@sequenceholdings/artifact-studio 0.4.0 → 0.5.0

package/dist/next-build.js

@@ -58,12 +58,16 @@ export async function resolveNextRepositoryId({ spec, repository, baseUrl, token
             return match[1];
     }
     catch { /* Opaque labels/SSH origins are valid preview provenance but cannot attest a release. */ }
-    throw new Error('Official Next.js releases require a Git Service repository in this Atlas environment. Push the reviewed revision, then run artifact deploy --repo <namespace>/<name> --ref main --env <env>.');
+    throw new Error('Official Next.js releases require a Git Service repository in this Atlas environment. Push the reviewed revision, then run artifact deploy --repo <namespace>/<name> --ref main --env <env> (or --ref staging for a staging environment).');
 }
-/** A verified repository build names a commit; anything else uploads the committed source snapshot. */
-function nextBuildRequestBody({ manifest, files, commit, provenance, repository, repositoryId, channel }) {
+/**
+ * A verified repository build names a commit and the application's directory in it;
+ * anything else uploads the committed source snapshot. The repository root is omitted
+ * so the request stays valid for Atlas versions that predate `sourceRoot`.
+ */
+function nextBuildRequestBody({ manifest, files, commit, provenance, repository, repositoryId, sourceRoot, channel }) {
     if (repositoryId)
-        return { repositoryId, commit, idempotencyKey: randomUUID(), channel };
+        return { repositoryId, commit, ...(sourceRoot === '.' ? {} : { sourceRoot }), idempotencyKey: randomUUID(), channel };
     return {
         manifest,
         files: files.map(({ path, content, encoding }) => ({ path, content, encoding: encoding ?? 'utf8' })),
@@ -71,7 +75,7 @@ function nextBuildRequestBody({ manifest, files, commit, provenance, repository,
         idempotencyKey: randomUUID(), channel,
     };
 }
-export async function submitNextBuild({ root, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }) {
+export async function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }) {
     if (!provenance.gitCommit || !/^[a-f0-9]{40}$/i.test(provenance.gitCommit)) {
         throw new Error('Commit the application source before requesting a hosted build. Use artifact dev for uncommitted local development.');
     }
@@ -80,9 +84,10 @@ export async function submitNextBuild({ root, manifest, projectId, baseUrl, getT
     if (channel === 'active' && !repositoryId)
         throw new Error('An official release requires a verified Git Service repository.');
     const path = `/api/artifact-studio/projects/${encodeURIComponent(projectId)}/next`;
-    const body = nextBuildRequestBody({ manifest, files: source.files, commit: provenance.gitCommit, provenance, repository, repositoryId, channel });
+    const body = nextBuildRequestBody({ manifest, files: source.files, commit: provenance.gitCommit, provenance, repository, repositoryId, sourceRoot, channel });
     const response = operationSchema.parse(await postJson({ baseUrl, token: await getToken(), path: `${path}/builds${repositoryId ? '/from-repository' : ''}`, body }));
-    console.log(`[seq-studio] Atlas build ${response.operation.id} (${channel}) from ${provenance.gitCommit.slice(0, 12)}`);
+    const directory = repositoryId && sourceRoot !== '.' ? ` (${sourceRoot})` : '';
+    console.log(`[seq-studio] Atlas build ${response.operation.id} (${channel}) from ${provenance.gitCommit.slice(0, 12)}${directory}`);
     console.log(`${baseUrl}/artifact-studio/projects/${projectId}`);
     const controller = new AbortController();
     const onSignal = () => controller.abort();

package/dist/offline/cache.d.ts

@@ -0,0 +1,4 @@
+import type { EncryptedOfflineStore, OfflineCache } from './types.js';
+export declare function createOfflineCache({ store, }: {
+    store: EncryptedOfflineStore;
+}): OfflineCache;

package/dist/offline/cache.js

@@ -0,0 +1,7 @@
+export function createOfflineCache({ store, }) {
+    return {
+        read: ({ key }) => store.get({ store: 'cache', key }),
+        write: ({ key, entry }) => store.set({ store: 'cache', key, value: entry }),
+        remove: ({ key }) => store.delete({ store: 'cache', key }),
+    };
+}

package/dist/offline/connector.d.ts

@@ -0,0 +1,26 @@
+import type { SequenceOfflineRequest, SequenceOfflineRequestConnector } from '../sdk.js';
+import type { OfflineReplayEngine } from './replay.js';
+import type { OfflineCache, OfflineMutationPolicy, OfflineReadPolicy } from './types.js';
+export declare class OfflineDataUnavailableError extends Error {
+    constructor(path: string);
+}
+export declare class OfflineWriteBlockedError extends Error {
+    constructor(path: string);
+}
+export interface ArtifactOfflineConnector {
+    connector: SequenceOfflineRequestConnector;
+    flush(): Promise<void>;
+}
+export declare function createArtifactOfflineConnector({ cache, readPolicy, mutationPolicy, outbox, replay, isOnline, clock, onCacheWriteError, }: {
+    cache: OfflineCache;
+    readPolicy: OfflineReadPolicy;
+    mutationPolicy: OfflineMutationPolicy;
+    outbox: import('./types.js').OfflineOutbox;
+    replay: OfflineReplayEngine;
+    isOnline: () => boolean;
+    clock?: () => number;
+    onCacheWriteError?: (input: {
+        request: SequenceOfflineRequest;
+        error: unknown;
+    }) => void;
+}): ArtifactOfflineConnector;

package/dist/offline/connector.js

@@ -0,0 +1,118 @@
+export class OfflineDataUnavailableError extends Error {
+    constructor(path) {
+        super(`No current offline data is available for ${path}`);
+        this.name = 'OfflineDataUnavailableError';
+    }
+}
+export class OfflineWriteBlockedError extends Error {
+    constructor(path) {
+        super(`Reconnect to complete this action: ${path}`);
+        this.name = 'OfflineWriteBlockedError';
+    }
+}
+function canUseCachedFallback(response) {
+    return response.status === 408 || response.status === 429 || response.status >= 500;
+}
+export function createArtifactOfflineConnector({ cache, readPolicy, mutationPolicy, outbox, replay, isOnline, clock = () => Date.now(), onCacheWriteError, }) {
+    async function readCached({ request, key, }) {
+        const cached = await cache.read({ key });
+        if (!cached || cached.expiresAt < clock()) {
+            throw new OfflineDataUnavailableError(request.path);
+        }
+        // Cache entries are written from this same typed request. The durable
+        // store cannot retain the erased generic, so restore it at the boundary.
+        return cached.response;
+    }
+    async function queueMutation({ request, descriptor, requestId, }) {
+        const observed = await descriptor.capture?.({ request });
+        const entry = await outbox.enqueue({
+            ...(requestId === undefined ? {} : { id: requestId }),
+            request,
+            entity: descriptor.entity,
+            ...(observed === undefined ? {} : { observed }),
+        });
+        await descriptor.optimisticApply?.({ entry });
+        const optimistic = descriptor.optimisticResponse?.({ entry }) ?? {
+            ok: true,
+            status: 202,
+            body: { offlineQueued: true, requestId: entry.id },
+        };
+        // Mutation descriptors define the response shape expected by their own
+        // call site; the shared queue deliberately treats payloads as unknown.
+        return optimistic;
+    }
+    const connector = {
+        async execute({ request, network }) {
+            if (request.method === 'GET') {
+                const descriptor = readPolicy.match(request);
+                if (!descriptor) {
+                    if (!isOnline())
+                        throw new OfflineDataUnavailableError(request.path);
+                    return network(request);
+                }
+                if (!isOnline()) {
+                    return readCached({ request, key: descriptor.key });
+                }
+                try {
+                    const response = await network(request);
+                    if (response.ok) {
+                        const cachedAt = clock();
+                        try {
+                            await cache.write({
+                                key: descriptor.key,
+                                entry: {
+                                    response,
+                                    cachedAt,
+                                    expiresAt: cachedAt + descriptor.ttlMs,
+                                    entity: descriptor.entity,
+                                },
+                            });
+                        }
+                        catch (error) {
+                            if (onCacheWriteError) {
+                                onCacheWriteError({ request, error });
+                            }
+                            else {
+                                console.warn('[artifact-studio] offline cache write failed:', error);
+                            }
+                        }
+                        return response;
+                    }
+                    return canUseCachedFallback(response)
+                        ? readCached({ request, key: descriptor.key })
+                        : response;
+                }
+                catch {
+                    return readCached({ request, key: descriptor.key });
+                }
+            }
+            let replayableRequest = request;
+            let requestId;
+            if (isOnline()) {
+                requestId = request.headers?.['X-Request-Id'] ?? globalThis.crypto.randomUUID();
+                replayableRequest = {
+                    ...request,
+                    headers: { ...request.headers, 'X-Request-Id': requestId },
+                };
+                try {
+                    return await network(replayableRequest);
+                }
+                catch {
+                    // A transport failure is an offline transition. Only the explicit
+                    // mutation policy may decide whether this write is durable.
+                }
+            }
+            const descriptor = mutationPolicy.match(request);
+            if (!descriptor)
+                throw new OfflineWriteBlockedError(request.path);
+            return queueMutation({ request: replayableRequest, descriptor, requestId });
+        },
+        attach: ({ network }) => {
+            replay.attach({ network });
+        },
+    };
+    return {
+        connector,
+        flush: () => replay.flush(),
+    };
+}

package/dist/offline/crypto.d.ts

@@ -0,0 +1,5 @@
+import type { OfflineCrypto } from './types.js';
+export declare function generateOfflineEncryptionKey(): Promise<CryptoKey>;
+export declare function createOfflineCrypto({ key }: {
+    key: CryptoKey;
+}): OfflineCrypto;

package/dist/offline/crypto.js

@@ -0,0 +1,24 @@
+const AES_GCM_IV_BYTES = 12;
+export async function generateOfflineEncryptionKey() {
+    return globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+export function createOfflineCrypto({ key }) {
+    return {
+        async encrypt({ value }) {
+            const serialized = JSON.stringify(value);
+            if (serialized === undefined) {
+                throw new Error('Offline values must be JSON-serializable');
+            }
+            const iv = globalThis.crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
+            const ciphertext = await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(serialized));
+            return {
+                iv: Array.from(iv),
+                ciphertext: Array.from(new Uint8Array(ciphertext)),
+            };
+        },
+        async decrypt({ record }) {
+            const plaintext = await globalThis.crypto.subtle.decrypt({ name: 'AES-GCM', iv: new Uint8Array(record.iv) }, key, new Uint8Array(record.ciphertext));
+            return JSON.parse(new TextDecoder().decode(plaintext));
+        },
+    };
+}

package/dist/offline/index.d.ts

@@ -0,0 +1,8 @@
+export { createArtifactOfflineConnector, OfflineDataUnavailableError, OfflineWriteBlockedError, type ArtifactOfflineConnector, } from './connector.js';
+export { createOfflineCrypto, generateOfflineEncryptionKey, } from './crypto.js';
+export { openOfflineIndexedDatabase, type OfflineIndexedDatabase, } from './indexed-db.js';
+export { createOfflineCache } from './cache.js';
+export { createOfflineOutbox } from './outbox.js';
+export { classifyOfflineReplayFailure, createOfflineReplayEngine, type OfflineReplayEngine, } from './replay.js';
+export { createEncryptedOfflineStore } from './secure-store.js';
+export type { EncryptedOfflineStore, OfflineCache, OfflineCacheEntry, OfflineConflictField, OfflineConflictInfo, OfflineCrypto, OfflineEncryptedRecord, OfflineFailureKind, OfflineKvStore, OfflineMutationDescriptor, OfflineMutationPolicy, OfflineOutbox, OfflineOutboxEntry, OfflineReadDescriptor, OfflineReadPolicy, OfflineStoreName, OfflineUnresolvedWrite, } from './types.js';

package/dist/offline/index.js

@@ -0,0 +1,7 @@
+export { createArtifactOfflineConnector, OfflineDataUnavailableError, OfflineWriteBlockedError, } from './connector.js';
+export { createOfflineCrypto, generateOfflineEncryptionKey, } from './crypto.js';
+export { openOfflineIndexedDatabase, } from './indexed-db.js';
+export { createOfflineCache } from './cache.js';
+export { createOfflineOutbox } from './outbox.js';
+export { classifyOfflineReplayFailure, createOfflineReplayEngine, } from './replay.js';
+export { createEncryptedOfflineStore } from './secure-store.js';

package/dist/offline/indexed-db.d.ts

@@ -0,0 +1,10 @@
+import type { OfflineKvStore } from './types.js';
+export interface OfflineIndexedDatabase {
+    kv: OfflineKvStore;
+    nextSequence(): Promise<number>;
+    getOrCreateEncryptionKey(): Promise<CryptoKey>;
+    close(): void;
+}
+export declare function openOfflineIndexedDatabase({ databaseName, }: {
+    databaseName: string;
+}): Promise<OfflineIndexedDatabase>;

package/dist/offline/indexed-db.js

@@ -0,0 +1,104 @@
+import { generateOfflineEncryptionKey } from './crypto.js';
+const OFFLINE_DATABASE_VERSION = 1;
+const META_STORE = 'meta';
+const SECURE_STORES = [
+    'cache',
+    'outbox',
+    'accesslog',
+];
+function requestResult(request) {
+    return new Promise((resolve, reject) => {
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error ?? new Error('IndexedDB request failed'));
+    });
+}
+function transactionComplete(transaction) {
+    return new Promise((resolve, reject) => {
+        transaction.oncomplete = () => resolve();
+        transaction.onerror = () => reject(transaction.error ?? new Error('IndexedDB transaction failed'));
+        transaction.onabort = () => reject(transaction.error ?? new Error('IndexedDB transaction aborted'));
+    });
+}
+export async function openOfflineIndexedDatabase({ databaseName, }) {
+    if (!globalThis.indexedDB)
+        throw new Error('IndexedDB is unavailable');
+    const openRequest = globalThis.indexedDB.open(databaseName, OFFLINE_DATABASE_VERSION);
+    openRequest.onupgradeneeded = () => {
+        const database = openRequest.result;
+        for (const store of SECURE_STORES) {
+            if (!database.objectStoreNames.contains(store)) {
+                database.createObjectStore(store);
+            }
+        }
+        if (!database.objectStoreNames.contains(META_STORE)) {
+            database.createObjectStore(META_STORE);
+        }
+    };
+    const database = await requestResult(openRequest);
+    let invalidated = false;
+    database.onversionchange = () => {
+        invalidated = true;
+        database.close();
+    };
+    function assertOpen() {
+        if (invalidated) {
+            throw new Error('Offline storage was replaced; reopen the artifact before continuing');
+        }
+    }
+    const kv = {
+        async get({ store, key }) {
+            assertOpen();
+            const transaction = database.transaction(store, 'readonly');
+            return requestResult(transaction.objectStore(store).get(key));
+        },
+        async set({ store, key, value }) {
+            assertOpen();
+            const transaction = database.transaction(store, 'readwrite');
+            transaction.objectStore(store).put(value, key);
+            await transactionComplete(transaction);
+        },
+        async delete({ store, key }) {
+            assertOpen();
+            const transaction = database.transaction(store, 'readwrite');
+            transaction.objectStore(store).delete(key);
+            await transactionComplete(transaction);
+        },
+        async keys({ store }) {
+            assertOpen();
+            const transaction = database.transaction(store, 'readonly');
+            const keys = await requestResult(transaction.objectStore(store).getAllKeys());
+            return keys.map(String);
+        },
+    };
+    return {
+        kv,
+        async nextSequence() {
+            assertOpen();
+            const transaction = database.transaction(META_STORE, 'readwrite');
+            const store = transaction.objectStore(META_STORE);
+            const current = await requestResult(store.get('outbox-sequence'));
+            const next = typeof current === 'number' ? current + 1 : 1;
+            store.put(next, 'outbox-sequence');
+            await transactionComplete(transaction);
+            return next;
+        },
+        async getOrCreateEncryptionKey() {
+            assertOpen();
+            const candidate = await generateOfflineEncryptionKey();
+            const transaction = database.transaction(META_STORE, 'readwrite');
+            const store = transaction.objectStore(META_STORE);
+            const existing = await requestResult(store.get('encryption-key'));
+            if (existing instanceof CryptoKey) {
+                await transactionComplete(transaction);
+                return existing;
+            }
+            store.put(candidate, 'encryption-key');
+            await transactionComplete(transaction);
+            return candidate;
+        },
+        close: () => {
+            invalidated = true;
+            database.close();
+        },
+    };
+}

package/dist/offline/outbox.d.ts

@@ -0,0 +1,7 @@
+import type { EncryptedOfflineStore, OfflineOutbox } from './types.js';
+export declare function createOfflineOutbox({ store, nextSequence, createId, clock, }: {
+    store: EncryptedOfflineStore;
+    nextSequence: () => Promise<number>;
+    createId?: () => string;
+    clock?: () => number;
+}): OfflineOutbox;

package/dist/offline/outbox.js

@@ -0,0 +1,46 @@
+export function createOfflineOutbox({ store, nextSequence, createId = () => globalThis.crypto.randomUUID(), clock = () => Date.now(), }) {
+    async function list() {
+        const entries = await Promise.all((await store.keys({ store: 'outbox' })).map((key) => store.get({ store: 'outbox', key })));
+        return entries
+            .filter((entry) => entry !== undefined)
+            .sort((left, right) => left.sequence - right.sequence);
+    }
+    return {
+        async enqueue({ id: suppliedId, request, entity, observed, optimisticId }) {
+            const id = suppliedId ?? createId();
+            const entry = {
+                id,
+                sequence: await nextSequence(),
+                request,
+                entity,
+                capturedAt: new Date(clock()).toISOString(),
+                attempts: 0,
+                status: 'pending',
+                ...(observed === undefined ? {} : { observed }),
+                ...(optimisticId === undefined ? {} : { optimisticId }),
+            };
+            await store.set({ store: 'outbox', key: id, value: entry });
+            return entry;
+        },
+        list,
+        async update({ id, patch }) {
+            const existing = await store.get({
+                store: 'outbox',
+                key: id,
+            });
+            if (!existing)
+                return;
+            await store.set({
+                store: 'outbox',
+                key: id,
+                value: {
+                    ...existing,
+                    ...patch,
+                    id: existing.id,
+                    sequence: existing.sequence,
+                },
+            });
+        },
+        remove: ({ id }) => store.delete({ store: 'outbox', key: id }),
+    };
+}

package/dist/offline/replay.d.ts

@@ -0,0 +1,25 @@
+import type { SequenceOfflineNetwork } from '../sdk.js';
+import type { OfflineFailureKind, OfflineMutationPolicy, OfflineOutbox, OfflineUnresolvedWrite } from './types.js';
+export declare function classifyOfflineReplayFailure(error: unknown): OfflineFailureKind;
+export interface OfflineReplayEngine {
+    attach(context: {
+        network: SequenceOfflineNetwork;
+    }): void;
+    flush(): Promise<void>;
+    listUnresolved(): Promise<OfflineUnresolvedWrite[]>;
+    retry(input: {
+        id: string;
+    }): Promise<void>;
+    keepMine(input: {
+        id: string;
+    }): Promise<void>;
+    discard(input: {
+        id: string;
+    }): Promise<void>;
+}
+export declare function createOfflineReplayEngine({ outbox, mutationPolicy, maxAttempts, onEpoch, }: {
+    outbox: OfflineOutbox;
+    mutationPolicy: OfflineMutationPolicy;
+    maxAttempts?: number;
+    onEpoch?: () => void;
+}): OfflineReplayEngine;

package/dist/offline/replay.js

@@ -0,0 +1,192 @@
+class OfflineConflictDetected extends Error {
+    info;
+    constructor(info) {
+        super('Server changed since this offline edit was captured');
+        this.name = 'OfflineConflictDetected';
+        this.info = info;
+    }
+}
+class OfflineReplayHttpError extends Error {
+    status;
+    constructor(status) {
+        super(`Offline replay failed with HTTP ${status}`);
+        this.name = 'OfflineReplayHttpError';
+        this.status = status;
+    }
+}
+function statusFromError(error) {
+    if (error &&
+        typeof error === 'object' &&
+        'status' in error &&
+        typeof error.status === 'number') {
+        return error.status;
+    }
+    return null;
+}
+export function classifyOfflineReplayFailure(error) {
+    const status = statusFromError(error);
+    if (status === null)
+        return 'transient';
+    if (status === 401 || status === 403)
+        return 'auth';
+    if (status === 409 || status === 412)
+        return 'conflict';
+    if (status === 408 || status === 429 || status >= 500)
+        return 'transient';
+    return status >= 400 ? 'invalid' : 'transient';
+}
+async function replayEntry({ entry, descriptor, network, }) {
+    if (entry.force !== true &&
+        descriptor.fetchCurrent &&
+        descriptor.detectConflict) {
+        const current = await descriptor.fetchCurrent({ entry, network });
+        const conflict = descriptor.detectConflict({ entry, current });
+        if (conflict)
+            throw new OfflineConflictDetected(conflict);
+    }
+    const response = await network.execute({
+        ...entry.request,
+        headers: {
+            ...entry.request.headers,
+            'X-Request-Id': entry.id,
+        },
+    });
+    if (!response.ok)
+        throw new OfflineReplayHttpError(response.status);
+    await descriptor.reconcile?.({ entry, response });
+    return response;
+}
+export function createOfflineReplayEngine({ outbox, mutationPolicy, maxAttempts = 5, onEpoch, }) {
+    let network = null;
+    let flushing = false;
+    async function flush() {
+        if (!network || flushing)
+            return;
+        flushing = true;
+        try {
+            for (const entry of await outbox.list()) {
+                if (entry.status !== 'pending' && entry.status !== 'inflight')
+                    continue;
+                const descriptor = mutationPolicy.match(entry.request);
+                if (!descriptor) {
+                    await outbox.update({
+                        id: entry.id,
+                        patch: {
+                            status: 'failed',
+                            failureKind: 'invalid',
+                            lastError: 'No mutation policy matches this queued write',
+                        },
+                    });
+                    continue;
+                }
+                await outbox.update({ id: entry.id, patch: { status: 'inflight' } });
+                try {
+                    await replayEntry({ entry, descriptor, network });
+                    await outbox.remove({ id: entry.id });
+                }
+                catch (error) {
+                    if (error instanceof OfflineConflictDetected) {
+                        await outbox.update({
+                            id: entry.id,
+                            patch: {
+                                status: 'conflict',
+                                failureKind: 'conflict',
+                                conflict: error.info,
+                                lastError: error.message,
+                            },
+                        });
+                        continue;
+                    }
+                    const kind = classifyOfflineReplayFailure(error);
+                    const lastError = error instanceof Error ? error.message : String(error);
+                    if (kind === 'auth') {
+                        await outbox.update({
+                            id: entry.id,
+                            patch: { status: 'pending', failureKind: kind, lastError },
+                        });
+                        break;
+                    }
+                    if (kind === 'invalid' || kind === 'conflict') {
+                        await outbox.update({
+                            id: entry.id,
+                            patch: {
+                                status: kind === 'conflict' ? 'conflict' : 'failed',
+                                failureKind: kind,
+                                lastError,
+                            },
+                        });
+                        continue;
+                    }
+                    const attempts = entry.attempts + 1;
+                    await outbox.update({
+                        id: entry.id,
+                        patch: {
+                            attempts,
+                            status: attempts >= maxAttempts ? 'failed' : 'pending',
+                            failureKind: 'transient',
+                            lastError,
+                        },
+                    });
+                    if (attempts < maxAttempts)
+                        break;
+                }
+            }
+        }
+        finally {
+            flushing = false;
+            onEpoch?.();
+        }
+    }
+    async function rearm({ id, force, }) {
+        await outbox.update({
+            id,
+            patch: {
+                status: 'pending',
+                attempts: 0,
+                force,
+                lastError: undefined,
+                failureKind: undefined,
+                conflict: undefined,
+            },
+        });
+        await flush();
+    }
+    return {
+        attach: ({ network: nextNetwork }) => {
+            network = nextNetwork;
+        },
+        flush,
+        async listUnresolved() {
+            const writes = [];
+            for (const entry of await outbox.list()) {
+                const authPaused = entry.status === 'pending' && entry.failureKind === 'auth';
+                if (entry.status !== 'failed' &&
+                    entry.status !== 'conflict' &&
+                    !authPaused) {
+                    continue;
+                }
+                const descriptor = mutationPolicy.match(entry.request);
+                writes.push({
+                    id: entry.id,
+                    label: descriptor?.label(entry) ?? entry.entity,
+                    capturedAt: entry.capturedAt,
+                    kind: entry.failureKind ??
+                        (entry.status === 'conflict' ? 'conflict' : 'transient'),
+                    ...(entry.lastError === undefined ? {} : { error: entry.lastError }),
+                    ...(entry.conflict === undefined ? {} : { conflict: entry.conflict }),
+                });
+            }
+            return writes;
+        },
+        retry: ({ id }) => rearm({ id }),
+        keepMine: ({ id }) => rearm({ id, force: true }),
+        async discard({ id }) {
+            const entry = (await outbox.list()).find((candidate) => candidate.id === id);
+            if (!entry)
+                return;
+            await mutationPolicy.match(entry.request)?.rollback?.({ entry });
+            await outbox.remove({ id });
+            onEpoch?.();
+        },
+    };
+}

package/dist/offline/secure-store.d.ts

@@ -0,0 +1,6 @@
+import type { EncryptedOfflineStore, OfflineCrypto, OfflineKvStore } from './types.js';
+export declare function createEncryptedOfflineStore({ kv, crypto, namespace, }: {
+    kv: OfflineKvStore;
+    crypto: OfflineCrypto;
+    namespace: string;
+}): EncryptedOfflineStore;