@smthrs/sync 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/BranchCommands.js

@@ -0,0 +1,496 @@
+/**
+ * Idempotent admission of collaborative commands onto a branch document.
+ *
+ * Three different things look identical from the server's side — an optimistic
+ * client re-sending after a timeout, a reconnecting client flushing its
+ * outbox, and two people pressing the same button at once — and all three must
+ * produce exactly one durable command. The client-minted `commandId` is the
+ * idempotency key for all three.
+ *
+ * The exactly-once constraint is durable, not process-local: every append
+ * carries the producer identity `(branch run, commandSourceId(commandId),
+ * commandSourceSeq)`, which the journal enforces inside its own write
+ * transaction. Two independently constructed servers that race the same
+ * command therefore collide in the journal — one appends, the other receives
+ * a duplicate receipt or an idempotency conflict and resolves the canonical
+ * sequence by replaying the branch (audit finding F-14). The in-memory
+ * ledger, permit, and replay cursor are a fast path only: they answer known
+ * duplicates without a journal write and keep a restarted server from
+ * re-executing history, but correctness never depends on them.
+ *
+ * @since 0.1.0
+ */
+import { Journal } from "@smthrs/journal";
+import * as JournalEvent from "@smthrs/journal/JournalEvent";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as RcMap from "effect/RcMap";
+import * as Semaphore from "effect/Semaphore";
+import { branchRunId, CommandEvent, CommandReceipt, commandSourceId, commandSourceSeq, CommandSubmission, SubmitRequest } from "./BranchProtocol.js";
+import { maximumBranchTtlMs } from "./BranchRpcs.js";
+import * as BranchShare from "./BranchShare.js";
+import * as Admission from "./internal/Admission.js";
+import { causeCode } from "./internal/CauseText.js";
+import { journalErrorCode } from "./internal/JournalErrorCode.js";
+import { positiveInt } from "./internal/PolicyOptions.js";
+import { SyncError } from "./SyncError.js";
+import * as SyncProtocol from "./SyncProtocol.js";
+/**
+ * The branch command ledger.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export class BranchCommands extends Context.Service()("@smthrs/sync/BranchCommands") {
+}
+/**
+ * Constructs a command ledger that admits nothing.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeNoop = (overrides = {}) => BranchCommands.of({
+    submit: () => Effect.fail(new SyncError({ code: "closed", message: "Branch commands are unavailable" })),
+    ...overrides
+});
+/**
+ * Provides a command ledger that admits nothing.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerNoop = Layer.succeed(BranchCommands, makeNoop());
+/**
+ * Projects a journal write failure onto the sync boundary.
+ *
+ * The public `message` is a constant and the `cause` names the failure's type
+ * only. A branch writer may hold nothing but a share link, and the journal's
+ * own message is the SQLite driver's, which carries SQL text, table and column
+ * names, and constraint identifiers. The CODE is a different question from the
+ * message: a journal code this boundary also declares crosses as that code, so
+ * a writer whose commit was lost to a closing journal is told that rather than
+ * being told nothing.
+ */
+const journalFailure = (cause) => new SyncError({
+    code: journalErrorCode(cause),
+    message: "Branch journal write failed",
+    cause: causeCode(cause)
+});
+/** How many entries one rehydration page reads. */
+const pageSize = 256;
+/**
+ * Receipts one branch keeps in memory before the oldest are evicted.
+ *
+ * The ledger is a fast path: it answers a known duplicate without a journal
+ * write, and losing an entry costs a round trip, never correctness, because
+ * the journal's own producer identity is the durable exactly-once constraint
+ * and returns a `Duplicate` receipt for a command already admitted. Retaining
+ * one receipt per command forever meant a process serving a hundred branches
+ * of a hundred thousand commands held ten million of them, so the fast path
+ * is bounded and the durable path is what makes it safe to bound.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const defaultLedgerCapacity = 4096;
+/**
+ * Inclusive UTF-8 JSON submission ceiling. The separate sync entry ceiling
+ * leaves room for the durable envelope around every admitted command.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const defaultMaxCommandBytes = 1024 * 1024;
+/**
+ * Milliseconds a branch may have no active submissions before its in-memory state is
+ * dropped.
+ *
+ * The receipt ledger is bounded per branch; this bounds the branches. A
+ * dropped branch re-hydrates on its next submission exactly as it does after
+ * a restart, so eviction costs a journal read, never correctness. The default
+ * is the longest lifetime a branch capability may carry, so a branch is only
+ * dropped once every capability minted at its last touch can have expired.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const defaultBranchIdleMs = maximumBranchTtlMs;
+/**
+ * Entries one branch's first-touch hydration reads before it stops.
+ *
+ * Hydration is the only full history read that ever sat on the WRITE path: the
+ * first submission a process makes to a branch paged that branch's whole
+ * durable log, 256 entries at a time, while holding the branch's admission
+ * permit, before its own append was attempted. A hundred-thousand-entry branch
+ * therefore charged its next writer four hundred journal reads for a fast path
+ * that keeps four thousand receipts.
+ *
+ * The budget defaults to {@link defaultLedgerCapacity} because hydration
+ * cannot seed more receipts than the ledger holds: everything a longer walk
+ * records displaces something the same walk already recorded. What the extra
+ * reads buy is a FRESHER selection — the tail of history rather than its head
+ * — and the price is an unbounded wait on somebody's write. This trades that
+ * back: the walk stops, the cursor stays where it stopped, and a later replay
+ * continues forward from there.
+ *
+ * A branch longer than the budget starts with a partly cold fast path and
+ * nothing else. Correctness never rested on the ledger: the journal's producer
+ * identity is the durable exactly-once constraint, an exact retry receives a
+ * `Duplicate` receipt carrying the canonical sequence, and an
+ * `idempotency_conflict` is resolved by a read of the whole history that the
+ * ledger's own bound already made necessary.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const defaultHydrationLimit = defaultLedgerCapacity;
+/** The ledger over an already-validated policy. */
+const makeWith = (resolved) => Effect.gen(function* () {
+    const journal = yield* Journal.Journal;
+    const share = yield* BranchShare.BranchShare;
+    const { branchIdleMs, hydrationLimit, ledgerCapacity, maxCommandBytes, maxFrameBytes } = resolved;
+    // Active submissions share one state; its idle lifetime starts at release.
+    const branches = yield* RcMap.make({
+        idleTimeToLive: branchIdleMs,
+        lookup: (_branchId) => Effect.sync(() => ({
+            permit: Semaphore.makeUnsafe(1),
+            receipts: new Map(),
+            cursor: undefined,
+            hydrated: false
+        }))
+    });
+    /**
+     * Records one receipt, evicting the branch's oldest once the branch is
+     * at capacity. `Map` iterates in insertion order, so the first key is
+     * the least recently recorded one; re-recording a known command
+     * refreshes it in place rather than growing the branch.
+     */
+    const recordIn = (branch, receipt) => {
+        branch.delete(receipt.commandId);
+        branch.set(receipt.commandId, receipt);
+        for (const oldest of branch.keys()) {
+            if (branch.size <= ledgerCapacity)
+                break;
+            branch.delete(oldest);
+        }
+    };
+    const duplicateOf = (known) => new CommandReceipt({
+        branchId: known.branchId,
+        commandId: known.commandId,
+        status: "duplicate",
+        seq: known.seq
+    });
+    /**
+     * Pages a branch's journal forward from `from`, handing each entry to
+     * `visit` along with the command identity it carries, if any, and
+     * stopping once it has visited `budget` entries. Admission already
+     * decoded every command payload in full, so the identity is read off
+     * that decoded command rather than decoded a second time.
+     *
+     * The budget is entries VISITED, not pages read, so a caller names a
+     * bound in the unit its own memory is measured in.
+     * `Number.POSITIVE_INFINITY` is the unbounded walk the recovery reads
+     * take: they answer a question about the whole durable history, and a
+     * bounded answer to that question is a wrong one.
+     */
+    const walk = (branchId, from, budget, visit) => Effect.gen(function* () {
+        const runId = branchRunId(branchId);
+        let after = from;
+        let hasMore = true;
+        let remaining = budget;
+        while (hasMore && remaining > 0) {
+            const page = yield* journal.entries({
+                runId,
+                ...(after === undefined ? {} : { after }),
+                limit: Math.min(pageSize, remaining)
+            }).pipe(Effect.mapError(journalFailure));
+            const admitted = yield* Admission.withCommands(page.entries, runId, after ?? -1);
+            for (const { command, entry } of admitted) {
+                after = entry.seq;
+                remaining -= 1;
+                visit(entry, command?.commandId);
+            }
+            // An empty page ends the walk whatever the page claims, the same
+            // guard `SyncServer.tail` carries: `after` cannot move, so the
+            // next read is byte-identical and the loop would never terminate
+            // — while holding this branch's admission permit.
+            if (page.entries.length === 0)
+                return;
+            hasMore = page.hasMore;
+        }
+    });
+    /**
+     * Replays the branch journal forward from the last replayed sequence into
+     * the ledger. Used once on first touch, so a process that restarts
+     * mid-collaboration still recognises every command it already admitted,
+     * and again after an admission conflict, to read the command another
+     * writer admitted after this process last looked.
+     *
+     * The staged cursor tracks each visited entry. A successful bounded walk
+     * commits exactly where it stopped, so the next replay resumes there.
+     * Failure or interruption discards the staged cursor and receipts together.
+     */
+    const replay = (branchId, state, budget) => Effect.gen(function* () {
+        // Stage at most ledgerCapacity receipts. A malformed later page or an
+        // interruption must leave both the ledger and replay cursor untouched.
+        const staged = new Map(state.receipts);
+        let position = state.cursor;
+        yield* walk(branchId, position, budget, (entry, commandId) => {
+            position = entry.seq;
+            if (commandId !== undefined) {
+                recordIn(staged, new CommandReceipt({ branchId, commandId, status: "admitted", seq: entry.seq }));
+            }
+        });
+        state.cursor = position;
+        state.receipts = staged;
+    });
+    /**
+     * The sequence one command was admitted at, read from the branch's whole
+     * durable history rather than from the ledger.
+     *
+     * The ledger is BOUNDED, so the receipt for a command admitted far
+     * enough back has been evicted, and a forward replay from the ledger's
+     * own cursor can never bring it back — the entry is below that cursor.
+     * The durable log still holds it, and this is the read that says so.
+     * Neither the cursor nor the ledger moves: this answers one question
+     * about history and leaves the fast path exactly as it found it.
+     */
+    const admittedSeq = (branchId, commandId) => Effect.gen(function* () {
+        let found;
+        yield* walk(branchId, undefined, Number.POSITIVE_INFINITY, (entry, admitted) => {
+            if (admitted === commandId)
+                found = entry.seq;
+        });
+        return found;
+    });
+    /**
+     * Seeds the branch's fast path ONCE, from its durable history, within
+     * the configured budget (see {@link defaultHydrationLimit}).
+     *
+     * It runs on the write path, inside the branch's admission permit, so
+     * the budget is what keeps the length of a branch's history out of the
+     * latency of the next submission to it. The branch is marked hydrated
+     * whether or not the walk reached the tail, because the point of the
+     * budget is that no submission pays for the rest: what the walk did not
+     * reach is answered by the journal, and by the unbounded replay
+     * {@link lostRace} runs when the journal reports a conflict.
+     */
+    const hydrate = (branchId, state) => Effect.gen(function* () {
+        if (state.hydrated)
+            return;
+        yield* replay(branchId, state, hydrationLimit);
+        state.hydrated = true;
+    });
+    /**
+     * The losing side of a cross-server admission race: the journal refused
+     * this append because another writer already holds the command's producer
+     * identity with different content — same `commandId`, different
+     * participant or arguments. The original admission is durable, so
+     * replaying the branch forward must surface it; a replay that does not is
+     * a journal whose conflict report and entries disagree, and that failure
+     * is reported honestly instead of being masked as a duplicate.
+     *
+     * Two reads, because the ledger is bounded and the answer must not be.
+     * The forward replay picks up an admission another writer landed after
+     * this process last looked. A command this process admitted itself and
+     * has since evicted is BELOW that cursor, so only a read of the whole
+     * history finds it — and without one, bounding the ledger turned an
+     * ordinary duplicate into a report that the journal contradicts itself.
+     */
+    const lostRace = (submission, state, cause) => Effect.gen(function* () {
+        // Unbounded, unlike hydration: this is the recovery read, and the
+        // sequence it is looking for may sit anywhere in the history.
+        yield* replay(submission.branchId, state, Number.POSITIVE_INFINITY);
+        const known = state.receipts.get(submission.commandId);
+        if (known !== undefined)
+            return duplicateOf(known);
+        // A branch still under the ledger's capacity has never evicted
+        // anything, and `replay` has just read this branch to its tail, so a
+        // command missing from the ledger is missing from the journal too.
+        // Reading the whole history to confirm that would let one small
+        // request cost one full log scan.
+        const mayHaveEvicted = state.receipts.size >= ledgerCapacity;
+        const seq = mayHaveEvicted
+            ? yield* admittedSeq(submission.branchId, submission.commandId)
+            : undefined;
+        if (seq === undefined)
+            return yield* Effect.fail(journalFailure(cause));
+        return new CommandReceipt({
+            branchId: submission.branchId,
+            commandId: submission.commandId,
+            status: "duplicate",
+            seq
+        });
+    });
+    const journalInput = (submission, capabilityId) => new JournalEvent.Input({
+        runId: branchRunId(submission.branchId),
+        sourceId: commandSourceId(submission.commandId),
+        sourceSeq: commandSourceSeq,
+        eventType: CommandEvent,
+        payload: {
+            branchId: submission.branchId,
+            commandId: submission.commandId,
+            participantId: submission.participantId,
+            name: submission.name,
+            args: submission.args,
+            target: submission.target,
+            capabilityId
+        },
+        meta: null
+    });
+    const admit = (request, capabilityId, state) => Effect.gen(function* () {
+        const submission = request.submission;
+        yield* hydrate(submission.branchId, state);
+        const known = state.receipts.get(submission.commandId);
+        if (known !== undefined)
+            return duplicateOf(known);
+        // Unfenced: the sync command journal is a multi-writer admission
+        // log — participants own no branch run, and command admissions are
+        // first-writer-wins on the command id.
+        const receipt = yield* journal.emitDurableUnfenced(journalInput(submission, capabilityId)).pipe(
+        // A `Duplicate` receipt is another writer landing the identical
+        // submission first: the journal deduplicated durably and returned
+        // the canonical sequence the original append committed at.
+        Effect.map((accepted) => new CommandReceipt({
+            branchId: submission.branchId,
+            commandId: submission.commandId,
+            status: accepted._tag === "Duplicate" ? "duplicate" : "admitted",
+            seq: accepted.seq
+        })), Effect.catch((cause) => cause.code === "idempotency_conflict"
+            ? lostRace(submission, state, cause)
+            : Effect.fail(journalFailure(cause))));
+        recordIn(state.receipts, new CommandReceipt({
+            branchId: submission.branchId,
+            commandId: submission.commandId,
+            status: "admitted",
+            seq: receipt.seq
+        }));
+        return receipt;
+    });
+    const submit = Effect.fn("BranchCommands.submit")(function* (supplied) {
+        const decoded = yield* Admission.decode(SubmitRequest, supplied, "invalid_request");
+        // Freeze the authorized submission across asynchronous signature verification.
+        const request = { capability: decoded.capability, submission: { ...decoded.submission } };
+        yield* Effect.annotateCurrentSpan({
+            branchId: request.submission.branchId,
+            commandId: request.submission.commandId,
+            participantId: request.submission.participantId
+        });
+        // The verified capability, not the client's `participantId`, is who
+        // submitted: it is stamped on the durable payload for attribution.
+        const claims = yield* share.verify(request.capability, {
+            branchId: request.submission.branchId,
+            access: "write"
+        });
+        const bytes = SyncProtocol.encodedByteLength(request.submission);
+        if (bytes > maxCommandBytes) {
+            // Refused BEFORE the append: an oversized command must never reach
+            // the journal, and therefore never reaches any follower.
+            return yield* Effect.fail(new SyncError({
+                code: "frame_too_large",
+                message: `Encoded command submission of ${bytes} bytes exceeds the ${maxCommandBytes}-byte ceiling`
+            }));
+        }
+        const input = journalInput(request.submission, claims.capabilityId);
+        // The journal owns these fields. Reserve their largest encoded forms,
+        // so acceptance does not depend on wall clock or current history length.
+        // Event identity repeats run/source IDs; their escaping and UTF-8 cost
+        // must be measured, not replaced by a fixed envelope allowance.
+        const entryBytes = SyncProtocol.encodedByteLength({
+            ...input,
+            seq: Number.MAX_SAFE_INTEGER - 1,
+            eventId: JournalEvent.makeEventId(input.runId, input.sourceId, commandSourceSeq),
+            emittedAtMs: Number.MAX_VALUE
+        });
+        if (entryBytes > maxFrameBytes) {
+            return yield* Effect.fail(new SyncError({
+                code: "frame_too_large",
+                message: `Encoded command journal entry requires up to ${entryBytes} bytes, exceeding the ${maxFrameBytes}-byte frame ceiling`
+            }));
+        }
+        // The permit is taken AFTER authorization so an unauthorized caller
+        // cannot serialize (and therefore stall) legitimate collaborators,
+        // and it is this BRANCH's permit so a slow branch stalls only itself.
+        return yield* RcMap.get(branches, request.submission.branchId).pipe(Effect.flatMap((state) => state.permit.withPermit(admit(request, claims.capabilityId, state))), Effect.scoped);
+    });
+    return BranchCommands.of({ submit });
+});
+const defaults = {
+    maxCommandBytes: defaultMaxCommandBytes,
+    maxFrameBytes: SyncProtocol.defaultMaxFrameBytes,
+    ledgerCapacity: defaultLedgerCapacity,
+    hydrationLimit: defaultHydrationLimit,
+    branchIdleMs: defaultBranchIdleMs
+};
+/**
+ * Constructs the journal-backed branch command ledger under an explicit
+ * policy. The caller scope owns cached states and their idle-expiration timers.
+ *
+ * A submission whose encoded form exceeds the command ceiling is refused with
+ * `frame_too_large` before anything is appended, so one oversized `args`
+ * cannot enter the branch journal and poison every follower that replays it.
+ *
+ * First-touch hydration reads at most `hydrationLimit` entries, so the length
+ * of a branch's history is not charged to the next writer's latency; see
+ * {@link defaultHydrationLimit} for why the fast path may be seeded partially
+ * without any effect on what the ledger admits.
+ *
+ * Every option is validated as a positive safe integer at construction: the
+ * TypeScript type says `number`, and `NaN` silently disabled the ceiling it
+ * was compared against.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeLiveWith = (options = {}) => Effect.flatMap(Effect.all({
+    maxFrameBytes: positiveInt("BranchCommands.Options.maxFrameBytes", options.maxFrameBytes, defaults.maxFrameBytes),
+    maxCommandBytes: positiveInt("BranchCommands.Options.maxCommandBytes", options.maxCommandBytes, defaults.maxCommandBytes),
+    ledgerCapacity: positiveInt("BranchCommands.Options.ledgerCapacity", options.ledgerCapacity, defaults.ledgerCapacity),
+    hydrationLimit: positiveInt("BranchCommands.Options.hydrationLimit", options.hydrationLimit, defaults.hydrationLimit),
+    branchIdleMs: positiveInt("BranchCommands.Options.branchIdleMs", options.branchIdleMs, defaults.branchIdleMs)
+}), makeWith);
+/**
+ * Constructs the journal-backed branch command ledger with default policy.
+ * The caller scope owns cached states and their idle-expiration timers.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeLive = makeWith(defaults);
+/**
+ * Provides the journal-backed branch command ledger.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layer = Layer.effect(BranchCommands, makeLive);
+/**
+ * Provides the journal-backed branch command ledger under an explicit policy.
+ * Fails with `invalid_request` when an option is not a positive safe integer.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerWith = (options) => Layer.effect(BranchCommands, makeLiveWith(options));
+/**
+ * Builds a submission, filling in the fields a plain command never sets, and
+ * refusing a field the schema forbids with a `SyncError` rather than a defect.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const submission = (fields) => 
+// Decoded, not constructed: `name` is a `NonEmptyString` the parameter type
+// admits `""` for, and `new CommandSubmission` throws on it. A builder that
+// dies on a caller's argument is the same defect `submit` already refuses
+// typed, one call earlier.
+Admission.decode(CommandSubmission, {
+    branchId: fields.branchId,
+    commandId: fields.commandId,
+    participantId: fields.participantId,
+    name: fields.name,
+    args: fields.args ?? "",
+    target: fields.target ?? ""
+}, "invalid_request");
+//# sourceMappingURL=BranchCommands.js.map

package/dist/esm/BranchCommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BranchCommands.js","sourceRoot":"","sources":["../../src/BranchCommands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACzC,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAEL,WAAW,EACX,YAAY,EAEZ,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AAYjD;;;;;GAKG;AACH,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAA2B,CAAC,6BAA6B,CAAC;CAAG;AAEhH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,YAA8B,EAAE,EAAW,EAAE,CACpE,cAAc,CAAC,EAAE,CAAC;IAChB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACxG,GAAG,SAAS;CACb,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAgC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAA;AAE/F;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,CAAC,KAAc,EAAa,EAAE,CACnD,IAAI,SAAS,CAAC;IACZ,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC;IAC7B,OAAO,EAAE,6BAA6B;IACtC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;CACxB,CAAC,CAAA;AAEJ,mDAAmD;AACnD,MAAM,QAAQ,GAAG,GAAG,CAAA;AAEpB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAA;AAqD1D,mDAAmD;AACnD,MAAM,QAAQ,GAAG,CACf,QAMC,EACuF,EAAE,CAC1F,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;IACP,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAA;IAC5C,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAA;IACjG,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,cAAc,EAAE,YAAY;QAC5B,MAAM,EAAE,CAAC,SAAmB,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,CAAC,GAAgB,EAAE,CAAC,CAAC;YAC9B,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/B,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;KACN,CAAC,CAAA;IAEF;;;;;OAKG;IACH,MAAM,QAAQ,GAAG,CAAC,MAAsC,EAAE,OAAuB,EAAQ,EAAE;QACzF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACtC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,IAAI,IAAI,cAAc;gBAAE,MAAK;YACxC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAAC,KAAqB,EAAkB,EAAE,CAC5D,IAAI,cAAc,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAA;IAEJ;;;;;;;;;;;;OAYG;IACH,MAAM,IAAI,GAAG,CACX,QAAkB,EAClB,IAAkC,EAClC,MAAc,EACd,KAA4E,EAC5C,EAAE,CAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,IAAI,CAAA;QAChB,IAAI,OAAO,GAAG,IAAI,CAAA;QAClB,IAAI,SAAS,GAAG,MAAM,CAAA;QACtB,OAAO,OAAO,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;gBAClC,KAAK;gBACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBACzC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;aACrC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;YACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;YAChF,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1C,KAAK,GAAG,KAAK,CAAC,GAAG,CAAA;gBACjB,SAAS,IAAI,CAAC,CAAA;gBACd,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;YAClC,CAAC;YACD,iEAAiE;YACjE,+DAA+D;YAC/D,iEAAiE;YACjE,kDAAkD;YAClD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YACrC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QACxB,CAAC;IACH,CAAC,CAAC,CAAA;IAEJ;;;;;;;;;;OAUG;IACH,MAAM,MAAM,GAAG,CAAC,QAAkB,EAAE,KAAkB,EAAE,MAAc,EAAkC,EAAE,CACxG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAA;QAC3B,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;YAC3D,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAA;YACpB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,QAAQ,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YACnG,CAAC;QACH,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAA;QACvB,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAA;IACzB,CAAC,CAAC,CAAA;IAEJ;;;;;;;;;;OAUG;IACH,MAAM,WAAW,GAAG,CAClB,QAAkB,EAClB,SAAoB,EACoC,EAAE,CAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,KAAmC,CAAA;QACvC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC7E,IAAI,QAAQ,KAAK,SAAS;gBAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAA;QAC/C,CAAC,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEJ;;;;;;;;;;;OAWG;IACH,MAAM,OAAO,GAAG,CAAC,QAAkB,EAAE,KAAkB,EAAkC,EAAE,CACzF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAM;QAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC,CAAA;QAC9C,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvB,CAAC,CAAC,CAAA;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,MAAM,QAAQ,GAAG,CACf,UAA6B,EAC7B,KAAkB,EAClB,KAA2B,EACe,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,kEAAkE;QAClE,8DAA8D;QAC9D,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QACtD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;QAClD,+DAA+D;QAC/D,qEAAqE;QACrE,mEAAmE;QACnE,gEAAgE;QAChE,kCAAkC;QAClC,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,cAAc,CAAA;QAC5D,MAAM,GAAG,GAAG,cAAc;YACxB,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC;YAC/D,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAA;QACvE,OAAO,IAAI,cAAc,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,WAAW;YACnB,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEJ,MAAM,YAAY,GAAG,CAAC,UAA6B,EAAE,YAAoB,EAAsB,EAAE,CAC/F,IAAI,YAAY,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QACvC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,gBAAgB;QAC3B,SAAS,EAAE,YAAY;QACvB,OAAO,EAAE;YACP,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,YAAY;SACb;QACD,IAAI,EAAE,IAAI;KACX,CAAC,CAAA;IAEJ,MAAM,KAAK,GAAG,CACZ,OAAsB,EACtB,YAAoB,EACpB,KAAkB,EACwB,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACrC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QACtD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;QAClD,iEAAiE;QACjE,mEAAmE;QACnE,uCAAuC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAChD,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,CACvC,CAAC,IAAI;QACJ,gEAAgE;QAChE,kEAAkE;QAClE,2DAA2D;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,IAAI,cAAc,CAAC;YACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;YAChE,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,KAAK,CAAC,IAAI,KAAK,sBAAsB;YACnC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CACvC,CACF,CAAA;QACD,QAAQ,CACN,KAAK,CAAC,QAAQ,EACd,IAAI,cAAc,CAAC;YACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CACH,CAAA;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAC,QAAuB;QACjF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QACnF,+EAA+E;QAC/E,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,EAAE,CAAA;QACzF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ;YACrC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS;YACvC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa;SAChD,CAAC,CAAA;QACF,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE;YACrD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ;YACrC,MAAM,EAAE,OAAO;SAChB,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChE,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;YAC5B,mEAAmE;YACnE,yDAAyD;YACzD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,iCAAiC,KAAK,sBAAsB,eAAe,eAAe;aACpG,CAAC,CACH,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QACnE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC;YAChD,GAAG,KAAK;YACR,GAAG,EAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC;YAChC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAChF,WAAW,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EACL,gDAAgD,UAAU,yBAAyB,aAAa,qBAAqB;aACxH,CAAC,CACH,CAAA;QACH,CAAC;QACD,oEAAoE;QACpE,mEAAmE;QACnE,sEAAsE;QACtE,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,EAC9F,MAAM,CAAC,MAAM,CACd,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,cAAc,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACtC,CAAC,CACF,CAAA;AAEH,MAAM,QAAQ,GAAG;IACf,eAAe,EAAE,sBAAsB;IACvC,aAAa,EAAE,YAAY,CAAC,oBAAoB;IAChD,cAAc,EAAE,qBAAqB;IACrC,cAAc,EAAE,qBAAqB;IACrC,YAAY,EAAE,mBAAmB;CAClC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,UAAmB,EAAE,EACuE,EAAE,CAC9F,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,GAAG,CAAC;IACT,aAAa,EAAE,WAAW,CACxB,sCAAsC,EACtC,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,aAAa,CACvB;IACD,eAAe,EAAE,WAAW,CAC1B,wCAAwC,EACxC,OAAO,CAAC,eAAe,EACvB,QAAQ,CAAC,eAAe,CACzB;IACD,cAAc,EAAE,WAAW,CACzB,uCAAuC,EACvC,OAAO,CAAC,cAAc,EACtB,QAAQ,CAAC,cAAc,CACxB;IACD,cAAc,EAAE,WAAW,CACzB,uCAAuC,EACvC,OAAO,CAAC,cAAc,EACtB,QAAQ,CAAC,cAAc,CACxB;IACD,YAAY,EAAE,WAAW,CACvB,qCAAqC,EACrC,OAAO,CAAC,YAAY,EACpB,QAAQ,CAAC,YAAY,CACtB;CACF,CAAC,EACF,QAAQ,CACT,CAAA;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GACnB,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAEpB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAkF,KAAK,CAAC,MAAM,CAC9G,cAAc,EACd,QAAQ,CACT,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAgB,EACmE,EAAE,CACrF,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAO1B,EAA+C,EAAE;AAChD,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,2BAA2B;AAC3B,SAAS,CAAC,MAAM,CAAC,iBAAiB,EAAE;IAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,SAAS,EAAE,MAAM,CAAC,SAAS;IAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;CAC5B,EAAE,iBAAiB,CAAC,CAAA","sourcesContent":["/**\n * Idempotent admission of collaborative commands onto a branch document.\n *\n * Three different things look identical from the server's side — an optimistic\n * client re-sending after a timeout, a reconnecting client flushing its\n * outbox, and two people pressing the same button at once — and all three must\n * produce exactly one durable command. The client-minted `commandId` is the\n * idempotency key for all three.\n *\n * The exactly-once constraint is durable, not process-local: every append\n * carries the producer identity `(branch run, commandSourceId(commandId),\n * commandSourceSeq)`, which the journal enforces inside its own write\n * transaction. Two independently constructed servers that race the same\n * command therefore collide in the journal — one appends, the other receives\n * a duplicate receipt or an idempotency conflict and resolves the canonical\n * sequence by replaying the branch (audit finding F-14). The in-memory\n * ledger, permit, and replay cursor are a fast path only: they answer known\n * duplicates without a journal write and keep a restarted server from\n * re-executing history, but correctness never depends on them.\n *\n * @since 0.1.0\n */\n\nimport { Journal } from \"@smthrs/journal\"\nimport * as JournalEvent from \"@smthrs/journal/JournalEvent\"\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as RcMap from \"effect/RcMap\"\nimport type * as Scope from \"effect/Scope\"\nimport * as Semaphore from \"effect/Semaphore\"\nimport {\n  type BranchId,\n  branchRunId,\n  CommandEvent,\n  type CommandId,\n  CommandReceipt,\n  commandSourceId,\n  commandSourceSeq,\n  CommandSubmission,\n  SubmitRequest\n} from \"./BranchProtocol.ts\"\nimport { maximumBranchTtlMs } from \"./BranchRpcs.ts\"\nimport * as BranchShare from \"./BranchShare.ts\"\nimport * as Admission from \"./internal/Admission.ts\"\nimport { causeCode } from \"./internal/CauseText.ts\"\nimport { journalErrorCode } from \"./internal/JournalErrorCode.ts\"\nimport { positiveInt } from \"./internal/PolicyOptions.ts\"\nimport { SyncError } from \"./SyncError.ts\"\nimport * as SyncProtocol from \"./SyncProtocol.ts\"\n\n/**\n * Branch command admission operations.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Service {\n  readonly submit: (request: SubmitRequest) => Effect.Effect<CommandReceipt, SyncError>\n}\n\n/**\n * The branch command ledger.\n *\n * @category services\n * @since 0.1.0\n */\nexport class BranchCommands extends Context.Service<BranchCommands, Service>()(\"@smthrs/sync/BranchCommands\") {}\n\n/**\n * Constructs a command ledger that admits nothing.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeNoop = (overrides: Partial<Service> = {}): Service =>\n  BranchCommands.of({\n    submit: () => Effect.fail(new SyncError({ code: \"closed\", message: \"Branch commands are unavailable\" })),\n    ...overrides\n  })\n\n/**\n * Provides a command ledger that admits nothing.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoop: Layer.Layer<BranchCommands> = Layer.succeed(BranchCommands, makeNoop())\n\n/**\n * Projects a journal write failure onto the sync boundary.\n *\n * The public `message` is a constant and the `cause` names the failure's type\n * only. A branch writer may hold nothing but a share link, and the journal's\n * own message is the SQLite driver's, which carries SQL text, table and column\n * names, and constraint identifiers. The CODE is a different question from the\n * message: a journal code this boundary also declares crosses as that code, so\n * a writer whose commit was lost to a closing journal is told that rather than\n * being told nothing.\n */\nconst journalFailure = (cause: unknown): SyncError =>\n  new SyncError({\n    code: journalErrorCode(cause),\n    message: \"Branch journal write failed\",\n    cause: causeCode(cause)\n  })\n\n/** How many entries one rehydration page reads. */\nconst pageSize = 256\n\n/**\n * Receipts one branch keeps in memory before the oldest are evicted.\n *\n * The ledger is a fast path: it answers a known duplicate without a journal\n * write, and losing an entry costs a round trip, never correctness, because\n * the journal's own producer identity is the durable exactly-once constraint\n * and returns a `Duplicate` receipt for a command already admitted. Retaining\n * one receipt per command forever meant a process serving a hundred branches\n * of a hundred thousand commands held ten million of them, so the fast path\n * is bounded and the durable path is what makes it safe to bound.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const defaultLedgerCapacity = 4096\n\n/**\n * Inclusive UTF-8 JSON submission ceiling. The separate sync entry ceiling\n * leaves room for the durable envelope around every admitted command.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const defaultMaxCommandBytes = 1024 * 1024\n\n/**\n * Milliseconds a branch may have no active submissions before its in-memory state is\n * dropped.\n *\n * The receipt ledger is bounded per branch; this bounds the branches. A\n * dropped branch re-hydrates on its next submission exactly as it does after\n * a restart, so eviction costs a journal read, never correctness. The default\n * is the longest lifetime a branch capability may carry, so a branch is only\n * dropped once every capability minted at its last touch can have expired.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const defaultBranchIdleMs = maximumBranchTtlMs\n\n/**\n * Entries one branch's first-touch hydration reads before it stops.\n *\n * Hydration is the only full history read that ever sat on the WRITE path: the\n * first submission a process makes to a branch paged that branch's whole\n * durable log, 256 entries at a time, while holding the branch's admission\n * permit, before its own append was attempted. A hundred-thousand-entry branch\n * therefore charged its next writer four hundred journal reads for a fast path\n * that keeps four thousand receipts.\n *\n * The budget defaults to {@link defaultLedgerCapacity} because hydration\n * cannot seed more receipts than the ledger holds: everything a longer walk\n * records displaces something the same walk already recorded. What the extra\n * reads buy is a FRESHER selection — the tail of history rather than its head\n * — and the price is an unbounded wait on somebody's write. This trades that\n * back: the walk stops, the cursor stays where it stopped, and a later replay\n * continues forward from there.\n *\n * A branch longer than the budget starts with a partly cold fast path and\n * nothing else. Correctness never rested on the ledger: the journal's producer\n * identity is the durable exactly-once constraint, an exact retry receives a\n * `Duplicate` receipt carrying the canonical sequence, and an\n * `idempotency_conflict` is resolved by a read of the whole history that the\n * ledger's own bound already made necessary.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const defaultHydrationLimit = defaultLedgerCapacity\n\n/**\n * Admission policy.\n *\n * The default caps one encoded command submission at 1 MiB, one branch's\n * in-memory receipt ledger at {@link defaultLedgerCapacity} commands, and one\n * branch's first-touch hydration at {@link defaultHydrationLimit} entries.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Options {\n  /**\n   * Largest encoded journal entry followers accept. Defaults to\n   * {@link SyncProtocol.defaultMaxFrameBytes}. Configure the server and client\n   * with the same or a larger ceiling. Admission reserves the full durable\n   * envelope, including generated sequence and timestamp fields, before writing.\n   */\n  readonly maxFrameBytes?: number | undefined\n  /**\n   * Largest encoded command submission admitted, in bytes. Defaults to\n   * {@link defaultMaxCommandBytes}.\n   */\n  readonly maxCommandBytes?: number | undefined\n  /**\n   * Receipts one branch keeps in memory before the oldest are evicted.\n   * Defaults to {@link defaultLedgerCapacity}.\n   */\n  readonly ledgerCapacity?: number | undefined\n  /**\n   * Entries one branch's first-touch hydration reads before it stops.\n   * Defaults to {@link defaultHydrationLimit}.\n   */\n  readonly hydrationLimit?: number | undefined\n  /**\n   * Milliseconds a branch may have no active submissions before its in-memory state is\n   * dropped. Defaults to {@link defaultBranchIdleMs}.\n   */\n  readonly branchIdleMs?: number | undefined\n}\n\n/** Everything one process holds for one branch. */\ninterface BranchState {\n  // One permit PER BRANCH. A single process-wide permit serialized admission\n  // across every branch the process served, so one branch's first-touch\n  // history replay blocked every other branch's writes.\n  readonly permit: Semaphore.Semaphore\n  receipts: Map<CommandId, CommandReceipt>\n  cursor: JournalEvent.Seq | undefined\n  hydrated: boolean\n}\n\n/** The ledger over an already-validated policy. */\nconst makeWith = (\n  resolved: {\n    readonly maxCommandBytes: number\n    readonly maxFrameBytes: number\n    readonly ledgerCapacity: number\n    readonly hydrationLimit: number\n    readonly branchIdleMs: number\n  }\n): Effect.Effect<Service, never, Journal.Journal | BranchShare.BranchShare | Scope.Scope> =>\n  Effect.gen(\n    function*() {\n      const journal = yield* Journal.Journal\n      const share = yield* BranchShare.BranchShare\n      const { branchIdleMs, hydrationLimit, ledgerCapacity, maxCommandBytes, maxFrameBytes } = resolved\n      // Active submissions share one state; its idle lifetime starts at release.\n      const branches = yield* RcMap.make({\n        idleTimeToLive: branchIdleMs,\n        lookup: (_branchId: BranchId) =>\n          Effect.sync((): BranchState => ({\n            permit: Semaphore.makeUnsafe(1),\n            receipts: new Map(),\n            cursor: undefined,\n            hydrated: false\n          }))\n      })\n\n      /**\n       * Records one receipt, evicting the branch's oldest once the branch is\n       * at capacity. `Map` iterates in insertion order, so the first key is\n       * the least recently recorded one; re-recording a known command\n       * refreshes it in place rather than growing the branch.\n       */\n      const recordIn = (branch: Map<CommandId, CommandReceipt>, receipt: CommandReceipt): void => {\n        branch.delete(receipt.commandId)\n        branch.set(receipt.commandId, receipt)\n        for (const oldest of branch.keys()) {\n          if (branch.size <= ledgerCapacity) break\n          branch.delete(oldest)\n        }\n      }\n\n      const duplicateOf = (known: CommandReceipt): CommandReceipt =>\n        new CommandReceipt({\n          branchId: known.branchId,\n          commandId: known.commandId,\n          status: \"duplicate\",\n          seq: known.seq\n        })\n\n      /**\n       * Pages a branch's journal forward from `from`, handing each entry to\n       * `visit` along with the command identity it carries, if any, and\n       * stopping once it has visited `budget` entries. Admission already\n       * decoded every command payload in full, so the identity is read off\n       * that decoded command rather than decoded a second time.\n       *\n       * The budget is entries VISITED, not pages read, so a caller names a\n       * bound in the unit its own memory is measured in.\n       * `Number.POSITIVE_INFINITY` is the unbounded walk the recovery reads\n       * take: they answer a question about the whole durable history, and a\n       * bounded answer to that question is a wrong one.\n       */\n      const walk = (\n        branchId: BranchId,\n        from: JournalEvent.Seq | undefined,\n        budget: number,\n        visit: (entry: JournalEvent.Entry, commandId: CommandId | undefined) => void\n      ): Effect.Effect<void, SyncError> =>\n        Effect.gen(function*() {\n          const runId = branchRunId(branchId)\n          let after = from\n          let hasMore = true\n          let remaining = budget\n          while (hasMore && remaining > 0) {\n            const page = yield* journal.entries({\n              runId,\n              ...(after === undefined ? {} : { after }),\n              limit: Math.min(pageSize, remaining)\n            }).pipe(Effect.mapError(journalFailure))\n            const admitted = yield* Admission.withCommands(page.entries, runId, after ?? -1)\n            for (const { command, entry } of admitted) {\n              after = entry.seq\n              remaining -= 1\n              visit(entry, command?.commandId)\n            }\n            // An empty page ends the walk whatever the page claims, the same\n            // guard `SyncServer.tail` carries: `after` cannot move, so the\n            // next read is byte-identical and the loop would never terminate\n            // — while holding this branch's admission permit.\n            if (page.entries.length === 0) return\n            hasMore = page.hasMore\n          }\n        })\n\n      /**\n       * Replays the branch journal forward from the last replayed sequence into\n       * the ledger. Used once on first touch, so a process that restarts\n       * mid-collaboration still recognises every command it already admitted,\n       * and again after an admission conflict, to read the command another\n       * writer admitted after this process last looked.\n       *\n       * The staged cursor tracks each visited entry. A successful bounded walk\n       * commits exactly where it stopped, so the next replay resumes there.\n       * Failure or interruption discards the staged cursor and receipts together.\n       */\n      const replay = (branchId: BranchId, state: BranchState, budget: number): Effect.Effect<void, SyncError> =>\n        Effect.gen(function*() {\n          // Stage at most ledgerCapacity receipts. A malformed later page or an\n          // interruption must leave both the ledger and replay cursor untouched.\n          const staged = new Map(state.receipts)\n          let position = state.cursor\n          yield* walk(branchId, position, budget, (entry, commandId) => {\n            position = entry.seq\n            if (commandId !== undefined) {\n              recordIn(staged, new CommandReceipt({ branchId, commandId, status: \"admitted\", seq: entry.seq }))\n            }\n          })\n          state.cursor = position\n          state.receipts = staged\n        })\n\n      /**\n       * The sequence one command was admitted at, read from the branch's whole\n       * durable history rather than from the ledger.\n       *\n       * The ledger is BOUNDED, so the receipt for a command admitted far\n       * enough back has been evicted, and a forward replay from the ledger's\n       * own cursor can never bring it back — the entry is below that cursor.\n       * The durable log still holds it, and this is the read that says so.\n       * Neither the cursor nor the ledger moves: this answers one question\n       * about history and leaves the fast path exactly as it found it.\n       */\n      const admittedSeq = (\n        branchId: BranchId,\n        commandId: CommandId\n      ): Effect.Effect<JournalEvent.Seq | undefined, SyncError> =>\n        Effect.gen(function*() {\n          let found: JournalEvent.Seq | undefined\n          yield* walk(branchId, undefined, Number.POSITIVE_INFINITY, (entry, admitted) => {\n            if (admitted === commandId) found = entry.seq\n          })\n          return found\n        })\n\n      /**\n       * Seeds the branch's fast path ONCE, from its durable history, within\n       * the configured budget (see {@link defaultHydrationLimit}).\n       *\n       * It runs on the write path, inside the branch's admission permit, so\n       * the budget is what keeps the length of a branch's history out of the\n       * latency of the next submission to it. The branch is marked hydrated\n       * whether or not the walk reached the tail, because the point of the\n       * budget is that no submission pays for the rest: what the walk did not\n       * reach is answered by the journal, and by the unbounded replay\n       * {@link lostRace} runs when the journal reports a conflict.\n       */\n      const hydrate = (branchId: BranchId, state: BranchState): Effect.Effect<void, SyncError> =>\n        Effect.gen(function*() {\n          if (state.hydrated) return\n          yield* replay(branchId, state, hydrationLimit)\n          state.hydrated = true\n        })\n\n      /**\n       * The losing side of a cross-server admission race: the journal refused\n       * this append because another writer already holds the command's producer\n       * identity with different content — same `commandId`, different\n       * participant or arguments. The original admission is durable, so\n       * replaying the branch forward must surface it; a replay that does not is\n       * a journal whose conflict report and entries disagree, and that failure\n       * is reported honestly instead of being masked as a duplicate.\n       *\n       * Two reads, because the ledger is bounded and the answer must not be.\n       * The forward replay picks up an admission another writer landed after\n       * this process last looked. A command this process admitted itself and\n       * has since evicted is BELOW that cursor, so only a read of the whole\n       * history finds it — and without one, bounding the ledger turned an\n       * ordinary duplicate into a report that the journal contradicts itself.\n       */\n      const lostRace = (\n        submission: CommandSubmission,\n        state: BranchState,\n        cause: Journal.JournalError\n      ): Effect.Effect<CommandReceipt, SyncError> =>\n        Effect.gen(function*() {\n          // Unbounded, unlike hydration: this is the recovery read, and the\n          // sequence it is looking for may sit anywhere in the history.\n          yield* replay(submission.branchId, state, Number.POSITIVE_INFINITY)\n          const known = state.receipts.get(submission.commandId)\n          if (known !== undefined) return duplicateOf(known)\n          // A branch still under the ledger's capacity has never evicted\n          // anything, and `replay` has just read this branch to its tail, so a\n          // command missing from the ledger is missing from the journal too.\n          // Reading the whole history to confirm that would let one small\n          // request cost one full log scan.\n          const mayHaveEvicted = state.receipts.size >= ledgerCapacity\n          const seq = mayHaveEvicted\n            ? yield* admittedSeq(submission.branchId, submission.commandId)\n            : undefined\n          if (seq === undefined) return yield* Effect.fail(journalFailure(cause))\n          return new CommandReceipt({\n            branchId: submission.branchId,\n            commandId: submission.commandId,\n            status: \"duplicate\",\n            seq\n          })\n        })\n\n      const journalInput = (submission: CommandSubmission, capabilityId: string): JournalEvent.Input =>\n        new JournalEvent.Input({\n          runId: branchRunId(submission.branchId),\n          sourceId: commandSourceId(submission.commandId),\n          sourceSeq: commandSourceSeq,\n          eventType: CommandEvent,\n          payload: {\n            branchId: submission.branchId,\n            commandId: submission.commandId,\n            participantId: submission.participantId,\n            name: submission.name,\n            args: submission.args,\n            target: submission.target,\n            capabilityId\n          },\n          meta: null\n        })\n\n      const admit = (\n        request: SubmitRequest,\n        capabilityId: string,\n        state: BranchState\n      ): Effect.Effect<CommandReceipt, SyncError> =>\n        Effect.gen(function*() {\n          const submission = request.submission\n          yield* hydrate(submission.branchId, state)\n          const known = state.receipts.get(submission.commandId)\n          if (known !== undefined) return duplicateOf(known)\n          // Unfenced: the sync command journal is a multi-writer admission\n          // log — participants own no branch run, and command admissions are\n          // first-writer-wins on the command id.\n          const receipt = yield* journal.emitDurableUnfenced(\n            journalInput(submission, capabilityId)\n          ).pipe(\n            // A `Duplicate` receipt is another writer landing the identical\n            // submission first: the journal deduplicated durably and returned\n            // the canonical sequence the original append committed at.\n            Effect.map((accepted) =>\n              new CommandReceipt({\n                branchId: submission.branchId,\n                commandId: submission.commandId,\n                status: accepted._tag === \"Duplicate\" ? \"duplicate\" : \"admitted\",\n                seq: accepted.seq\n              })\n            ),\n            Effect.catch((cause) =>\n              cause.code === \"idempotency_conflict\"\n                ? lostRace(submission, state, cause)\n                : Effect.fail(journalFailure(cause))\n            )\n          )\n          recordIn(\n            state.receipts,\n            new CommandReceipt({\n              branchId: submission.branchId,\n              commandId: submission.commandId,\n              status: \"admitted\",\n              seq: receipt.seq\n            })\n          )\n          return receipt\n        })\n\n      const submit = Effect.fn(\"BranchCommands.submit\")(function*(supplied: SubmitRequest) {\n        const decoded = yield* Admission.decode(SubmitRequest, supplied, \"invalid_request\")\n        // Freeze the authorized submission across asynchronous signature verification.\n        const request = { capability: decoded.capability, submission: { ...decoded.submission } }\n        yield* Effect.annotateCurrentSpan({\n          branchId: request.submission.branchId,\n          commandId: request.submission.commandId,\n          participantId: request.submission.participantId\n        })\n        // The verified capability, not the client's `participantId`, is who\n        // submitted: it is stamped on the durable payload for attribution.\n        const claims = yield* share.verify(request.capability, {\n          branchId: request.submission.branchId,\n          access: \"write\"\n        })\n        const bytes = SyncProtocol.encodedByteLength(request.submission)\n        if (bytes > maxCommandBytes) {\n          // Refused BEFORE the append: an oversized command must never reach\n          // the journal, and therefore never reaches any follower.\n          return yield* Effect.fail(\n            new SyncError({\n              code: \"frame_too_large\",\n              message: `Encoded command submission of ${bytes} bytes exceeds the ${maxCommandBytes}-byte ceiling`\n            })\n          )\n        }\n        const input = journalInput(request.submission, claims.capabilityId)\n        // The journal owns these fields. Reserve their largest encoded forms,\n        // so acceptance does not depend on wall clock or current history length.\n        // Event identity repeats run/source IDs; their escaping and UTF-8 cost\n        // must be measured, not replaced by a fixed envelope allowance.\n        const entryBytes = SyncProtocol.encodedByteLength({\n          ...input,\n          seq: Number.MAX_SAFE_INTEGER - 1,\n          eventId: JournalEvent.makeEventId(input.runId, input.sourceId, commandSourceSeq),\n          emittedAtMs: Number.MAX_VALUE\n        })\n        if (entryBytes > maxFrameBytes) {\n          return yield* Effect.fail(\n            new SyncError({\n              code: \"frame_too_large\",\n              message:\n                `Encoded command journal entry requires up to ${entryBytes} bytes, exceeding the ${maxFrameBytes}-byte frame ceiling`\n            })\n          )\n        }\n        // The permit is taken AFTER authorization so an unauthorized caller\n        // cannot serialize (and therefore stall) legitimate collaborators,\n        // and it is this BRANCH's permit so a slow branch stalls only itself.\n        return yield* RcMap.get(branches, request.submission.branchId).pipe(\n          Effect.flatMap((state) => state.permit.withPermit(admit(request, claims.capabilityId, state))),\n          Effect.scoped\n        )\n      })\n\n      return BranchCommands.of({ submit })\n    }\n  )\n\nconst defaults = {\n  maxCommandBytes: defaultMaxCommandBytes,\n  maxFrameBytes: SyncProtocol.defaultMaxFrameBytes,\n  ledgerCapacity: defaultLedgerCapacity,\n  hydrationLimit: defaultHydrationLimit,\n  branchIdleMs: defaultBranchIdleMs\n}\n\n/**\n * Constructs the journal-backed branch command ledger under an explicit\n * policy. The caller scope owns cached states and their idle-expiration timers.\n *\n * A submission whose encoded form exceeds the command ceiling is refused with\n * `frame_too_large` before anything is appended, so one oversized `args`\n * cannot enter the branch journal and poison every follower that replays it.\n *\n * First-touch hydration reads at most `hydrationLimit` entries, so the length\n * of a branch's history is not charged to the next writer's latency; see\n * {@link defaultHydrationLimit} for why the fast path may be seeded partially\n * without any effect on what the ledger admits.\n *\n * Every option is validated as a positive safe integer at construction: the\n * TypeScript type says `number`, and `NaN` silently disabled the ceiling it\n * was compared against.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeLiveWith = (\n  options: Options = {}\n): Effect.Effect<Service, SyncError, Journal.Journal | BranchShare.BranchShare | Scope.Scope> =>\n  Effect.flatMap(\n    Effect.all({\n      maxFrameBytes: positiveInt(\n        \"BranchCommands.Options.maxFrameBytes\",\n        options.maxFrameBytes,\n        defaults.maxFrameBytes\n      ),\n      maxCommandBytes: positiveInt(\n        \"BranchCommands.Options.maxCommandBytes\",\n        options.maxCommandBytes,\n        defaults.maxCommandBytes\n      ),\n      ledgerCapacity: positiveInt(\n        \"BranchCommands.Options.ledgerCapacity\",\n        options.ledgerCapacity,\n        defaults.ledgerCapacity\n      ),\n      hydrationLimit: positiveInt(\n        \"BranchCommands.Options.hydrationLimit\",\n        options.hydrationLimit,\n        defaults.hydrationLimit\n      ),\n      branchIdleMs: positiveInt(\n        \"BranchCommands.Options.branchIdleMs\",\n        options.branchIdleMs,\n        defaults.branchIdleMs\n      )\n    }),\n    makeWith\n  )\n\n/**\n * Constructs the journal-backed branch command ledger with default policy.\n * The caller scope owns cached states and their idle-expiration timers.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeLive: Effect.Effect<Service, never, Journal.Journal | BranchShare.BranchShare | Scope.Scope> =\n  makeWith(defaults)\n\n/**\n * Provides the journal-backed branch command ledger.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer: Layer.Layer<BranchCommands, never, Journal.Journal | BranchShare.BranchShare> = Layer.effect(\n  BranchCommands,\n  makeLive\n)\n\n/**\n * Provides the journal-backed branch command ledger under an explicit policy.\n * Fails with `invalid_request` when an option is not a positive safe integer.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerWith = (\n  options: Options\n): Layer.Layer<BranchCommands, SyncError, Journal.Journal | BranchShare.BranchShare> =>\n  Layer.effect(BranchCommands, makeLiveWith(options))\n\n/**\n * Builds a submission, filling in the fields a plain command never sets, and\n * refusing a field the schema forbids with a `SyncError` rather than a defect.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const submission = (fields: {\n  readonly branchId: BranchId\n  readonly commandId: CommandId\n  readonly participantId: CommandSubmission[\"participantId\"]\n  readonly name: string\n  readonly args?: string\n  readonly target?: string\n}): Effect.Effect<CommandSubmission, SyncError> =>\n  // Decoded, not constructed: `name` is a `NonEmptyString` the parameter type\n  // admits `\"\"` for, and `new CommandSubmission` throws on it. A builder that\n  // dies on a caller's argument is the same defect `submit` already refuses\n  // typed, one call earlier.\n  Admission.decode(CommandSubmission, {\n    branchId: fields.branchId,\n    commandId: fields.commandId,\n    participantId: fields.participantId,\n    name: fields.name,\n    args: fields.args ?? \"\",\n    target: fields.target ?? \"\"\n  }, \"invalid_request\")\n"]}

package/dist/esm/BranchIds.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The source of freshly minted branch and capability identifiers.
+ *
+ * Minting an id is nondeterminism against the host, so it enters through a
+ * port like every other host effect: `BranchServer.layerHandlers` asks
+ * this service for the ids it puts on the wire instead of calling a global
+ * generator, which is what lets a deterministic composition — a test, a
+ * replayed transcript, a deployment that derives ids from its own namespace —
+ * supply its own without touching the handlers.
+ *
+ * @since 0.1.0
+ */
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+/**
+ * Identifier minting operations.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Service {
+    /** A fresh, unguessable identifier. Never returns the same value twice. */
+    readonly fresh: Effect.Effect<string>;
+}
+declare const BranchIds_base: Context.ServiceClass<BranchIds, "@smthrs/sync/BranchIds", Service>;
+/**
+ * The branch identifier source.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class BranchIds extends BranchIds_base {
+}
+/**
+ * Constructs the default source: Web Crypto UUIDs.
+ *
+ * Web Crypto is used directly, as it is for the share signature in
+ * `BranchShare`, so the same module runs in the browser and on node.
+ * A branch id is not itself an authorization — every operation still
+ * authorizes through a signed capability — but an unguessable id keeps a
+ * branch from being enumerated, which is why the default stays with a
+ * cryptographic generator rather than `Random`.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makeWebCrypto: () => Service;
+/**
+ * Provides {@link makeWebCrypto}.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: Layer.Layer<BranchIds>;
+/**
+ * Provides a deterministic counter, `<prefix>-1`, `<prefix>-2`, and so on.
+ * For tests and reproducible transcripts only — the ids are guessable.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerSequential: (prefix: string) => Layer.Layer<BranchIds>;
+export {};
+//# sourceMappingURL=BranchIds.d.ts.map

package/dist/esm/BranchIds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BranchIds.d.ts","sourceRoot":"","sources":["../../src/BranchIds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;CACtC;;AAED;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,cAA+D;CAAG;AAEjG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,QAAO,OAA0E,CAAA;AAE3G;;;;;GAKG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAwC,CAAA;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CASlE,CAAA"}