sealbridge 0.2.1 → 0.3.0

package/dist/packages/runtime/dist/mcp.d.ts

@@ -1,7 +1,7 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import type { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { CapabilityGuard } from '@acp/core';
-import type { CapabilityToken, CapabilityContext, ApprovalReceipt } from '@acp/core';
+import { CapabilityGuard } from '../../core/dist/index.js';
+import type { CapabilityToken, CapabilityContext, ApprovalReceipt } from '../../core/dist/index.js';
 import { ApprovalGate } from './policy.js';
 import type { QuotaMeter } from './quota.js';
 export interface ToolBackend {

package/dist/packages/runtime/dist/message-status.d.ts

@@ -0,0 +1,32 @@
+import type { SignedDeliveryStatus } from '../../core/dist/index.js';
+import type { DeliveryStore } from './delivery-store.js';
+import type { MessageStatus } from './delivery-records.js';
+export type MessageStatusSelector = {
+    messageId: string;
+    taskId?: never;
+} | {
+    taskId: string;
+    messageId?: never;
+};
+export type MessageStatusResult = {
+    found: false;
+} | {
+    found: true;
+    messageId: string;
+    taskId: string;
+    peerDid: string;
+    status: MessageStatus;
+    source: 'local' | 'relay' | 'recipient' | 'reply';
+    createdAt: number;
+    updatedAt: number;
+    deliveryDeadline: number;
+    retainUntil: number;
+    retry: {
+        pending: boolean;
+        attemptCount: number;
+        nextAttemptAt: number | null;
+    };
+    recipientStatus: SignedDeliveryStatus | null;
+};
+/** Read sender-local facts without starting delivery, changing records or pruning expired bytes. */
+export declare function messageStatus(store: DeliveryStore, selector: MessageStatusSelector): MessageStatusResult;

package/dist/packages/runtime/dist/message-status.js

@@ -0,0 +1,29 @@
+import { deliveryError } from './delivery-records.js';
+/** Read sender-local facts without starting delivery, changing records or pruning expired bytes. */
+export function messageStatus(store, selector) {
+    const matches = selector.messageId !== undefined
+        ? [store.getMessage(selector.messageId)].flatMap(r => r ? [r] : [])
+        : store.findTask(selector.taskId);
+    if (matches.length > 1)
+        throw deliveryError('MESSAGE_STATUS_AMBIGUOUS');
+    const message = matches[0];
+    if (!message)
+        return { found: false };
+    const proposal = store.read('outbox', message.messageId);
+    const pending = message.status === 'queued' && proposal?.state === 'pending' && store.now() < message.deliveryDeadline;
+    // C4 verifies the recipient binding and pins disclosure before publishing each event.
+    const recipientStatus = message.protocolVersion === '0.2.0' && message.remoteStatus &&
+        store.now() < message.remoteStatus.payload.retainUntil ? message.remoteStatus : null;
+    const source = message.status === 'replied' ? 'reply'
+        : recipientStatus?.payload.state === message.status ? 'recipient'
+            : message.status === 'relayed' ? 'relay' : 'local';
+    return {
+        found: true, messageId: message.messageId, taskId: message.taskId, peerDid: message.peerOwnerDid,
+        status: message.status, source, createdAt: message.createdAt, updatedAt: message.updatedAt,
+        deliveryDeadline: message.deliveryDeadline, retainUntil: message.retainUntil,
+        // C1 removes completed batch members; absent attempt metadata is reported as zero.
+        retry: { pending, attemptCount: proposal?.attemptCount ?? 0, nextAttemptAt: pending ? proposal.nextAttemptAt : null },
+        recipientStatus,
+    };
+}
+//# sourceMappingURL=message-status.js.map

package/dist/packages/runtime/dist/message-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-status.js","sourceRoot":"","sources":["../src/message-status.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAYtD,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,KAAoB,EAAE,QAA+B;IACjF,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,KAAK,SAAS;QAC9C,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,0BAA0B,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACvH,sFAAsF;IACtF,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY;QACjF,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO;QACnD,CAAC,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YACjE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,OAAO;QACL,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY;QAChG,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;QAC1F,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QAC5E,mFAAmF;QACnF,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE;QACrH,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/packages/runtime/dist/outbox.d.ts

@@ -0,0 +1,91 @@
+import { DeliveryStatusRouter } from './delivery-status-router.js';
+import { RecipientDeliveryCoordinator } from './delivery-status.js';
+import type { KeyPair, SignedEnvelope } from '../../core/dist/index.js';
+import type { RelayTransport } from '../../relay/dist/index.js';
+import type { IdentityStoreOptions } from './key-store.js';
+import { DeliveryStore } from './delivery-store.js';
+import type { DeliveryLimits, MessageStatus, OutboxRecordV1 } from './delivery-records.js';
+export interface DeliveryContext {
+    messageId: string;
+    peerOwnerDid: string;
+    relayUrl: string;
+    deliveryDeadline: number;
+    kind?: OutboxRecordV1['kind'];
+    message?: {
+        taskId: string;
+        peerAgentDid: string;
+        protocolVersion: '0.1.0' | '0.2.0';
+        operationId?: string;
+    };
+}
+export interface GatewayDeliveryOptions {
+    identityOptions?: IdentityStoreOptions;
+    now?: () => number;
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    limits?: Partial<DeliveryLimits>;
+    resolveTransport: (relayUrl: string, owner: KeyPair) => RelayTransport | Promise<RelayTransport>;
+    assertSendAllowed?: (context: OutboxRecordV1) => void | Promise<void>;
+    /** Check retained relay bindings before starting a status reader. */
+    assertReceiveAllowed?: (relayUrl: string) => void | Promise<void>;
+    requestTimeoutMs?: number;
+    onError?: (error: Error) => void;
+    timers?: Pick<typeof globalThis, 'setTimeout' | 'clearTimeout'>;
+}
+export declare function outboxRetryDelay(attemptCount: number): number;
+/** Durable transport admission, independent of task execution and owner decisions. */
+declare class GatewayDeliveryServiceImplementation {
+    readonly owner: KeyPair;
+    readonly options: GatewayDeliveryOptions;
+    readonly store: DeliveryStore;
+    readonly statusRouter: DeliveryStatusRouter;
+    recipientStatus: RecipientDeliveryCoordinator;
+    private controller;
+    private active;
+    private timer?;
+    private readonly attempts;
+    private readonly terminalErrors;
+    private readonly maintenance;
+    onMaintenance(callback: (signal: AbortSignal) => void | Promise<void>): void;
+    private readonly sleep;
+    private readonly timers;
+    constructor(owner: KeyPair, options: GatewayDeliveryOptions);
+    start(): Promise<void>;
+    stop(): void;
+    private report;
+    private schedule;
+    prepare(signal?: AbortSignal): Promise<void>;
+    private buildBatch;
+    private batchOperation;
+    private publishBatch;
+    private publishBatchLocked;
+    private batchWrites;
+    /** Publish all immutable members before the batch marker makes any member dispatchable. */
+    enqueue(prepared: readonly SignedEnvelope[], context: DeliveryContext): string[];
+    /** Independent batches write concurrently without holding the signer lock or blocking relay readers. */
+    enqueuePrepared(frames: readonly SignedEnvelope[], context: DeliveryContext, signal?: AbortSignal): Promise<string[]>;
+    /** C4 stages status frames and observation references in one prepared transaction. */
+    enqueueLocked(frames: readonly SignedEnvelope[], context: DeliveryContext): string[];
+    private ordered;
+    /** Cleanup can be retried by maintenance after admission has already completed. */
+    finishBatch(batchId: string): void;
+    drainDue(signal?: AbortSignal): Promise<void>;
+    /** One attempt per due control frame; background lifecycle owns subsequent retries. */
+    drainStatuses(): Promise<void>;
+    sendPrepared(envelopeId: string, signal?: AbortSignal): Promise<void>;
+    private attempt;
+    private attemptOnce;
+    private closeLocked;
+    closeMessage(messageId: string, code?: string): void;
+    markPeerObserved(messageId: string, observation: {
+        status: MessageStatus;
+        envelopeId: string;
+        replyEnvelopeId?: string;
+    }): void;
+}
+/** Structural public interface permits source and built hosts to share a service. */
+export type GatewayDeliveryService = Pick<GatewayDeliveryServiceImplementation, keyof GatewayDeliveryServiceImplementation>;
+export declare const GatewayDeliveryService: {
+    new (owner: KeyPair, options: GatewayDeliveryOptions): GatewayDeliveryService;
+    readonly prototype: GatewayDeliveryService;
+};
+export {};

package/dist/packages/runtime/dist/outbox.js

@@ -0,0 +1,462 @@
+// SPDX-License-Identifier: Apache-2.0
+import { DeliveryStatusRouter } from './delivery-status-router.js';
+import { RecipientDeliveryCoordinator } from './delivery-status.js';
+import { randomUUID } from 'node:crypto';
+import { digest } from '../../core/dist/index.js';
+import { isTransientRelayError, relayDeadline, waitForRelayRetry } from '../../relay/dist/index.js';
+import { DeliveryStore } from './delivery-store.js';
+import { deliveryError, DELIVERY_RETENTION_MS, requireDelivery } from './delivery-records.js';
+const delays = [60_000, 300_000, 900_000, 3_600_000];
+export function outboxRetryDelay(attemptCount) { return delays[Math.min(Math.max(attemptCount - 1, 0), 3)]; }
+function errorCode(error) {
+    const code = error?.code;
+    if (typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,79}$/.test(code))
+        return code;
+    const message = error instanceof Error ? error.message : '';
+    return /^[A-Z][A-Z0-9_]{0,79}$/.test(message) ? message : 'RELAY_UNAVAILABLE';
+}
+/** Durable transport admission, independent of task execution and owner decisions. */
+class GatewayDeliveryServiceImplementation {
+    owner;
+    options;
+    store;
+    statusRouter;
+    recipientStatus;
+    controller = new AbortController();
+    active = false;
+    timer;
+    attempts = new Map();
+    terminalErrors = new Map();
+    maintenance = new Set();
+    onMaintenance(callback) { this.maintenance.add(callback); }
+    sleep;
+    timers;
+    constructor(owner, options) {
+        this.owner = owner;
+        this.options = options;
+        this.store = new DeliveryStore(owner, { ...options.identityOptions, now: options.now, limits: options.limits });
+        this.statusRouter = new DeliveryStatusRouter(this);
+        this.recipientStatus = new RecipientDeliveryCoordinator(this);
+        this.sleep = options.sleep ?? waitForRelayRetry;
+        this.timers = options.timers ?? globalThis;
+    }
+    async start() {
+        if (this.active)
+            return;
+        if (this.controller.signal.aborted)
+            this.controller = new AbortController();
+        this.active = true;
+        if (this.store.ids('observations', e => this.report(e)).length)
+            await this.prepare();
+        this.recipientStatus.reconcile();
+        // Do not create an empty store during lifecycle-only startup.
+        if (this.store.ids('observations', e => this.report(e)).length || this.store.ids('batches', e => this.report(e)).length || this.store.ids('receipts', e => this.report(e)).length || this.store.ids('messages', e => this.report(e)).length)
+            await this.store.maintainInBackground(error => this.report(error), this.controller.signal);
+        for (const callback of this.maintenance) {
+            this.controller.signal.throwIfAborted();
+            await callback(this.controller.signal);
+        }
+        await this.drainDue(this.controller.signal);
+        await this.statusRouter.start();
+        this.schedule();
+    }
+    stop() {
+        this.active = false;
+        this.statusRouter.stop();
+        this.timers.clearTimeout(this.timer);
+        this.controller.abort(deliveryError('OUTBOX_STOPPED'));
+        this.terminalErrors.clear();
+    }
+    report(error) {
+        const normalized = deliveryError(errorCode(error));
+        if (this.options.onError)
+            this.options.onError(normalized);
+        else
+            console.warn(normalized.message);
+    }
+    schedule() {
+        if (!this.active)
+            return;
+        this.timer = this.timers.setTimeout(() => {
+            void this.prepare().then(() => this.recipientStatus.reconcile()).then(() => this.drainDue(this.controller.signal)).then(async () => {
+                void this.statusRouter.refresh().catch(e => this.report(e));
+                await this.store.maintainInBackground(error => this.report(error), this.controller.signal);
+                for (const id of this.terminalErrors.keys()) {
+                    await new Promise(resolve => setImmediate(resolve));
+                    this.controller.signal.throwIfAborted();
+                    if (!this.store.read('outbox', id))
+                        this.terminalErrors.delete(id);
+                }
+                for (const callback of this.maintenance) {
+                    this.controller.signal.throwIfAborted();
+                    await callback(this.controller.signal);
+                }
+            }).catch(e => this.report(e)).finally(() => this.schedule());
+        }, 60_000);
+        this.timer.unref?.();
+    }
+    async prepare(signal) {
+        await this.store.prepare(AbortSignal.any([this.controller.signal, ...(signal ? [signal] : [])]));
+    }
+    buildBatch(prepared, context) {
+        const frames = structuredClone(prepared), c = structuredClone(context);
+        const now = this.store.now(), batchId = randomUUID();
+        requireDelivery(frames.length >= 1 && frames.length <= 2 && (c.kind !== 'delivery-status' || frames.length === 1));
+        requireDelivery(frames.length !== 2 || frames[1].payload.eventType === 'AUDIT_ENTRY' &&
+            frames[1].payload.seq === frames[0].payload.seq + 1 && frames[1].payload.taskId === frames[0].payload.taskId);
+        const records = frames.map(e => ({ version: 1, envelopeId: e.payload.envelopeId,
+            messageId: c.messageId, batchId, kind: c.kind ?? 'task', localOwnerDid: this.owner.did,
+            peerOwnerDid: c.peerOwnerDid, relayUrl: c.relayUrl, envelopeDigest: digest(e), envelope: e,
+            createdAt: now, deliveryDeadline: c.deliveryDeadline, state: 'pending', attemptCount: 0, nextAttemptAt: now,
+            ordinal: e.payload.seq }));
+        const first = frames[0];
+        const message = c.message ? { version: 1, messageId: c.messageId,
+            localOwnerDid: this.owner.did, peerOwnerDid: c.peerOwnerDid, peerAgentDid: c.message.peerAgentDid,
+            taskId: c.message.taskId, relayUrl: c.relayUrl, protocolVersion: c.message.protocolVersion,
+            createdAt: now, deliveryDeadline: c.deliveryDeadline, retainUntil: Math.max(now, c.deliveryDeadline) + DELIVERY_RETENTION_MS,
+            status: 'queued', updatedAt: now, proposalEnvelopeDigest: digest(first),
+            ...(c.message.operationId ? { operationId: c.message.operationId } : {}) } : undefined;
+        if (message)
+            requireDelivery(first.payload.eventType === 'PROPOSE' && first.payload.envelopeId === c.messageId && first.payload.taskId === message.taskId);
+        const marker = { version: 1, batchId, messageId: c.messageId, localOwnerDid: this.owner.did,
+            envelopeIds: records.map(r => r.envelopeId), createdAt: now, committed: true };
+        return { records, message, marker };
+    }
+    batchOperation(message) {
+        if (!message?.operationId)
+            return;
+        const operation = this.store.read('operations', message.operationId);
+        const action = operation?.preparedActions.find(a => a.manifest.taskId === message.taskId);
+        requireDelivery(operation && operation.phase !== 'finished' && action &&
+            operation.approvals?.some(a => a.childIndex === action.childIndex) &&
+            action.peerOwnerDid === message.peerOwnerDid && action.peerAgentDid === message.peerAgentDid &&
+            action.relayUrl === message.relayUrl &&
+            Date.parse(action.manifest.deadline) === message.deliveryDeadline);
+        const prior = JSON.stringify(operation);
+        action.messageId = message.messageId;
+        operation.messageIds = operation.preparedActions.flatMap(a => a.messageId ? [a.messageId] : []);
+        operation.phase = 'sending';
+        return { prior, record: operation };
+    }
+    publishBatch({ records, message, marker }, prepared, operation) {
+        const publish = (write) => {
+            if (prepared)
+                this.store.publishWrite(prepared.find(p => p.kind === write.kind && p.id === write.id));
+            else
+                this.store.write(write.kind, write.id, write.record);
+        };
+        const ids = this.store.transaction(() => {
+            if (operation && JSON.stringify(this.store.read('operations', operation.record.operationId)) !== operation.prior)
+                return;
+            return this.publishBatchLocked({ records, message, marker }, publish, operation);
+        });
+        if (ids)
+            void this.statusRouter.refresh().catch(e => this.report(e));
+        return ids;
+    }
+    publishBatchLocked({ records, message, marker }, publish, operation) {
+        this.store.assertCapacity(records, message);
+        for (const r of records) {
+            const prior = this.store.read('outbox', r.envelopeId);
+            if (prior)
+                throw deliveryError('DELIVERY_RECORD_CONFLICT');
+            publish({ kind: 'outbox', id: r.envelopeId, record: r });
+        }
+        if (message) {
+            const prior = this.store.read('messages', message.messageId);
+            if (prior)
+                throw deliveryError('DELIVERY_RECORD_CONFLICT');
+            publish({ kind: 'messages', id: message.messageId, record: message });
+        }
+        if (operation)
+            publish({ kind: 'operations', id: operation.record.operationId, record: operation.record });
+        publish({ kind: 'batches', id: marker.batchId, record: marker });
+        this.store.committed(marker.batchId);
+        return records.map(r => r.envelopeId);
+    }
+    batchWrites(batch) {
+        const writes = batch.records.map(record => ({ kind: 'outbox', id: record.envelopeId, record }));
+        if (batch.message)
+            writes.push({ kind: 'messages', id: batch.message.messageId, record: batch.message });
+        writes.push({ kind: 'batches', id: batch.marker.batchId, record: batch.marker });
+        return writes;
+    }
+    /** Publish all immutable members before the batch marker makes any member dispatchable. */
+    enqueue(prepared, context) {
+        const batch = this.buildBatch(prepared, context);
+        if (!batch.message?.operationId)
+            return this.publishBatch(batch);
+        for (;;) {
+            const operation = this.batchOperation(batch.message);
+            const update = this.store.prepareWritesSync([...this.batchWrites(batch),
+                { kind: 'operations', id: operation.record.operationId, record: operation.record }]);
+            try {
+                // Complete synchronous keyed writes before acquiring the publication lock.
+                const ids = this.publishBatch(batch, update, operation);
+                if (ids)
+                    return ids;
+            }
+            finally {
+                this.store.discardWrites(update);
+            }
+        }
+    }
+    /** Independent batches write concurrently without holding the signer lock or blocking relay readers. */
+    async enqueuePrepared(frames, context, signal) {
+        const batch = this.buildBatch(frames, context);
+        const prepared = await this.store.prepareWrites(this.batchWrites(batch));
+        try {
+            for (;;) {
+                const operation = this.batchOperation(batch.message);
+                const update = operation ? await this.store.prepareWrites([{ kind: 'operations', id: operation.record.operationId, record: operation.record }]) : [];
+                try {
+                    await this.prepare(signal);
+                    const ids = this.publishBatch(batch, [...prepared, ...update], operation);
+                    if (ids)
+                        return ids;
+                }
+                finally {
+                    this.store.discardWrites(update);
+                }
+            }
+        }
+        finally {
+            this.store.discardWrites(prepared);
+        }
+    }
+    /** C4 stages status frames and observation references in one prepared transaction. */
+    enqueueLocked(frames, context) {
+        return this.publishBatchLocked(this.buildBatch(frames, context), write => this.store.write(write.kind, write.id, write.record));
+    }
+    async ordered(signal) {
+        const records = [];
+        for (const id of this.store.ids('batches', e => this.report(e))) {
+            await new Promise(resolve => setImmediate(resolve));
+            signal.throwIfAborted();
+            try {
+                records.push(...this.store.committed(id));
+            }
+            catch (error) {
+                this.report(error);
+            }
+        }
+        return records.sort((a, b) => a.createdAt - b.createdAt || a.ordinal - b.ordinal);
+    }
+    /** Cleanup can be retried by maintenance after admission has already completed. */
+    finishBatch(batchId) {
+        try {
+            this.store.transaction(() => this.store.finishBatch(batchId));
+        }
+        catch (error) {
+            this.report(error);
+        }
+    }
+    async drainDue(signal) {
+        const combined = AbortSignal.any([this.controller.signal, ...(signal ? [signal] : [])]);
+        for (const r of await this.ordered(combined)) {
+            await new Promise(resolve => setImmediate(resolve));
+            combined.throwIfAborted();
+            try {
+                await this.attempt(r.envelopeId, combined);
+            }
+            catch (error) {
+                this.report(error);
+            }
+        }
+    }
+    /** One attempt per due control frame; background lifecycle owns subsequent retries. */
+    async drainStatuses() {
+        try {
+            await this.prepare();
+        }
+        catch (error) {
+            this.report(error);
+            return;
+        }
+        for (const r of this.store.statusOutbox().sort((a, b) => a.createdAt - b.createdAt || a.ordinal - b.ordinal)) {
+            if (this.controller.signal.aborted)
+                return;
+            try {
+                await this.attempt(r.envelopeId, this.controller.signal);
+                if (!this.controller.signal.aborted)
+                    this.finishBatch(r.batchId);
+            }
+            catch (error) {
+                if (!this.controller.signal.aborted)
+                    this.report(error);
+            }
+        }
+    }
+    async sendPrepared(envelopeId, signal) {
+        const combined = AbortSignal.any([this.controller.signal, ...(signal ? [signal] : [])]);
+        for (;;) {
+            combined.throwIfAborted();
+            const r = this.store.read('outbox', envelopeId);
+            if (!r)
+                throw this.terminalErrors.get(envelopeId) ?? deliveryError('OUTBOX_STORE_INVALID');
+            const committed = this.store.committed(r.batchId);
+            if (!committed.some(member => member.envelopeId === envelopeId))
+                throw deliveryError('OUTBOX_STORE_INVALID');
+            if (r.state === 'admitted')
+                return;
+            if (r.state === 'closed')
+                throw this.terminalErrors.get(envelopeId) ?? deliveryError(r.lastError ?? 'OUTBOX_DEADLINE_EXPIRED');
+            await this.attempt(envelopeId, combined);
+            const next = this.store.read('outbox', envelopeId);
+            if (next?.state === 'pending') {
+                const blockers = this.store.pending(next.messageId).filter(other => other.kind === next.kind && other.ordinal < next.ordinal);
+                const time = Math.min(next.deliveryDeadline, Math.max(next.nextAttemptAt, next.lease?.until ?? 0, ...blockers.map(r => Math.max(r.nextAttemptAt, r.lease?.until ?? this.store.now() + 60_000))));
+                await this.sleep(Math.max(1, time - this.store.now()), combined);
+            }
+        }
+    }
+    attempt(id, signal) {
+        const prior = this.attempts.get(id);
+        if (prior)
+            return prior;
+        const run = this.attemptOnce(id, signal).finally(() => this.attempts.delete(id));
+        this.attempts.set(id, run);
+        return run;
+    }
+    async attemptOnce(id, signal) {
+        await this.prepare(signal);
+        const holderId = randomUUID();
+        const claimed = this.store.transaction(() => {
+            const r = this.store.read('outbox', id);
+            if (!r || r.state !== 'pending')
+                return;
+            const batch = this.store.committed(r.batchId);
+            if (!batch.length)
+                return;
+            const now = this.store.now();
+            // Suppression/expiry bookkeeping can replay; every attempt rechecks disclosure and deadline.
+            if (r.kind === 'delivery-status' && !this.recipientStatus.dispatchAllowed(r)) {
+                this.store.write('outbox', id, { ...r, state: 'closed', lastError: 'DELIVERY_STATUS_NOT_SUPPORTED' });
+                return;
+            }
+            if (now >= r.deliveryDeadline) {
+                if (r.kind === 'delivery-status')
+                    this.store.write('outbox', id, { ...r, state: 'closed', lastError: 'OUTBOX_DEADLINE_EXPIRED' });
+                else
+                    this.closeLocked(r.messageId, 'OUTBOX_DEADLINE_EXPIRED', 'deadline');
+                return;
+            }
+            if (r.nextAttemptAt > now || r.lease && r.lease.until > now)
+                return;
+            if (this.store.pending(r.messageId).some(other => other.kind === r.kind && (other.ordinal < r.ordinal || other.envelopeId !== id && other.lease && other.lease.until > now)))
+                return;
+            const next = { ...r, lease: { holderId, until: now + 60_000 }, attemptCount: r.attemptCount + 1 };
+            // A lost lease or attempt counter only repeats the same immutable envelope.
+            this.store.write('outbox', id, next);
+            return next;
+        });
+        if (!claimed)
+            return;
+        let error, admitted = false, relayDid;
+        try {
+            const ceiling = Math.min(this.options.requestTimeoutMs ?? 45_000, 45_000, claimed.deliveryDeadline - this.store.now());
+            const attemptSignal = AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, ceiling))]);
+            await relayDeadline((async () => {
+                attemptSignal.throwIfAborted();
+                await this.options.assertSendAllowed?.(structuredClone(claimed));
+                attemptSignal.throwIfAborted();
+                if (claimed.kind === 'delivery-status' && !this.recipientStatus.dispatchAllowed(claimed))
+                    throw deliveryError('DELIVERY_STATUS_NOT_SUPPORTED');
+                const relay = await this.options.resolveTransport(claimed.relayUrl, this.owner);
+                attemptSignal.throwIfAborted();
+                if (this.store.now() >= claimed.deliveryDeadline)
+                    throw deliveryError('OUTBOX_DEADLINE_EXPIRED');
+                if (claimed.kind === 'delivery-status' && !this.recipientStatus.dispatchAllowed(claimed))
+                    throw deliveryError('DELIVERY_STATUS_NOT_SUPPORTED');
+                await relay.send(structuredClone(claimed.envelope));
+                relayDid = relay.getDeliveryStatusPin?.(claimed.envelopeId);
+            })(), Math.max(1, ceiling), signal);
+            admitted = true;
+        }
+        catch (e) {
+            error = e;
+            const value = e;
+            admitted = e instanceof Error && e.name === 'RelayDuplicateEnvelopeError' && value.code === 'REPLAYED_ENVELOPE' &&
+                value.status === 400 && e.message === 'RELAY_REJECTED: 400';
+        }
+        // Leave an interrupted attempt's lease for bounded recovery; shutdown does not publish an outcome.
+        signal.throwIfAborted();
+        await this.prepare(signal);
+        this.store.transaction(() => {
+            const r = this.store.read('outbox', id);
+            if (!r || r.state !== 'pending' || r.lease?.holderId !== holderId)
+                return;
+            delete r.lease;
+            const now = this.store.now();
+            if (admitted) {
+                r.state = 'admitted';
+                r.admittedAt = now;
+                delete r.lastError;
+                if (relayDid)
+                    r.relayDid = relayDid;
+                const m = r.kind === 'task' && this.store.read('messages', r.messageId);
+                if (m && r.envelopeId === m.messageId && m.status === 'queued')
+                    this.store.write('messages', m.messageId, { ...m, status: 'relayed', updatedAt: now });
+            }
+            else if (now >= r.deliveryDeadline || !isTransientRelayError(error)) {
+                if (error instanceof Error && now < r.deliveryDeadline)
+                    this.terminalErrors.set(id, error);
+                const code = now >= r.deliveryDeadline ? 'OUTBOX_DEADLINE_EXPIRED' : errorCode(error);
+                if (r.kind === 'delivery-status')
+                    this.store.write('outbox', id, { ...r, state: 'closed', lastError: code });
+                else
+                    this.closeLocked(r.messageId, code, now >= r.deliveryDeadline ? 'deadline' : 'local');
+                return;
+            }
+            else {
+                r.lastError = errorCode(error);
+                const detail = error;
+                const hint = error instanceof Error && error.name === 'RelayAdmissionError' && detail.status === 429 &&
+                    detail.code === 'RELAY_RETRY_LATER' && Number.isSafeInteger(detail.retryAfterMs) &&
+                    detail.retryAfterMs > 0 && detail.retryAfterMs <= 3_600_000 ? detail.retryAfterMs : 0;
+                r.nextAttemptAt = Math.min(r.deliveryDeadline, now + Math.max(outboxRetryDelay(r.attemptCount), hint));
+            }
+            // Admission and retry scheduling may be replayed after interruption; enqueue remains published.
+            this.store.write('outbox', id, r);
+        });
+        if (signal.aborted)
+            signal.throwIfAborted();
+    }
+    closeLocked(messageId, code, closedBy) {
+        const now = this.store.now();
+        for (const summary of this.store.pending(messageId))
+            if (summary.kind === 'task') {
+                const r = this.store.read('outbox', summary.envelopeId);
+                const next = { ...r, state: 'closed', lastError: code };
+                delete next.lease;
+                this.store.write('outbox', r.envelopeId, next);
+            }
+        const m = this.store.read('messages', messageId);
+        if (m && ['queued', 'relayed'].includes(m.status))
+            this.store.write('messages', messageId, { ...m, status: 'closed', closedBy, lastError: code, updatedAt: now });
+    }
+    closeMessage(messageId, code = 'CANCELLED') {
+        this.store.transaction(() => this.closeLocked(messageId, code, code === 'OUTBOX_DEADLINE_EXPIRED' ? 'deadline' : 'local'));
+    }
+    markPeerObserved(messageId, observation) {
+        const change = () => {
+            const m = this.store.read('messages', messageId);
+            requireDelivery(observation.envelopeId === messageId);
+            const r = this.store.read('outbox', messageId);
+            if (r?.state === 'pending') {
+                const next = { ...r, state: 'admitted', admittedAt: this.store.now() };
+                delete next.lease;
+                this.store.write('outbox', r.envelopeId, next);
+            }
+            if (m && (['queued', 'relayed'].includes(m.status) || observation.status === 'replied'))
+                this.store.write('messages', messageId, { ...m, status: observation.status, updatedAt: this.store.now(),
+                    ...(observation.replyEnvelopeId ? { replyEnvelopeId: observation.replyEnvelopeId } : {}) });
+        };
+        if (observation.replyEnvelopeId)
+            this.store.preparedTransaction(change);
+        else
+            this.store.transaction(change);
+    }
+}
+export const GatewayDeliveryService = GatewayDeliveryServiceImplementation;
+//# sourceMappingURL=outbox.js.map