt.decide` is one human act (journaled\n// under the app's actId). createHolder registers this module beside the\n// domain modules, so its command name is taken.\n//\n// What a choice does in its domain (joining the group, confirming the\n// encounter, accepting the introduction) belongs to the module that opens\n// that kind of prompt: it registers a DecisionHandler for the kind\n// (HolderModule.decisions). The decision runs that handler in its own\n// transition, so the domain effect, its outbound and duties, and the\n// closing of the prompt commit together or not at all; a handler's\n// refusal refuses the decision. A kind without a handler is only closed.\n// The events are the handler's, then prompt.decided. At most one handler\n// per kind across all modules; a second, an unknown kind or a handler\n// that is no function throws when the holder is built.\n//\n// Expiry: a prompt with expiresAt <= when is refused as prompt-expired;\n// the refusal commits nothing, so the prompt stays until tick removes it\n// (engine.ts, built-in tick). An id without an open prompt is\n// unknown-prompt. A malformed input (a promptId that is no string, a\n// choice other than accept or decline) is a programming error and throws.\n//\n// A handler that signs or seals (PR 7: the counter-step, the membership\n// accept, the introduction's consent) is the prepared form {prepare?,\n// apply}: its preparation runs in the decision's own preparation, against\n// the snapshot its apply then sees (engine.ts, step 2).\nimport type { Applied, CommandDef, DecisionDef, DecisionHandler, EventDraft, HolderModule, Refusal } from './engine.js'\nimport { handlerPrepared } from './receive.js'\nimport type { HolderState, PromptChoice, PromptKind } from './state.js'\n\n/** The command name of the decision. */\nexport const DECIDE = 'prompt.decide'\n\nexport interface DecideInput { promptId: string, choice: PromptChoice }\n\nconst KINDS: readonly PromptKind[] = ['encounter-confirm', 'group-invite', 'introduction']\n\nexport type Decisions = ReadonlyMap<PromptKind, DecisionHandler>\n\n/** The decision handlers of the modules, one per kind at most. */\nexport function collectDecisions (modules: readonly HolderModule[]): Decisions {\n  const out = new Map<PromptKind, DecisionHandler>()\n  for (const m of modules) {\n    for (const [kind, h] of Object.entries(m?.decisions ?? {})) {\n      if (!(KINDS as readonly string[]).includes(kind)) throw new Error(`unknown prompt kind ${kind} (module ${m.name})`)\n      if (out.has(kind as PromptKind)) throw new Error(`duplicate decision handler ${kind} (module ${m.name})`)\n      if (typeof h !== 'function' && (h === null || typeof h !== 'object' || typeof (h as DecisionDef).apply !== 'function' || ((h as DecisionDef).prepare !== undefined && typeof (h as DecisionDef).prepare !== 'function'))) {\n        throw new TypeError(`decision handler ${kind} (module ${m.name}) must be a function or {prepare?, apply}`)\n      }\n      out.set(kind as PromptKind, h)\n    }\n  }\n  return out\n}\n\nconst validInput = (input: DecideInput): boolean =>\n  input !== null && typeof input === 'object' && typeof input.promptId === 'string' && (input.choice === 'accept' || input.choice === 'decline')\n\nconst decideDef = (decisions: Decisions): CommandDef<DecideInput, unknown> => ({\n  human: true,\n  // a prepared handler's preparation, against the snapshot apply sees;\n  // nothing for an unknown, expired or malformed decision (apply answers it)\n  async prepare (ctx, input) {\n    if (!validInput(input) || !Object.hasOwn(ctx.snapshot.prompts, input.promptId)) return undefined\n    const p = ctx.snapshot.prompts[input.promptId]\n    if (p.expiresAt !== undefined && p.expiresAt <= ctx.when) return undefined\n    const h = decisions.get(p.kind)\n    return h && typeof h !== 'function' && h.prepare ? h.prepare(ctx, p, input.choice) : undefined\n  },\n  apply (state, prepared, input, when) {\n    if (input === null || typeof input !== 'object' || typeof input.promptId !== 'string') throw new TypeError('prompt.decide needs {promptId: string, choice}')\n    if (input.choice !== 'accept' && input.choice !== 'decline') throw new TypeError(`prompt.decide: choice must be accept or decline, got ${String(input.choice)}`)\n    const { promptId, choice } = input\n    if (!Object.hasOwn(state.prompts, promptId)) return { ok: false, code: 'unknown-prompt' }\n    const p = state.prompts[promptId]\n    if (p.expiresAt !== undefined && p.expiresAt <= when) return { ok: false, code: 'prompt-expired' }\n    const handler = decisions.get(p.kind)\n    const r: Applied | Refusal = !handler ? { state: state as HolderState }\n      : typeof handler === 'function' ? handler(state, p, choice, when)\n        : handler.apply(state, p, choice, when, handlerPrepared(prepared, prepared.value))\n    if ((r as Refusal).ok === false) return r as Refusal\n    const done = r as Applied\n    const prompts = { ...done.state.prompts }\n    delete prompts[promptId]\n    const decided: EventDraft = { type: 'prompt.decided', promptId, kind: p.kind, choice }\n    return {\n      state: { ...done.state, prompts },\n      ...(done.outbound ? { outbound: done.outbound } : {}),\n      ...(done.duties ? { duties: done.duties } : {}),\n      events: [...(done.events ?? []), decided],\n    }\n  },\n})\n\n/** The prompts module createHolder registers, over the modules' decision handlers. */\nexport function promptsModule (decisions: Decisions = new Map()): HolderModule {\n  return Object.freeze({ name: 'prompts', commands: Object.freeze({ [DECIDE]: decideDef(decisions) }) })\n}\n"]}

package/dist/receive.d.ts

@@ -0,0 +1,134 @@
+import type { Json } from './core.js';
+import type { HolderState, Millis, Relationship, StoredAck, Tuple } from './state.js';
+/** An ack as sealed in the preparation; the engine adds its schedule. */
+export type SealedAck = Pick<StoredAck, 'digest' | 'envelope' | 'threadId' | 'recipient'>;
+import type { Outbound } from './ports.js';
+import type { ReceiveResult } from './results.js';
+import type { EventDraft, PrepareCtx, Prepared } from './engine.js';
+/** Where and when a document arrived: the own rkid it was sealed to, its
+ *  thread, its digest and the receive's `when`. */
+export interface Arrival {
+    rkid: string;
+    threadId: string;
+    digest: string;
+    when: Millis;
+}
+/** Why a task handler refuses a document; the stage follows from where:
+ *  decode 'malformed' → 7, decode or prepare otherwise → 8, apply → 9. */
+export type TaskFailure = 'malformed' | 'validation-failed' | 'stale-issuance' | 'gate-future' | 'consumed-challenge' | 'rate-limited';
+/** A handler's refusal: nothing commits, the digest stays uncached and
+ *  a redelivery is evaluated afresh (Delivery 6.2 stage 4) — with one
+ *  narrow, enumerated exception, the Encounter aging latch: an apply that
+ *  refuses because its authoritative resolution found an own challenge past
+ *  its age bound (Encounter 5260, 5270, 5290; Delivery 4.1 check 5) returns
+ *  `latch`, the state with that challenge removed, and the engine commits
+ *  exactly it (and the raised lastWhen): no cache entry, no ack, no event;
+ *  the disposition stays failed. A latch that touches anything beyond
+ *  encounter.challenges is a programming error and throws (engine.ts). */
+export interface TaskRefusal {
+    ok: false;
+    reason: TaskFailure;
+    ref?: string;
+    latch?: HolderState;
+}
+/** A discard at a resource limit (Trust 5365/5366), answered by apply:
+ *  `state` commits (assembly dropped, lower bound held), the disposition
+ *  is `discarded`, with no cache entry, no ack and no event. */
+export interface TaskDiscarded {
+    discarded: true;
+    reason: DiscardReason;
+    state: HolderState;
+    ref?: string;
+}
+/** Why an assembly was discarded: a local resource limit (5365), or an
+ *  authenticated violation of the assembly rules that rejects the delivery. */
+export type DiscardReason = 'resource-limit' | 'rejected';
+export declare const isTaskDiscarded: (x: unknown) => x is TaskDiscarded;
+/** A received document after stage 7: the profile fields, its payload
+ *  as the handler's decode returned it. Read-only. */
+export interface ReceivedDocument<T = unknown> {
+    readonly id: string;
+    readonly type: string;
+    readonly issuer: string;
+    readonly recipient: string;
+    readonly threadId: string;
+    readonly issuedAt: string;
+    readonly payload: T;
+    readonly ceremony?: Json;
+    readonly proof?: Json;
+}
+/** A sealed ack as the outbound the app sends, at the given attempt. */
+export declare const ackOutbound: (a: Readonly<SealedAck>, attempt: number) => Outbound;
+/** Signature-class types (Delivery 4.2/4.4): payloads whose authenticity
+ *  is a transferable signature; their acks are signed, not MACed. The
+ *  `x-` slugs are this library's own experimental, unregistered forms
+ *  for what the specifications leave to the application (the welcome until the Access envelope is
+ *  built; the introduction offer that conveys the target designator,
+ *  Trust 8.3): signed documents as well. A receiver that does not know
+ *  them answers unknown-type (Delivery §6.2). */
+export declare const SIGNATURE_CLASS: ReadonlySet<string>;
+/** The counterpart a `channel` binding names: the key agreement the ack
+ *  is sealed to and the contact it is filed under. */
+/** The binding a document arrives under: the counterpart's key and the
+ *  contact; `via`, where the arrival key is no tuple's (a member key), the
+ *  own rkid of the tuple the contact was named through (Recipient.via). */
+export interface Channel {
+    keyAgreement: string;
+    contactId: string;
+    via?: string;
+}
+export declare const isTaskRefusal: (x: unknown) => x is TaskRefusal;
+type Failed = Extract<ReceiveResult, {
+    disposition: 'failed';
+}>;
+/** What stages 1–8 decided, bound to the snapshot they ran against. */
+export type ReceivePlan = {
+    kind: 'failed';
+    result: Failed;
+} | {
+    kind: 'duplicate';
+    digest: string;
+} | {
+    kind: 'ack';
+    digest: string;
+    ref: string;
+    doc: ReceivedDocument;
+    arrival: Arrival;
+} | {
+    kind: 'task';
+    digest: string;
+    type: string;
+    doc: ReceivedDocument;
+    arrival: Arrival;
+    value: unknown;
+    ack: SealedAck;
+};
+/** The handler surface the core needs (engine.ts TaskHandler). */
+export interface TaskEntry {
+    proof: 'absent' | 'required';
+    decode(payload: unknown): unknown;
+    channel?(state: Readonly<HolderState>, doc: ReceivedDocument, rkid: string): Channel | TaskRefusal;
+    /** may arrive on a deactivated tuple an act pinned (engine TaskHandler) */
+    pinned?: true;
+    prepare?(ctx: PrepareCtx, doc: ReceivedDocument, arrival: Arrival): Promise<unknown>;
+}
+/** The tuple whose own rkid is `rkid`, with its relationship. */
+export declare function tupleByRkid(state: Readonly<HolderState>, rkid: string): {
+    rel: Relationship;
+    tuple: Tuple;
+} | null;
+/**
+ * Stages 1–8 against the preparation's snapshot. Never throws for
+ * anything the envelope carries; port failures surface as InfraError.
+ */
+export declare function prepareReceive(ctx: PrepareCtx, env: unknown, tasks: ReadonlyMap<string, TaskEntry>): Promise<ReceivePlan>;
+/** The outbox after a valid ack of `ref` (4.2, 6.1): delivered, late after
+ *  failed; unchanged when already delivered. Shared with report(). */
+export declare function markDelivered(state: Readonly<HolderState>, ref: string, when: Millis): {
+    outbox: HolderState['outbox'];
+    event: EventDraft | null;
+};
+/** Prepared for a handler: its own value under the receive's binding. */
+export declare const handlerPrepared: <P>(p: Prepared<unknown>, value: P) => Prepared<P>;
+export {};
+//# sourceMappingURL=receive.d.ts.map

package/dist/receive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.d.ts","sourceRoot":"","sources":["../src/receive.ts"],"names":[],"mappings":"AA+GA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAQrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAc,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEjG,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,CAAA;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C,OAAO,KAAK,EAAkB,aAAa,EAAkB,MAAM,cAAc,CAAA;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAInE;mDACmD;AACnD,MAAM,WAAW,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAEzF;0EAC0E;AAC1E,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,aAAa,GAAG,oBAAoB,GAAG,cAAc,CAAA;AAEtI;;;;;;;;0EAQ0E;AAC1E,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE;AAElG;;gEAEgE;AAChE,MAAM,WAAW,aAAa;IAAG,SAAS,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;AAE3G;+EAC+E;AAC/E,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,UAAU,CAAA;AAEzD,eAAO,MAAM,eAAe,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,aAC8B,CAAA;AAEhF;sDACsD;AACtD,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAA;CACtB;AAED,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,KAAG,QAC8D,CAAA;AAGpI;;;;;;iDAMiD;AACjD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAoB9C,CAAA;AAEF;sDACsD;AACtD;;2EAE2E;AAC3E,MAAM,WAAW,OAAO;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE;AAElF,eAAO,MAAM,aAAa,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,WACyE,CAAA;AAIzH,KAAK,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAA;AAE/D,uEAAuE;AACvE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,CAAA;AAE3H,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAA;IAC5B,MAAM,CAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAA;IAClC,OAAO,CAAC,CAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;IACnG,2EAA2E;IAC3E,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,OAAO,CAAC,CAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtF;AAUD,iEAAiE;AACjE,wBAAgB,WAAW,CAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG,IAAI,CAMnH;AAYD;;;GAGG;AACH,wBAAsB,cAAc,CAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CA+FhI;AAED;sEACsE;AACtE,wBAAgB,aAAa,CAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,CASnJ;AAED,yEAAyE;AACzE,eAAO,MAAM,eAAe,GAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,CAAC,CACR,CAAA"}

package/dist/receive.js

@@ -0,0 +1,317 @@
+// receive — the holder's receive core (lib Stage 2, note §4.3; Delivery
+// §6.2, §4.2, §4.4). The engine runs it as its built-in `receive`: the
+// preparation (async) walks stages 1–8, the transition (sync) is stage 9.
+//
+//   1–4  once, here, through delivery.receiveByAgreement: the key agreement
+//        is the KeyProvider's `agree` under the engine's release from
+//        `addresses` (a tombstone answers retired: stage 3; an rkid never
+//        issued answers unknown: stage 2); the completed-effect cache is
+//        `state.effects`
+//   5    the document profile (schema, calendar-valid issuedAt) and
+//        recipient = the own anchor of the label the arrival rkid derives
+//        under (addresses)
+//   6    dispatch by the full type URI with version: the built-in
+//        delivery-ack path, else the task register, else unknown-type;
+//        then the entry's proof declaration. Delivery §3 wants `proof`
+//        absent on every type but delivery-ack and registry-declaration,
+//        and §4.4 puts the declaration into the registry entry; the
+//        profile schema can name only the types it knows, so for
+//        companion types the rule is enforced here, the earliest stage at
+//        which the receiver holds the entry: a mismatch is
+//        failed(validation-failed)
+//   7–8  the handler's decode (malformed at 7, any other refusal at 8),
+//        the core's closed acceptance binding (Delivery 4.4: the arrival
+//        tuple is selected by rkid, the document's issuer is its
+//        counterpart anchor), the handler's prepare, and the ack: sealed
+//        here, before the transaction, from fresh entropy
+//   9    the handler's apply; the core files the effect-cache entry with
+//        the ack in the same commit (the handler never writes `effects`)
+//        and hands the ack out first among the outbound
+//
+// Acks (delivery-ack/0.1) are no registered task: one common path checks
+// the form (ack.ts macAckForm), then the consistency of 4.2 against the
+// outbox — `ref` is a document this holder sent on that thread, on the
+// arrival tuple (outbox item rkid = arrival rkid), the issuer is that
+// tuple's counterpart, the referenced document's type is of the
+// designated-verifier class (a MAC ack of a signature-class document is
+// the wrong class), and the MAC verifies under the arrival tuple's ack
+// key. A valid ack marks the item delivered (late after failed) and
+// earns a terminal cache entry, no ack of its own.
+//
+// The stage-9 lock set (Delivery 6.2): the engine serializes every
+// operation of a holder in one queue and commits by CAS — a strictly
+// stronger serialization than the lock set asks for (it holds every key
+// of the holder, not only the overlapping ones), which is how this
+// library implements it under Stage 2's one-writer contract. The lock set
+// — the digest, and for star and group-star chunks additionally the
+// assembly key (tuple, type, salt) of 4.4 — is held for the whole
+// evaluation; a CAS conflict re-reads and re-enters at stage 1, which
+// re-checks the cache at stage 4. The chunk types (trust/star.ts,
+// trust/group-star.ts, PR 4b) need no key of their own here: every
+// chunk of one tuple and type is evaluated against, and committed over,
+// the one state version its preparation read, so the completing chunk's
+// effect (validated assembly, accepted snapshot, completed-salt advance)
+// commits with the cache entry and the ack in one transaction.
+//
+// The lock keys a registering specification adds (Delivery RLTP-DEL-6210
+// to 6230): the relationship key of a message or an attributed invitation,
+// the holder-wide credential-digest key of every invitation, the
+// (genesis digest, inviter) key of the prelude (Membership 3950–3957,
+// 3980), and the writers that take them (a block, a chaining, a merge or
+// split, a deletion of a completion-record entry or a binding) are all
+// held by the same whole-state serialization.
+//
+// A refusal (TaskRefusal) never commits anything, at any stage. One of
+// them is transient: `rate-limited` (Delivery RLTP-DEL-5820, 6270, 6280),
+// a document beyond a bound its type declares; it earns no ack and no
+// cache entry, the carrier keeps it, and a redelivery is evaluated in
+// full. A rate the type places inside stage 9 is checked here in the
+// handler's preparation (stage 8), against the snapshot stage 9 commits
+// on — the same state, by the CAS above.
+//
+// A handler's apply may answer a TaskDiscarded: the receiver discarded an
+// open assembly and holds its salt as the lower bound (5366), for one of
+// two reasons: `resource-limit` (Trust 5365), or `rejected` — an
+// authenticated chunk (its MAC verified) violates the assembly rules
+// (5260–5310, 5500, 5510), and the spec rejects the whole delivery, so it
+// must not complete from any later chunk. That is a spec-mandated state
+// effect, not a failure of the document: its state commits and the result
+// is the disposition `discarded` with the reason and the rule — no
+// effect-cache entry (a redelivery is evaluated afresh and meets the lower
+// bound), no ack (the delivery must not complete), no event; the completed
+// high-water mark stays. A chunk that does not authenticate is a plain
+// refusal and touches nothing. DELIVERY GAP: Delivery §6.2 names no
+// disposition for a document whose processing ends in such a discard;
+// `discarded` (both reasons) is this library's, to be registered in
+// Delivery 0.82.
+//
+// A verified ack runs the ack handler a module registered for the
+// acknowledged item's type, in the ack's transaction (engine.ts
+// AckHandler): the sender side of 5660, completion by verified acks only.
+//
+// Ack class (4.4): the class follows the payload's audience class. The
+// types of SIGNATURE_CLASS carry transferable signatures (the encounter
+// carriers, the membership documents, the signed introduction artifacts,
+// the registry declaration): their ack is SIGNED, an eddsa-jcs-2022 proof
+// under the ack's issuer anchor through the KeyProvider (`sign` with the
+// arrival key's label). Every other type is designated-verifier and earns
+// the MAC form under the channel ack key of the arrival rkid and the
+// counterpart key. A received ack is checked in the form its referenced
+// outbox item's class selects; the other form is validation-failed.
+//
+// The acceptance binding before a tuple exists (PR 7): a handler with a
+// `channel` binds its document itself, from the document, where it may
+// arrive on an own key no tuple carries yet — the encounter bundle on the
+// displayed card's key (Delivery 4.1: the bundle establishes the tuple,
+// its issuer bound to card.anchor = credential.issuer), the membership
+// documents on member keys (Membership 3.1, 3.2). `channel` names the
+// counterpart's key agreement the ack is sealed to and the contact it is
+// filed under, or refuses (stage 7 for malformed, else 8). Every other
+// handler keeps the tuple binding of Delivery 4.4.
+import { calOK, iso, makeValidator, toU } from './core.js';
+import { diSignWith, diVerify, digestDoc, xRawOfMk } from './crypto.js';
+import { receiveByAgreement, seal } from './delivery.js';
+import { ACK_TYPE, ackDocument, ackKeyOf, ackProofForm, macAck, macAckForm, macAckValid, signedAckForm } from './ack.js';
+import { SCHEMAS } from './schemas.js';
+import { triasOf } from './state.js';
+import { entryOf, liveRel } from './trust/state.js';
+import { InfraError } from './results.js';
+export const isTaskDiscarded = (x) => x !== null && typeof x === 'object' && x.discarded === true;
+/** A sealed ack as the outbound the app sends, at the given attempt. */
+export const ackOutbound = (a, attempt) => structuredClone({ digest: a.digest, envelope: a.envelope, type: ACK_TYPE, threadId: a.threadId, recipient: a.recipient, attempt });
+const TT = 'https://real-life.org/trust-tasks/';
+/** Signature-class types (Delivery 4.2/4.4): payloads whose authenticity
+ *  is a transferable signature; their acks are signed, not MACed. The
+ *  `x-` slugs are this library's own experimental, unregistered forms
+ *  for what the specifications leave to the application (the welcome until the Access envelope is
+ *  built; the introduction offer that conveys the target designator,
+ *  Trust 8.3): signed documents as well. A receiver that does not know
+ *  them answers unknown-type (Delivery §6.2). */
+export const SIGNATURE_CLASS = new Set([
+    TT + 'encounter-bundle/0.1',
+    TT + 'encounter-credential-delivery/0.1',
+    TT + 'membership-invite/0.2',
+    TT + 'membership-accept/0.2',
+    TT + 'membership-evidence/0.1',
+    TT + 'membership-evidence/0.2',
+    TT + 'registry-declaration/0.1',
+    TT + 'introduction-request/0.1',
+    TT + 'introduction-forward/0.1',
+    TT + 'introduction-reply/0.1',
+    TT + 'membership-prelude-request/0.1',
+    TT + 'membership-prelude-reply/0.1',
+    // lib 0.4.0's prelude forms: never received any more (unknown-type), kept
+    // for the class of an outbox item a codec-1 state still holds, whose
+    // signed ack may yet arrive
+    TT + 'x-membership-prelude-request/0.1',
+    TT + 'x-membership-prelude-reply/0.1',
+    TT + 'x-membership-welcome/0.1',
+    TT + 'x-introduction-offer/0.1',
+]);
+export const isTaskRefusal = (x) => x !== null && typeof x === 'object' && x.ok === false && typeof x.reason === 'string';
+const V = makeValidator(SCHEMAS);
+const profileOk = (doc) => V.validate(doc, SCHEMAS['rltp-delivery-document.schema.json'], SCHEMAS['rltp-delivery-document.schema.json']).length === 0 &&
+    calOK(doc.issuedAt);
+const failed = (reason, stage, extra = {}) => ({ kind: 'failed', result: { disposition: 'failed', reason, stage, ...extra } });
+/** The tuple whose own rkid is `rkid`, with its relationship. */
+export function tupleByRkid(state, rkid) {
+    for (const id of Object.keys(state.relationships).sort()) {
+        const rel = state.relationships[id];
+        for (const tuple of rel.tuples)
+            if (tuple.rkid === rkid)
+                return { rel, tuple };
+    }
+    return null;
+}
+/** The arrival channel's ack key (4.2): X25519 of the own key behind
+ *  `rkid` and the counterpart key, HKDF under issuer/recipient. */
+async function ackKey(ctx, rkid, counterpartKeyAgreement, issuer, recipient) {
+    const raw = xRawOfMk(counterpartKeyAgreement);
+    if (!raw)
+        return null;
+    const a = await ctx.keys.agree(rkid, raw, ctx.release);
+    if (a.status !== 'available')
+        return null;
+    try {
+        return await ackKeyOf(a.shared, issuer, recipient, ctx.crypto.subtle);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Stages 1–8 against the preparation's snapshot. Never throws for
+ * anything the envelope carries; port failures surface as InfraError.
+ */
+export async function prepareReceive(ctx, env, tasks) {
+    const S = ctx.crypto.subtle;
+    const state = ctx.snapshot;
+    // 1–4
+    const agree = (rkid, epk) => ctx.keys.agree(rkid, epk, ctx.release);
+    const r = await receiveByAgreement(env, agree, (d) => Object.hasOwn(state.effects, d), S);
+    if (r.disposition === 'duplicate-known')
+        return { kind: 'duplicate', digest: r.digest };
+    if (r.disposition !== 'unique') {
+        const stage = r.stages[r.stages.length - 1].stage;
+        const reason = r.disposition.slice('failed('.length, -1);
+        return failed(reason, stage, r.key ? { key: r.key } : {});
+    }
+    const doc = r.document;
+    const digest = r.digest;
+    const rkid = env.rkid;
+    // 5 — profile, then recipient = own anchor under the arrival key's label
+    if (!profileOk(doc))
+        return failed('malformed', 5, { digest });
+    const release = ctx.release(rkid);
+    if (release.status !== 'live')
+        throw new InfraError('key-provider', 'agree answered for an rkid the release does not hold live');
+    const own = await ctx.keys.anchorOf(release.label);
+    if (doc.recipient !== own.anchor)
+        return failed('wrong-recipient', 5, { digest });
+    const at = tupleByRkid(state, rkid);
+    // 6 — the built-in ack path, in the form the acked document's class selects
+    if (doc.type === ACK_TYPE) {
+        const signed = ackProofForm(doc) === 'signed';
+        const f = signed ? signedAckForm(doc) : macAckForm(doc);
+        if (!f.ok)
+            return failed(f.reason, f.stage, { digest });
+        // 8 — consistency against what this holder sent (4.2): the document on
+        // that thread, sent from the arrival rkid, of the class the proof form
+        // claims; the issuer its recipient (the tuple's counterpart, or the
+        // anchor it went to where no tuple carried it)
+        // the ref in either rendering (u or z, 4.2) names the outbox item by its digest bytes
+        const ref = toU(f.ref) ?? f.ref;
+        const item = Object.hasOwn(state.outbox, ref) ? state.outbox[ref] : undefined;
+        if (!item || item.threadId !== f.threadId || item.recipient.rkid !== rkid || SIGNATURE_CLASS.has(item.type) !== signed)
+            return failed('validation-failed', 8, { digest });
+        const expected = at ? at.tuple.counterpartAnchor : item.recipient.anchor;
+        if (expected === undefined || doc.issuer !== expected)
+            return failed('validation-failed', 8, { digest });
+        if (signed) {
+            if (!(await diVerify(doc, doc.issuer, S)))
+                return failed('validation-failed', 8, { digest });
+        }
+        else {
+            const key = await ackKey(ctx, rkid, item.recipient.keyAgreement, doc.issuer, doc.recipient);
+            if (!key || !(await macAckValid(doc, key, S)))
+                return failed('validation-failed', 8, { digest });
+        }
+        const arrival = Object.freeze({ rkid, threadId: doc.threadId, digest, when: ctx.when });
+        return { kind: 'ack', digest, ref, doc: Object.freeze({ ...doc }), arrival };
+    }
+    // 6 — the task register, by the full type URI (no prefix, no fallback)
+    const h = tasks.get(doc.type);
+    if (!h)
+        return failed('unknown-type', 6, { digest });
+    if ((h.proof === 'absent') !== (doc.proof === undefined))
+        return failed('validation-failed', 6, { digest });
+    // 7–8 — decode, the closed acceptance binding, the handler's preparation
+    const payload = h.decode(doc.payload);
+    const refused = (r, stage) => failed(r.reason, stage, { digest, ...(r.ref !== undefined ? { ref: r.ref } : {}) });
+    if (isTaskRefusal(payload))
+        return refused(payload, payload.reason === 'malformed' ? 7 : 8);
+    const rdoc = Object.freeze({ ...doc, payload });
+    // the binding: the arrival tuple (4.4), or the handler's own channel
+    // where its document may arrive before any tuple (4.1, Membership)
+    let peer;
+    if (h.channel) {
+        const c = h.channel(state, rdoc, rkid);
+        if (isTaskRefusal(c))
+            return refused(c, c.reason === 'malformed' ? 7 : 8);
+        peer = c;
+    }
+    else {
+        if (!at || doc.issuer !== at.tuple.counterpartAnchor)
+            return failed('validation-failed', 8, { digest });
+        // a deactivated tuple takes nothing new (6190, 6240): the arrival tuple is
+        // the active head of a live relationship, unless the handler binds its
+        // artifacts to the tuples an act pinned before a chaining (8270)
+        if (!h.pinned && (!liveRel(at.rel) || at.rel.activeHead !== at.tuple.ownPairLabel))
+            return failed('validation-failed', 8, { digest, ref: 'RLTP-TRU-6240' });
+        // the entry the arrival's relationship sends under (2146), by its current id
+        peer = { keyAgreement: at.tuple.counterpartKeyAgreement, contactId: entryOf(state, at.rel)?.id ?? at.rel.contactId };
+    }
+    const arrival = Object.freeze({ rkid, threadId: doc.threadId, digest, when: ctx.when });
+    const value = h.prepare ? await h.prepare(ctx, rdoc, arrival) : undefined;
+    if (isTaskRefusal(value))
+        return refused(value, 8);
+    // the ack, sealed before the transaction (4.2: created inside the
+    // effect's transaction — it commits with the cache entry or not at all),
+    // in the form the document's class selects (4.4)
+    const base = ackDocument({
+        id: ctx.entropy.id('ack.id'), issuer: own.anchor, recipient: doc.issuer,
+        threadId: arrival.threadId, issuedAt: iso(ctx.when), ref: digest,
+    });
+    let ackDoc;
+    if (SIGNATURE_CLASS.has(doc.type)) {
+        ackDoc = await diSignWith(own.anchor, (b) => ctx.keys.sign(release.label, b), base, base.issuedAt, S);
+    }
+    else {
+        const key = await ackKey(ctx, rkid, peer.keyAgreement, own.anchor, doc.issuer);
+        if (!key)
+            return failed('validation-failed', 8, { digest });
+        ackDoc = await macAck(base, key, S);
+    }
+    const envelope = await seal(ackDoc, peer.keyAgreement, { ephSeed: ctx.entropy.bytes('seal.eph', 32), nonce: ctx.entropy.bytes('seal.nonce', 12) }, S);
+    const ack = {
+        digest: await digestDoc(ackDoc, S), envelope, threadId: arrival.threadId,
+        recipient: { contactId: peer.contactId, rkid, keyAgreement: peer.keyAgreement, ...(peer.via !== undefined ? { via: peer.via } : {}) },
+    };
+    return { kind: 'task', digest, type: doc.type, doc: rdoc, arrival, value, ack };
+}
+/** The outbox after a valid ack of `ref` (4.2, 6.1): delivered, late after
+ *  failed; unchanged when already delivered. Shared with report(). */
+export function markDelivered(state, ref, when) {
+    const it = state.outbox[ref];
+    if (it.history.some((s) => s.status === 'delivered'))
+        return { outbox: state.outbox, event: null };
+    const late = triasOf(it) === 'failed';
+    const { nextAttemptAt: _, ...rest } = it;
+    return {
+        outbox: { ...state.outbox, [ref]: { ...rest, history: [...it.history, { status: 'delivered', at: when, late }] } },
+        event: { type: 'delivery.status', digest: ref, threadId: it.threadId, status: 'delivered', late },
+    };
+}
+/** Prepared for a handler: its own value under the receive's binding. */
+export const handlerPrepared = (p, value) => Object.freeze({ value, version: p.version, commitSeq: p.commitSeq });
+//# sourceMappingURL=receive.js.map