@real-life/trust-protocol 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,77 @@
 # Changelog
 
+## 0.6.0
+
+Takes up Delivery Contract 0.83: the holder keeps custody of what waits
+for transport, and only an open, resumed opening hands anything over.
+
+- **Custody** (RLTP-DEL-6120 to 6135): `pendingTransport(when)` names
+  what the holder keeps for transport, after this opening's first
+  completed resume (else `{ok: false, code: 'not-resumed'}`): every
+  outbox document neither terminal nor accepted, the ones the adapter
+  reported `awaiting-transport` included, and every unsent ack, each with
+  its envelope, recipient, `since` (first submission), `notAfter` (the
+  horizon or the type's sender lifetime, whichever first), `held` and
+  `nextAttemptAt`; none past its deadline, whether or not a resume has
+  recorded the give-up. Entries are deep-frozen and issued to the
+  opening. `handOver(entry, when, start)` re-reads the store and, for an
+  entry this opening issued that is still pending, unchanged and before
+  its deadline, calls `start` inside the holder's queue: the check and the
+  start of the deposit are one step. `mayHandOver(entry, when)` is the
+  check alone, and authorizes nothing afterwards. Both read at
+  max(when, lastWhen): the holder's time never runs back. A resume that throws, the settling of an earlier commit
+  included, withdraws the opening's authority until one completes. One
+  opening per store at a time is the app's to keep: two openings are not
+  serialized with each other.
+- **A duplicate's answer** (RLTP-DEL-6330): a duplicate makes an answer
+  due, stored with the ack (`answers`, `answerDue`) and so kept across a
+  lock; `pendingTransport` offers it as a `resend` entry numbered by it,
+  beside the ack's retries and independent of their state, with the
+  effect's retention as deadline. The begun hand-over ends it (a commit);
+  a duplicate arriving while one is due is answered by it (the same
+  bytes), the next one after it makes the next due. A duplicate therefore
+  commits that answer (else, as before, lastWhen only).
+- **The opening ends**: `await close()` (a lock, the end of a process),
+  resolved once the operation running at the call has finished; only then
+  may the next opening start. Every
+  later call rejects with `InfraError('closed')` (a new code),
+  `mayHandOver` answers false, `closed` says so. The next opening is a new
+  `createHolder` over the same store.
+- **Acks** (RLTP-DEL-6330, 6335): an `awaiting-transport` report on an
+  ack no longer marks it sent; it records `held`, resume stops re-offering
+  it and `pendingTransport` keeps it. `accepted` or `delivered` marks it
+  sent (`sentBy: 'accepted'`), `failed` gives it up (`'failed'`), the
+  horizon ends its retries (`'horizon'`). Sent or not, it stays with its
+  effect until the effect's retention; a duplicate re-sends it once
+  without new retries.
+- **Codec 3, a clean cut**: `StoredAck.sentBy` is `accepted | failed |
+  horizon`, present exactly when sent, `held` only while unsent, and the
+  answers (`answers`, `answerDue`). Codec 3 replaces codecs 1 and 2
+  without a migration: neither ever held a rolled-out app's state, so a
+  state of either is refused as `codec-unknown`. Removed: the migrations
+  1 → 2 and 2 → 3 (`MIGRATIONS` is empty), the codec-1 and codec-2
+  validators, `schemas/holder-state-v1.schema.json`,
+  `schemas/holder-state-v2.schema.json`, the types `HolderStateV1` and
+  `HolderStateV2`, and their fixtures and generators. New:
+  `schemas/holder-state-v3.schema.json`, `HolderStateV3`, fixtures
+  `state-v3*.json` (generated, reproduced in `npm test`).
+- **`./adapters/vti-mediator`**: `reconcile(view, gate, now)` replaces
+  `submitOutbound`. It files the entries of the view not yet filed and
+  withdraws every submission before the trias whose digest the view no
+  longer names; each deposit starts inside `gate.handOver` (the holder),
+  after the adapter's own re-check (retired, withdrawn, past the trias,
+  past the entry's deadline or its horizon): the holder's no withdraws,
+  an error skips the attempt. Its give-up horizon counts from the entry's
+  `since`; an entry taken over past it is given up at once, never
+  attempted. A `resend` entry is a submission of its own. One adapter
+  serves one opening: bound to the holder of its first reconcile, it
+  refuses another, and the next opening gets a new adapter. It keeps no
+  custody of its own.
+- Tests: the custody scenarios (`test/transport-custody.test.mjs`, among
+  them the open counter-probes of the store-launch reviews) and seeded
+  interleavings of locks, the end of a process, hand-overs and acks with
+  every cell reached (`test/transport-interleavings.test.mjs`).
+
 ## 0.5.0
 
 Takes up Message Tasks 0.1, Delivery Contract 0.82 and Membership Tasks

package/README.md

@@ -49,6 +49,53 @@ const { outbound, nextDueAt } = await holder.resume(Date.now())
 holder.subscribe(async () => render(await holder.contacts(), await holder.prompts()))
 ```
 
+**Custody and the lock** (Delivery 0.83, RLTP-DEL-6120 to 6135). The
+holder keeps every outbound document until a service takes it or the
+holder gives it up, across a lock and the end of a process; a transport
+takes what it hands over from the holder, never from a store of its own.
+One `createHolder` is one opening of the store:
+
+```ts
+await holder.resume(Date.now())                      // the opening's first resume comes first
+const view = await holder.pendingTransport(Date.now())
+if (view.ok) for (const entry of view.entries) {
+  // entry: digest, kind ('document' | 'ack'), envelope, recipient,
+  // since (first submission), notAfter (deadline), held?, nextAttemptAt?, resend?
+  // the check and the start of the send are one step of the holder
+  await holder.handOver(entry, Date.now(), () => { transport.send(entry); return true })
+}
+// a lock or the end of the process: nothing issued before authorizes anything;
+// it resolves once the operation running at the call has finished
+await holder.close()
+```
+
+`pendingTransport` answers `{ok: false, code: 'not-resumed'}` until a
+resume of this opening has completed (a resume that throws withdraws it
+again). It names every outbox document neither terminal nor accepted
+(held ones included) and every unsent ack, none past its deadline.
+`handOver(entry, when, start)` checks an entry and calls `start` inside
+the holder's queue, so nothing of this holder runs between the check and
+the start of the send; it says yes only for an entry this opening issued
+that is still pending, unchanged and before its deadline (`mayHandOver`
+is the check alone). A document missing from the view is not to be sent.
+A duplicate makes an answer due, stored with the ack and kept across a
+lock: a `resend` entry beside the ack's retries, independent of their
+state, ended by the begun hand-over; a duplicate while one is due is
+answered by it (the same bytes). The check is the opening's:
+two openings over one store at once are not serialized with each other,
+so an app keeps one opening per store (its writer lock), and releases
+that lock, or starts the next opening, only after `await holder.close()`:
+until then the operation running at the close may still commit. After `close()` every call rejects with
+`InfraError('closed')` and `mayHandOver` answers false; the next opening
+is a new `createHolder` over the same store. An ack is sent once a
+service took it (`accepted`/`delivered` report), the adapter reports it
+failed, or its horizon passes; an `awaiting-transport` report records
+that the adapter holds it and ends nothing (RLTP-DEL-6330), and it stays
+retained with its effect for a duplicate (6335).
+`./adapters/vti-mediator` reconciles from the view
+(`reconcile(view, holder, now)`); one adapter serves one opening, so the
+next opening creates a new one.
+
 **The timer.** Every act, receive and resume may name `nextDueAt`: the
 earliest time something is due, delivery work (retries, duties, acks)
 and expiry work (a prompt's expiry, an act's timeout or lifetime, an aging
@@ -71,7 +118,8 @@ consent to an introduction), `trust`, `untrust`, `pauseTrust`, `setClass`,
 `addDevice`, `revokeDevice`. Not
 human: `receive`, `report`, `resume`, `tick`, `recover`, `takeMessages`.
 Reads: `contacts`, `contact`, `groups`, `profile`, `prompts`, `inbox`,
-`deliveryStatus`, `deviceKey`, `snapshot`, `subscribe`.
+`deliveryStatus`, `deviceKey`, `snapshot`, `subscribe`. Custody:
+`pendingTransport`, `handOver`, `mayHandOver`, `close`, `closed`.
 
 ## What the root exports
 
@@ -124,7 +172,7 @@ Bare four-digit numbers are RLTP-TRU rules; the other layers name theirs.
 | `membership`, `membership/holder` | Membership Tasks 0.20 on Access 0.57 | founding (Access 3.4.1), the prelude (3.5: `membership-prelude-request/0.1`, `membership-prelude-reply/0.1`, the binding per relationship), invite, accept, admission within the bound of 3282 and welcome, evidence relay and `vouch@2` (Access 5.3), an in-library Access over the holder's groups |
 | `message`, `message/holder` | Message Tasks 0.1 | `message@1`, `k_msg` and its MAC (3); sending on a ready, unblocked relationship with the sender lifetime (5); reception through the stages with the age and future bounds on the time mark, the completion record, the inbox taken over by the app, the rates and the inbox bound as `failed(rate-limited)` (4); the block of a relationship (6010–6030, 6510), its discard of messages and its treatment of invitations and prelude replies (Membership 3115, 3975), the holder's own offers refused (6410) |
 | `introduction`, `introduction/holder` | Trust §8 on Delivery §4.4 | the Introduction Act in its three roles: request, forward, reply, the mediator's one ack at its declared delay, the vouchers; the requester's timeout at the act's expiry (8340; A20, spec follow-up 18: no ack timeout of 8690) |
-| `receive`, `engine` | Delivery 0.82 §5, §6.1, §6.2 | the sealed envelope and the two key classes, stages 1–9 once per envelope with the dispositions `discarded` and the transient `failed(rate-limited)`, the task register by full task URI, the completed-effect cache with stored acks, the outbox with the status trias, retry by backoff, give-up at the horizon, the act journal |
+| `receive`, `engine` | Delivery 0.83 §5, §6.1, §6.2 | the sealed envelope and the two key classes, stages 1–9 once per envelope with the dispositions `discarded` and the transient `failed(rate-limited)`, the task register by full task URI, the completed-effect cache with stored acks, the outbox with the status trias, retry by backoff, give-up at the horizon, custody before the trias and the hand-over gate (`pendingTransport`, `mayHandOver`, `close`), ack retries apart from ack retention, the act journal |
 | `carrier-identity`, `carrier`, `carrier-holder` | Identity §7a, Delivery §4.4, §5a, Identity §9.3 | the carrier-relationship principal, the carrier port's state machine, proofs, verdicts and recovery |
 | `views`, `prompts` | — | the read model: contacts by entry (2120, 2140), groups, prompts, the delivery status |
 
@@ -149,39 +197,36 @@ A holder's state is pure JSON under a codec version. The Store port takes
 the state as opaque JSON and gives it back; the library decodes it
 (`decodeState`), the adapter never migrates.
 
-- **Codec 1** is the format of 0.4.0, the first stable one. Its golden
-  fixtures (`test/fixtures/state-v1*.json`, written by lib 0.4.0 with
-  `test/fixtures/gen-state-v1.mjs` and frozen since) cover a settled
-  holder, one with work open (prompts, a joining invite, duties, a
-  rotation at step 2) and one with a tombstone, a revoked device and
-  carrier entries. They validate under codec 1 and migrate to codec 2.
-- **Codec 2** is the format of 0.5.0: codec 1 with the state of Message
-  Tasks 0.1 (`messages`: the block, the rates, the ready tuples, the
-  completion record, the inbox), an outbox item's sender lifetime
-  (`expiresAt`) and `failed(task-expired)`, and the record of surfaced
-  and the register of declined invitations (`joining.surfaced`,
-  `joining.declined`); an invitation may be attributed to no
-  relationship. The migration from codec 1 is pure: no block, no rate, no
-  record, no inbox, the ready tuples read from what the counterparts'
-  documents left, every invitation received counted as surfaced. Its
-  fixtures (`test/fixtures/state-v2*.json`, deterministic runs of
-  `test/fixtures/gen-state-v2.mjs`, reproduced in `npm test`) add
-  messages to the settled holder and a block and a declined invitation to
-  the open one; each decodes and re-encodes byte for byte. A later codec brings its validator, a pure
-  migration from the one before, and its own fixture with a migration
-  test.
+- **Codec 3** is the format of 0.6.0 and the only one this library
+  reads. It holds the state of Message Tasks 0.1 (`messages`: the block,
+  the rates, the ready tuples, the completion record, the inbox), an
+  outbox item's sender lifetime (`expiresAt`) and `failed(task-expired)`,
+  the record of surfaced and the register of declined invitations, and
+  per stored ack (Delivery 0.83) why it counts as sent (`sentBy`:
+  `accepted`, `failed`, `horizon`, present exactly when `sent`), whether
+  the adapter holds it (`held`), and the duplicates' answers (`answers`,
+  `answerDue`). Its fixtures (`test/fixtures/state-v3*.json`,
+  deterministic runs of `test/fixtures/gen-state-v3.mjs`, reproduced in
+  `npm test`) cover a settled holder, one with work open (prompts, a
+  joining invite, duties, a rotation at step 2, a block and a declined
+  invitation), one with a tombstone, a revoked device and carrier entries,
+  and one with transport in custody (acks held, accepted, failed and
+  unsent, an answer due and one handed over, an own document held); each
+  decodes and re-encodes byte for byte.
+- Codecs 1 and 2 (lib 0.4.0, 0.5.0) never held a rolled-out app's state:
+  they are read no more, a state of either is `codec-unknown`. A later
+  codec that must read codec 3 brings its validator, a pure migration from
+  it, and its own fixture with a migration test.
 - A newer codec is refused as `codec-newer`, a codec without a validator
   as `codec-unknown`; nothing is read best-effort.
-- `schemas/holder-state-v1.schema.json` and
-  `schemas/holder-state-v2.schema.json` describe the codecs as
-  non-normative JSON Schemas (published with the package). The types
-  `HolderStateV1` and `HolderStateV2` (`./internal`) are generated from
-  them (`scripts/build-holder-state-types.mjs`); the build holds the
-  current one against the library's `HolderState`, and the tests hold each
-  schema against its codec's validator on the fixtures and on mutations
-  of them. Rules only the codec states: a record's id equals its key, an
-  envelope's `rkid` equals its recipient's `keyAgreement`, and (codec 2) a
-  set of strings is sorted.
+- `schemas/holder-state-v3.schema.json` describes the codec as a
+  non-normative JSON Schema (published with the package). The type
+  `HolderStateV3` (`./internal`) is generated from it
+  (`scripts/build-holder-state-types.mjs`); the build holds it against the
+  library's `HolderState`, and the tests hold the schema against the
+  codec's validator on the fixtures and on mutations of them. Rules only
+  the codec states: a record's id equals its key, an envelope's `rkid`
+  equals its recipient's `keyAgreement`, and a set of strings is sorted.
 
 **Writing a Store adapter.** Implement `read(): Promise<{state, version}>`
 (a deep, independent copy; `null` state and version for an empty store) and
@@ -224,7 +269,7 @@ This package uses its own semver; the specification uses castings.
 | trust | Trust Layer 0.31 | — |
 | membership | Membership Tasks 0.20, Access 0.57 | the Access envelope (Membership 3.3: `access-operation/0.1` with `member.add` and the sealed welcome; this library sends its own `x-membership-welcome/0.1`); an admission prompt after the bound of RLTP-MT-3282; roster replication: a holder knows the members it admitted and the roster its welcome carried |
 | introduction | Trust 0.31 §8 | how a requester learns the mediator's designator (8.3): this library's mediator sends `x-introduction-offer/0.1` |
-| delivery | Delivery 0.82 | transport adapters beyond `./adapters/vti-mediator`; the block of the Trust Layer's types (Message Tasks 6240: their treatments wait for the next casting of the Trust Layer) |
+| delivery | Delivery 0.83 | transport adapters beyond `./adapters/vti-mediator`; the block of the Trust Layer's types (Message Tasks 6240: their treatments wait for the next casting of the Trust Layer) |
 | message | Message Tasks 0.1 | holding a message unsent until its tuple is ready (5020): `sendMessage` answers `not-ready` and the app keeps the message; checking `replyTo` against the relationship's history (5120), which is the app's; multi-device (§9); `failed(task-expired)` for a message: reachable only with a retry horizon beyond P179D, which the engine does not admit (at most P90D), so an undelivered message ends as `failed(expired-by-adapter-policy)` |
 | devices | Identity §5.5 | multi-device production: one writer per holder |
 

package/dist/adapters/vti-mediator.d.ts

@@ -1,5 +1,6 @@
 import type { CarrierPrincipal, CarrierScopedIdentity } from '../carrier-identity.js';
-import type { DeliveryReport, Outbound, ReceiverRefusalCode, SubmissionRef } from '../ports.js';
+import type { DeliveryReport, ReceiverRefusalCode, SubmissionRef } from '../ports.js';
+import type { TransportEntry, TransportView } from '../engine.js';
 import type { ReceiveResult } from '../results.js';
 export type { ReceiverRefusalCode } from '../ports.js';
 export declare const DECLARED: Readonly<{
@@ -82,6 +83,14 @@ export interface AckState {
     }>;
     pending: string[];
 }
+/** The holder's side of a hand-over (lib 0.6.0): the holder itself.
+ *  handOver checks the entry and calls `start` inside the holder's queue;
+ *  `start` re-checks the adapter's own state, starts the deposit
+ *  synchronously and says whether it did. `closed` is read in `start`. */
+export interface TransportGate {
+    handOver(entry: TransportEntry, when: number, start: () => boolean): Promise<boolean>;
+    readonly closed?: boolean;
+}
 export declare class MediatorCarrierAdapter {
     #private;
     get principal(): string;
@@ -103,10 +112,14 @@ export declare class MediatorCarrierAdapter {
      *  honest report exists, status() returns null — §6.1's own
      *  pre-report window, represented as absence, not as a value. */
     submit(envelopeBytes: Uint8Array, rawNow: number): string;
-    /** Files an Outbound (its envelope as JCS bytes) and returns the
-     *  SubmissionRef the holder's reports are keyed by: submission id ↔
-     *  document digest (note §4.3). */
-    submitOutbound(outbound: Pick<Outbound, 'digest' | 'envelope'>, rawNow: number): SubmissionRef;
+    /** Takes the holder's custody set (holder.pendingTransport, after a
+     *  resume of this opening) and the holder as the gate: files every entry
+     *  not yet filed under its digest (its envelope as JCS bytes; the give-up
+     *  horizon from entry.since) and returns their SubmissionRefs; withdraws
+     *  every filed submission still before the trias (no report, or
+     *  awaiting-transport) whose digest the view does not name. Accepted and
+     *  terminal submissions stay for their reports. */
+    reconcile(view: TransportView, gate: TransportGate, rawNow: number): SubmissionRef[];
     /** The current state as the ports' DeliveryReport for holder.report(),
      *  or null while no honest report exists (and for an unknown id). A
      *  submission filed without a digest (submit) has no report form. */

package/dist/adapters/vti-mediator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vti-mediator.d.ts","sourceRoot":"","sources":["../../src/adapters/vti-mediator.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,QAAQ;;;;;;;EAOV,CAAA;AAGX,MAAM,MAAM,aAAa,GACrB,aAAa,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,UAAU,CAAA;AAE1E,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,aAAa,CAAA;gBACN,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E,YAAY,CAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAI/F,OAAO,CAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjD,aAAa,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,WAAW,CAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,SAAS,CAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1D,mEAAmE;IACnE,OAAO,CAAC,IAAK,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AASD,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,uBAAuB,GAAG,2BAA2B,CAAA;CAAE,GAC1G;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,2BAA2B,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAElF;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,cAAc,CASrF;AAED;;;;kCAIkC;AAClC,wBAAgB,WAAW,CAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEtD;AAKD,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE;AAElE;;kCAEkC;AAClC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAmBD,qBAAa,sBAAsB;;IAOjC,IAAI,SAAS,IAAK,MAAM,CAA2B;IACnD,IAAI,aAAa,IAAK,MAAM,CAA+B;IAC3D,IAAI,SAAS,IAAK,MAAM,CAA2B;IA2BnD;;;;kDAI8C;WACjC,MAAM,CACjB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EACvD,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAC3D,OAAO,CAAC,sBAAsB,CAAC;gBAahC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,YAAY,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM;IAsIrB;;+BAE2B;IAC3B,QAAQ,CAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQhD,IAAI,aAAa,IAAK,OAAO,CAG5B;IAyBD;;qEAEiE;IACjE,MAAM,CAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAkB1D;;uCAEmC;IACnC,cAAc,CAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa;IAQ/F;;yEAEqE;IACrE,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQ1C,GAAG,CAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwCzB;;;;0DAIsD;IAChD,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;;;;;+DAW2D;IAC3D,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3C,YAAY,CAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAU/B;;;;;iEAK6D;IAC7D,eAAe,CAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAgB7D,gBAAgB,IAAK,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,WAAW,CAAA;KAAE,CAAC;IAM3D,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,UAAU;IAepC;;;;;2EAKuE;IACvE,QAAQ,CAAE,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,IAAI;IAsBpG,QAAQ,IAAK,QAAQ;IAmErB,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IA8C9B;;;;mBAIe;IACf,KAAK,IAAK,IAAI;IAEd,IAAI,MAAM,IAAK,OAAO,CAAwB;CAC/C;AAED,eAAO,MAAM,SAAS,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,MAAM,CAA0B,CAAA"}
+{"version":3,"file":"vti-mediator.d.ts","sourceRoot":"","sources":["../../src/adapters/vti-mediator.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,QAAQ;;;;;;;EAOV,CAAA;AAGX,MAAM,MAAM,aAAa,GACrB,aAAa,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,UAAU,CAAA;AAE1E,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,aAAa,CAAA;gBACN,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E,YAAY,CAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAI/F,OAAO,CAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjD,aAAa,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,WAAW,CAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,SAAS,CAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1D,mEAAmE;IACnE,OAAO,CAAC,IAAK,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AASD,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,uBAAuB,GAAG,2BAA2B,CAAA;CAAE,GAC1G;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,2BAA2B,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAElF;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,cAAc,CASrF;AAED;;;;kCAIkC;AAClC,wBAAgB,WAAW,CAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEtD;AAKD,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE;AAElE;;kCAEkC;AAClC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;0EAG0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAuBD,qBAAa,sBAAsB;;IAOjC,IAAI,SAAS,IAAK,MAAM,CAA2B;IACnD,IAAI,aAAa,IAAK,MAAM,CAA+B;IAC3D,IAAI,SAAS,IAAK,MAAM,CAA2B;IA6BnD;;;;kDAI8C;WACjC,MAAM,CACjB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EACvD,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAC3D,OAAO,CAAC,sBAAsB,CAAC;gBAahC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,YAAY,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM;IAsIrB;;+BAE2B;IAC3B,QAAQ,CAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQhD,IAAI,aAAa,IAAK,OAAO,CAG5B;IAyBD;;qEAEiE;IACjE,MAAM,CAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAmB1D;;;;;;uDAMmD;IACnD,SAAS,CAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAmDrF;;yEAEqE;IACrE,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQ1C,GAAG,CAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwEzB;;;;0DAIsD;IAChD,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;;;;;+DAW2D;IAC3D,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3C,YAAY,CAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAU/B;;;;;iEAK6D;IAC7D,eAAe,CAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAgB7D,gBAAgB,IAAK,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,WAAW,CAAA;KAAE,CAAC;IAM3D,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,UAAU;IAepC;;;;;2EAKuE;IACvE,QAAQ,CAAE,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,IAAI;IAsBpG,QAAQ,IAAK,QAAQ;IAmErB,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IA8C9B;;;;mBAIe;IACf,KAAK,IAAK,IAAI;IAEd,IAAI,MAAM,IAAK,OAAO,CAAwB;CAC/C;AAED,eAAO,MAAM,SAAS,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,MAAM,CAA0B,CAAA"}

package/dist/adapters/vti-mediator.js

@@ -1,12 +1,24 @@
 // RLTP transport adapter: VTI mediator — published as
 // @real-life/trust-protocol/adapters/vti-mediator (lib Stage 2, note §4.6).
 //
-// Its reports reach the holder as the ports' DeliveryReport: submitOutbound
-// files an Outbound under its document digest and returns the
-// SubmissionRef (submission id ↔ digest); report(id) maps the adapter's
-// SubmissionState onto DeliveryReport (deliveryReportOf), which the app
-// hands to holder.report(). An adapter's `delivered` is its claim about
-// transport; the holder's receive core verifies the delivery-ack itself.
+// It takes the holder's documents from the holder's custody (Delivery 0.83
+// RLTP-DEL-6120 to 6135, lib 0.6.0): reconcile(view, gate, now) files every
+// entry of holder.pendingTransport(when) not yet filed, and withdraws every
+// filed submission still before the trias whose digest the view no longer
+// names — a missing entry means stop, never keep sending. Before every
+// deposit it asks gate.mayHandOver(entry, now) (the holder): false
+// withdraws the submission, an error skips the attempt. It keeps no
+// custody of its own: its copies are volatile and bound to the holder's
+// opening: bound to the holder of its first reconcile, it refuses another,
+// so after holder.close() nothing it holds goes out, and the next opening
+// gets a new adapter (restored from ackState like any other). Its give-up horizon counts
+// from the entry's first submission (`since`), never from when it took the
+// entry over (RLTP-DEL-6130). Its reports reach the holder as the ports'
+// DeliveryReport: report(id) maps the adapter's SubmissionState onto
+// DeliveryReport (deliveryReportOf), keyed by the document digest, which
+// the app hands to holder.report(). An adapter's `delivered` is its claim
+// about transport; the holder's receive core verifies the delivery-ack
+// itself.
 //
 // Profile: spec/adapter-vti-mediator.md v0.23 (twenty-third casting;
 // round journals under design/adapter-review*). A
@@ -95,6 +107,8 @@ export class MediatorCarrierAdapter {
     #tokens = null;
     #clock = Number.NEGATIVE_INFINITY;
     #closed = false;
+    /** the opening this adapter serves, bound at its first reconcile */
+    #gate = null;
     #subs = new Map();
     #inflight = new Set();
     #nextId = 1;
@@ -322,6 +336,7 @@ export class MediatorCarrierAdapter {
         const id = 's' + this.#nextId++;
         const knownOffline = this.#wire.offline?.() === true;
         const sub = {
+            id,
             // a plain copy of its own (a Node Buffer's slice() shares memory)
             bytes: new Uint8Array(envelopeBytes),
             submittedAt: now,
@@ -334,16 +349,79 @@ export class MediatorCarrierAdapter {
             this.#startAttempt(sub, now);
         return id;
     }
-    /** Files an Outbound (its envelope as JCS bytes) and returns the
-     *  SubmissionRef the holder's reports are keyed by: submission id ↔
-     *  document digest (note §4.3). */
-    submitOutbound(outbound, rawNow) {
+    /** Takes the holder's custody set (holder.pendingTransport, after a
+     *  resume of this opening) and the holder as the gate: files every entry
+     *  not yet filed under its digest (its envelope as JCS bytes; the give-up
+     *  horizon from entry.since) and returns their SubmissionRefs; withdraws
+     *  every filed submission still before the trias (no report, or
+     *  awaiting-transport) whose digest the view does not name. Accepted and
+     *  terminal submissions stay for their reports. */
+    reconcile(view, gate, rawNow) {
         this.#open();
-        if (typeof outbound?.digest !== 'string' || outbound.digest === '')
-            throw new Error('an outbound needs its document digest');
-        const submissionId = this.submit(new TextEncoder().encode(jcs(outbound.envelope)), rawNow);
-        this.#subs.get(submissionId).digest = outbound.digest;
-        return { submissionId, digest: outbound.digest };
+        if (view?.ok !== true || !Array.isArray(view.entries))
+            throw new Error('reconcile needs a view of holder.pendingTransport');
+        if (typeof gate?.handOver !== 'function')
+            throw new Error('reconcile needs the holder as its gate');
+        // one adapter per opening: its copies and the holder's grants belong to
+        // that opening, and the next opening gets an adapter of its own
+        if (this.#gate === null)
+            this.#gate = gate;
+        else if (this.#gate !== gate)
+            throw new Error('one adapter per opening: this adapter reconciles with another holder (create a new adapter for the next opening)');
+        const now = this.#now(rawNow);
+        // a submission's key: the digest, and for a duplicate's answer its
+        // grant too — the retries and each answer are hand-overs of their own
+        const keyOf = (digest, resend) => resend === undefined ? digest : `${digest}#${resend}`;
+        const named = new Set(view.entries.map((e) => keyOf(e.digest, e.resend)));
+        const filed = new Map();
+        for (const [id, sub] of this.#subs) {
+            if (sub.digest === undefined)
+                continue;
+            const key = keyOf(sub.digest, sub.entry?.resend);
+            const before = sub.st === null || sub.st.state === 'awaiting-transport';
+            if (before && !named.has(key)) {
+                this.#subs.delete(id);
+                continue;
+            }
+            filed.set(key, sub);
+        }
+        const refs = [];
+        for (const entry of view.entries) {
+            const had = filed.get(keyOf(entry.digest, entry.resend));
+            if (had !== undefined) {
+                // the newest entry of a live submission is the one its gate checks
+                if (had.st === null || had.st.state === 'awaiting-transport') {
+                    had.entry = entry;
+                    had.gate = gate;
+                    continue;
+                }
+                // an answer the holder still offers is still owed — its hand-over
+                // never began, or the holder could not record that it did: a
+                // terminal submission of it is filed again (the holder ends it)
+                if (entry.resend === undefined)
+                    continue;
+                this.#subs.delete(had.id);
+            }
+            const id = 's' + this.#nextId++;
+            const sub = {
+                id, digest: entry.digest, entry, gate,
+                bytes: new TextEncoder().encode(jcs(entry.envelope)),
+                // a duplicate's ack is a hand-over of its own, from now
+                submittedAt: entry.resend !== undefined ? now : Math.min(entry.since, now),
+                attemptStartedAt: null, lastKind: null, st: null,
+            };
+            this.#subs.set(id, sub);
+            refs.push({ submissionId: id, digest: entry.digest });
+            // taken over past its horizon (counted from the first submission,
+            // RLTP-DEL-6130): given up at once, never attempted
+            if (now - sub.submittedAt >= DECLARED.giveUpHorizonMs) {
+                sub.st = { state: 'failed', reason: 'expired-by-adapter-policy' };
+                continue;
+            }
+            if (this.#wire.offline?.() !== true)
+                this.#startAttempt(sub, now);
+        }
+        return refs;
     }
     /** The current state as the ports' DeliveryReport for holder.report(),
      *  or null while no honest report exists (and for an unknown id). A
@@ -354,7 +432,7 @@ export class MediatorCarrierAdapter {
             return null;
         const digest = this.#subs.get(id).digest;
         if (digest === undefined)
-            throw new Error('submitted without a document digest: use submitOutbound');
+            throw new Error('submitted without a document digest: file holder documents through reconcile');
         return deliveryReportOf(digest, st);
     }
     has(id) {
@@ -376,7 +454,55 @@ export class MediatorCarrierAdapter {
             if (this.#closed)
                 return; // retirement between auth and deposit: nothing new starts (R5-B2)
             // each attempt hands the wire a copy: what it does with it never reaches the next
-            await this.#wire.deposit(token, new Uint8Array(sub.bytes), this.#egressDid);
+            const deposit = () => {
+                try {
+                    return this.#wire.deposit(token, new Uint8Array(sub.bytes), this.#egressDid);
+                }
+                catch (e) {
+                    return Promise.reject(e);
+                }
+            };
+            if (sub.gate !== undefined) {
+                // the holder decides, and the deposit starts in the same step of its
+                // queue (Delivery RLTP-DEL-6125 to 6135); the adapter re-checks its
+                // own state there: retired, withdrawn, past the trias, past the
+                // entry's deadline or its own horizon → no deposit
+                // the deposit's outcome, caught at once: the holder's step may still
+                // be committing when the wire answers
+                let started = null;
+                let declined = false;
+                const entry = sub.entry;
+                const start = () => {
+                    if (this.#closed || this.#subs.get(sub.id) !== sub || sub.gate.closed === true ||
+                        (sub.st !== null && sub.st.state !== 'awaiting-transport') || this.#clock >= entry.notAfter ||
+                        this.#clock - sub.submittedAt >= DECLARED.giveUpHorizonMs) {
+                        declined = true;
+                        return false;
+                    }
+                    started = deposit().then(() => null, (e) => ({ failed: e }));
+                    return true;
+                };
+                let ok;
+                try {
+                    ok = await sub.gate.handOver(entry, this.#clock, start);
+                }
+                catch {
+                    ok = null;
+                }
+                if (started === null) {
+                    // the holder said no: withdrawn; the adapter declined or the
+                    // holder was unreachable: not this attempt
+                    if (ok === false && !declined && this.#subs.get(sub.id) === sub)
+                        this.#subs.delete(sub.id);
+                    return;
+                }
+                const outcome = await started;
+                if (outcome !== null)
+                    throw outcome.failed;
+            }
+            else {
+                await deposit();
+            }
             sub.lastKind = null;
             next = { state: 'accepted' };
         }