chainlesschain 0.163.6 → 0.163.7

package/src/lib/session-host-lease.js

@@ -125,6 +125,54 @@ function normalizeActiveLease(value, fallbackRevocationEpoch = null) {
   });
 }
 
+function normalizeWriteDelegation(value, expectedSessionId = null) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError("session host write delegation must be an object");
+  }
+  const sessionId = canonicalSessionId(value.sessionId);
+  if (expectedSessionId !== null && sessionId !== expectedSessionId) {
+    throw leaseError(
+      SESSION_HOST_LEASE_FENCED_CODE,
+      `Session host write delegation belongs to a different session`,
+      { sessionId: expectedSessionId, delegatedSessionId: sessionId },
+    );
+  }
+  if (
+    typeof value.leaseId !== "string" ||
+    !LEASE_ID_PATTERN.test(value.leaseId) ||
+    !Number.isSafeInteger(value.fencingToken) ||
+    value.fencingToken < 1 ||
+    !Number.isSafeInteger(value.revocationEpoch) ||
+    value.revocationEpoch < 0 ||
+    !Number.isSafeInteger(value.ownerPid) ||
+    value.ownerPid < 1 ||
+    typeof value.hostKind !== "string" ||
+    !HOST_KIND_PATTERN.test(value.hostKind)
+  ) {
+    throw new TypeError("session host write delegation is invalid");
+  }
+  return Object.freeze({
+    sessionId,
+    leaseId: value.leaseId,
+    fencingToken: value.fencingToken,
+    revocationEpoch: value.revocationEpoch,
+    ownerPid: value.ownerPid,
+    hostKind: value.hostKind,
+  });
+}
+
+function delegationMatchesLease(delegation, lease) {
+  return Boolean(
+    delegation &&
+    lease &&
+    delegation.leaseId === lease.leaseId &&
+    delegation.fencingToken === lease.fencingToken &&
+    delegation.revocationEpoch === lease.revocationEpoch &&
+    delegation.ownerPid === lease.ownerPid &&
+    delegation.hostKind === lease.hostKind,
+  );
+}
+
 function normalizeRevocation(value, expectedEpoch) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new TypeError("session host revocation must be an object");
@@ -268,6 +316,7 @@ export class SessionHostLeaseAuthority {
     this._lock = lock;
     this._local = new Map();
     this._fenced = new Map();
+    this._delegatedWrites = [];
   }
 
   pathFor(sessionId) {
@@ -568,6 +617,8 @@ export class SessionHostLeaseAuthority {
       leaseId: record.active.leaseId,
       fencingToken: record.active.fencingToken,
       revocationEpoch: record.active.revocationEpoch,
+      ownerPid: record.active.ownerPid,
+      hostKind: record.active.hostKind,
       signal: controller.signal,
       renew,
       assert: () => this.withWriteAuthority(id, (authority) => authority),
@@ -756,8 +807,16 @@ export class SessionHostLeaseAuthority {
     const priorFence = this._fenced.get(key);
     if (priorFence) throw priorFence;
     const local = this._local.get(key);
+    const delegation = this._delegatedWrites.at(-1) || null;
     if (!fs.existsSync(filePath)) {
-      if (!local) return invokeTask(null);
+      if (!delegation && !local) return invokeTask(null);
+      if (delegation) {
+        throw leaseError(
+          SESSION_HOST_LEASE_FENCED_CODE,
+          `Delegated session write lost its active host lease: ${id}`,
+          { sessionId: id, delegatedLeaseId: delegation.leaseId },
+        );
+      }
       const error = leaseError(
         SESSION_HOST_LEASE_FENCED_CODE,
         `Session host authority disappeared while locally held: ${id}`,
@@ -777,6 +836,43 @@ export class SessionHostLeaseAuthority {
           const snapshot = this._read(filePath, id);
           const record = this._local.get(key);
           const now = Math.trunc(this._now());
+          // A delegated scope is always constrained by the delegated lease.
+          // Do this before considering a local record: an authority instance
+          // may have acquired a successor/recovery lease after the delegation
+          // was minted, and that local authority must never upgrade the stale
+          // capability into a write under the successor.
+          if (
+            delegation &&
+            (!snapshot.active ||
+              !delegationMatchesLease(delegation, snapshot.active) ||
+              delegation.sessionId !== id ||
+              snapshot.active.expiresAtMs <= now)
+          ) {
+            throw leaseError(
+              SESSION_HOST_LEASE_FENCED_CODE,
+              `Delegated session write is fenced by a revocation, successor, or expired host lease: ${id}`,
+              {
+                sessionId: id,
+                delegatedLeaseId: delegation.leaseId,
+                delegatedFencingToken: delegation.fencingToken,
+                activeLeaseId: snapshot.active?.leaseId ?? null,
+                activeFencingToken: snapshot.active?.fencingToken ?? null,
+                activeRevocationEpoch: snapshot.revocationEpoch,
+              },
+            );
+          }
+          if (delegation && snapshot.active) {
+            return invokeTask(
+              Object.freeze({
+                leaseId: snapshot.active.leaseId,
+                fencingToken: snapshot.active.fencingToken,
+                revocationEpoch: snapshot.active.revocationEpoch,
+                ownerPid: snapshot.active.ownerPid,
+                hostKind: snapshot.active.hostKind,
+                delegated: true,
+              }),
+            );
+          }
           if (
             record &&
             (record.released ||
@@ -806,7 +902,7 @@ export class SessionHostLeaseAuthority {
               `Session write is fenced by another host lease: ${id}`,
               {
                 sessionId: id,
-                activeFencingToken: snapshot.active.fencingToken,
+                activeFencingToken: snapshot.active?.fencingToken ?? null,
                 localFencingToken: null,
                 activeRevocationEpoch: snapshot.revocationEpoch,
               },
@@ -837,6 +933,41 @@ export class SessionHostLeaseAuthority {
       throw this._unavailable(id, filePath, cause);
     }
   }
+
+  withDelegatedWriteAuthority(sessionId, delegation, task, options = {}) {
+    if (typeof task !== "function") {
+      throw new TypeError("delegated session host write callback is required");
+    }
+    const id = canonicalSessionId(sessionId);
+    const normalized = normalizeWriteDelegation(delegation, id);
+    if (
+      options.expectedOwnerPid !== undefined &&
+      normalized.ownerPid !==
+        positiveInteger(options.expectedOwnerPid, "delegated owner pid")
+    ) {
+      throw leaseError(
+        SESSION_HOST_LEASE_FENCED_CODE,
+        `Session host write delegation owner does not match the turn child (delegated ${normalized.ownerPid}, expected ${Number(options.expectedOwnerPid)})`,
+        {
+          sessionId: id,
+          delegatedOwnerPid: normalized.ownerPid,
+          expectedOwnerPid: Number(options.expectedOwnerPid),
+        },
+      );
+    }
+    this._delegatedWrites.push(normalized);
+    try {
+      const result = task();
+      if (result && typeof result.then === "function") {
+        throw new TypeError(
+          "delegated session host write callback must be synchronous",
+        );
+      }
+      return result;
+    } finally {
+      this._delegatedWrites.pop();
+    }
+  }
 }
 
 const defaultAuthority = new SessionHostLeaseAuthority();
@@ -849,6 +980,44 @@ export function withSessionHostWriteAuthority(sessionId, task) {
   return defaultAuthority.withWriteAuthority(sessionId, task);
 }
 
+export function createSessionHostWriteDelegation(lease) {
+  return normalizeWriteDelegation(lease);
+}
+
+export function withSessionHostDelegatedWriteAuthority(
+  sessionId,
+  delegation,
+  task,
+  options,
+) {
+  return defaultAuthority.withDelegatedWriteAuthority(
+    sessionId,
+    delegation,
+    task,
+    options,
+  );
+}
+
+export function withSessionHostRecoveryLease(
+  sessionId,
+  task,
+  { hostKind = "background-recovery" } = {},
+) {
+  if (typeof task !== "function") {
+    throw new TypeError("session host recovery callback is required");
+  }
+  const lease = acquireSessionHostLease(sessionId, { hostKind });
+  try {
+    const result = task(lease);
+    if (result && typeof result.then === "function") {
+      throw new TypeError("session host recovery callback must be synchronous");
+    }
+    return result;
+  } finally {
+    lease.release();
+  }
+}
+
 export function assertSessionHostWriteAuthority(sessionId) {
   return defaultAuthority.withWriteAuthority(
     sessionId,

package/src/lib/session-host-snapshot.js

@@ -26,6 +26,7 @@ import {
   sanitizePersistedMessage,
   sanitizePersistedMessages,
 } from "./session-message-provenance.js";
+import { createSessionTranscriptStructureProjection } from "./session-transcript-structure.js";
 
 export const SESSION_HOST_SNAPSHOT_SCHEMA =
   "chainlesschain.session-host-snapshot/v1";
@@ -122,12 +123,17 @@ function titleFromEvents(events) {
   return title;
 }
 
-function validatePlainSessionEvents(events) {
+function validatePlainSessionEvents(events, sessionId) {
   // Validate the complete nested graph without invoking accessors/Proxy traps,
   // then retain the original in-process objects so an already-established
   // runtime WeakMap provenance capability is not lost on the trusted legacy
   // adapter seam.
   sanitizePersistedMessages(events, { strict: true });
+  const structure = createSessionTranscriptStructureProjection(sessionId, {
+    failFast: true,
+  });
+  for (const event of events) structure.accept(event);
+  structure.finish();
   return events;
 }
 
@@ -250,7 +256,7 @@ export function projectSessionHostObservation({
   messages,
   recovery,
 }) {
-  const safeEvents = validatePlainSessionEvents(events);
+  const safeEvents = validatePlainSessionEvents(events, sessionId);
   if (safeEvents.length === 0) {
     throw new TypeError("Verified session events must be a non-empty array");
   }
@@ -271,7 +277,7 @@ export function projectSessionHostObservation({
 
 /** Build a content-free snapshot from one already-verified, stable event set. */
 export function projectVerifiedSessionHostSnapshot(sessionId, events) {
-  const safeEvents = validatePlainSessionEvents(events);
+  const safeEvents = validatePlainSessionEvents(events, sessionId);
   const messages = replayMessagesFromVerifiedEvents(safeEvents);
   const recovery = reduceMcpLedgerEvents(safeEvents, {
     sessionId,
@@ -292,6 +298,9 @@ export function projectVerifiedSessionHostSnapshot(sessionId, events) {
 function createStreamingSessionHostProjection(sessionId) {
   let title = "Untitled";
   let lastEventType = null;
+  const structure = createSessionTranscriptStructureProjection(sessionId, {
+    failFast: true,
+  });
   const mcpReducer = createMcpLedgerEventReducer({
     sessionId,
     verified: true,
@@ -303,6 +312,7 @@ function createStreamingSessionHostProjection(sessionId) {
       if (!safeEvent || typeof safeEvent !== "object") {
         throw new TypeError("Verified session event must be plain JSON data");
       }
+      structure.accept(safeEvent);
       if (safeEvent.type === "session_start" && safeEvent.data?.title) {
         title = String(safeEvent.data.title);
       } else if (safeEvent.type === "session_rename" && safeEvent.data?.title) {
@@ -313,6 +323,7 @@ function createStreamingSessionHostProjection(sessionId) {
       mcpReducer.accept(safeEvent);
     },
     finish({ headHash, eventCount, readMessages }) {
+      structure.finish();
       if (typeof readMessages !== "function") {
         throw new TypeError("Verified resume message reader is missing");
       }

package/src/lib/session-persistence-failure.js

@@ -10,6 +10,7 @@ const COMMIT_STATES = new Set(["not-committed", "unknown", "committed"]);
 const OPERATIONS = new Set([
   "append-event",
   "append-authority-event",
+  "verified-projection-authority-append",
   "transcript-append",
   "transcript-settlement",
   "session-start",

package/src/lib/session-tail.js

@@ -11,11 +11,19 @@
 import { promises as fsp } from "node:fs";
 import { existsSync, statSync } from "node:fs";
 import {
+  assertCanonicalJsonlRecordByteLength,
+  assertCanonicalJsonlRecordSize,
+  CANONICAL_JSONL_RECORD_MAX_BYTES,
+  CANONICAL_JSONL_RECORD_TOO_LARGE_CODE,
   getSessionPresence,
+  parseCanonicalJsonlRecord,
+  resolveCanonicalJsonlRecordMaxBytes,
   SESSION_PRESENCE,
   sessionPath,
 } from "../harness/jsonl-session-store.js";
 
+const DEFAULT_LIVE_READ_CHUNK_BYTES = 64 * 1024;
+
 export function readLiveTranscriptPresence(
   sessionId,
   readPresence = getSessionPresence,
@@ -59,35 +67,149 @@ function assertLiveTranscriptReadable(sessionId) {
   throw error;
 }
 
-function parseLine(line) {
+function positiveSafeInteger(value, label) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new TypeError(`${label} must be a positive safe integer`);
+  }
+  return parsed;
+}
+
+function nonNegativeSafeInteger(value, label) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new TypeError(`${label} must be a non-negative safe integer`);
+  }
+  return parsed;
+}
+
+function rethrowCanonicalRecordLimit(error) {
+  if (error?.code === CANONICAL_JSONL_RECORD_TOO_LARGE_CODE) throw error;
+}
+
+function parseLine(line, maxRecordBytes = CANONICAL_JSONL_RECORD_MAX_BYTES) {
+  // Bound attacker-controlled text before trim() can copy it and again inside
+  // the canonical parser before JSON.parse.
+  assertCanonicalJsonlRecordSize(line, maxRecordBytes);
   const trimmed = line.trim();
   if (!trimmed) return null;
   try {
-    return JSON.parse(trimmed);
-  } catch {
+    return parseCanonicalJsonlRecord(trimmed, maxRecordBytes);
+  } catch (error) {
+    rethrowCanonicalRecordLimit(error);
     return null;
   }
 }
 
+function assertUtf8RangeSize(text, start, end, maxRecordBytes) {
+  let byteLength = 0;
+  for (let index = start; index < end; index += 1) {
+    const codeUnit = text.charCodeAt(index);
+    if (codeUnit <= 0x7f) {
+      byteLength += 1;
+    } else if (codeUnit <= 0x7ff) {
+      byteLength += 2;
+    } else if (
+      codeUnit >= 0xd800 &&
+      codeUnit <= 0xdbff &&
+      index + 1 < end &&
+      text.charCodeAt(index + 1) >= 0xdc00 &&
+      text.charCodeAt(index + 1) <= 0xdfff
+    ) {
+      byteLength += 4;
+      index += 1;
+    } else {
+      // Lone UTF-16 surrogates are encoded as the three-byte replacement
+      // character by Buffer.byteLength()/UTF-8 decoders.
+      byteLength += 3;
+    }
+  }
+  assertCanonicalJsonlRecordByteLength(byteLength, maxRecordBytes);
+}
+
 /**
  * Parse a contiguous chunk of buffered text into events. Returns {events, rest}
  * where `rest` is the unterminated trailing partial line to keep for the next
  * read.
  */
-export function parseChunk(buffer) {
+export function parseChunk(
+  buffer,
+  { maxRecordBytes = CANONICAL_JSONL_RECORD_MAX_BYTES } = {},
+) {
+  const limit = resolveCanonicalJsonlRecordMaxBytes(maxRecordBytes);
   const events = [];
-  let rest = buffer;
-  let nl = rest.indexOf("\n");
+  let start = 0;
+  let nl = buffer.indexOf("\n", start);
   while (nl !== -1) {
-    const line = rest.slice(0, nl);
-    rest = rest.slice(nl + 1);
-    const evt = parseLine(line);
+    // Count the source range before slice() can retain/copy an attacker-sized
+    // terminated line.
+    assertUtf8RangeSize(buffer, start, nl, limit);
+    const line = buffer.slice(start, nl);
+    const evt = parseLine(line, limit);
     if (evt) events.push(evt);
-    nl = rest.indexOf("\n");
+    start = nl + 1;
+    nl = buffer.indexOf("\n", start);
   }
+  assertUtf8RangeSize(buffer, start, buffer.length, limit);
+  const rest = buffer.slice(start);
   return { events, rest };
 }
 
+function offsetBoundaryError(offset) {
+  const error = new Error(
+    `Session tail offset ${offset} is not at a JSONL record boundary`,
+  );
+  error.code = "SESSION_TAIL_OFFSET_NOT_RECORD_BOUNDARY";
+  error.offset = offset;
+  return error;
+}
+
+async function assertOffsetAtRecordBoundary(fd, offset, fileSize) {
+  if (offset === 0) return;
+  if (offset > fileSize) throw offsetBoundaryError(offset);
+  const previousByte = Buffer.allocUnsafe(1);
+  const read = await fd.read(previousByte, 0, 1, offset - 1);
+  if (read.bytesRead !== 1 || previousByte[0] !== 0x0a) {
+    throw offsetBoundaryError(offset);
+  }
+}
+
+function joinedRecordBuffer(parts, byteLength) {
+  if (parts.length === 0) return Buffer.alloc(0);
+  if (parts.length === 1) return parts[0];
+  return Buffer.concat(parts, byteLength);
+}
+
+function consumeLiveJsonlBytes(state, bytes, maxRecordBytes) {
+  const events = [];
+  let start = 0;
+  let newline = bytes.indexOf(0x0a, start);
+  while (newline >= 0) {
+    const segment = bytes.subarray(start, newline);
+    const recordBytes = state.byteLength + segment.length;
+    assertCanonicalJsonlRecordByteLength(recordBytes, maxRecordBytes);
+    const record = joinedRecordBuffer(
+      segment.length > 0 ? [...state.parts, segment] : state.parts,
+      recordBytes,
+    );
+    // Decode only after the byte limit passes. The parser repeats the same
+    // canonical check immediately before JSON.parse.
+    const event = parseLine(record.toString("utf8"), maxRecordBytes);
+    if (event) events.push(event);
+    state.parts = [];
+    state.byteLength = 0;
+    start = newline + 1;
+    newline = bytes.indexOf(0x0a, start);
+  }
+
+  const trailing = bytes.subarray(start);
+  const pendingBytes = state.byteLength + trailing.length;
+  assertCanonicalJsonlRecordByteLength(pendingBytes, maxRecordBytes);
+  if (trailing.length > 0) state.parts.push(Buffer.from(trailing));
+  state.byteLength = pendingBytes;
+  return events;
+}
+
 function matchesFilter(event, { types, sinceMs }) {
   if (types && types.length > 0 && !types.includes(event.type)) return false;
   if (sinceMs && event.timestamp && event.timestamp < sinceMs) return false;
@@ -119,6 +241,8 @@ export function initialOffset(sessionId, { fromStart = false } = {}) {
  *   - types        string[] of event.type to include (null = all)
  *   - sinceMs      only yield events with timestamp >= sinceMs
  *   - once         if true, stop once file is drained (no polling)
+ *   - maxRecordBytes canonical JSONL record cap (test seam; default 16 MiB)
+ *   - readChunkBytes bounded file read size (test seam; default 64 KiB)
  */
 export async function* followSession(sessionId, options = {}) {
   const {
@@ -129,18 +253,23 @@ export async function* followSession(sessionId, options = {}) {
     types = null,
     sinceMs = null,
     once = false,
+    maxRecordBytes = CANONICAL_JSONL_RECORD_MAX_BYTES,
+    readChunkBytes = DEFAULT_LIVE_READ_CHUNK_BYTES,
   } = options;
 
+  const recordLimit = resolveCanonicalJsonlRecordMaxBytes(maxRecordBytes);
+  const readLimit = Math.min(
+    positiveSafeInteger(readChunkBytes, "readChunkBytes"),
+    recordLimit,
+  );
+
   const filePath = sessionPath(sessionId);
-  let offset =
-    typeof fromOffset === "number"
-      ? fromOffset
-      : initialOffset(sessionId, { fromStart });
-  let buffer = "";
-  // Streaming decoder persisted across polls: when the file grows by a partial
-  // multi-byte UTF-8 character between reads (the rest arrives next poll), the
-  // held bytes are reassembled instead of corrupted into U+FFFD.
-  let decoder = new TextDecoder("utf-8");
+  const hasExplicitOffset = fromOffset !== undefined;
+  let offset = hasExplicitOffset
+    ? nonNegativeSafeInteger(fromOffset, "fromOffset")
+    : initialOffset(sessionId, { fromStart });
+  const pending = { parts: [], byteLength: 0 };
+  let offsetBoundaryValidated = offset === 0;
 
   while (true) {
     if (signal?.aborted) return;
@@ -156,27 +285,43 @@ export async function* followSession(sessionId, options = {}) {
         if (stat.size < offset) {
           // File was truncated / rotated — restart from beginning
           offset = 0;
-          buffer = "";
-          decoder = new TextDecoder("utf-8"); // drop any held partial-char bytes
+          pending.parts = [];
+          pending.byteLength = 0;
+          offsetBoundaryValidated = true;
         }
-        if (stat.size > offset) {
+        if (!offsetBoundaryValidated || stat.size > offset) {
           const fd = await fsp.open(filePath, "r");
           try {
-            const length = stat.size - offset;
-            const buf = Buffer.alloc(length);
-            await fd.read(buf, 0, length, offset);
-            offset = stat.size;
-            buffer += decoder.decode(buf, { stream: true });
+            const targetOffset = stat.size;
+            if (!offsetBoundaryValidated) {
+              await assertOffsetAtRecordBoundary(fd, offset, targetOffset);
+              offsetBoundaryValidated = true;
+            }
+            while (offset < targetOffset) {
+              const length = Math.min(readLimit, targetOffset - offset);
+              const buf = Buffer.allocUnsafe(length);
+              const read = await fd.read(buf, 0, length, offset);
+              if (
+                !Number.isSafeInteger(read.bytesRead) ||
+                read.bytesRead <= 0
+              ) {
+                break;
+              }
+              offset += read.bytesRead;
+              const events = consumeLiveJsonlBytes(
+                pending,
+                buf.subarray(0, read.bytesRead),
+                recordLimit,
+              );
+              for (const evt of events) {
+                if (matchesFilter(evt, { types, sinceMs })) {
+                  yield { event: evt, offset };
+                }
+              }
+            }
           } finally {
             await fd.close();
           }
-          const { events, rest } = parseChunk(buffer);
-          buffer = rest;
-          for (const evt of events) {
-            if (matchesFilter(evt, { types, sinceMs })) {
-              yield { event: evt, offset };
-            }
-          }
         }
       } catch (error) {
         if (error?.code !== "ENOENT") throw error;

package/src/lib/session-transcript-structure.js

@@ -0,0 +1,96 @@
+/**
+ * Streaming structural authority for canonical session transcripts.
+ *
+ * Hash-chain verification proves that bytes were not changed after they were
+ * anchored. It does not prove that the event protocol has one genesis marker.
+ * Every usable session must therefore contain exactly one `session_start`, and
+ * that marker must be the first event.
+ */
+
+export const SESSION_TRANSCRIPT_STRUCTURE_ERROR_CODE =
+  "CC_SESSION_TRANSCRIPT_STRUCTURE_INVALID";
+
+function structureReason({ eventCount, sessionStartCount, sessionStartIndex }) {
+  if (eventCount > 0 && sessionStartIndex !== 0) {
+    return "session_start must be the first event";
+  }
+  if (sessionStartCount !== 1) {
+    return "session must contain exactly one session_start event";
+  }
+  return null;
+}
+
+function structureError(sessionId, reason, projection) {
+  const label =
+    typeof sessionId === "string" && sessionId.length > 0
+      ? sessionId.slice(0, 256)
+      : "unknown";
+  const error = new Error(`session ${label} ${reason}`);
+  error.code = SESSION_TRANSCRIPT_STRUCTURE_ERROR_CODE;
+  error.sessionId = sessionId ?? null;
+  error.structure = projection;
+  return error;
+}
+
+/**
+ * Build a constant-space structure projection for a stream of session events.
+ *
+ * `failFast` rejects violations that are already irreversible while events are
+ * accepted. `finish({ assertValid: true })` additionally rejects a missing
+ * marker once the complete stream is known.
+ */
+export function createSessionTranscriptStructureProjection(
+  sessionId,
+  { failFast = false } = {},
+) {
+  let eventCount = 0;
+  let sessionStartCount = 0;
+  let sessionStartIndex = null;
+
+  const snapshot = () => {
+    const projection = {
+      eventCount,
+      sessionStartCount,
+      sessionStartIndex,
+      hasStartEvent: sessionStartCount > 0,
+    };
+    const reason = structureReason(projection);
+    return Object.freeze({
+      ...projection,
+      sessionStartIsFirst: sessionStartIndex === 0,
+      valid: reason === null,
+      reason,
+    });
+  };
+
+  const assertProjection = (projection) => {
+    if (!projection.valid) {
+      throw structureError(sessionId, projection.reason, projection);
+    }
+    return projection;
+  };
+
+  return Object.freeze({
+    accept(event) {
+      const index = eventCount;
+      eventCount += 1;
+      if (event?.type === "session_start") {
+        sessionStartCount += 1;
+        if (sessionStartIndex === null) sessionStartIndex = index;
+      }
+
+      const projection = snapshot();
+      const irreversibleViolation =
+        (index === 0 && event?.type !== "session_start") ||
+        sessionStartCount > 1;
+      if (failFast && irreversibleViolation) {
+        assertProjection(projection);
+      }
+      return projection;
+    },
+    finish({ assertValid = failFast } = {}) {
+      const projection = snapshot();
+      return assertValid ? assertProjection(projection) : projection;
+    },
+  });
+}