@smthrs/journal 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/JournalEvent.js

@@ -0,0 +1,517 @@
+/**
+ * Durable event-envelope schemas for the journal.
+ *
+ * @since 0.1.0
+ */
+import * as Schema from "effect/Schema";
+/**
+ * A UTF-16 surrogate with no partner: a high surrogate not followed by a low
+ * one, or a low surrogate not preceded by a high one. `String.isWellFormed`
+ * answers the same question but needs the ES2024 lib, which this package does
+ * not target.
+ */
+const loneSurrogate = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+/**
+ * A NUL anywhere in an identifier.
+ *
+ * SQLite's `length()` counts the characters BEFORE the first NUL, and every
+ * identifier column carries `CHECK (length(...) > 0)`, so a leading-NUL run id
+ * measures zero and the write fails the constraint. Measured on this tree, an
+ * emit with a leading-NUL run id came back as `sink_failed` with a
+ * `DatabaseError` cause, which tells the caller the database is down when the
+ * real fault is the identifier it just supplied. A NUL after the first
+ * character is refused on the same terms: it makes the column's own length
+ * check disagree with the identifier's length.
+ *
+ * Built from a code point rather than written as a pattern literal: a control
+ * character in a regex is exactly the typo `no-control-regex` exists to catch,
+ * and no reader can see one in the source.
+ */
+const embeddedNul = new RegExp(String.fromCharCode(0));
+/**
+ * Longest identifier the journal persists.
+ *
+ * A run id, a source id and an event type are index columns of a permanent
+ * table and are held in per-run maps for the layer's lifetime, so an
+ * unbounded one costs durable index space and heap that nothing ever
+ * reclaims. Every identifier this repository mints is a uuid or a short
+ * dotted name, two orders of magnitude below this bound, so the ceiling
+ * refuses only the shapes that were never identifiers.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const maxIdentifierLength = 1024;
+/**
+ * A persistable identifier: non-empty, and representable in the store.
+ *
+ * SQLite binds a lone UTF-16 surrogate as U+FFFD, so two ill-formed
+ * identifiers that differ only in their surrogates land on ONE persisted key.
+ * The second run's first event then dedupes into the first run's row and reads
+ * by either id return the same history, which destroys run isolation at the
+ * persistence boundary. Rejecting ill-formed text at the schema keeps the
+ * identifier the caller decoded and the identifier the database stores the
+ * same value.
+ *
+ * A NUL is rejected for the reason {@link embeddedNul} gives: the column's own
+ * length check cannot see past one, so the store refuses the identifier as a
+ * constraint violation and the caller is told the sink failed.
+ *
+ * The empty string is rejected for a plainer reason: it names nothing, and the
+ * journal used to accept it at decode and then reject it at the service, so a
+ * caller could hold a "valid" identifier the next call refused.
+ * The length is bounded because every identifier occupies permanent index
+ * space and layer-lifetime heap.
+ */
+const identifier = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxIdentifierLength), Schema.makeFilter((value) => !loneSurrogate.test(value), { title: "wellFormedIdentifier" }), Schema.makeFilter((value) => !embeddedNul.test(value), { title: "nulFreeIdentifier" }));
+/**
+ * Schema for an identifier of one durable run.
+ *
+ * Between 1 and 1,024 UTF-16 code units, free of unpaired UTF-16 surrogates
+ * because the store cannot tell two ill-formed identifiers apart, and free of
+ * NUL because the store's own length check cannot see past one.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const RunId = identifier.pipe(Schema.brand("@smthrs/journal/JournalEvent/RunId"));
+/**
+ * Schema for the canonical, durable sequence number within a run.
+ *
+ * `Number.MAX_SAFE_INTEGER` is excluded because the journal must always be
+ * able to allocate the next sequence. `Number.MAX_SAFE_INTEGER + 1` is not a
+ * distinct integer, so the maximum is not an allocatable sequence.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const Seq = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThan(Number.MAX_SAFE_INTEGER)).pipe(Schema.brand("@smthrs/journal/JournalEvent/Seq"));
+/**
+ * Schema for an event producer identifier.
+ *
+ * The same shape `RunId` accepts, on the same terms: the pair identifies a
+ * producer's retries in the database.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const SourceId = identifier.pipe(Schema.brand("@smthrs/journal/JournalEvent/SourceId"));
+/**
+ * Schema for a producer-local event sequence number.
+ *
+ * `Number.MAX_SAFE_INTEGER` is excluded because the journal must always be
+ * able to allocate the next sequence. `Number.MAX_SAFE_INTEGER + 1` is not a
+ * distinct integer, so the maximum is not an allocatable sequence.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const SourceSeq = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThan(Number.MAX_SAFE_INTEGER)).pipe(Schema.brand("@smthrs/journal/JournalEvent/SourceSeq"));
+/**
+ * Schema for what a re-emitted `(runId, sourceId, sourceSeq)` identity means.
+ *
+ * `content` is the default and the strict reading: the identity names one set
+ * of bytes, so a producer that re-emits it with different bytes has a bug and
+ * the journal says so with `idempotency_conflict`.
+ *
+ * `identity` is for a producer that derives the sequence from the event
+ * itself. There a collision IS the same event observed twice, and the bytes
+ * that differ between the two observations are metadata ABOUT the observation
+ * rather than the event: when a replayed frame was re-recorded, how long a
+ * step took the second time a durable engine served it from its record. The
+ * first admitted row stands and the re-emission settles as `Duplicate`. Only
+ * declare it with a sequence derived from the event's own content, because
+ * the journal then has nothing else with which to notice two different events
+ * wearing one identity.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const Dedupe = Schema.Literals(["content", "identity"]);
+/**
+ * Schema for an event submitted to the journal.
+ *
+ * Event types and values intentionally remain an open envelope. The durable
+ * core never closes this into an interpreter-specific union.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export class Input extends Schema.Class("@smthrs/journal/JournalEvent/Input")({
+    runId: RunId,
+    sourceId: SourceId,
+    sourceSeq: Schema.optional(SourceSeq),
+    /** How a collision on this event's identity is settled. Defaults to `content`. */
+    dedupe: Schema.optional(Dedupe),
+    /** Non-empty, NUL-free, well-formed UTF-16 of at most 1,024 code units. */
+    eventType: identifier,
+    payload: Schema.Unknown,
+    meta: Schema.optional(Schema.Unknown)
+}) {
+}
+/**
+ * Schema for a committed durable journal row.
+ *
+ * `seq` is allocated synchronously at journal admission and is the only
+ * sequence used for replay and durable provenance. `sourceSeq` identifies
+ * retries from one producer.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export class Entry extends Schema.Class("@smthrs/journal/JournalEvent/Entry")({
+    runId: RunId,
+    seq: Seq,
+    /**
+     * Derived by {@link makeEventId} from the other three identity members, never
+     * supplied by a caller, so it carries no check of its own.
+     */
+    eventId: Schema.String,
+    sourceId: SourceId,
+    sourceSeq: SourceSeq,
+    emittedAtMs: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+    /**
+     * The same bounded identifier `Input.eventType` accepts. It used to be a bare
+     * `Schema.String` here, so a consumer decoding an `Entry` accepted an empty,
+     * over-long, NUL-bearing, or ill-formed-UTF-16 event type that no emit could
+     * ever have produced.
+     */
+    eventType: identifier,
+    payload: Schema.Unknown,
+    meta: Schema.Unknown
+}) {
+}
+/**
+ * Makes a collision-free deterministic event identifier from the idempotency
+ * key `(runId, sourceId, sourceSeq)`.
+ *
+ * Length prefixes preserve tuple boundaries even when identifiers contain the
+ * separator. The value is deliberately not random: retrying the same source
+ * event must produce the same durable id.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeEventId = (runId, sourceId, sourceSeq) => `flows:event:${runId.length}:${runId}${sourceId.length}:${sourceId}${sourceSeq}`;
+/**
+ * The reserved prefix of every companion stream id.
+ *
+ * A run id that begins with it names a companion stream, never a run: stores
+ * that admit run ids (`@smthrs/run-store`'s `RunStore.create`) refuse it.
+ *
+ * @category constants
+ * @since 1.0.0
+ */
+export const companionPrefix = "flows.companion/";
+/** SHA-256 round constants: the first 32 bits of the cube roots of the first 64 primes. */
+const sha256Rounds = Uint32Array.from([
+    0x428a2f98,
+    0x71374491,
+    0xb5c0fbcf,
+    0xe9b5dba5,
+    0x3956c25b,
+    0x59f111f1,
+    0x923f82a4,
+    0xab1c5ed5,
+    0xd807aa98,
+    0x12835b01,
+    0x243185be,
+    0x550c7dc3,
+    0x72be5d74,
+    0x80deb1fe,
+    0x9bdc06a7,
+    0xc19bf174,
+    0xe49b69c1,
+    0xefbe4786,
+    0x0fc19dc6,
+    0x240ca1cc,
+    0x2de92c6f,
+    0x4a7484aa,
+    0x5cb0a9dc,
+    0x76f988da,
+    0x983e5152,
+    0xa831c66d,
+    0xb00327c8,
+    0xbf597fc7,
+    0xc6e00bf3,
+    0xd5a79147,
+    0x06ca6351,
+    0x14292967,
+    0x27b70a85,
+    0x2e1b2138,
+    0x4d2c6dfc,
+    0x53380d13,
+    0x650a7354,
+    0x766a0abb,
+    0x81c2c92e,
+    0x92722c85,
+    0xa2bfe8a1,
+    0xa81a664b,
+    0xc24b8b70,
+    0xc76c51a3,
+    0xd192e819,
+    0xd6990624,
+    0xf40e3585,
+    0x106aa070,
+    0x19a4c116,
+    0x1e376c08,
+    0x2748774c,
+    0x34b0bcb5,
+    0x391c0cb3,
+    0x4ed8aa4a,
+    0x5b9cca4f,
+    0x682e6ff3,
+    0x748f82ee,
+    0x78a5636f,
+    0x84c87814,
+    0x8cc70208,
+    0x90befffa,
+    0xa4506ceb,
+    0xbef9a3f7,
+    0xc67178f2
+]);
+const rotate = (value, bits) => (value >>> bits) | (value << (32 - bits));
+/**
+ * SHA-256 of the UTF-8 encoding of `text`, as lowercase hex.
+ *
+ * Synchronous on purpose: companion ids are derived inside write
+ * transactions, and an asynchronous digest would yield the event loop while
+ * the writer is held.
+ */
+const sha256Hex = (text) => {
+    const bytes = new TextEncoder().encode(text);
+    const length = ((bytes.length + 9 + 63) >> 6) << 6;
+    const padded = new Uint8Array(length);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(length - 8, Math.floor(bytes.length / 0x20000000));
+    view.setUint32(length - 4, (bytes.length << 3) >>> 0);
+    const hash = Uint32Array.from([
+        0x6a09e667,
+        0xbb67ae85,
+        0x3c6ef372,
+        0xa54ff53a,
+        0x510e527f,
+        0x9b05688c,
+        0x1f83d9ab,
+        0x5be0cd19
+    ]);
+    const words = new Uint32Array(64);
+    for (let block = 0; block < length; block += 64) {
+        for (let index = 0; index < 16; index++)
+            words[index] = view.getUint32(block + index * 4);
+        for (let index = 16; index < 64; index++) {
+            const low = words[index - 15];
+            const high = words[index - 2];
+            const s0 = rotate(low, 7) ^ rotate(low, 18) ^ (low >>> 3);
+            const s1 = rotate(high, 17) ^ rotate(high, 19) ^ (high >>> 10);
+            words[index] = (words[index - 16] + s0 + words[index - 7] + s1) >>> 0;
+        }
+        let a = hash[0];
+        let b = hash[1];
+        let c = hash[2];
+        let d = hash[3];
+        let e = hash[4];
+        let f = hash[5];
+        let g = hash[6];
+        let h = hash[7];
+        for (let index = 0; index < 64; index++) {
+            const choose = (e & f) ^ (~e & g);
+            const t1 = (h + (rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25)) + choose + sha256Rounds[index] + words[index]) >>> 0;
+            const t2 = ((rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        hash[0] = (hash[0] + a) >>> 0;
+        hash[1] = (hash[1] + b) >>> 0;
+        hash[2] = (hash[2] + c) >>> 0;
+        hash[3] = (hash[3] + d) >>> 0;
+        hash[4] = (hash[4] + e) >>> 0;
+        hash[5] = (hash[5] + f) >>> 0;
+        hash[6] = (hash[6] + g) >>> 0;
+        hash[7] = (hash[7] + h) >>> 0;
+    }
+    return Array.from(hash, (word) => word.toString(16).padStart(8, "0")).join("");
+};
+/**
+ * The digest a journal fact uses to reference bytes kept outside the journal:
+ * the SHA-256 of the UTF-8 encoding of `text`, as 64 lowercase hex digits.
+ *
+ * The journal redacts every payload, so a fact never carries executable
+ * values. A store that folds state from its facts keeps the bytes in its own
+ * rows and records only their digest, which a rebuild checks the row against.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export const contentDigest = (text) => sha256Hex(text);
+/**
+ * The id of the companion stream that carries one store's facts about a run.
+ *
+ * A companion stream is an ordinary journal stream with its own sequence
+ * clock, kept beside the run's own stream rather than inside it. A consumer
+ * that reads the run's stream by position never sees a companion fact, and a
+ * rewind or compaction of the run's stream never truncates one. The id is
+ * `flows.companion/<stream>/<sha-256 of the run id>`, so it stays within
+ * {@link maxIdentifierLength} for every run id; each fact carries its run id
+ * in its payload.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export const companionRunId = (stream, runId) => `${companionPrefix}${stream}/${contentDigest(runId)}`;
+/**
+ * Whether a run id names a companion stream.
+ *
+ * @category predicates
+ * @since 1.0.0
+ */
+export const isCompanionRunId = (runId) => runId.startsWith(companionPrefix);
+/**
+ * Bounded durable text shared by namespace contracts.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const Identifier = identifier;
+/**
+ * A lineage coordinate, distinct from the run that currently hosts it.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const LineageId = identifier.pipe(Schema.brand("@smthrs/journal/LineageId"));
+/**
+ * A concrete wait identity.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const WaitId = identifier.pipe(Schema.brand("@smthrs/journal/WaitId"));
+/**
+ * An admitted command identity.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const CommandId = identifier.pipe(Schema.brand("@smthrs/journal/CommandId"));
+/**
+ * A plan identity, never interchangeable with a dispatch or artifact.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const PlanId = identifier.pipe(Schema.brand("@smthrs/journal/PlanId"));
+/**
+ * A dispatch identity. Branding does not verify its digest.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const DispatchId = identifier.pipe(Schema.brand("@smthrs/journal/DispatchId"));
+/**
+ * An artifact identity. Branding does not verify content.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const ArtifactId = identifier.pipe(Schema.brand("@smthrs/journal/ArtifactId"));
+/**
+ * Integer quantities in the inclusive safe range, including zero.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const NonNegativeQuantity = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER));
+/**
+ * Integer quantities in the inclusive safe range, excluding zero.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const PositiveQuantity = NonNegativeQuantity.check(Schema.isGreaterThan(0));
+/**
+ * Non-negative integral milliseconds since the Unix epoch.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const TimestampMs = NonNegativeQuantity.pipe(Schema.brand("@smthrs/journal/TimestampMs"));
+/**
+ * Decode a run id without a cast; schema failures retain their issue.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeRunId = Schema.decodeUnknownEffect(RunId);
+/**
+ * Decode a lineage id without a cast.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeLineageId = Schema.decodeUnknownEffect(LineageId);
+/**
+ * Decode a wait id without a cast.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeWaitId = Schema.decodeUnknownEffect(WaitId);
+/**
+ * Decode a command id without a cast.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeCommandId = Schema.decodeUnknownEffect(CommandId);
+/**
+ * Decode a plan id without a cast.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodePlanId = Schema.decodeUnknownEffect(PlanId);
+/**
+ * Decode a dispatch id without a cast.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeDispatchId = Schema.decodeUnknownEffect(DispatchId);
+/**
+ * Decode an artifact id without a cast.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeArtifactId = Schema.decodeUnknownEffect(ArtifactId);
+/**
+ * Decode an absolute timestamp without coercion.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeTimestampMs = Schema.decodeUnknownEffect(TimestampMs);
+/**
+ * Decode a budget that permits zero. Units belong to the field.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodeNonNegativeQuantity = Schema.decodeUnknownEffect(NonNegativeQuantity);
+/**
+ * Decode a budget that requires positive capacity.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decodePositiveQuantity = Schema.decodeUnknownEffect(PositiveQuantity);
+//# sourceMappingURL=JournalEvent.js.map

package/dist/esm/JournalEvent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JournalEvent.js","sourceRoot":"","sources":["../../src/JournalEvent.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,aAAa,GAAG,wEAAwE,CAAA;AAE9F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;AAEtD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEvC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACpC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EACrB,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,EACvC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,EACnG,MAAM,CAAC,UAAU,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAC/F,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;AAUxF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CACjC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAChC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAC3C,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CACjD,CAAA;AAUD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;AAU9F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CACvC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAChC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAC3C,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CACvD,CAAA;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;AAU9D;;;;;;;;GAQG;AACH,MAAM,OAAO,KAAM,SAAQ,MAAM,CAAC,KAAK,CAAQ,oCAAoC,CAAC,CAAC;IACnF,KAAK,EAAE,KAAK;IACZ,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrC,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,SAAS,EAAE,UAAU;IACrB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;CACtC,CAAC;CAAG;AAEL;;;;;;;;;GASG;AACH,MAAM,OAAO,KAAM,SAAQ,MAAM,CAAC,KAAK,CAAQ,oCAAoC,CAAC,CAAC;IACnF,KAAK,EAAE,KAAK;IACZ,GAAG,EAAE,GAAG;IACR;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/D;;;;;OAKG;IACH,SAAS,EAAE,UAAU;IACrB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,IAAI,EAAE,MAAM,CAAC,OAAO;CACrB,CAAC;CAAG;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAY,EAAE,QAAkB,EAAE,SAAoB,EAAU,EAAE,CAC5F,eAAe,KAAK,CAAC,MAAM,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAA;AAElF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAA;AAEjD,2FAA2F;AAC3F,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC;IACpC,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;CACX,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;AAEjG;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE;IACzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAC3B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC5B,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;KACX,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAA;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAA;QACzF,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,EAAE,CAAE,CAAA;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAA;YAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;YACzD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;YAC9D,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAE,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACjC,MAAM,EAAE,GACN,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,YAAY,CAAC,KAAK,CAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC,CAAA;YAC5G,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YACjG,CAAC,GAAG,CAAC,CAAA;YACL,CAAC,GAAG,CAAC,CAAA;YACL,CAAC,GAAG,CAAC,CAAA;YACL,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC,GAAG,CAAC,CAAA;YACL,CAAC,GAAG,CAAC,CAAA;YACL,CAAC,GAAG,CAAC,CAAA;YACL,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAChF,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,KAAa,EAAS,EAAE,CACrE,GAAG,eAAe,GAAG,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAW,CAAA;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;AAE7F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAA;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAA;AASnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;AAS7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAA;AASnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;AAS7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAA;AASrF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAA;AASrF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CACjD,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAChC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CACpD,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;AAShG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;AAC5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;AACpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;AAC9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;AACpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;AAC9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAA;AACtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAA;AACtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAA;AACxE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;AACxF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAA","sourcesContent":["/**\n * Durable event-envelope schemas for the journal.\n *\n * @since 0.1.0\n */\n\nimport * as Schema from \"effect/Schema\"\n\n/**\n * A UTF-16 surrogate with no partner: a high surrogate not followed by a low\n * one, or a low surrogate not preceded by a high one. `String.isWellFormed`\n * answers the same question but needs the ES2024 lib, which this package does\n * not target.\n */\nconst loneSurrogate = /[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|(?<![\\uD800-\\uDBFF])[\\uDC00-\\uDFFF]/\n\n/**\n * A NUL anywhere in an identifier.\n *\n * SQLite's `length()` counts the characters BEFORE the first NUL, and every\n * identifier column carries `CHECK (length(...) > 0)`, so a leading-NUL run id\n * measures zero and the write fails the constraint. Measured on this tree, an\n * emit with a leading-NUL run id came back as `sink_failed` with a\n * `DatabaseError` cause, which tells the caller the database is down when the\n * real fault is the identifier it just supplied. A NUL after the first\n * character is refused on the same terms: it makes the column's own length\n * check disagree with the identifier's length.\n *\n * Built from a code point rather than written as a pattern literal: a control\n * character in a regex is exactly the typo `no-control-regex` exists to catch,\n * and no reader can see one in the source.\n */\nconst embeddedNul = new RegExp(String.fromCharCode(0))\n\n/**\n * Longest identifier the journal persists.\n *\n * A run id, a source id and an event type are index columns of a permanent\n * table and are held in per-run maps for the layer's lifetime, so an\n * unbounded one costs durable index space and heap that nothing ever\n * reclaims. Every identifier this repository mints is a uuid or a short\n * dotted name, two orders of magnitude below this bound, so the ceiling\n * refuses only the shapes that were never identifiers.\n *\n * @since 1.0.0\n * @category constants\n */\nexport const maxIdentifierLength = 1024\n\n/**\n * A persistable identifier: non-empty, and representable in the store.\n *\n * SQLite binds a lone UTF-16 surrogate as U+FFFD, so two ill-formed\n * identifiers that differ only in their surrogates land on ONE persisted key.\n * The second run's first event then dedupes into the first run's row and reads\n * by either id return the same history, which destroys run isolation at the\n * persistence boundary. Rejecting ill-formed text at the schema keeps the\n * identifier the caller decoded and the identifier the database stores the\n * same value.\n *\n * A NUL is rejected for the reason {@link embeddedNul} gives: the column's own\n * length check cannot see past one, so the store refuses the identifier as a\n * constraint violation and the caller is told the sink failed.\n *\n * The empty string is rejected for a plainer reason: it names nothing, and the\n * journal used to accept it at decode and then reject it at the service, so a\n * caller could hold a \"valid\" identifier the next call refused.\n * The length is bounded because every identifier occupies permanent index\n * space and layer-lifetime heap.\n */\nconst identifier = Schema.String.check(\n  Schema.isMinLength(1),\n  Schema.isMaxLength(maxIdentifierLength),\n  Schema.makeFilter((value: string) => !loneSurrogate.test(value), { title: \"wellFormedIdentifier\" }),\n  Schema.makeFilter((value: string) => !embeddedNul.test(value), { title: \"nulFreeIdentifier\" })\n)\n\n/**\n * Schema for an identifier of one durable run.\n *\n * Between 1 and 1,024 UTF-16 code units, free of unpaired UTF-16 surrogates\n * because the store cannot tell two ill-formed identifiers apart, and free of\n * NUL because the store's own length check cannot see past one.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const RunId = identifier.pipe(Schema.brand(\"@smthrs/journal/JournalEvent/RunId\"))\n\n/**\n * Branded identifier of one durable run.\n *\n * @category models\n * @since 0.1.0\n */\nexport type RunId = typeof RunId.Type\n\n/**\n * Schema for the canonical, durable sequence number within a run.\n *\n * `Number.MAX_SAFE_INTEGER` is excluded because the journal must always be\n * able to allocate the next sequence. `Number.MAX_SAFE_INTEGER + 1` is not a\n * distinct integer, so the maximum is not an allocatable sequence.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const Seq = Schema.Int.check(\n  Schema.isGreaterThanOrEqualTo(0),\n  Schema.isLessThan(Number.MAX_SAFE_INTEGER)\n).pipe(\n  Schema.brand(\"@smthrs/journal/JournalEvent/Seq\")\n)\n\n/**\n * Canonical durable per-run sequence number.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Seq = typeof Seq.Type\n\n/**\n * Schema for an event producer identifier.\n *\n * The same shape `RunId` accepts, on the same terms: the pair identifies a\n * producer's retries in the database.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const SourceId = identifier.pipe(Schema.brand(\"@smthrs/journal/JournalEvent/SourceId\"))\n\n/**\n * Identifier of an event producer.\n *\n * @category models\n * @since 0.1.0\n */\nexport type SourceId = typeof SourceId.Type\n\n/**\n * Schema for a producer-local event sequence number.\n *\n * `Number.MAX_SAFE_INTEGER` is excluded because the journal must always be\n * able to allocate the next sequence. `Number.MAX_SAFE_INTEGER + 1` is not a\n * distinct integer, so the maximum is not an allocatable sequence.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const SourceSeq = Schema.Int.check(\n  Schema.isGreaterThanOrEqualTo(0),\n  Schema.isLessThan(Number.MAX_SAFE_INTEGER)\n).pipe(\n  Schema.brand(\"@smthrs/journal/JournalEvent/SourceSeq\")\n)\n\n/**\n * Producer-local event sequence number.\n *\n * @category models\n * @since 0.1.0\n */\nexport type SourceSeq = typeof SourceSeq.Type\n\n/**\n * Schema for what a re-emitted `(runId, sourceId, sourceSeq)` identity means.\n *\n * `content` is the default and the strict reading: the identity names one set\n * of bytes, so a producer that re-emits it with different bytes has a bug and\n * the journal says so with `idempotency_conflict`.\n *\n * `identity` is for a producer that derives the sequence from the event\n * itself. There a collision IS the same event observed twice, and the bytes\n * that differ between the two observations are metadata ABOUT the observation\n * rather than the event: when a replayed frame was re-recorded, how long a\n * step took the second time a durable engine served it from its record. The\n * first admitted row stands and the re-emission settles as `Duplicate`. Only\n * declare it with a sequence derived from the event's own content, because\n * the journal then has nothing else with which to notice two different events\n * wearing one identity.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const Dedupe = Schema.Literals([\"content\", \"identity\"])\n\n/**\n * What a re-emitted producer identity means.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Dedupe = typeof Dedupe.Type\n\n/**\n * Schema for an event submitted to the journal.\n *\n * Event types and values intentionally remain an open envelope. The durable\n * core never closes this into an interpreter-specific union.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport class Input extends Schema.Class<Input>(\"@smthrs/journal/JournalEvent/Input\")({\n  runId: RunId,\n  sourceId: SourceId,\n  sourceSeq: Schema.optional(SourceSeq),\n  /** How a collision on this event's identity is settled. Defaults to `content`. */\n  dedupe: Schema.optional(Dedupe),\n  /** Non-empty, NUL-free, well-formed UTF-16 of at most 1,024 code units. */\n  eventType: identifier,\n  payload: Schema.Unknown,\n  meta: Schema.optional(Schema.Unknown)\n}) {}\n\n/**\n * Schema for a committed durable journal row.\n *\n * `seq` is allocated synchronously at journal admission and is the only\n * sequence used for replay and durable provenance. `sourceSeq` identifies\n * retries from one producer.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport class Entry extends Schema.Class<Entry>(\"@smthrs/journal/JournalEvent/Entry\")({\n  runId: RunId,\n  seq: Seq,\n  /**\n   * Derived by {@link makeEventId} from the other three identity members, never\n   * supplied by a caller, so it carries no check of its own.\n   */\n  eventId: Schema.String,\n  sourceId: SourceId,\n  sourceSeq: SourceSeq,\n  emittedAtMs: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /**\n   * The same bounded identifier `Input.eventType` accepts. It used to be a bare\n   * `Schema.String` here, so a consumer decoding an `Entry` accepted an empty,\n   * over-long, NUL-bearing, or ill-formed-UTF-16 event type that no emit could\n   * ever have produced.\n   */\n  eventType: identifier,\n  payload: Schema.Unknown,\n  meta: Schema.Unknown\n}) {}\n\n/**\n * Makes a collision-free deterministic event identifier from the idempotency\n * key `(runId, sourceId, sourceSeq)`.\n *\n * Length prefixes preserve tuple boundaries even when identifiers contain the\n * separator. The value is deliberately not random: retrying the same source\n * event must produce the same durable id.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeEventId = (runId: RunId, sourceId: SourceId, sourceSeq: SourceSeq): string =>\n  `flows:event:${runId.length}:${runId}${sourceId.length}:${sourceId}${sourceSeq}`\n\n/**\n * The reserved prefix of every companion stream id.\n *\n * A run id that begins with it names a companion stream, never a run: stores\n * that admit run ids (`@smthrs/run-store`'s `RunStore.create`) refuse it.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const companionPrefix = \"flows.companion/\"\n\n/** SHA-256 round constants: the first 32 bits of the cube roots of the first 64 primes. */\nconst sha256Rounds = Uint32Array.from([\n  0x428a2f98,\n  0x71374491,\n  0xb5c0fbcf,\n  0xe9b5dba5,\n  0x3956c25b,\n  0x59f111f1,\n  0x923f82a4,\n  0xab1c5ed5,\n  0xd807aa98,\n  0x12835b01,\n  0x243185be,\n  0x550c7dc3,\n  0x72be5d74,\n  0x80deb1fe,\n  0x9bdc06a7,\n  0xc19bf174,\n  0xe49b69c1,\n  0xefbe4786,\n  0x0fc19dc6,\n  0x240ca1cc,\n  0x2de92c6f,\n  0x4a7484aa,\n  0x5cb0a9dc,\n  0x76f988da,\n  0x983e5152,\n  0xa831c66d,\n  0xb00327c8,\n  0xbf597fc7,\n  0xc6e00bf3,\n  0xd5a79147,\n  0x06ca6351,\n  0x14292967,\n  0x27b70a85,\n  0x2e1b2138,\n  0x4d2c6dfc,\n  0x53380d13,\n  0x650a7354,\n  0x766a0abb,\n  0x81c2c92e,\n  0x92722c85,\n  0xa2bfe8a1,\n  0xa81a664b,\n  0xc24b8b70,\n  0xc76c51a3,\n  0xd192e819,\n  0xd6990624,\n  0xf40e3585,\n  0x106aa070,\n  0x19a4c116,\n  0x1e376c08,\n  0x2748774c,\n  0x34b0bcb5,\n  0x391c0cb3,\n  0x4ed8aa4a,\n  0x5b9cca4f,\n  0x682e6ff3,\n  0x748f82ee,\n  0x78a5636f,\n  0x84c87814,\n  0x8cc70208,\n  0x90befffa,\n  0xa4506ceb,\n  0xbef9a3f7,\n  0xc67178f2\n])\n\nconst rotate = (value: number, bits: number): number => (value >>> bits) | (value << (32 - bits))\n\n/**\n * SHA-256 of the UTF-8 encoding of `text`, as lowercase hex.\n *\n * Synchronous on purpose: companion ids are derived inside write\n * transactions, and an asynchronous digest would yield the event loop while\n * the writer is held.\n */\nconst sha256Hex = (text: string): string => {\n  const bytes = new TextEncoder().encode(text)\n  const length = ((bytes.length + 9 + 63) >> 6) << 6\n  const padded = new Uint8Array(length)\n  padded.set(bytes)\n  padded[bytes.length] = 0x80\n  const view = new DataView(padded.buffer)\n  view.setUint32(length - 8, Math.floor(bytes.length / 0x20000000))\n  view.setUint32(length - 4, (bytes.length << 3) >>> 0)\n  const hash = Uint32Array.from([\n    0x6a09e667,\n    0xbb67ae85,\n    0x3c6ef372,\n    0xa54ff53a,\n    0x510e527f,\n    0x9b05688c,\n    0x1f83d9ab,\n    0x5be0cd19\n  ])\n  const words = new Uint32Array(64)\n  for (let block = 0; block < length; block += 64) {\n    for (let index = 0; index < 16; index++) words[index] = view.getUint32(block + index * 4)\n    for (let index = 16; index < 64; index++) {\n      const low = words[index - 15]!\n      const high = words[index - 2]!\n      const s0 = rotate(low, 7) ^ rotate(low, 18) ^ (low >>> 3)\n      const s1 = rotate(high, 17) ^ rotate(high, 19) ^ (high >>> 10)\n      words[index] = (words[index - 16]! + s0 + words[index - 7]! + s1) >>> 0\n    }\n    let a = hash[0]!\n    let b = hash[1]!\n    let c = hash[2]!\n    let d = hash[3]!\n    let e = hash[4]!\n    let f = hash[5]!\n    let g = hash[6]!\n    let h = hash[7]!\n    for (let index = 0; index < 64; index++) {\n      const choose = (e & f) ^ (~e & g)\n      const t1 =\n        (h + (rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25)) + choose + sha256Rounds[index]! + words[index]!) >>> 0\n      const t2 = ((rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0\n      h = g\n      g = f\n      f = e\n      e = (d + t1) >>> 0\n      d = c\n      c = b\n      b = a\n      a = (t1 + t2) >>> 0\n    }\n    hash[0] = (hash[0]! + a) >>> 0\n    hash[1] = (hash[1]! + b) >>> 0\n    hash[2] = (hash[2]! + c) >>> 0\n    hash[3] = (hash[3]! + d) >>> 0\n    hash[4] = (hash[4]! + e) >>> 0\n    hash[5] = (hash[5]! + f) >>> 0\n    hash[6] = (hash[6]! + g) >>> 0\n    hash[7] = (hash[7]! + h) >>> 0\n  }\n  return Array.from(hash, (word) => word.toString(16).padStart(8, \"0\")).join(\"\")\n}\n\n/**\n * The digest a journal fact uses to reference bytes kept outside the journal:\n * the SHA-256 of the UTF-8 encoding of `text`, as 64 lowercase hex digits.\n *\n * The journal redacts every payload, so a fact never carries executable\n * values. A store that folds state from its facts keeps the bytes in its own\n * rows and records only their digest, which a rebuild checks the row against.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const contentDigest = (text: string): string => sha256Hex(text)\n\n/**\n * The id of the companion stream that carries one store's facts about a run.\n *\n * A companion stream is an ordinary journal stream with its own sequence\n * clock, kept beside the run's own stream rather than inside it. A consumer\n * that reads the run's stream by position never sees a companion fact, and a\n * rewind or compaction of the run's stream never truncates one. The id is\n * `flows.companion/<stream>/<sha-256 of the run id>`, so it stays within\n * {@link maxIdentifierLength} for every run id; each fact carries its run id\n * in its payload.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const companionRunId = (stream: string, runId: string): RunId =>\n  `${companionPrefix}${stream}/${contentDigest(runId)}` as RunId\n\n/**\n * Whether a run id names a companion stream.\n *\n * @category predicates\n * @since 1.0.0\n */\nexport const isCompanionRunId = (runId: string): boolean => runId.startsWith(companionPrefix)\n\n/**\n * Bounded durable text shared by namespace contracts.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const Identifier = identifier\n\n/**\n * A lineage coordinate, distinct from the run that currently hosts it.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const LineageId = identifier.pipe(Schema.brand(\"@smthrs/journal/LineageId\"))\n/**\n * A lineage coordinate.\n *\n * @category models\n * @since 1.0.0\n */\nexport type LineageId = typeof LineageId.Type\n\n/**\n * A concrete wait identity.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const WaitId = identifier.pipe(Schema.brand(\"@smthrs/journal/WaitId\"))\n/**\n * A concrete wait identity.\n *\n * @category models\n * @since 1.0.0\n */\nexport type WaitId = typeof WaitId.Type\n\n/**\n * An admitted command identity.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const CommandId = identifier.pipe(Schema.brand(\"@smthrs/journal/CommandId\"))\n/**\n * An admitted command identity.\n *\n * @category models\n * @since 1.0.0\n */\nexport type CommandId = typeof CommandId.Type\n\n/**\n * A plan identity, never interchangeable with a dispatch or artifact.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const PlanId = identifier.pipe(Schema.brand(\"@smthrs/journal/PlanId\"))\n/**\n * A plan identity.\n *\n * @category models\n * @since 1.0.0\n */\nexport type PlanId = typeof PlanId.Type\n\n/**\n * A dispatch identity. Branding does not verify its digest.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const DispatchId = identifier.pipe(Schema.brand(\"@smthrs/journal/DispatchId\"))\n/**\n * A dispatch identity.\n *\n * @category models\n * @since 1.0.0\n */\nexport type DispatchId = typeof DispatchId.Type\n\n/**\n * An artifact identity. Branding does not verify content.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const ArtifactId = identifier.pipe(Schema.brand(\"@smthrs/journal/ArtifactId\"))\n/**\n * An artifact identity.\n *\n * @category models\n * @since 1.0.0\n */\nexport type ArtifactId = typeof ArtifactId.Type\n\n/**\n * Integer quantities in the inclusive safe range, including zero.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const NonNegativeQuantity = Schema.Int.check(\n  Schema.isGreaterThanOrEqualTo(0),\n  Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)\n)\n\n/**\n * Integer quantities in the inclusive safe range, excluding zero.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const PositiveQuantity = NonNegativeQuantity.check(Schema.isGreaterThan(0))\n\n/**\n * Non-negative integral milliseconds since the Unix epoch.\n *\n * @category schemas\n * @since 1.0.0\n */\nexport const TimestampMs = NonNegativeQuantity.pipe(Schema.brand(\"@smthrs/journal/TimestampMs\"))\n/**\n * Non-negative integral milliseconds since the Unix epoch.\n *\n * @category models\n * @since 1.0.0\n */\nexport type TimestampMs = typeof TimestampMs.Type\n\n/**\n * Decode a run id without a cast; schema failures retain their issue.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeRunId = Schema.decodeUnknownEffect(RunId)\n/**\n * Decode a lineage id without a cast.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeLineageId = Schema.decodeUnknownEffect(LineageId)\n/**\n * Decode a wait id without a cast.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeWaitId = Schema.decodeUnknownEffect(WaitId)\n/**\n * Decode a command id without a cast.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeCommandId = Schema.decodeUnknownEffect(CommandId)\n/**\n * Decode a plan id without a cast.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodePlanId = Schema.decodeUnknownEffect(PlanId)\n/**\n * Decode a dispatch id without a cast.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeDispatchId = Schema.decodeUnknownEffect(DispatchId)\n/**\n * Decode an artifact id without a cast.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeArtifactId = Schema.decodeUnknownEffect(ArtifactId)\n/**\n * Decode an absolute timestamp without coercion.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeTimestampMs = Schema.decodeUnknownEffect(TimestampMs)\n/**\n * Decode a budget that permits zero. Units belong to the field.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodeNonNegativeQuantity = Schema.decodeUnknownEffect(NonNegativeQuantity)\n/**\n * Decode a budget that requires positive capacity.\n *\n * @category decoders\n * @since 1.0.0\n */\nexport const decodePositiveQuantity = Schema.decodeUnknownEffect(PositiveQuantity)\n"]}

package/dist/esm/JournalGeneration.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Durable generations distinguish histories that reuse journal sequences.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+/**
+ * Installs the generation table idempotently. Both the SQL journal and time
+ * travel initialize it, including databases whose migration ladder already
+ * passed the journal's reserved block. A read-only client installs nothing.
+ *
+ * @category migrations
+ * @since 1.0.0-rc.0
+ */
+export declare const initialize: Effect.Effect<void, import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/**
+ * Registers a live journal's cache invalidation until its scope closes.
+ * Multiple journals over the same SQL client must observe the same rewind.
+ *
+ * @category lifecycle
+ * @since 1.0.0-rc.0
+ */
+export declare const onTruncate: (forget: (runIds: ReadonlyArray<string>) => void) => Effect.Effect<void, never, import("effect/Scope").Scope | SqlClient.SqlClient>;
+/**
+ * Forgets cached identities and allocation floors after a committed truncation.
+ * The rewinder must quiesce producers and flush pending admissions first.
+ * Database rows remain authoritative; this operation changes no durable data.
+ *
+ * @category lifecycle
+ * @since 1.0.0-rc.0
+ */
+export declare const forget: (runIds: ReadonlyArray<string>) => Effect.Effect<void, never, SqlClient.SqlClient>;
+//# sourceMappingURL=JournalGeneration.d.ts.map

package/dist/esm/JournalGeneration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JournalGeneration.d.ts","sourceRoot":"","sources":["../../src/JournalGeneration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,2FAerB,CAAA;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,mFAgBtE,CAAA;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,GAAI,QAAQ,aAAa,CAAC,MAAM,CAAC,oDAMhD,CAAA"}

package/dist/esm/JournalGeneration.js

@@ -0,0 +1,65 @@
+/**
+ * Durable generations distinguish histories that reuse journal sequences.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Dialect from "@smthrs/database/Dialect";
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+/**
+ * Installs the generation table idempotently. Both the SQL journal and time
+ * travel initialize it, including databases whose migration ladder already
+ * passed the journal's reserved block. A read-only client installs nothing.
+ *
+ * @category migrations
+ * @since 1.0.0-rc.0
+ */
+export const initialize = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    // A read-only observer reads the schema it finds and installs nothing.
+    if (Dialect.isReadOnly(sql))
+        return;
+    yield* sql `
+    CREATE TABLE IF NOT EXISTS flows_journal_generations (
+      run_id TEXT PRIMARY KEY NOT NULL CHECK (length(run_id) > 0),
+      generation ${Dialect.integer(sql)} NOT NULL CHECK (${Dialect.isInteger(sql, sql `generation`)} AND generation > 0 AND generation <= 9007199254740991),
+      after_seq ${Dialect.integer(sql)} NOT NULL CHECK (${Dialect.isInteger(sql, sql `after_seq`)} AND after_seq >= -1 AND after_seq <= 9007199254740991)
+    )
+  `;
+});
+const journals = new WeakMap();
+/**
+ * Registers a live journal's cache invalidation until its scope closes.
+ * Multiple journals over the same SQL client must observe the same rewind.
+ *
+ * @category lifecycle
+ * @since 1.0.0-rc.0
+ */
+export const onTruncate = (forget) => Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    let listeners = journals.get(sql);
+    if (listeners === undefined) {
+        listeners = new Set();
+        journals.set(sql, listeners);
+    }
+    const registered = listeners;
+    yield* Effect.acquireRelease(Effect.sync(() => registered.add(forget)), () => Effect.sync(() => {
+        registered.delete(forget);
+    }));
+});
+/**
+ * Forgets cached identities and allocation floors after a committed truncation.
+ * The rewinder must quiesce producers and flush pending admissions first.
+ * Database rows remain authoritative; this operation changes no durable data.
+ *
+ * @category lifecycle
+ * @since 1.0.0-rc.0
+ */
+export const forget = (runIds) => Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* Effect.sync(() => {
+        for (const invalidate of journals.get(sql) ?? [])
+            invalidate(runIds);
+    });
+});
+//# sourceMappingURL=JournalGeneration.js.map