@xyo-network/event-kit-node 2.1.0 → 2.2.1

package/README.md

@@ -1,12 +1,14 @@
 # `@xyo-network/event-kit-node`
 
-Node.js 24+ durability adapters for Event Kit (verified on Node 24.14.1):
+Node.js 26+ durability adapters for Event Kit. The repository pins Node 26.9.0:
 
 - `createFilesystemCursorStore` — publisher cursor for the wake publisher actor
 - `createFilesystemPublisherOutbox` — durable pending-wake slot for retry stability
-- `createFilesystemWakeQueue` — crash-safe at-least-once `WakeQueue`
-- `createSqliteWakeQueue` — `WakeQueue` over `node:sqlite`, no new dependencies
-- `createFilesystemWakeInbox` — durable `AtomicWakeInbox` over that queue
+- `createSqliteWakeReceiver` — atomic durable inbox/queue over one private FULL/WAL SQLite database
+- `createSqliteWakeQueue` — standalone fenced `WakeQueue` over `node:sqlite`
+- `createFilesystemWakeQueue` / `createFilesystemWakeInbox` — coordinated SQLite authority with inspectable JSON projections
+- `createSqliteBestEffortInbox` / `createBestEffortSnapshotWorker` — persistent bounded hint security/coalescing and independent snapshot work
+- `migrateReceiverStore` / `migrateIdOnlyReducerCheckpoint` — explicit stopped-owner offline migration and reports
 
 ## Handshake clients
 
@@ -63,43 +65,60 @@ the remaining hosted/Sequence gates.
 
 ## Durability model
 
-`createFilesystemWakeInbox` commits in one order and that order is the
-correctness property: the wake reaches the durable queue **before** either
-identity record is written.
-
-- A crash in the gap redelivers the wake, which the idempotent consumer absorbs.
-- The reverse order could claim `wakeId` for a wake that was never queued and
-  wedge it permanently, which D-002 §6 forbids.
-
-Records and queue entries are published with `link`, never `rename`. `rename` is
-unsound as a claim: when two callers race the same source, both can observe
-success once the paths resolve to one inode, and the entry is handed out twice.
-`link` fails with `EEXIST`, so exactly one caller wins and the loser re-reads the
-winner's receipt.
-
-A claim is `link(pending -> inflight)` then `unlink(pending)`. A consumer that
-dies mid-handler leaves its entry in `inflight/`; `recoverInflight()` returns it
-to `pending/` at startup. A crash between the link and the unlink leaves one
-inode in both sets, and recovery keeps the pending copy.
+The [2026-10-05 remediation](../../docs/CODE_REVIEW_REMEDIATION_PLAN_2026-10-05.md)
+replaces split identity/enqueue commits with one transaction over scoped wake
+and token bindings, a stable receipt, exact authorized work, lease state and
+completion. Duplicate token binding/expiry extension is atomic. FULL/WAL SQLite
+coordinates objects and processes on one local host; a bounded 100 ms busy wait
+fails visibly under unresolved contention. Retrying retains logical identity.
+
+The filesystem adapter uses the same authority in `receiver.sqlite`. Private
+`pending/` and `inflight/` JSON files are projections, published exclusively with
+`link` and synced directories. They do not decide admission or lease ownership.
+Missing projections can be repaired; corrupt or mismatching bytes stop processing
+and remain available for inspection. Claims validate shape and canonical hash
+against committed authority. Completion removes the retained body while keeping
+the stable identity/receipt tombstone; stale files cannot resurrect completed work.
+`repairProjections()` scans active work and filesystem references explicitly.
+
+Owned directories/files are `0700`/`0600`, with owner, regular-file and symlink
+checks. Unsafe existing custody is refused instead of chmodding unrelated paths.
+Publisher cursor/outbox replacement remains single-writer `rename`, with file
+and publication-directory syncs. Read, parse, state and sync failures propagate;
+retained retry bytes/IDs are never replaced because a read failed.
+
+Legacy stores are refused before journal-mode mutation. Use the
+[offline migration runbook](../../docs/CODE_REVIEW_RECEIVER_MIGRATION_2026-10-05.md)
+on stopped-owner copies; retain backup, inventory and quarantine evidence. The
+new source format is intentionally incompatible with old writers and runtime
+dual readers are absent.
 
 ## Queue providers
 
-Both queues implement the shared lease-based `WakeQueue` port and pass the
-conformance suite in `@xyo-network/event-kit-testing`, so they are swappable
-with each other and with the in-process memory provider.
+All three providers assign a fresh lease fence on each claim. `ack()`/`release()`
+compare the current entry/state/token atomically. A stale or opposite completion
+throws `StaleWakeLeaseError`; repeating the same successful operation is inert.
+Recovery requires `recoverInflight({ consumersStopped: true })` after every
+consumer sharing the store has stopped. The assertion is an operator contract,
+not a liveness detector. Startup alone does not establish quiescence.
+
+Expanded shared conformance covers stale/repeated completion and successor
+preservation. Independent-object/process admission races, real SIGKILL boundaries,
+private custody and signed HTTP tests supplement it. Provider clauses requiring
+`reopen`/cross-writer support remain explicitly skipped for memory.
 
-SQLite makes the lease a single statement: `UPDATE … WHERE state = 'pending'`,
-where the affected-row count decides the winner. That is the transactional form
-of what the filesystem provider approximates with `link`. WAL lets several
-processes on one host share the file; it does not coordinate across hosts.
+Application effects remain at least once. Fence queue state and separately make
+external effects idempotent or atomically commit effects/checkpoints in their owner.
 
-`node:sqlite` is built in, so this adds no dependency. It does emit an
-ExperimentalWarning.
+`node:sqlite` is built in, so this adds no dependency. It does not emit an
+ExperimentalWarning when loaded on the pinned Node 26.9.0 runtime.
 
 ## Boundary
 
-This survives process death, not host loss, and does not coordinate across
-machines. The historical core implementation plan's Gate 5 durable-adapter
-clause is satisfied for a single node only. The on-chain publisher roadmap
+Current recovery evidence covers local objects/processes and copied fixtures,
+not host-loss, storage hardware failure, restore or cross-machine qualification.
+Historical core Gate 5 evidence remains scoped to its original artifacts. See
+the remediation plan for current checks and measured performance/retention costs.
+The on-chain publisher roadmap
 qualifies a single VM in Phases 4-7; a coordinated multi-VM deployment needs a
 transactional shared store, leases, and fencing and is roadmap Phase 8.

package/dist/node/bestEffortSnapshotWorker.d.ts

@@ -0,0 +1,44 @@
+import type { BestEffortWorkerLease, PersistentBestEffortInbox, VerifiedBestEffortSnapshot } from './bestEffortTypes.ts';
+/** The port must enforce the byte bound while reading and independently verify source identity/finality/content. */
+export interface BestEffortSnapshotSource<TSnapshot, TValue> {
+    readCurrent(input: {
+        readonly maxBytes: number;
+        readonly signal: AbortSignal;
+        readonly source: BestEffortWorkerLease['binding']['source'];
+    }): Promise<TSnapshot>;
+    verifySnapshot(input: {
+        readonly signal: AbortSignal;
+        readonly snapshot: TSnapshot;
+        readonly source: BestEffortWorkerLease['binding']['source'];
+    }): Promise<VerifiedBestEffortSnapshot<TValue>>;
+}
+/**
+ * Host-owned effect/checkpoint commit. The host must atomically reject older
+ * binding/fence commits and make repeats safe through idempotence or its effect
+ * journal/checkpoint transaction. A process can die after this commit and before
+ * inbox completion, so it can be repeated. `lease.isCurrent()` is advisory and
+ * cannot replace the app's own atomic fence/effect commit.
+ * dapp-kit consumers implement this through their effect journal/checkpoint,
+ * rather than an independent app engine in Event Kit.
+ */
+export interface BestEffortSnapshotApplication<TValue> {
+    commitSnapshot(input: {
+        readonly lease: BestEffortWorkerLease;
+        readonly snapshot: VerifiedBestEffortSnapshot<TValue>;
+    }): Promise<void>;
+}
+export interface BestEffortSnapshotWorkerOptions<TSnapshot, TValue> {
+    readonly application: BestEffortSnapshotApplication<TValue>;
+    readonly inbox: PersistentBestEffortInbox;
+    readonly leaseSeconds?: number;
+    readonly maxSnapshotBytes: number;
+    readonly nowSeconds?: () => number;
+    readonly source: BestEffortSnapshotSource<TSnapshot, TValue>;
+}
+export interface BestEffortSnapshotWorker {
+    /** Run at startup and periodically; durable scanning, not callbacks, chooses work. */
+    runOnce(signal?: AbortSignal): Promise<'idle' | 'completed' | 'superseded'>;
+}
+/** A bounded observer worker; no full-history replay or public-ingress app execution. */
+export declare function createBestEffortSnapshotWorker<TSnapshot, TValue>(options: BestEffortSnapshotWorkerOptions<TSnapshot, TValue>): BestEffortSnapshotWorker;
+//# sourceMappingURL=bestEffortSnapshotWorker.d.ts.map

package/dist/node/bestEffortSnapshotWorker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bestEffortSnapshotWorker.d.ts","sourceRoot":"","sources":["../../src/bestEffortSnapshotWorker.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAC7E,MAAM,sBAAsB,CAAA;AAE7B,oHAAoH;AACpH,MAAM,WAAW,wBAAwB,CAAC,SAAS,EAAE,MAAM;IACzD,WAAW,CAAC,KAAK,EAAE;QACjB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;QAC5B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAA;KAC5D,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACtB,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;QAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;QAC5B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAA;KAC5D,GAAG,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAA;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA6B,CAAC,MAAM;IACnD,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;QACrC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAA;KACtD,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED,MAAM,WAAW,+BAA+B,CAAC,SAAS,EAAE,MAAM;IAChE,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC,MAAM,CAAC,CAAA;IAC3D,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAA;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,GAAG,YAAY,CAAC,CAAA;CAC5E;AAED,yFAAyF;AACzF,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,EAC9D,OAAO,EAAE,+BAA+B,CAAC,SAAS,EAAE,MAAM,CAAC,GAC1D,wBAAwB,CAqE1B"}

package/dist/node/bestEffortTypes.d.ts

@@ -0,0 +1,55 @@
+import type { AtomicBestEffortInbox } from '@xyo-network/event-kit-protocol';
+import type { Hash, WakeSource } from '@xyo-network/event-kit-schemas';
+/** The exact authenticated consumer/source/profile scope; filterHash commits mode and policy. */
+export interface BestEffortConsumerBinding {
+    readonly audience: string;
+    readonly authorizationChainId: string;
+    readonly consumerId: string;
+    readonly controller: string;
+    readonly deploymentId: string;
+    readonly filterHash: string;
+    readonly publisher: string;
+    readonly queueId?: string;
+    readonly source: WakeSource;
+    readonly subscriptionHash: string;
+}
+/** Durable scheduling authority. A callback is only an acceleration signal. */
+export interface BestEffortDirtyTarget {
+    readonly binding: BestEffortConsumerBinding;
+    readonly completedGeneration: number;
+    readonly generation: number;
+    readonly id: string;
+    readonly requestedPosition: number;
+}
+/** A receiver-verified bounded snapshot, never evidence supplied by the hint publisher. */
+export interface VerifiedBestEffortSnapshot<TValue = unknown> {
+    readonly hash?: Hash;
+    readonly position: number;
+    readonly source: WakeSource;
+    readonly value: TValue;
+}
+export interface BestEffortWorkerLease extends BestEffortDirtyTarget {
+    /** Monotonic per-target fence. Host app commits must fence their own effects/checkpoint. */
+    readonly fence: number;
+    readonly leaseToken: string;
+    readonly previousSnapshot?: Pick<VerifiedBestEffortSnapshot, 'hash' | 'position'>;
+    complete(snapshot: Pick<VerifiedBestEffortSnapshot, 'hash' | 'position'>): Promise<boolean>;
+    isCurrent(): Promise<boolean>;
+    release(): Promise<void>;
+}
+export interface PersistentBestEffortInbox extends AtomicBestEffortInbox {
+    claim(input: {
+        readonly leaseSeconds: number;
+        readonly nowSeconds: number;
+    }): Promise<BestEffortWorkerLease | undefined>;
+    close(): void;
+    dirtyTargets(): Promise<readonly BestEffortDirtyTarget[]>;
+    /** Expired work remains dirty; a reclaimed worker gets a new token and fence. */
+    recoverExpired(nowSeconds: number): Promise<number>;
+    /** Startup/periodic scanning repairs lost callback delivery. Failure cannot delete dirty work. */
+    repairDirty(): Promise<{
+        readonly failed: number;
+        readonly scheduled: number;
+    }>;
+}
+//# sourceMappingURL=bestEffortTypes.d.ts.map

package/dist/node/bestEffortTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bestEffortTypes.d.ts","sourceRoot":"","sources":["../../src/bestEffortTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEtE,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CACnC;AAED,2FAA2F;AAC3F,MAAM,WAAW,0BAA0B,CAAC,MAAM,GAAG,OAAO;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,GAAG,UAAU,CAAC,CAAA;IACjF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3F,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;IACxH,KAAK,IAAI,IAAI,CAAA;IACb,YAAY,IAAI,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAA;IACzD,iFAAiF;IACjF,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnD,kGAAkG;IAClG,WAAW,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChF"}

package/dist/node/filesystemCursorStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystemCursorStore.d.ts","sourceRoot":"","sources":["../../src/filesystemCursorStore.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAExE,MAAM,WAAW,4BAA4B;IAC3C,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAMD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,oBAAoB,CAmBtB"}
+{"version":3,"file":"filesystemCursorStore.d.ts","sourceRoot":"","sources":["../../src/filesystemCursorStore.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAQxE,MAAM,WAAW,4BAA4B;IAC3C,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAID;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,oBAAoB,CAuBtB"}

package/dist/node/filesystemJson.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystemJson.d.ts","sourceRoot":"","sources":["../../src/filesystemJson.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvE;AAED,+EAA+E;AAC/E,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,OAAO,CAAC,CAelB;AAMD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"filesystemJson.d.ts","sourceRoot":"","sources":["../../src/filesystemJson.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvE;AAED,+EAA+E;AAC/E,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,OAAO,CAAC,CAelB;AAMD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD"}

package/dist/node/filesystemPublisherOutbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystemPublisherOutbox.d.ts","sourceRoot":"","sources":["../../src/filesystemPublisherOutbox.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAe,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAIhF,MAAM,WAAW,gCAAgC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,eAAe,CAgCjB"}
+{"version":3,"file":"filesystemPublisherOutbox.d.ts","sourceRoot":"","sources":["../../src/filesystemPublisherOutbox.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAe,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAWhF,MAAM,WAAW,gCAAgC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,eAAe,CA2DjB"}

package/dist/node/filesystemWakeInbox.d.ts

@@ -1,30 +1,13 @@
 import type { AtomicWakeInbox } from '@xyo-network/event-kit-protocol';
 import type { FilesystemWakeQueue } from './filesystemWakeQueue.ts';
 export interface FilesystemWakeInboxOptions {
-    /** Directory owning the `tokens/` and `wakes/` record sets. */
     readonly path: string;
-    /** Durable sink receiving each newly admitted wake inside the commit. */
+    /** Must be the coordinated queue created by createFilesystemWakeQueue. */
     readonly queue: FilesystemWakeQueue;
 }
 export interface FilesystemWakeInbox extends AtomicWakeInbox {
-    /** Deletes token records past `retainJwtUntil`. Returns how many were removed. */
-    pruneExpiredTokens: (nowSeconds: number) => Promise<number>;
+    pruneExpiredTokens(nowSeconds: number): Promise<number>;
 }
-/**
- * Crash-safe single-node `AtomicWakeInbox`.
- *
- * Commit order is the correctness property: the wake reaches the durable queue
- * **before** either identity record is written. A crash in the gap redelivers
- * the wake, which the idempotent consumer absorbs; the reverse order could
- * claim `wakeId` for a wake that was never queued and wedge it permanently.
- * D-002 §6 forbids burning a valid `jti` ahead of a fallible enqueue.
- *
- * Identity records are published by `link`, which fails rather than overwrites,
- * so a concurrent writer loses the race and re-reads the winner's receipt.
- *
- * This survives process death, not host loss, and does not coordinate across
- * machines. A multi-node deployment needs a transactional store or a cloud
- * queue with native deduplication.
- */
+/** Both identity indexes, stable receipt and exact work share the queue's transaction. */
 export declare function createFilesystemWakeInbox(options: FilesystemWakeInboxOptions): FilesystemWakeInbox;
 //# sourceMappingURL=filesystemWakeInbox.d.ts.map

package/dist/node/filesystemWakeInbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystemWakeInbox.d.ts","sourceRoot":"","sources":["../../src/filesystemWakeInbox.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,eAAe,EAKhB,MAAM,iCAAiC,CAAA;AAExC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAGnE,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CACpC;AAED,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,kFAAkF;IAClF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC5D;AAkBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CA4HrB"}
+{"version":3,"file":"filesystemWakeInbox.d.ts","sourceRoot":"","sources":["../../src/filesystemWakeInbox.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAInE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CACpC;AACD,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACxD;AACD,0FAA0F;AAC1F,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,mBAAmB,CAiBlG"}

package/dist/node/filesystemWakeQueue.d.ts

@@ -1,28 +1,19 @@
 import type { WakeQueue } from '@xyo-network/event-kit-protocol';
 import { ensureDurableDirectory, syncDirectory, writeDurableFile } from './filesystemDurability.ts';
+import type { ReceiverAuthority } from './receiverAuthority.ts';
 export { ensureDurableDirectory, syncDirectory, writeDurableFile, };
 export interface FilesystemWakeQueueOptions {
-    /** Directory owning the `pending/` and `inflight/` entry sets. */
+    /** Private directory; receiver.sqlite owns state, JSON files are projections. */
     readonly path: string;
 }
-export type FilesystemWakeQueue = WakeQueue;
-/**
- * Directory-backed at-least-once wake queue.
- *
- * Entries are published by `link`, never `rename`. `rename` is unsound as a
- * claim: when two callers race the same source, both can observe success once
- * the paths resolve to one inode, and the entry is then handed out twice. `link`
- * fails with `EEXIST`, so exactly one claimer wins.
- *
- * A claim is `link(pending -> inflight)` followed by `unlink(pending)`. A crash
- * between the two leaves the entry in both sets as one inode; recovery drops the
- * inflight copy and the entry stays pending. A consumer that dies mid-handler
- * leaves its entry inflight for `recoverInflight` rather than dropping it.
- *
- * Ordering is approximate FIFO by entry name. Single-node only: this survives
- * process death, not host loss, and does not coordinate across machines.
- */
+export interface FilesystemWakeQueue extends WakeQueue {
+    close(): void;
+    repairProjections(): Promise<void>;
+    repairRow(id: number): Promise<void>;
+}
+export declare function filesystemReceiverAuthority(queue: FilesystemWakeQueue): ReceiverAuthority;
+/** Filesystem-facing receiver with one SQLite admission/lease/completion authority. */
 export declare function createFilesystemWakeQueue(options: FilesystemWakeQueueOptions): FilesystemWakeQueue;
-/** Reads and parses a JSON file, treating an absent or unreadable file as empty. */
+/** Only open-time absence means an empty optional record. */
 export declare function readJsonFile<T>(path: string): Promise<T | undefined>;
 //# sourceMappingURL=filesystemWakeQueue.d.ts.map

package/dist/node/filesystemWakeQueue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystemWakeQueue.d.ts","sourceRoot":"","sources":["../../src/filesystemWakeQueue.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,SAAS,EACV,MAAM,iCAAiC,CAAA;AAExC,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAE3C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAwFrB;AAED,oFAAoF;AACpF,wBAAsB,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAY1E"}
+{"version":3,"file":"filesystemWakeQueue.d.ts","sourceRoot":"","sources":["../../src/filesystemWakeQueue.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAA;AAGhE,OAAO,EACL,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,EACxD,MAAM,2BAA2B,CAAA;AAIlC,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,wBAAwB,CAAA;AAGjF,OAAO,EACL,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,GACxD,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AACD,MAAM,WAAW,mBAAoB,SAAQ,SAAS;IACpD,KAAK,IAAI,IAAI,CAAA;IACb,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,GAAG,iBAAiB,CAIzF;AAED,uFAAuF;AACvF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,mBAAmB,CA4HlG;AAED,6DAA6D;AAC7D,wBAAsB,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAY1E"}

package/dist/node/handshake.mjs

@@ -58,25 +58,26 @@ function errorCode(error) {
 
 // src/filesystemJson.ts
 async function readJsonFileStrict(path) {
+  let handle;
   try {
-    const handle = await open2(path, "r");
-    try {
-      return JSON.parse(await handle.readFile("utf8"), reviveJson);
-    } finally {
-      await handle.close();
-    }
+    handle = await open2(path, "r");
   } catch (error) {
     if (errorCode2(error) === "ENOENT") return void 0;
     throw error;
   }
+  try {
+    return JSON.parse(await handle.readFile("utf8"), reviveJson);
+  } finally {
+    await handle.close();
+  }
 }
 async function replaceJsonFile(path, value, options = {}) {
   const directory = PATH2.dirname(path);
   await ensureDurableDirectory(directory, options.directoryMode);
   const tempPath = PATH2.join(directory, `.${PATH2.basename(path)}.${process.pid}.${suffix()}.tmp`);
-  await writeDurableFile(tempPath, `${stringifyJson(value)}
-`, options.mode);
   try {
+    await writeDurableFile(tempPath, `${stringifyJson(value)}
+`, options.mode);
     await rename(tempPath, path);
     await syncDirectory(directory);
   } catch (error) {
@@ -88,9 +89,9 @@ async function publishJsonFile(path, value, options = {}) {
   const directory = PATH2.dirname(path);
   await ensureDurableDirectory(directory, options.directoryMode);
   const tempPath = PATH2.join(directory, `.${PATH2.basename(path)}.${process.pid}.${suffix()}.tmp`);
-  await writeDurableFile(tempPath, `${stringifyJson(value)}
-`, options.mode);
   try {
+    await writeDurableFile(tempPath, `${stringifyJson(value)}
+`, options.mode);
     await link(tempPath, path);
     await syncDirectory(directory);
     return true;
@@ -1197,7 +1198,7 @@ function createPublisherHandshakeClient(options) {
     const reconciliation = await reconcileAcceptance(acceptanceHash, publication, intent.challenge.subscriber, intent.challenge.subscription);
     return Object.freeze({
       acceptance: Object.freeze({ body: intent.acceptance, objectHash: acceptanceHash }),
-      challenge: intent.operationId,
+      challenge: intent.acceptance.challenge,
       intentDisposition,
       operationId: intent.operationId,
       publication,