agentfootprint 9.36.0 → 9.37.1

package/dist/esm/hosting/sessionOwnership.d.ts

@@ -0,0 +1,86 @@
+/**
+ * hosting/sessionOwnership — the ONE owner-transition rule, so four stores
+ * cannot each get it slightly wrong (9.36.1).
+ *
+ * Every store implementing {@link SessionLifecycle} keeps an owner index, and
+ * every one of them wrote the write-once rule out longhand in its own dialect:
+ * a `COALESCE` in SQL, a `has()` on a `Map`, a read-then-decide inside a
+ * transaction. Four spellings of one sentence, and all four were missing the
+ * same half of it — which is what a rule that lives in prose rather than in
+ * code eventually costs.
+ *
+ * ── The rule, whole ─────────────────────────────────────────────────────────
+ * An owner is a fact about the CONVERSATION, established by the first turn
+ * that signs for it. Given what is stored and what a turn is carrying:
+ *
+ *   | stored     | incoming   | outcome                                       |
+ *   |------------|------------|-----------------------------------------------|
+ *   | nobody     | nobody     | still nobody — an anonymous conversation       |
+ *   | nobody     | somebody   | FILLED IN — the first turn that signs, owns    |
+ *   | somebody   | nobody     | KEPT — a leaner turn erases nothing            |
+ *   | somebody   | the same   | KEPT — the ordinary turn                       |
+ *   | somebody   | DIFFERENT  | REFUSED, by name                               |
+ *
+ * The last row is the one that was missing, and the difference between the
+ * last two rows is the whole design decision:
+ *
+ *  - **A different identity is a CONTRADICTION.** Two people cannot both have
+ *    signed for one conversation. Keeping the index and storing the payload
+ *    anyway — which is what every store did — leaves the index naming one
+ *    person and the conversation naming another, and the person the index
+ *    names opens it and reads the other one's conversation.
+ *  - **An absent identity is not a contradiction.** It claims nobody. The
+ *    contract blesses it in as many words ("a later turn carrying a leaner
+ *    identity must not erase it"), and refusing it would fail a flow the
+ *    library's own documentation describes as intended, to protect against a
+ *    claim nobody made.
+ *
+ * ── Why this is a function and not a base class ─────────────────────────────
+ * Stores share no ancestry and should not start now: one is a `Map`, one is a
+ * SQL upsert, one is a distributed transaction, one is somebody's managed
+ * service where the owner field is immutable. What they share is a DECISION,
+ * so what they share is a decision function — called at the point each of them
+ * already had to decide, inside whatever atomicity that store can offer.
+ *
+ * The atomicity is deliberately NOT this module's business, and cannot be: a
+ * read-then-decide is only as safe as the transaction it happens inside, and
+ * only the store knows what it has. What this owns is the answer; where it is
+ * safe to ask is the store's own promise, and the conformance suite is what
+ * checks that the store kept it (`contested-write-leaves-no-split-brain`).
+ */
+/**
+ * Which owner a store should record, given what it already has and what the
+ * turn being written is signed by — or a refusal.
+ *
+ * Call it INSIDE whatever the store uses to make read-then-write atomic (a
+ * transaction, a lock, a single-threaded map), with the owner already derived
+ * from the stored conversation by `envelopeOwner`. The return value is the
+ * owner to store; a refusal means the whole `persist` must not land, including
+ * the envelope.
+ *
+ * **The envelope is the part that matters.** A store that catches this and
+ * writes the payload anyway has re-created the exact defect: the refusal
+ * exists to stop the CONVERSATION being replaced, not merely to protect an
+ * index column.
+ *
+ * Empty strings are read as "nobody" on both sides, matching `envelopeOwner`,
+ * so a store that keeps `''` for an unowned row cannot accidentally make it a
+ * principal that conflicts with everybody.
+ *
+ * @param sessionId  the id being written — the caller's own string, and the
+ *   only thing the refusal repeats back.
+ * @param storedOwner  the owner already recorded for this session, or
+ *   `undefined` for a session that is new or that nobody has signed for.
+ * @param incomingOwner  the owner derived from the envelope being written —
+ *   `envelopeOwner(envelope)`, never anything a caller supplied.
+ * @returns the owner to record. `undefined` means "record nobody".
+ * @throws SessionOwnershipConflictError when the two name DIFFERENT people.
+ *
+ * @example  Inside a store's persist
+ *   const incoming = envelopeOwner(checked);
+ *   const owner = resolveSessionOwner(sessionId, rows.get(sessionId), incoming);
+ *   // Only now — a refusal above must leave the stored conversation alone.
+ *   rows.set(sessionId, checked);
+ *   if (owner !== undefined) owners.set(sessionId, owner);
+ */
+export declare function resolveSessionOwner(sessionId: string, storedOwner: string | undefined, incomingOwner: string | undefined): string | undefined;

package/dist/esm/hosting/sessionOwnership.js

@@ -0,0 +1,106 @@
+/**
+ * hosting/sessionOwnership — the ONE owner-transition rule, so four stores
+ * cannot each get it slightly wrong (9.36.1).
+ *
+ * Every store implementing {@link SessionLifecycle} keeps an owner index, and
+ * every one of them wrote the write-once rule out longhand in its own dialect:
+ * a `COALESCE` in SQL, a `has()` on a `Map`, a read-then-decide inside a
+ * transaction. Four spellings of one sentence, and all four were missing the
+ * same half of it — which is what a rule that lives in prose rather than in
+ * code eventually costs.
+ *
+ * ── The rule, whole ─────────────────────────────────────────────────────────
+ * An owner is a fact about the CONVERSATION, established by the first turn
+ * that signs for it. Given what is stored and what a turn is carrying:
+ *
+ *   | stored     | incoming   | outcome                                       |
+ *   |------------|------------|-----------------------------------------------|
+ *   | nobody     | nobody     | still nobody — an anonymous conversation       |
+ *   | nobody     | somebody   | FILLED IN — the first turn that signs, owns    |
+ *   | somebody   | nobody     | KEPT — a leaner turn erases nothing            |
+ *   | somebody   | the same   | KEPT — the ordinary turn                       |
+ *   | somebody   | DIFFERENT  | REFUSED, by name                               |
+ *
+ * The last row is the one that was missing, and the difference between the
+ * last two rows is the whole design decision:
+ *
+ *  - **A different identity is a CONTRADICTION.** Two people cannot both have
+ *    signed for one conversation. Keeping the index and storing the payload
+ *    anyway — which is what every store did — leaves the index naming one
+ *    person and the conversation naming another, and the person the index
+ *    names opens it and reads the other one's conversation.
+ *  - **An absent identity is not a contradiction.** It claims nobody. The
+ *    contract blesses it in as many words ("a later turn carrying a leaner
+ *    identity must not erase it"), and refusing it would fail a flow the
+ *    library's own documentation describes as intended, to protect against a
+ *    claim nobody made.
+ *
+ * ── Why this is a function and not a base class ─────────────────────────────
+ * Stores share no ancestry and should not start now: one is a `Map`, one is a
+ * SQL upsert, one is a distributed transaction, one is somebody's managed
+ * service where the owner field is immutable. What they share is a DECISION,
+ * so what they share is a decision function — called at the point each of them
+ * already had to decide, inside whatever atomicity that store can offer.
+ *
+ * The atomicity is deliberately NOT this module's business, and cannot be: a
+ * read-then-decide is only as safe as the transaction it happens inside, and
+ * only the store knows what it has. What this owns is the answer; where it is
+ * safe to ask is the store's own promise, and the conformance suite is what
+ * checks that the store kept it (`contested-write-leaves-no-split-brain`).
+ */
+import { SessionOwnershipConflictError } from './errors.js';
+/**
+ * Which owner a store should record, given what it already has and what the
+ * turn being written is signed by — or a refusal.
+ *
+ * Call it INSIDE whatever the store uses to make read-then-write atomic (a
+ * transaction, a lock, a single-threaded map), with the owner already derived
+ * from the stored conversation by `envelopeOwner`. The return value is the
+ * owner to store; a refusal means the whole `persist` must not land, including
+ * the envelope.
+ *
+ * **The envelope is the part that matters.** A store that catches this and
+ * writes the payload anyway has re-created the exact defect: the refusal
+ * exists to stop the CONVERSATION being replaced, not merely to protect an
+ * index column.
+ *
+ * Empty strings are read as "nobody" on both sides, matching `envelopeOwner`,
+ * so a store that keeps `''` for an unowned row cannot accidentally make it a
+ * principal that conflicts with everybody.
+ *
+ * @param sessionId  the id being written — the caller's own string, and the
+ *   only thing the refusal repeats back.
+ * @param storedOwner  the owner already recorded for this session, or
+ *   `undefined` for a session that is new or that nobody has signed for.
+ * @param incomingOwner  the owner derived from the envelope being written —
+ *   `envelopeOwner(envelope)`, never anything a caller supplied.
+ * @returns the owner to record. `undefined` means "record nobody".
+ * @throws SessionOwnershipConflictError when the two name DIFFERENT people.
+ *
+ * @example  Inside a store's persist
+ *   const incoming = envelopeOwner(checked);
+ *   const owner = resolveSessionOwner(sessionId, rows.get(sessionId), incoming);
+ *   // Only now — a refusal above must leave the stored conversation alone.
+ *   rows.set(sessionId, checked);
+ *   if (owner !== undefined) owners.set(sessionId, owner);
+ */
+export function resolveSessionOwner(sessionId, storedOwner, incomingOwner) {
+    const stored = nonEmpty(storedOwner);
+    const incoming = nonEmpty(incomingOwner);
+    // Nothing is claimed yet: the first turn that signs owns the conversation,
+    // and a turn that signs for nothing leaves it unowned.
+    if (stored === undefined)
+        return incoming;
+    // The blessed leaner turn. It claims nobody, so it contradicts nobody, and
+    // the established owner stands.
+    if (incoming === undefined)
+        return stored;
+    if (incoming === stored)
+        return stored;
+    throw new SessionOwnershipConflictError(sessionId);
+}
+/** `''` is nobody, exactly as `envelopeOwner` reads it. */
+function nonEmpty(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=sessionOwnership.js.map

package/dist/esm/hosting/sessionOwnership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionOwnership.js","sourceRoot":"","sources":["../../../src/hosting/sessionOwnership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,WAA+B,EAC/B,aAAiC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACzC,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC1C,2EAA2E;IAC3E,gCAAgC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC1C,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,IAAI,6BAA6B,CAAC,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/dist/esm/hosting/sqliteSessions.js

@@ -54,6 +54,7 @@
  */
 import { checkEnvelope, envelopeOwner, envelopeTranscript } from './envelope.js';
 import { UnreadableEnvelopeError } from './errors.js';
+import { resolveSessionOwner } from './sessionOwnership.js';
 import { lazyRequire } from '../lib/lazyRequire.js';
 import { SqliteUnavailableError } from '../lib/sqliteUnavailable.js';
 // ─── The refusals ────────────────────────────────────────────────────
@@ -216,14 +217,17 @@ export function sqliteSessions(options) {
         `VALUES (?, ?, ?, ?, ?, ?) ` +
         `ON CONFLICT(session_id) DO UPDATE SET format = excluded.format, ` +
         `saved_at = excluded.saved_at, envelope = excluded.envelope, ` +
-        // WRITE ONCE — the existing owner wins, and a NULL one is filled in.
-        // An owner is a fact about the CONVERSATION, established by the first
-        // turn that signed for it: a later turn carrying a leaner identity must
-        // not erase it (the session would drop out of its owner's list), and a
-        // later turn carrying a DIFFERENT one must not take it (ownership would
-        // transfer by writing, which undoes every check made against this index).
-        // The argument order is the whole rule; reversing it is the bug.
-        `owner = COALESCE(${SESSIONS_TABLE}.owner, excluded.owner), ` +
+        // The owner is bound, already decided — NOT `COALESCE(sessions.owner,
+        // excluded.owner)`, which is what this was until 9.36.1.
+        //
+        // COALESCE kept the right owner and could not refuse, so a turn signed
+        // by somebody else quietly won the `envelope` column beside an `owner`
+        // column that still named the first writer: the index said one person
+        // and the stored conversation said another. SQL that can only pick a
+        // column cannot express "and if they disagree, write nothing" — so the
+        // decision moved out of the statement and into `resolveSessionOwner`,
+        // one transaction up, where a refusal can stop the whole row.
+        `owner = excluded.owner, ` +
         `message_count = excluded.message_count`);
     const select = db.prepare(`SELECT envelope FROM ${SESSIONS_TABLE} WHERE session_id = ?`);
     const remove = db.prepare(`DELETE FROM ${SESSIONS_TABLE} WHERE session_id = ?`);
@@ -284,8 +288,35 @@ export function sqliteSessions(options) {
             // never supplied by the caller — the port takes no owner argument and
             // gains none, because a store where owning a session is a matter of
             // asking is not an index, it is a formality.
-            const owner = envelopeOwner(checked);
-            insert.run(sessionId, checked.format, checked.savedAt, JSON.stringify(checked), owner ?? null, envelopeTranscript(checked).length);
+            const incoming = envelopeOwner(checked);
+            // BEGIN IMMEDIATE, not BEGIN: it takes the write lock up front, so the
+            // read below and the write after it cannot have another writer's turn
+            // between them. A deferred transaction would take the lock only at the
+            // INSERT — which is exactly the window where two containers persisting
+            // the same fresh session both read "nobody owns this" and both proceed.
+            // The lock waits `busy_timeout` and then fails loudly, which is the same
+            // bargain the rest of this store makes.
+            db.exec('BEGIN IMMEDIATE');
+            try {
+                const existing = selectOwner.get(sessionId);
+                const owner = resolveSessionOwner(sessionId, typeof existing?.owner === 'string' ? existing.owner : undefined, incoming);
+                insert.run(sessionId, checked.format, checked.savedAt, JSON.stringify(checked), owner ?? null, envelopeTranscript(checked).length);
+                db.exec('COMMIT');
+            }
+            catch (err) {
+                // The envelope must not land when the owner was refused — the payload
+                // is the half that carries somebody's conversation, and a row that
+                // kept the old owner beside a new conversation is the whole defect.
+                // ROLLBACK is best-effort: if the transaction is already gone the
+                // original refusal is the one worth raising, not this one.
+                try {
+                    db.exec('ROLLBACK');
+                }
+                catch {
+                    /* Already rolled back or never opened; the error below says why. */
+                }
+                throw err;
+            }
         },
         // eslint-disable-next-line @typescript-eslint/require-await
         async listByUser(userId, options) {

package/dist/esm/hosting/sqliteSessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sqliteSessions.js","sourceRoot":"","sources":["../../../src/hosting/sqliteSessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAgGrE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,6BAAsC,CAAC;IACvD,iCAAiC;IACxB,IAAI,CAAS;IACtB,wCAAwC;IAC/B,OAAO,CAAoD;IAEpE,YAAY,IAAY,EAAE,OAA8C,EAAE,MAAc;QACtF,KAAK,CACH,mCAAmC,IAAI,qBAAqB,MAAM,GAAG;YACnE,iFAAiF;YACjF,6EAA6E;YAC7E,2EAA2E;YAC3E,CAAC,OAAO,KAAK,cAAc;gBACzB,CAAC,CAAC,4EAA4E;oBAC5E,0DAA0D;gBAC5D,CAAC,CAAC,OAAO,KAAK,gBAAgB;oBAC9B,CAAC,CAAC,0EAA0E;wBAC1E,gBAAgB;oBAClB,CAAC,CAAC,wEAAwE,GAAG,UAAU,CAAC,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAU,CAAC;AAEnF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,aAAa,GAA6C;IAC9D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;IACpC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,uBAAuB,EAAE;CACxD,CAAC;AAEF,wEAAwE;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAE/C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,qCAAqC,IAAI,+BAA+B;YACtE,gFAAgF;YAChF,+EAA+E;YAC/E,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;IACrD,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE5B,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,YAAY,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAC9C,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,0BAA0B;YAAE,MAAM,GAAG,CAAC;QACzD,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,eAAe,cAAc,kEAAkE;QAC7F,4BAA4B;QAC5B,kEAAkE;QAClE,8DAA8D;QAC9D,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,oBAAoB,cAAc,2BAA2B;QAC7D,wCAAwC,CAC3C,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wBAAwB,cAAc,uBAAuB,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,cAAc,uBAAuB,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,cAAc,uBAAuB,CAAC,CAAC;IAC3F,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAC1B,2DAA2D,cAAc,GAAG;QAC1E,0EAA0E;QAC1E,gDAAgD,CACnD,CAAC;IAEF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,6BAA6B,IAAI,IAAI;gBACjF,0EAA0E;gBAC1E,8EAA8E;gBAC9E,yBAAyB,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,OAAO;QACL,WAAW;QAEX,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAuC,CAAC;YACxE,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAExC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,oCAAoC;gBACpC,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,sEAAsE;gBACtE,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAA4B;YAC3D,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC1B,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACnD,0EAA0E;YAC1E,sEAAsE;YACtE,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,CACR,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,OAAO,EACf,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,KAAK,IAAI,IAAI,EACb,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAM,CACnC,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAA4B;YAC3D,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,CAAC,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CACxB,MAAM,EACN,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS;YACf,qEAAqE;YACrE,0BAA0B;YAC1B,KAAK,GAAG,CAAC,CAMR,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;gBACjC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,oEAAoE;gBACpE,8DAA8D;gBAC9D,mEAAmE;gBACnE,oDAAoD;gBACpD,YAAY,EAAE,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aAC5E,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnC,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK;oBACrB,IAAI,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAoC,CAAC;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,OAAO,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,MAAM,CAAC,SAAiB;YAC5B,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE;;;;;;GAMG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAqC,aAAa,CAAC,CAAC;QAC3E,IAAI,OAAO,GAAG,EAAE,YAAY,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW;IAClB,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAC1E,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAA2B,SAAS,CAAC,CAAC;QACvE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAA6B,WAAW,CAAC,CAAC;QACzE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,EAAsB,EAAE,aAAqB;IACjE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,GAAG,EAE1C,CAAC;IACd,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,EAAE,CAAC,IAAI,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,oCAAoC;IACpC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACvC,OAAO,OAAO,GAAG,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,EAAsB,EAAE,IAAY;IACxD,EAAE,CAAC,IAAI,CACL,8BAA8B,cAAc,IAAI;QAC9C,qDAAqD;QACrD,qDAAqD;QACrD,2CAA2C,CAC9C,CAAC;IACF,EAAE,CAAC,IAAI,CACL,8BAA8B,UAAU,qDAAqD,CAC9F,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,4BAA4B;IAC5B,MAAM,OAAO,GACX,EAAE,CAAC,OAAO,CAAC,sBAAsB,cAAc,IAAI,CAAC,CAAC,GAAG,EAGzD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,0BAA0B,CAClC,IAAI,EACJ,gBAAgB,EAChB,aAAa,cAAc,mCAAmC;YAC5D,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,CAC/E,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5C,EAAE,CAAC,IAAI,CAAC,eAAe,cAAc,eAAe,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,2BAA2B;IAC3B,EAAE,CAAC,IAAI,CACL,8BAA8B,cAAc,SAAS;QACnD,MAAM,cAAc,yBAAyB,CAChD,CAAC;IAEF,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CAAC,qBAAqB,UAAU,+BAA+B,CAAC;SACvE,GAAG,EAAqC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,EAAE,CAAC,OAAO,CAAC,eAAe,UAAU,4CAA4C,CAAC,CAAC,GAAG,CACnF,MAAM,CAAC,cAAc,CAAC,CACvB,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QACtD,MAAM,IAAI,0BAA0B,CAClC,IAAI,EACJ,cAAc,EACd,sCAAsC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB;YAC5E,iBAAiB,cAAc,GAAG,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,kFAAkF;AAClF,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,MAA0B;IAC7C,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"sqliteSessions.js","sourceRoot":"","sources":["../../../src/hosting/sqliteSessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAgGrE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,6BAAsC,CAAC;IACvD,iCAAiC;IACxB,IAAI,CAAS;IACtB,wCAAwC;IAC/B,OAAO,CAAoD;IAEpE,YAAY,IAAY,EAAE,OAA8C,EAAE,MAAc;QACtF,KAAK,CACH,mCAAmC,IAAI,qBAAqB,MAAM,GAAG;YACnE,iFAAiF;YACjF,6EAA6E;YAC7E,2EAA2E;YAC3E,CAAC,OAAO,KAAK,cAAc;gBACzB,CAAC,CAAC,4EAA4E;oBAC5E,0DAA0D;gBAC5D,CAAC,CAAC,OAAO,KAAK,gBAAgB;oBAC9B,CAAC,CAAC,0EAA0E;wBAC1E,gBAAgB;oBAClB,CAAC,CAAC,wEAAwE,GAAG,UAAU,CAAC,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAU,CAAC;AAEnF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,aAAa,GAA6C;IAC9D,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;IACpC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,uBAAuB,EAAE;CACxD,CAAC;AAEF,wEAAwE;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAE/C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,qCAAqC,IAAI,+BAA+B;YACtE,gFAAgF;YAChF,+EAA+E;YAC/E,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;IACrD,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE5B,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,YAAY,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAC9C,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,0BAA0B;YAAE,MAAM,GAAG,CAAC;QACzD,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,eAAe,cAAc,kEAAkE;QAC7F,4BAA4B;QAC5B,kEAAkE;QAClE,8DAA8D;QAC9D,sEAAsE;QACtE,yDAAyD;QACzD,EAAE;QACF,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,8DAA8D;QAC9D,0BAA0B;QAC1B,wCAAwC,CAC3C,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wBAAwB,cAAc,uBAAuB,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,cAAc,uBAAuB,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,cAAc,uBAAuB,CAAC,CAAC;IAC3F,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAC1B,2DAA2D,cAAc,GAAG;QAC1E,0EAA0E;QAC1E,gDAAgD,CACnD,CAAC;IAEF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,6BAA6B,IAAI,IAAI;gBACjF,0EAA0E;gBAC1E,8EAA8E;gBAC9E,yBAAyB,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,OAAO;QACL,WAAW;QAEX,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAuC,CAAC;YACxE,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAExC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,oCAAoC;gBACpC,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,sEAAsE;gBACtE,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAA4B;YAC3D,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC1B,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACnD,0EAA0E;YAC1E,sEAAsE;YACtE,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACxC,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,wCAAwC;YACxC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAoC,CAAC;gBAC/E,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAChE,QAAQ,CACT,CAAC;gBACF,MAAM,CAAC,GAAG,CACR,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,OAAO,EACf,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,KAAK,IAAI,IAAI,EACb,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAM,CACnC,CAAC;gBACF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,kEAAkE;gBAClE,2DAA2D;gBAC3D,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;gBACtE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAA4B;YAC3D,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,YAAY,CAAC,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CACxB,MAAM,EACN,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS;YACf,qEAAqE;YACrE,0BAA0B;YAC1B,KAAK,GAAG,CAAC,CAMR,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;gBACjC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,oEAAoE;gBACpE,8DAA8D;gBAC9D,mEAAmE;gBACnE,oDAAoD;gBACpD,YAAY,EAAE,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aAC5E,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnC,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK;oBACrB,IAAI,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAoC,CAAC;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,OAAO,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,MAAM,CAAC,SAAiB;YAC5B,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE;;;;;;GAMG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAqC,aAAa,CAAC,CAAC;QAC3E,IAAI,OAAO,GAAG,EAAE,YAAY,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW;IAClB,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAC1E,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAA2B,SAAS,CAAC,CAAC;QACvE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAA6B,WAAW,CAAC,CAAC;QACzE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,EAAsB,EAAE,aAAqB;IACjE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,GAAG,EAE1C,CAAC;IACd,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,EAAE,CAAC,IAAI,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,oCAAoC;IACpC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACvC,OAAO,OAAO,GAAG,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,EAAsB,EAAE,IAAY;IACxD,EAAE,CAAC,IAAI,CACL,8BAA8B,cAAc,IAAI;QAC9C,qDAAqD;QACrD,qDAAqD;QACrD,2CAA2C,CAC9C,CAAC;IACF,EAAE,CAAC,IAAI,CACL,8BAA8B,UAAU,qDAAqD,CAC9F,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,4BAA4B;IAC5B,MAAM,OAAO,GACX,EAAE,CAAC,OAAO,CAAC,sBAAsB,cAAc,IAAI,CAAC,CAAC,GAAG,EAGzD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,0BAA0B,CAClC,IAAI,EACJ,gBAAgB,EAChB,aAAa,cAAc,mCAAmC;YAC5D,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,CAC/E,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5C,EAAE,CAAC,IAAI,CAAC,eAAe,cAAc,eAAe,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,2BAA2B;IAC3B,EAAE,CAAC,IAAI,CACL,8BAA8B,cAAc,SAAS;QACnD,MAAM,cAAc,yBAAyB,CAChD,CAAC;IAEF,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CAAC,qBAAqB,UAAU,+BAA+B,CAAC;SACvE,GAAG,EAAqC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,EAAE,CAAC,OAAO,CAAC,eAAe,UAAU,4CAA4C,CAAC,CAAC,GAAG,CACnF,MAAM,CAAC,cAAc,CAAC,CACvB,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QACtD,MAAM,IAAI,0BAA0B,CAClC,IAAI,EACJ,cAAc,EACd,sCAAsC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB;YAC5E,iBAAiB,cAAc,GAAG,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,kFAAkF;AAClF,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,MAA0B;IAC7C,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC"}

package/dist/esm/hosting/types.d.ts

@@ -656,11 +656,40 @@ export type WakeReason = 'invoke' | 'resume' | 'artifact' | 'transcript';
  * Deliberately two required methods. Anything a real store also wants — a TTL,
  * a scan, a delete — is that store's own API, not a demand this port makes of
  * every store that will ever implement it.
+ *
+ * ── Claiming the port ───────────────────────────────────────────────────────
+ * The two required methods are what TypeScript checks. What a store has to
+ * *behave* like is a battery every shipped store runs against and any store
+ * can: `sessionLifecycleConformance`, exported from this same subpath. It was
+ * written after a flaw in THIS interface's semantics turned up in four
+ * independent adapters at once — every one of them tested, and every one of
+ * them tested only against its own doubles, which is precisely why none of
+ * them could see it. Run it against your store; a case your store cannot
+ * satisfy is DECLARED by name with its reason, never skipped.
  */
 export interface SessionLifecycle {
     /** The stored conversation, or `undefined` for a session that has none yet. */
     hydrate(sessionId: string): Promise<CheckpointEnvelope | undefined>;
-    /** Store the conversation for this session. Last write wins. */
+    /**
+     * Store the conversation for this session. Last write wins — with ONE
+     * exception, and it is the only thing this method ever refuses.
+     *
+     * **A store that keeps an owner index refuses a turn signed by somebody
+     * other than the established owner** (`SessionOwnershipConflictError`,
+     * 9.36.1), and refuses it whole: neither the index nor the ENVELOPE changes.
+     * Until 9.36.1 the write-once rule protected only the index, so such a write
+     * kept the first writer's `owner` and stored the second writer's entire
+     * conversation — leaving the index naming one person and the stored
+     * conversation naming another. The person the index named listed it, opened
+     * it, and read the other one's conversation.
+     *
+     * A turn carrying a LEANER identity is not refused. It claims nobody, so it
+     * contradicts nobody, and the established owner stands — see `listByUser`.
+     *
+     * The composer refuses a foreign turn at the door long before this, when a
+     * verifier is configured. This is the store keeping the same promise for
+     * every caller that holds it directly, and for a door with no verifier.
+     */
     persist(sessionId: string, envelope: CheckpointEnvelope): Promise<void>;
     /**
      * Called once per served request, before `hydrate`, for stores that need to
@@ -688,9 +717,38 @@ export interface SessionLifecycle {
      *
      * **And established ONCE.** The first turn that signs for a conversation owns
      * it; no later write moves that — not a leaner identity (which would erase
-     * it) and not a different one (which would transfer it). Both shipped stores
-     * implement the index that way, and a custom one that let the last writer win
-     * would undo every ownership check made against it one turn later.
+     * it) and not a different one (which would transfer it). Every shipped store
+     * implements the index that way, and a custom one that let the last writer
+     * win would undo every ownership check made against it one turn later.
+     *
+     * The two halves of "no later write moves it" are NOT symmetrical, and
+     * 9.36.1 exists because they were treated as if they were:
+     *
+     *  - a **leaner** turn is stored, and the owner is kept. It claims nobody, so
+     *    it contradicts nobody. Refusing it would break a flow this contract
+     *    blesses in the sentence above.
+     *  - a **different** turn is REFUSED — index and envelope both. Keeping the
+     *    index while storing the payload is not "not moving" the owner; it is
+     *    moving the CONVERSATION out from under them, which is worse. Don't
+     *    write this rule yourself: `resolveSessionOwner(sessionId, stored,
+     *    incoming)` is the one implementation, and it is what every shipped store
+     *    now calls.
+     *
+     * ── Which of the two says who owns a session ────────────────────────────────
+     * This index is the authority for LISTING and for the session-history ops:
+     * `ownerOf` is the question `{ op: 'session-transcript' }` asks, and nothing
+     * re-derives an answer behind it. An ordinary TURN does not ask it — it
+     * re-derives from the envelope it has just hydrated (`envelopeOwner`), which
+     * is the same derivation and one round-trip cheaper, and which is what keeps
+     * a store with NO index protected exactly as well as one with a fast one.
+     *
+     * Those two can never name different people: that is what the refusal above
+     * buys, and it is the only reason a turn is safe to answer from the envelope.
+     * They CAN differ in one direction — an index that names somebody over a
+     * conversation that names nobody, which is what a leaner turn leaves behind.
+     * That state only ever REFUSES: the owner can still list and read the
+     * session, and a turn on it is refused at any verifying door, for everybody.
+     * Stated because it is a real asymmetry and not a bug to be surprised by.
      *
      * A conversation that ran anonymously has no owner and appears in nobody's
      * list. That is the honest consequence of deriving rather than inventing.
@@ -707,6 +765,12 @@ export interface SessionLifecycle {
      *
      * Implement it beside `listByUser` — a door that can list but not check
      * ownership can hand somebody a list and then refuse to open any of it.
+     *
+     * This is the ownership INDEX, and it is not a second source of truth beside
+     * the identity embedded in the stored envelope: `persist` refuses any write
+     * that would make the two name different people. A store that answers this
+     * from something a caller supplied, rather than from what it derived, has
+     * built a permission system out of a request field.
      */
     ownerOf?(sessionId: string): Promise<string | undefined>;
 }

package/dist/esm/hosting/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hosting/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA25BH;iFACiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hosting/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA29BH;iFACiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC"}

package/dist/esm/memory/identity/encode.d.ts

@@ -0,0 +1,67 @@
+/**
+ * identity/encode — one identity field → one unambiguous key segment.
+ *
+ * **This module is the tenant boundary.** Every durable store in the library
+ * addresses rows by a string composed from `{ tenant, principal,
+ * conversationId }`. If two DIFFERENT tuples can spell the SAME string, one
+ * scope reads, overwrites and erases another scope's data — no race, no
+ * misconfiguration, just arithmetic. So the encoding here is **injective**
+ * (different tuples ⇒ different strings, always), and that property is
+ * load-bearing rather than tidy: it is the whole isolation guarantee.
+ *
+ * Two things could collapse two tuples into one string, and each has a rule:
+ *
+ *   • **the separator.** `/` is what joins the fields, so a value containing
+ *     one would otherwise donate a field boundary: tenant `acme/hr` and
+ *     principal `alice` spelled the same string as tenant `acme` and
+ *     principal `hr/alice`. Real ids hit this — a JWT `sub` is often a URI.
+ *     `/` is therefore escaped to `%2F`, and `%` — the escape's own
+ *     introducer — is escaped FIRST to `%25`, or a value that merely reads
+ *     like an escape (`a%2Fb`) would land on the value that produced it
+ *     (`a/b`) and we would have moved the collision rather than closed it.
+ *
+ *   • **the absence marker.** A field that was not given still needs a
+ *     segment, and that segment is `_`. A tenant *named* `_` is a different
+ *     scope from *no tenant*, so a present value that spells the marker is
+ *     escaped to `%5F`. `%5F` is unreachable any other way (every `%` in an
+ *     encoded value is already escaped), which is what makes it safe to
+ *     reserve.
+ *
+ * **What deliberately does NOT change.** A value containing neither `/` nor
+ * `%`, and which is not exactly `_`, is returned BYTE FOR BYTE. That is not a
+ * nicety — it is what makes this fix deployable: every existing artifact and
+ * memory row written under a well-behaved id keeps its address, so there is no
+ * migration. The only tuples that change key are the ones that were sharing a
+ * key with somebody else, and those were already broken.
+ *
+ * Absence has exactly ONE spelling: `undefined`, `null` and `''` all mean "not
+ * given". An empty string is not a name, and treating it as one would create a
+ * second anonymous scope rather than distinguish anything real.
+ */
+/** The one segment that means "this field was not given". */
+export declare const IDENTITY_ABSENT = "_";
+/**
+ * Keep a PRESENT value from spelling the absence marker.
+ *
+ * For encoders that already do their own escaping (the artifact path
+ * segments use `encodeURIComponent`) and only need the absence law applied on
+ * top.
+ *
+ * **Precondition:** `escaped` comes from an escaper that escapes `%`. Without
+ * that, a caller-supplied `%5F` would collide with an escaped `_` and this
+ * function would be hiding a collision instead of closing one.
+ */
+export declare function distinctFromAbsent(escaped: string): string;
+/**
+ * Encode ONE identity field as a key segment that cannot be confused with any
+ * other field's, or with absence.
+ *
+ * @param raw the field as the caller gave it; `undefined`/`null`/`''` are
+ *            absence.
+ * @returns a segment containing no `/`, never equal to another field's segment
+ *          unless the fields were equal.
+ * @throws TypeError when a present field is not a string. The value is NOT
+ *         named in the message — this function is the identity boundary, and
+ *         an error string is the one place a tenant id must never travel.
+ */
+export declare function encodeIdentityField(raw: string | undefined | null): string;

package/dist/esm/memory/identity/encode.js

@@ -0,0 +1,91 @@
+/**
+ * identity/encode — one identity field → one unambiguous key segment.
+ *
+ * **This module is the tenant boundary.** Every durable store in the library
+ * addresses rows by a string composed from `{ tenant, principal,
+ * conversationId }`. If two DIFFERENT tuples can spell the SAME string, one
+ * scope reads, overwrites and erases another scope's data — no race, no
+ * misconfiguration, just arithmetic. So the encoding here is **injective**
+ * (different tuples ⇒ different strings, always), and that property is
+ * load-bearing rather than tidy: it is the whole isolation guarantee.
+ *
+ * Two things could collapse two tuples into one string, and each has a rule:
+ *
+ *   • **the separator.** `/` is what joins the fields, so a value containing
+ *     one would otherwise donate a field boundary: tenant `acme/hr` and
+ *     principal `alice` spelled the same string as tenant `acme` and
+ *     principal `hr/alice`. Real ids hit this — a JWT `sub` is often a URI.
+ *     `/` is therefore escaped to `%2F`, and `%` — the escape's own
+ *     introducer — is escaped FIRST to `%25`, or a value that merely reads
+ *     like an escape (`a%2Fb`) would land on the value that produced it
+ *     (`a/b`) and we would have moved the collision rather than closed it.
+ *
+ *   • **the absence marker.** A field that was not given still needs a
+ *     segment, and that segment is `_`. A tenant *named* `_` is a different
+ *     scope from *no tenant*, so a present value that spells the marker is
+ *     escaped to `%5F`. `%5F` is unreachable any other way (every `%` in an
+ *     encoded value is already escaped), which is what makes it safe to
+ *     reserve.
+ *
+ * **What deliberately does NOT change.** A value containing neither `/` nor
+ * `%`, and which is not exactly `_`, is returned BYTE FOR BYTE. That is not a
+ * nicety — it is what makes this fix deployable: every existing artifact and
+ * memory row written under a well-behaved id keeps its address, so there is no
+ * migration. The only tuples that change key are the ones that were sharing a
+ * key with somebody else, and those were already broken.
+ *
+ * Absence has exactly ONE spelling: `undefined`, `null` and `''` all mean "not
+ * given". An empty string is not a name, and treating it as one would create a
+ * second anonymous scope rather than distinguish anything real.
+ */
+/** The one segment that means "this field was not given". */
+export const IDENTITY_ABSENT = '_';
+/**
+ * The segment for a present value that literally spells {@link IDENTITY_ABSENT}.
+ *
+ * Reserved, and reachable ONLY from the value `_`: any escaper used with
+ * {@link distinctFromAbsent} escapes `%` itself, so no other input can produce
+ * these three bytes.
+ */
+const ABSENT_LOOKALIKE = '%5F';
+/**
+ * Keep a PRESENT value from spelling the absence marker.
+ *
+ * For encoders that already do their own escaping (the artifact path
+ * segments use `encodeURIComponent`) and only need the absence law applied on
+ * top.
+ *
+ * **Precondition:** `escaped` comes from an escaper that escapes `%`. Without
+ * that, a caller-supplied `%5F` would collide with an escaped `_` and this
+ * function would be hiding a collision instead of closing one.
+ */
+export function distinctFromAbsent(escaped) {
+    return escaped === IDENTITY_ABSENT ? ABSENT_LOOKALIKE : escaped;
+}
+/**
+ * Encode ONE identity field as a key segment that cannot be confused with any
+ * other field's, or with absence.
+ *
+ * @param raw the field as the caller gave it; `undefined`/`null`/`''` are
+ *            absence.
+ * @returns a segment containing no `/`, never equal to another field's segment
+ *          unless the fields were equal.
+ * @throws TypeError when a present field is not a string. The value is NOT
+ *         named in the message — this function is the identity boundary, and
+ *         an error string is the one place a tenant id must never travel.
+ */
+export function encodeIdentityField(raw) {
+    if (raw === undefined || raw === null || raw === '')
+        return IDENTITY_ABSENT;
+    if (typeof raw !== 'string') {
+        throw new TypeError('[identity] a MemoryIdentity field must be a string or omitted. A non-string was ' +
+            'given, and it is not quoted here on purpose: this value addresses a tenant, and an ' +
+            'error message is the wrong place for one. Convert it at the call site so the id ' +
+            'that reaches storage is the id you meant.');
+    }
+    // '%' FIRST — it introduces every escape below, so it has to be inert before
+    // any are emitted. Reversing these two lines re-opens the collision.
+    const escaped = raw.replace(/%/g, '%25').replace(/\//g, '%2F');
+    return distinctFromAbsent(escaped);
+}
+//# sourceMappingURL=encode.js.map

package/dist/esm/memory/identity/encode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encode.js","sourceRoot":"","sources":["../../../../src/memory/identity/encode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA8B;IAChE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,eAAe,CAAC;IAC5E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,kFAAkF;YAChF,qFAAqF;YACrF,kFAAkF;YAClF,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/esm/memory/identity/index.d.ts

@@ -1,2 +1,3 @@
 export type { MemoryIdentity } from './types.js';
 export { identityNamespace } from './types.js';
+export { distinctFromAbsent, encodeIdentityField, IDENTITY_ABSENT } from './encode.js';

package/dist/esm/memory/identity/index.js

@@ -1,2 +1,3 @@
 export { identityNamespace } from './types.js';
+export { distinctFromAbsent, encodeIdentityField, IDENTITY_ABSENT } from './encode.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/memory/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/memory/identity/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/memory/identity/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/esm/memory/identity/types.d.ts

@@ -39,11 +39,28 @@ export interface MemoryIdentity {
 }
 /**
  * Encode a MemoryIdentity as a deterministic storage namespace. Used by
- * storage adapters that need a single string key (Redis, localStorage,
- * filesystem paths). Format is stable across library versions — adapters
+ * storage adapters that need a single string key (Redis, SQLite columns,
+ * object-store keys). Format is stable across library versions — adapters
  * can safely use it for long-lived keys.
  *
- * Empty `tenant` / `principal` collapse to `_` so the format has a constant
- * shape (easy to parse, easy to list by prefix).
+ * **The encoding is INJECTIVE: two different identities never produce the
+ * same namespace.** That is the isolation guarantee itself, not a detail of
+ * it — a namespace two tuples share is a scope that reads and overwrites
+ * another scope's rows, with no race required. It held only for well-behaved
+ * ids before 9.36.x: `{ tenant: 'acme/hr', principal: 'alice' }` and
+ * `{ tenant: 'acme', principal: 'hr/alice' }` spelled one namespace, and a
+ * JWT `sub` is routinely a URI. Each field is now escaped by
+ * {@link encodeIdentityField} before it is joined, so a value can no longer
+ * donate a field boundary — do not "simplify" the joins back to raw
+ * interpolation.
+ *
+ * A missing `tenant` / `principal` / `conversationId` is the segment `_`, so
+ * the shape stays constant (three segments, easy to list by prefix), and a
+ * field whose VALUE is `_` encodes as `%5F` so "no tenant" and "the tenant
+ * named `_`" stay two different scopes.
+ *
+ * Building a FILESYSTEM path? Use `scopeSegments` from `artifacts/scopePath`
+ * instead: it encodes each field for a path (`.` included, so a field of `..`
+ * cannot be a directory hop). This namespace is a key, not a path.
  */
 export declare function identityNamespace(identity: MemoryIdentity): string;