@real-life/trust-protocol 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # Changelog
 
+## 0.5.0
+
+Takes up Message Tasks 0.1, Delivery Contract 0.82 and Membership Tasks
+0.20.
+
+- **Messages** (Message Tasks 0.1): `sendMessage(contactId, text,
+  {when, actId, replyTo?})` sends a `message@1` on a ready, unblocked
+  relationship (refused as `not-ready`, `blocked` or `message-invalid`;
+  event `message.sent` with the mid and the document digest). Reception
+  runs the stages of Delivery 6.2: the MAC under `k_msg`, the age bound
+  (`failed(stale-issuance)`) and the future bound on the holder's time
+  mark, the completion record per tuple (no new effect for a known body,
+  equivocation refused), the inbox entry committed with the cache entry
+  and the acknowledgement. `inbox()` lists the messages not yet taken
+  over, in display order; `takeMessages(ids, {when})` takes them over.
+  `ContactView.canMessage`. The pure forms (`messageKeyOf`,
+  `messageMac`, `messageProblem`, `MESSAGE_TYPE`, …) are exported from the
+  root.
+- **The block** (Message Tasks 6): `block(contactId)` and
+  `unblock(contactId)`, chain-level state of every relationship of the
+  entry, kept through chaining, merge and split; event `contact.blocked`,
+  `ContactView.blocked`. Under a block messages are discarded and
+  invitations declined into the register of declined invitations,
+  silently and acknowledged; the holder's own messages, invitations and
+  introduction acts toward a blocked relationship are refused. The
+  treatment of the Trust Layer's types waits for that layer's next
+  casting.
+- **Invitations** (Membership Tasks 0.20 §3.1): attributed to the
+  relationship of their prelude binding, or to none; at most 20 new
+  credential digests per relationship and day; one surfacing per
+  credential digest, decided with the register and the permanent record
+  of surfaced invitations.
+- **The prelude** (Membership §3.5): the registered types
+  `membership-prelude-request/0.1` and `membership-prelude-reply/0.1` with
+  the binding `membership-inviter@1`, kept per relationship for its life;
+  genesis digests compared by their bytes. **Breaking:** a holder of 0.4.0
+  sends `x-membership-prelude-*`, which 0.5.0 refuses as `unknown-type`.
+- The inviter admits without a human act only before
+  `validUntil + membership-skew + P90D` (Membership 3282).
+- **Delivery 0.82**: the transient disposition `failed(rate-limited)`
+  (nothing committed, no ack, no cache entry, evaluated afresh when
+  delivered again); an outbound may carry its type's sender lifetime,
+  after which resume moves it to `failed(task-expired)` and never hands it
+  out again — for a message `sentAt + P179D`, after any retry horizon
+  (at most P90D), so an undelivered message fails as
+  `failed(expired-by-adapter-policy)` first.
+- `./adapters/vti-mediator`: `conclude(collection, now, {keep})` leaves
+  transient items unconcluded and offers them again; `concludable(result)`.
+- **State codec 2**, with a pure migration from codec 1 (no block, no
+  rate, no record, no inbox; the ready tuples read from the state; every
+  received invitation counted as surfaced), its non-normative schema
+  `schemas/holder-state-v2.schema.json` and the type `HolderStateV2`, and
+  golden fixtures reproduced in `npm test`. The codec 1 fixtures are
+  frozen as 0.4.0 wrote them and migrated in the tests.
+- Closed unions grown: `ActError` (`blocked`, `not-ready`,
+  `message-invalid`), `ReceiveFailure` (`rate-limited`), `HolderEvent`
+  (`contact.blocked`, `message.sent`, `message.received`), the outbox's
+  failure reasons (`task-expired`), the entropy purposes (`message.mid`).
+- Engine (for modules): `keepKeys(state, when)` gets the tick's time; the
+  module hook `accepted` runs in the stage-9 transaction of every unique
+  document.
+- Tests: the scenario set of Message Tasks §10.2, the race of #103 on two
+  engines over one store, and a seeded interleaving generator over
+  messages, the block, take-over and the record's retention.
+
 ## 0.4.0
 
 - `createHolder`: one person's device state behind typed human acts

package/README.md

@@ -67,10 +67,11 @@ The human acts: `show`, `scan`, `captureSentCard`, `counter` (the encounter),
 `decide` (a prompt: confirm an encounter, accept an invitation, take up or
 consent to an introduction), `trust`, `untrust`, `pauseTrust`, `setClass`,
 `setGroupClass`, `merge`, `depart`, `setProfile`, `foundGroup`, `invite`,
-`vouchFor`, `introduce`, `rotateAnchor`, `addDevice`, `revokeDevice`. Not
-human: `receive`, `report`, `resume`, `tick`, `recover`. Reads: `contacts`,
-`contact`, `groups`, `profile`, `prompts`, `deliveryStatus`, `deviceKey`,
-`snapshot`, `subscribe`.
+`vouchFor`, `introduce`, `sendMessage`, `block`, `unblock`, `rotateAnchor`,
+`addDevice`, `revokeDevice`. Not
+human: `receive`, `report`, `resume`, `tick`, `recover`, `takeMessages`.
+Reads: `contacts`, `contact`, `groups`, `profile`, `prompts`, `inbox`,
+`deliveryStatus`, `deviceKey`, `snapshot`, `subscribe`.
 
 ## What the root exports
 
@@ -80,14 +81,17 @@ human: `receive`, `report`, `resume`, `tick`, `recover`. Reads: `contacts`,
   `RetryPolicy`, `DeliveryReport`, `Outbound`; `seedKeys(seed)` is the
   default KeyProvider, `randomEntropy` the default Entropy.
 - The views: `ContactView`, `GroupView`, `PromptView`, `ProfileView`,
-  `DeliveryStatusView` and their parts.
+  `InboxMessageView`, `DeliveryStatusView` and their parts.
 - The results and events: `ActResult`, `ReceiveResult`, `ResumeResult`,
   `InfraError`, `CryptoUnavailableError`, `HolderEvent`.
 - The state as an opaque type (`HolderState`), `decodeState`, `CODEC`,
   `StateCodecError`, and `storeContract`, the suite a Store adapter passes.
 - The pure wire builders and verifiers of every layer (`core`, `crypto`,
-  `identity`, `profile`, `encounter`, `membership`, `introduction`,
-  `delivery`, `carrier-identity`, `carrier`, `carrier-holder`), and two
+  `identity`, `profile`, `encounter`, `membership`, `message` —
+  `MESSAGE_TYPE`, `messageKeyOf`, `messageMac`, `messageProblem`,
+  `messageShapeOk` and the constants of Message Tasks 0.1 —,
+  `introduction`, `delivery`, `carrier-identity`, `carrier`,
+  `carrier-holder`), and two
   namespaces of pure forms: `visibility` (anchor, star, group star,
   continuity, acks) and `ceremony` (the encounter's, the group's and the
   introduction's forms).
@@ -98,7 +102,7 @@ Other entry points:
 |---|---|
 | `./testing` | `InMemoryStore`, `memoryLog`, `scriptedEntropy`, `storeContract`, `emptyState`, `stateBuilder`, `freezeDeep`, `sampleState`, `openPromptModule`, the invariant checks, `forgeMapping` (deniability, Trust 6.1), `SCHEMAS` and the generated `wire` types. For tests, vectors and adapter authors; not for production holders. |
 | `./internal` | The structural `HolderState`, `encodeState` and the codec chain, the engine's module types, the pure view functions, the modules' factories and pure reads. For the library's own modules and tests; not an app contract. |
-| `./adapters/vti-mediator` | The VTI mediator as a carrier adapter: its submission states as `DeliveryReport`, collection and ack handling. |
+| `./adapters/vti-mediator` | The VTI mediator as a carrier adapter: its submission states as `DeliveryReport`, collection and ack handling, the selective conclusion of a collection (`conclude(c, now, {keep})`, `concludable(result)`: a `failed(rate-limited)` item stays with the carrier). |
 
 ## The modules and the rules they implement
 
@@ -117,9 +121,10 @@ Bare four-digit numbers are RLTP-TRU rules; the other layers name theirs.
 | `trust/continuity` | Trust §6a | `continuity-probe@1` and `continuity-mapping@1`, chaining a re-encounter into the existing relationship (6a.4) |
 | `trust/profile`, `profile` | Trust §6b | `profile@1`: the one revision counter (6450), delivery on the class gates (6455), reception and the image bounds (6475) |
 | `trust/duties` | Trust 2850, 6370, 6455, 6595, 6596 | the duties a commit leaves: class on, re-issue after a rotation, the lag rule |
-| `membership`, `membership/holder` | Membership Tasks 0.19 on Access 0.57 | founding (Access 3.4.1), the prelude, invite, accept, admission and welcome, evidence relay and `vouch@2` (Access 5.3), an in-library Access over the holder's groups |
+| `membership`, `membership/holder` | Membership Tasks 0.20 on Access 0.57 | founding (Access 3.4.1), the prelude (3.5: `membership-prelude-request/0.1`, `membership-prelude-reply/0.1`, the binding per relationship), invite, accept, admission within the bound of 3282 and welcome, evidence relay and `vouch@2` (Access 5.3), an in-library Access over the holder's groups |
+| `message`, `message/holder` | Message Tasks 0.1 | `message@1`, `k_msg` and its MAC (3); sending on a ready, unblocked relationship with the sender lifetime (5); reception through the stages with the age and future bounds on the time mark, the completion record, the inbox taken over by the app, the rates and the inbox bound as `failed(rate-limited)` (4); the block of a relationship (6010–6030, 6510), its discard of messages and its treatment of invitations and prelude replies (Membership 3115, 3975), the holder's own offers refused (6410) |
 | `introduction`, `introduction/holder` | Trust §8 on Delivery §4.4 | the Introduction Act in its three roles: request, forward, reply, the mediator's one ack at its declared delay, the vouchers; the requester's timeout at the act's expiry (8340; A20, spec follow-up 18: no ack timeout of 8690) |
-| `receive`, `engine` | Delivery 0.81 §5, §6.1, §6.2 | the sealed envelope, stages 1–9 once per envelope, the task register by full task URI, the completed-effect cache with stored acks, the outbox with the status trias, retry by backoff, give-up at the horizon, the act journal |
+| `receive`, `engine` | Delivery 0.82 §5, §6.1, §6.2 | the sealed envelope and the two key classes, stages 1–9 once per envelope with the dispositions `discarded` and the transient `failed(rate-limited)`, the task register by full task URI, the completed-effect cache with stored acks, the outbox with the status trias, retry by backoff, give-up at the horizon, the act journal |
 | `carrier-identity`, `carrier`, `carrier-holder` | Identity §7a, Delivery §4.4, §5a, Identity §9.3 | the carrier-relationship principal, the carrier port's state machine, proofs, verdicts and recovery |
 | `views`, `prompts` | — | the read model: contacts by entry (2120, 2140), groups, prompts, the delivery status |
 
@@ -145,22 +150,38 @@ the state as opaque JSON and gives it back; the library decodes it
 (`decodeState`), the adapter never migrates.
 
 - **Codec 1** is the format of 0.4.0, the first stable one. Its golden
-  fixtures (`test/fixtures/state-v1*.json`, deterministic runs of
-  `test/fixtures/gen-state-v1.mjs`, reproduced in `npm test`) cover a
-  settled holder, one with work open (prompts, a joining invite, duties, a
+  fixtures (`test/fixtures/state-v1*.json`, written by lib 0.4.0 with
+  `test/fixtures/gen-state-v1.mjs` and frozen since) cover a settled
+  holder, one with work open (prompts, a joining invite, duties, a
   rotation at step 2) and one with a tombstone, a revoked device and
-  carrier entries; each decodes and re-encodes byte for byte. A later codec brings its validator, a pure migration from the
-  one before, and its own fixture with a migration test.
+  carrier entries. They validate under codec 1 and migrate to codec 2.
+- **Codec 2** is the format of 0.5.0: codec 1 with the state of Message
+  Tasks 0.1 (`messages`: the block, the rates, the ready tuples, the
+  completion record, the inbox), an outbox item's sender lifetime
+  (`expiresAt`) and `failed(task-expired)`, and the record of surfaced
+  and the register of declined invitations (`joining.surfaced`,
+  `joining.declined`); an invitation may be attributed to no
+  relationship. The migration from codec 1 is pure: no block, no rate, no
+  record, no inbox, the ready tuples read from what the counterparts'
+  documents left, every invitation received counted as surfaced. Its
+  fixtures (`test/fixtures/state-v2*.json`, deterministic runs of
+  `test/fixtures/gen-state-v2.mjs`, reproduced in `npm test`) add
+  messages to the settled holder and a block and a declined invitation to
+  the open one; each decodes and re-encodes byte for byte. A later codec brings its validator, a pure
+  migration from the one before, and its own fixture with a migration
+  test.
 - A newer codec is refused as `codec-newer`, a codec without a validator
   as `codec-unknown`; nothing is read best-effort.
-- `schemas/holder-state-v1.schema.json` describes codec 1 as a
-  non-normative JSON Schema (published with the package). The type
-  `HolderStateV1` (`./internal`) is generated from it
-  (`scripts/build-holder-state-types.mjs`); the build holds it against the
-  library's `HolderState`, and the tests hold the schema against the
-  codec's validator on the fixtures and on mutations of them. Two rules
-  only the codec states: a record's id equals its key, and an envelope's
-  `rkid` equals its recipient's `keyAgreement`.
+- `schemas/holder-state-v1.schema.json` and
+  `schemas/holder-state-v2.schema.json` describe the codecs as
+  non-normative JSON Schemas (published with the package). The types
+  `HolderStateV1` and `HolderStateV2` (`./internal`) are generated from
+  them (`scripts/build-holder-state-types.mjs`); the build holds the
+  current one against the library's `HolderState`, and the tests hold each
+  schema against its codec's validator on the fixtures and on mutations
+  of them. Rules only the codec states: a record's id equals its key, an
+  envelope's `rkid` equals its recipient's `keyAgreement`, and (codec 2) a
+  set of strings is sorted.
 
 **Writing a Store adapter.** Implement `read(): Promise<{state, version}>`
 (a deep, independent copy; `null` state and version for an empty store) and
@@ -201,9 +222,10 @@ This package uses its own semver; the specification uses castings.
 | identity | Identity 0.54 | recovery derivation (§5.3), service identities (§7) |
 | encounter | Encounter 0.31, cards 0.25, credentials 0.26 | — |
 | trust | Trust Layer 0.31 | — |
-| membership | Membership Tasks 0.19, Access 0.57 | the Access envelope (Membership 3.3: `access-operation/0.1` with `member.add` and the sealed welcome; this library sends its own `x-membership-welcome/0.1`, and the prelude as `x-membership-prelude-*`); roster replication: a holder knows the members it admitted and the roster its welcome carried |
+| membership | Membership Tasks 0.20, Access 0.57 | the Access envelope (Membership 3.3: `access-operation/0.1` with `member.add` and the sealed welcome; this library sends its own `x-membership-welcome/0.1`); an admission prompt after the bound of RLTP-MT-3282; roster replication: a holder knows the members it admitted and the roster its welcome carried |
 | introduction | Trust 0.31 §8 | how a requester learns the mediator's designator (8.3): this library's mediator sends `x-introduction-offer/0.1` |
-| delivery | Delivery 0.81 | transport adapters beyond `./adapters/vti-mediator` |
+| delivery | Delivery 0.82 | transport adapters beyond `./adapters/vti-mediator`; the block of the Trust Layer's types (Message Tasks 6240: their treatments wait for the next casting of the Trust Layer) |
+| message | Message Tasks 0.1 | holding a message unsent until its tuple is ready (5020): `sendMessage` answers `not-ready` and the app keeps the message; checking `replyTo` against the relationship's history (5120), which is the app's; multi-device (§9); `failed(task-expired)` for a message: reachable only with a retry horizon beyond P179D, which the engine does not admit (at most P90D), so an undelivered message ends as `failed(expired-by-adapter-policy)` |
 | devices | Identity §5.5 | multi-device production: one writer per holder |
 
 ## The contract: the vectors

package/dist/adapters/vti-mediator.d.ts

@@ -1,14 +1,15 @@
 import type { CarrierPrincipal, CarrierScopedIdentity } from '../carrier-identity.js';
 import type { DeliveryReport, Outbound, ReceiverRefusalCode, SubmissionRef } from '../ports.js';
+import type { ReceiveResult } from '../results.js';
 export type { ReceiverRefusalCode } from '../ports.js';
-export declare const DECLARED: {
+export declare const DECLARED: Readonly<{
     readonly giveUpHorizonMs: number;
     readonly statusHorizonMs: 60000;
     readonly queueFloorCount: 64;
     readonly queueFloorBytes: 1048576;
     readonly maxQueueBytes: 16777216;
     readonly duplicateWindowMs: number;
-};
+}>;
 export type WireErrorKind = 'unreachable' | 'refused-retriable' | 'refused-admission' | 'oversize';
 export declare class WireError extends Error {
     kind: WireErrorKind;
@@ -57,6 +58,12 @@ export type SubmissionState = {
 /** The ports' DeliveryReport for a document `digest` in adapter state `st`
  *  (Delivery §6.1): one-to-one, `late` and the refusal code carried over. */
 export declare function deliveryReportOf(digest: string, st: SubmissionState): DeliveryReport;
+/** Whether a receive outcome is terminal and its item may be concluded
+ *  (Delivery 5a.8): every disposition but `failed(rate-limited)`, the one
+ *  failure that is transient (RLTP-DEL-5820). An InfraError of the
+ *  holder's store is transient as well (RLTP-DEL-5810): an item whose
+ *  receive threw is kept, too. */
+export declare function concludable(r: ReceiveResult): boolean;
 export interface CollectedItem {
     bytes: Uint8Array;
     queueId: string;
@@ -137,9 +144,17 @@ export declare class MediatorCarrierAdapter {
         to: 'delivered';
     }>;
     collect(rawNow: number): Collection;
+    /** Concludes a collection (profile §4, Delivery 5a.8): its items'
+     *  digests become ack intent. `keep` names the items whose disposition
+     *  is transient (Delivery RLTP-DEL-5810, 5820: `failed(rate-limited)`,
+     *  or a transaction that could not commit, see `concludable`): they are
+     *  not concluded and not acknowledged, they go back to the buffer and the
+     *  next collect offers them again, and the mediator keeps its copy. */
     conclude(collection: {
         id: string;
-    }, rawNow: number): void;
+    }, rawNow: number, opts?: {
+        keep?: readonly string[];
+    }): void;
     ackState(): AckState;
     advance(rawNow: number): void;
     /** §5a.10 lifecycle boundary: after close, every state port is

package/dist/adapters/vti-mediator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vti-mediator.d.ts","sourceRoot":"","sources":["../../src/adapters/vti-mediator.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC/F,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGtD,eAAO,MAAM,QAAQ;;;;;;;CAOX,CAAA;AAGV,MAAM,MAAM,aAAa,GACrB,aAAa,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,UAAU,CAAA;AAE1E,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,aAAa,CAAA;gBACN,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E,YAAY,CAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAI/F,OAAO,CAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjD,aAAa,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,WAAW,CAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,SAAS,CAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1D,mEAAmE;IACnE,OAAO,CAAC,IAAK,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AASD,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,uBAAuB,GAAG,2BAA2B,CAAA;CAAE,GAC1G;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,2BAA2B,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAElF;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,cAAc,CASrF;AAED,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE;AAElE;;kCAEkC;AAClC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAmBD,qBAAa,sBAAsB;;IAOjC,IAAI,SAAS,IAAK,MAAM,CAA2B;IACnD,IAAI,aAAa,IAAK,MAAM,CAA+B;IAC3D,IAAI,SAAS,IAAK,MAAM,CAA2B;IA2BnD;;;;kDAI8C;WACjC,MAAM,CACjB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EACvD,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAC3D,OAAO,CAAC,sBAAsB,CAAC;gBAahC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,YAAY,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM;IAqIrB;;+BAE2B;IAC3B,QAAQ,CAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQhD,IAAI,aAAa,IAAK,OAAO,CAG5B;IAyBD;;qEAEiE;IACjE,MAAM,CAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAiB1D;;uCAEmC;IACnC,cAAc,CAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa;IAQ/F;;yEAEqE;IACrE,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQ1C,GAAG,CAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAuCzB;;;;0DAIsD;IAChD,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;;;;;+DAW2D;IAC3D,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3C,YAAY,CAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAU/B;;;;;iEAK6D;IAC7D,eAAe,CAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAgB7D,gBAAgB,IAAK,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,WAAW,CAAA;KAAE,CAAC;IAM3D,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,UAAU;IAapC,QAAQ,CAAE,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAc3D,QAAQ,IAAK,QAAQ;IAkErB,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IA8C9B;;;;mBAIe;IACf,KAAK,IAAK,IAAI;IAEd,IAAI,MAAM,IAAK,OAAO,CAAwB;CAC/C;AAED,eAAO,MAAM,SAAS,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,MAAM,CAA0B,CAAA"}
+{"version":3,"file":"vti-mediator.d.ts","sourceRoot":"","sources":["../../src/adapters/vti-mediator.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,QAAQ;;;;;;;EAOV,CAAA;AAGX,MAAM,MAAM,aAAa,GACrB,aAAa,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,UAAU,CAAA;AAE1E,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,aAAa,CAAA;gBACN,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E,YAAY,CAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAI/F,OAAO,CAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjD,aAAa,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,WAAW,CAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,SAAS,CAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1D,mEAAmE;IACnE,OAAO,CAAC,IAAK,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AASD,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,uBAAuB,GAAG,2BAA2B,CAAA;CAAE,GAC1G;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,2BAA2B,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAElF;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,cAAc,CASrF;AAED;;;;kCAIkC;AAClC,wBAAgB,WAAW,CAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEtD;AAKD,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE;AAElE;;kCAEkC;AAClC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAmBD,qBAAa,sBAAsB;;IAOjC,IAAI,SAAS,IAAK,MAAM,CAA2B;IACnD,IAAI,aAAa,IAAK,MAAM,CAA+B;IAC3D,IAAI,SAAS,IAAK,MAAM,CAA2B;IA2BnD;;;;kDAI8C;WACjC,MAAM,CACjB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EACvD,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAC3D,OAAO,CAAC,sBAAsB,CAAC;gBAahC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,YAAY,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM;IAsIrB;;+BAE2B;IAC3B,QAAQ,CAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQhD,IAAI,aAAa,IAAK,OAAO,CAG5B;IAyBD;;qEAEiE;IACjE,MAAM,CAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAkB1D;;uCAEmC;IACnC,cAAc,CAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa;IAQ/F;;yEAEqE;IACrE,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQ1C,GAAG,CAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwCzB;;;;0DAIsD;IAChD,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;;;;;+DAW2D;IAC3D,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3C,YAAY,CAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAU/B;;;;;iEAK6D;IAC7D,eAAe,CAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAgB7D,gBAAgB,IAAK,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,WAAW,CAAA;KAAE,CAAC;IAM3D,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,UAAU;IAepC;;;;;2EAKuE;IACvE,QAAQ,CAAE,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,IAAI;IAsBpG,QAAQ,IAAK,QAAQ;IAmErB,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IA8C9B;;;;mBAIe;IACf,KAAK,IAAK,IAAI;IAEd,IAAI,MAAM,IAAK,OAAO,CAAwB;CAC/C;AAED,eAAO,MAAM,SAAS,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,MAAM,CAA0B,CAAA"}

package/dist/adapters/vti-mediator.js

@@ -12,6 +12,13 @@
 // round journals under design/adapter-review*). A
 // transport adapter contract — NOT a carrier at the port.
 //
+// Beyond the profile (lib 0.5.0): conclude(collection, now, {keep}) leaves
+// the items whose disposition is transient unconcluded and offers them
+// again (Delivery 0.82 RLTP-DEL-5810, 5820: failed(rate-limited) is never
+// concluded); `concludable(result)` says which receive outcomes are
+// terminal. The profile's §4 concludes a collection whole; its next
+// casting is to take this up.
+//
 // Structural rules (reviews 3+4):
 //   · No port operation ever awaits the mediator — including
 //     register: keylist synchronization is a recorded intent with a
@@ -26,14 +33,15 @@ import { jcs } from '../core.js';
 import { sha } from '../crypto.js';
 import { carrierPrincipal, carrierScopedIdentity } from '../carrier-identity.js';
 // ── Declared constants (profile §2) — promises of THIS casting ──────
-export const DECLARED = {
+// frozen: the declared promises cannot be changed at run time either
+export const DECLARED = Object.freeze({
     giveUpHorizonMs: 72 * 3_600_000,
     statusHorizonMs: 60_000,
     queueFloorCount: 64,
     queueFloorBytes: 1_048_576,
     maxQueueBytes: 16_777_216,
     duplicateWindowMs: 30 * 86_400_000,
-};
+});
 export class WireError extends Error {
     kind;
     constructor(kind, message) {
@@ -59,6 +67,16 @@ export function deliveryReportOf(digest, st) {
             : { digest, status: 'failed', reason: st.reason };
     }
 }
+/** Whether a receive outcome is terminal and its item may be concluded
+ *  (Delivery 5a.8): every disposition but `failed(rate-limited)`, the one
+ *  failure that is transient (RLTP-DEL-5820). An InfraError of the
+ *  holder's store is transient as well (RLTP-DEL-5810): an item whose
+ *  receive threw is kept, too. */
+export function concludable(r) {
+    return !(r.disposition === 'failed' && r.reason === 'rate-limited');
+}
+/** The adapter's own copy of a wire's token set: the wire keeps no handle on it. */
+const tokenCopy = (t) => ({ accessToken: t.accessToken, accessExpiresAt: t.accessExpiresAt, refreshToken: t.refreshToken, refreshExpiresAt: t.refreshExpiresAt });
 const hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
 // construction capability: only create() holds it
 const KEY = Symbol('MediatorCarrierAdapter.create');
@@ -161,7 +179,8 @@ export class MediatorCarrierAdapter {
         this.#wire.onDeliver(async (raw) => {
             if (this.#closed)
                 return;
-            const bytes = raw.slice();
+            // a plain copy of its own: a Node Buffer's slice() would share memory
+            const bytes = new Uint8Array(raw);
             const queueId = hex(await sha(bytes));
             if (this.#closed)
                 return;
@@ -229,7 +248,7 @@ export class MediatorCarrierAdapter {
                     const refreshed = await this.#wire.refresh(this.#tokens.refreshToken);
                     if (this.#closed)
                         throw new Error('retired'); // as on the handshake path (R6-B1)
-                    this.#tokens = refreshed;
+                    this.#tokens = tokenCopy(refreshed);
                     return this.#tokens.accessToken;
                 }
                 catch (e) {
@@ -247,7 +266,7 @@ export class MediatorCarrierAdapter {
             const { challenge, sessionId } = await this.#wire.authChallenge(this.#connectionDid);
             if (this.#closed)
                 throw new Error('retired'); // nothing new starts, not even the answer (R6-B1)
-            this.#tokens = await this.#wire.authenticate({ did: this.#connectionDid, challenge, sessionId });
+            this.#tokens = tokenCopy(await this.#wire.authenticate({ did: this.#connectionDid, challenge, sessionId }));
             return this.#tokens.accessToken;
         })();
         this.#authing = run.finally(() => { this.#authing = null; });
@@ -278,7 +297,7 @@ export class MediatorCarrierAdapter {
                 const token = await this.#ensureAuth(now);
                 if (this.#closed)
                     return;
-                await this.#wire.keylistUpdate(token, wanted);
+                await this.#wire.keylistUpdate(token, [...wanted]); // the wire's own list: `wanted` is compared below
                 // land only if the desire has not moved meanwhile
                 if (!this.#closed && this.#desiredRkids !== null &&
                     wanted.join(' ') === this.#desiredRkids.join(' ')) {
@@ -303,7 +322,8 @@ export class MediatorCarrierAdapter {
         const id = 's' + this.#nextId++;
         const knownOffline = this.#wire.offline?.() === true;
         const sub = {
-            bytes: envelopeBytes.slice(),
+            // a plain copy of its own (a Node Buffer's slice() shares memory)
+            bytes: new Uint8Array(envelopeBytes),
             submittedAt: now,
             attemptStartedAt: null,
             lastKind: null,
@@ -355,7 +375,8 @@ export class MediatorCarrierAdapter {
             const token = await this.#ensureAuth(now);
             if (this.#closed)
                 return; // retirement between auth and deposit: nothing new starts (R5-B2)
-            await this.#wire.deposit(token, sub.bytes, this.#egressDid);
+            // each attempt hands the wire a copy: what it does with it never reaches the next
+            await this.#wire.deposit(token, new Uint8Array(sub.bytes), this.#egressDid);
             sub.lastKind = null;
             next = { state: 'accepted' };
         }
@@ -406,7 +427,7 @@ export class MediatorCarrierAdapter {
         if (!sub)
             return null;
         if (sub.st !== null && sub.st.state !== 'awaiting-transport')
-            return sub.st;
+            return { ...sub.st };
         if (this.#wire.offline?.() === true) {
             return { state: 'awaiting-transport', reason: 'offline' };
         }
@@ -414,7 +435,7 @@ export class MediatorCarrierAdapter {
             this.#clock - sub.attemptStartedAt >= DECLARED.statusHorizonMs) {
             return { state: 'awaiting-transport', reason: 'transport-unreachable' };
         }
-        return sub.st;
+        return sub.st === null ? null : { ...sub.st };
     }
     acknowledged(id) {
         if (this.#closed)
@@ -469,17 +490,33 @@ export class MediatorCarrierAdapter {
         this.#inboxDigests.clear();
         const id = 'c' + this.#nextColId++;
         this.#outstanding.set(id, new Map(items.map((i) => [i.queueId, i])));
-        return { id, items: items.map((i) => ({ ...i })) };
+        // the caller gets its own copies: the outstanding entries stay intact,
+        // whatever it does with the bytes, for a conclusion that keeps them
+        return { id, items: items.map((i) => ({ ...i, bytes: new Uint8Array(i.bytes) })) };
     }
-    conclude(collection, rawNow) {
+    /** Concludes a collection (profile §4, Delivery 5a.8): its items'
+     *  digests become ack intent. `keep` names the items whose disposition
+     *  is transient (Delivery RLTP-DEL-5810, 5820: `failed(rate-limited)`,
+     *  or a transaction that could not commit, see `concludable`): they are
+     *  not concluded and not acknowledged, they go back to the buffer and the
+     *  next collect offers them again, and the mediator keeps its copy. */
+    conclude(collection, rawNow, opts = {}) {
         this.#open();
         const now = this.#now(rawNow);
         const col = this.#outstanding.get(collection.id);
         if (!col)
             return;
         this.#outstanding.delete(collection.id);
+        const keep = new Set(opts.keep ?? []);
         for (const item of col.values()) {
             this.#outstandingBytes -= item.bytes.length;
+            if (keep.has(item.queueId)) {
+                // transient: back to the buffer, offered again, never acknowledged
+                this.#inbox.push(item);
+                this.#inboxBytes += item.bytes.length;
+                this.#inboxDigests.add(item.queueId);
+                continue;
+            }
             this.#concluded.set(item.queueId, now);
             this.#pendingAcks.add(item.queueId);
         }
@@ -531,7 +568,8 @@ export class MediatorCarrierAdapter {
             for (const id of live)
                 this.#flightAcks.add(id);
             try {
-                await this.#wire.ackReceived(token, live);
+                // the wire gets its own list: what it does with it never reaches the bookkeeping below
+                await this.#wire.ackReceived(token, [...live]);
                 if (!this.#closed)
                     for (const id of live)
                         this.#pendingAcks.delete(id);