waterplane 0.0.1 → 0.1.6

package/node_modules/@waterplane/shared/dist/queue/queuelane.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The facts about a session that decide whether a `holdUntilIdle` entry may go
+ * out. Primitives rather than a `SessionInfo` so this module stays node-runnable
+ * and DOM-free — the caller maps its own state onto it.
+ */
+export interface LaneSessionState {
+    /** A turn is in flight (exact on a hooked session, a silence guess otherwise). */
+    turnActive?: boolean;
+    /** The session is parked on a usage limit and is waiting for the reset. */
+    limitBlocked?: boolean;
+    /** Kind of the choice prompt on screen, if `prompt.ts` parsed one. */
+    promptKind?: string | null;
+    /** A dialog is up that could NOT be parsed into options. */
+    awaitingInput?: boolean;
+}
+/**
+ * Is this session unable to take a parked send right now?
+ *
+ * "Hold until idle" means "deliver it when the agent can actually run it", and
+ * `turnActive` alone does not answer that. Three states are quiet AND unable to
+ * take a prompt, and each one breaks differently:
+ *
+ *   • parked on a question — prose typed at an open dialog goes INTO the dialog.
+ *     It neither runs nor answers; the same trap `answerInsertAt` exists for.
+ *     On a hooked session the turn stays active while the box is up, so the hold
+ *     already worked; on a NON-hooked one `turnActive` is the silence guess, and
+ *     a session waiting for an answer is perfectly silent — so exactly the
+ *     sessions with no hook pipe were the ones that got a prompt typed into a
+ *     dialog.
+ *   • an unparsable dialog (`awaitingInput`) — same thing, minus the options.
+ *   • blocked on a usage limit — the session is waiting out a reset, and a
+ *     prompt delivered into it is typed at a menu.
+ *
+ * This is the client-side twin of the host's `sessions.autoFireBlocker()`, which
+ * gates backlog auto-fire on the same three facts. The backlog has refused to
+ * fire into all three since it was written; the send queue's own park did not,
+ * which made "queue for this session" and "hold until idle" — the same intent,
+ * expressed two ways — behave differently.
+ *
+ * A session that has ENDED is deliberately not busy: parking an entry against a
+ * dead session would hold it (and its lane) forever, when the right outcome is
+ * to attempt it, get `ok:false`, and tell the user.
+ */
+export declare function laneBusy(s: LaneSessionState): boolean;
+/**
+ * WHICH of the three walls a session is behind, or null when it is ready.
+ *
+ * `laneBusy` collapses this to a boolean, which is all a lane needs; every
+ * other caller wants the reason, and each of them used to re-derive it from the
+ * same four fields in its own order with its own words. There were four copies
+ * — this one, `intent.ts`'s `sessionBlocker`, the host's `autoFireBlocker` and
+ * the phone's `holdWall` — each carrying a comment saying the others existed.
+ * A fifth session state would have had to be added in four places, two of which
+ * fail silent.
+ *
+ * The ORDER is the load-bearing part and is `intent.ts`'s: a limited session is
+ * reported as limited even when a box happens to be on screen, because the
+ * reset is the thing the user is actually waiting for. `laneBusy` is unaffected
+ * by the order — it only asks whether the answer is null.
+ *
+ * The names are `BlockReason` values on purpose, so a caller can hand one
+ * straight to `intentReasonText` rather than writing a fourth set of sentences.
+ */
+export type SessionWall = "limit" | "awaitingAnswer" | "sessionBusy";
+export declare function sessionWall(s: LaneSessionState): SessionWall | null;

package/node_modules/@waterplane/shared/dist/queue/queuelane.js

@@ -0,0 +1,45 @@
+// Cut from queue.ts (move only): lane state and walls
+// The one door stays `./queue.js`; this slice imports its siblings directly, never the barrel.
+/**
+ * Is this session unable to take a parked send right now?
+ *
+ * "Hold until idle" means "deliver it when the agent can actually run it", and
+ * `turnActive` alone does not answer that. Three states are quiet AND unable to
+ * take a prompt, and each one breaks differently:
+ *
+ *   • parked on a question — prose typed at an open dialog goes INTO the dialog.
+ *     It neither runs nor answers; the same trap `answerInsertAt` exists for.
+ *     On a hooked session the turn stays active while the box is up, so the hold
+ *     already worked; on a NON-hooked one `turnActive` is the silence guess, and
+ *     a session waiting for an answer is perfectly silent — so exactly the
+ *     sessions with no hook pipe were the ones that got a prompt typed into a
+ *     dialog.
+ *   • an unparsable dialog (`awaitingInput`) — same thing, minus the options.
+ *   • blocked on a usage limit — the session is waiting out a reset, and a
+ *     prompt delivered into it is typed at a menu.
+ *
+ * This is the client-side twin of the host's `sessions.autoFireBlocker()`, which
+ * gates backlog auto-fire on the same three facts. The backlog has refused to
+ * fire into all three since it was written; the send queue's own park did not,
+ * which made "queue for this session" and "hold until idle" — the same intent,
+ * expressed two ways — behave differently.
+ *
+ * A session that has ENDED is deliberately not busy: parking an entry against a
+ * dead session would hold it (and its lane) forever, when the right outcome is
+ * to attempt it, get `ok:false`, and tell the user.
+ */
+export function laneBusy(s) {
+    return sessionWall(s) !== null;
+}
+export function sessionWall(s) {
+    if (s.limitBlocked)
+        return "limit";
+    // An unparsable dialog is the same trap as a parsed one, minus the options.
+    // A trust prompt is not a question in this sense — delivery auto-accepts it.
+    if (s.awaitingInput || (s.promptKind && s.promptKind !== "trust"))
+        return "awaitingAnswer";
+    if (s.turnActive)
+        return "sessionBusy";
+    return null;
+}
+//# sourceMappingURL=queuelane.js.map

package/node_modules/@waterplane/shared/dist/queue/queuelane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queuelane.js","sourceRoot":"","sources":["../../src/queue/queuelane.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,+FAA+F;AAkB/F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAmB;IAC1C,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AACjC,CAAC;AAuBD,MAAM,UAAU,WAAW,CAAC,CAAmB;IAC7C,IAAI,CAAC,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC;IACnC,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC3F,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,aAAa,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@waterplane/shared/dist/queue/queueplan.d.ts

@@ -0,0 +1,180 @@
+import type { SendQueueEntry } from "./queueentry.js";
+export interface SelectSendableOpts {
+    now: number;
+    /** ackIds already written to the socket and awaiting a receipt. */
+    inflight?: Iterable<string>;
+    /** Give up after this many delivery attempts. */
+    maxAttempts: number;
+    /**
+     * …but never before the entry has been trying for this long (`MIN_TRY_MS`).
+     * A floor, not a deadline: it can only KEEP an entry in the queue, never
+     * remove one. Omitted (or 0) leaves the attempts cap standing alone, which is
+     * what the pure-count tests pin.
+     */
+    minTryMs?: number;
+    /**
+     * Lane keys whose session is mid-turn right now (the caller derives it from
+     * whatever "working" signal it has — `SessionInfo.turnActive`). Only
+     * `holdUntilIdle` entries care; everything else sends into a busy session
+     * exactly as before, because typing while the agent works is normal.
+     *
+     * Data in, data out: no SessionInfo is imported here, so `shared/dist` stays
+     * node-runnable and the rules stay testable without a host.
+     */
+    busyLanes?: Iterable<string>;
+    /**
+     * Serialization groups whose previous member is still RUNNING — the answer to
+     * "has the session the last queued open started actually finished?".
+     *
+     * Deliberately not derived here: it is a fact about live sessions, and this
+     * module stays DOM-free and SessionInfo-free so `shared/dist` runs under node.
+     * `busySerialGroups()` below computes it from primitives; the caller feeds the
+     * result back in.
+     */
+    busySerial?: Iterable<string>;
+    /**
+     * The USAGE BUDGET says no: the account is past the ceiling the user set, and
+     * automatic work is paused until the window resets (`shared/budget.ts`).
+     *
+     * A boolean, not the verdict, for the same reason `busySerial` is a set of
+     * strings — this module decides what may go on the wire and knows nothing
+     * about percentages. The caller asks the rule and feeds the answer in.
+     *
+     * Three kinds of entry are exempt, and each exemption is the point of the
+     * budget rather than a hole in it:
+     *
+     *   • `armed` — an explicit "send this now". The budget stops work nobody is
+     *     watching; a person holding the phone deciding to spend the last 8% is
+     *     precisely who the reserve was kept for.
+     *   • an ANSWER — it does not start a turn, it unblocks one that is already
+     *     parked on a question, and it is worthless once that box is gone.
+     *   • an UPLOAD — bytes cost no tokens, and the files arriving during the
+     *     pause is what lets the work start the moment the window resets.
+     */
+    budgetBlocked?: boolean;
+    /**
+     * Lanes (session ids) whose OWN budget is spent (`sessionBudgetHeld`). Held
+     * with the account budget's three exemptions, for the same reasons: an
+     * armed send, an answer and an upload still go.
+     */
+    budgetHeldLanes?: ReadonlySet<string>;
+    /**
+     * Lane keys whose SESSION IS GONE — it exited, or it is simply not in the
+     * host's session list any more. Read for `input` entries only; see the branch
+     * in `selectSendable` for why the other three modes are exempt.
+     *
+     * Computed by the caller for the same reason `busyLanes` and `busySerial` are:
+     * it is a fact about live sessions, and this module stays SessionInfo-free so
+     * `shared/dist` runs under node. The caller must only fill it from a session
+     * list it can trust (one that landed on the CURRENT connection) — an empty
+     * set is the safe answer, and is what an offline client passes.
+     *
+     * **Only entries with no `cwd` are held.** The rule used to hold every one of
+     * them, because the host's only answer for a dead session was `ok:false,
+     * reason:"session not available"` — not retryable — so a lane of five queued
+     * prompts became five red rows and five toasts, one fact told five times.
+     * That is no longer the host's only answer: given a `cwd` it writes the words
+     * to that repo's work items itself and replies `rescued` (`main.ts`'s
+     * `deliverInput`), which is durable, happens with nobody watching, and is the
+     * same destination the client's own rescue was aiming at.
+     *
+     * So holding a rescuable entry here is now strictly harmful: it stops the
+     * message reaching the one thing that can save it. What is left is the case
+     * the host genuinely cannot answer — no `cwd`, so there is no work list to
+     * add to and no repo to name — and for that the original argument stands
+     * unchanged.
+     */
+    goneLanes?: Iterable<string>;
+}
+/**
+ * Why a queued entry did NOT go out on this pass.
+ *
+ * A code rather than a sentence, so `e2e-queue.mjs` pins the DECISION and the
+ * UI owns the wording (`blockedReasonText`).
+ */
+export type SendBlockReason = 
+/** Already on the wire; its receipt hasn't landed yet. */
+"inflight"
+/** Chained behind a `session.create` — its session does not exist yet. */
+ | "pendingCreate"
+/** `holdUntilIdle`, and that lane's agent is mid-turn / parked on a dialog. */
+ | "held"
+/** Serialized (`serial`), and the previous member of its group is still working. */
+ | "serial"
+/** Backing off after a failed attempt (`retryAt`). */
+ | "backoff"
+/** Another entry for the same session is going out first. */
+ | "lane"
+/** Past the usage budget — automatic work is paused until the window resets. */
+ | "budget"
+/** This session's own budget is spent — its sends wait for it to be raised. */
+ | "sessionBudget"
+/** The session this lane names no longer exists. Terminal: nothing but a
+ *  re-aim (or a rewrite) will ever get this delivered. */
+ | "sessionGone"
+/** The user's own switches (auto-send off / reconnect hold). Not decided here
+ *  — `sendEligible` answers it, and the caller appends these. */
+ | "gate";
+export interface BlockedEntry {
+    ackId: string;
+    sessionId: string;
+    reason: SendBlockReason;
+}
+export interface SendPlan<T> {
+    /** Entries to write now — at most one per session, in queue order. */
+    send: T[];
+    /**
+     * Every queued entry this pass refused to send, with the ladder branch that
+     * refused it — in queue order.
+     *
+     * This exists because `flushOutbox()` returning 0 was being read as "the link
+     * is down". It is not: six different things below leave a queued entry where
+     * it is with the socket wide open, and the phone reported every one of them as
+     * "still offline — staying queued" over a header chip that said `open`. Two
+     * flatly contradictory statements about the same instant, and the one the user
+     * can act on ("the agent is mid-turn", "it is waiting for its session to
+     * open") was the one thrown away.
+     *
+     * Same rule the backlog's `waiting()` and `pulls.whyIdle()` follow: the reason
+     * is emitted BY the ladder that decided, never re-derived by a second reading
+     * of the state — a parallel explanation drifts from the behaviour it explains,
+     * which is worse than silence.
+     */
+    blocked: BlockedEntry[];
+    /**
+     * Entries that ran out of ATTEMPTS — and, with `minTryMs` set, only once they
+     * have also been trying for that long.
+     *
+     * This is the END OF A ROUND, not a death sentence. Nothing here was refused
+     * by the host (a refusal is answered on the wire and failed by the caller the
+     * moment it lands); what is here is a delivery nobody ever answered, so the
+     * caller parks it on a long backoff (`roundDelay`) and it tries the ladder
+     * again. Only the caller decides whether a round boundary is ever shown to a
+     * person as a failure.
+     *
+     * There is no AGE clock in this list — nothing here is about how long the
+     * words have waited. `maxAttempts` bounds a delivery the host keeps refusing,
+     * which is a fact about the request; an attempt made with no socket open is
+     * rolled back by the caller, so riding out a week-long outage still costs
+     * nothing.
+     */
+    expire: {
+        ackId: string;
+        reason: string;
+    }[];
+    /**
+     * `holdUntilIdle` entries whose lane JUST went quiet — the park is over. The
+     * caller persists `applyRelease()` over its store, which drops the flag so
+     * the next pass does not re-report the same release for ever.
+     */
+    release: T[];
+}
+/**
+ * Decide what may go on the wire right now.
+ *
+ * Nothing here expires. An entry that cannot go out stays queued and is
+ * REPORTED (`blocked`) — the row is the honest place for "this has not reached
+ * the desktop", and it costs nothing to keep. The only list that removes an
+ * entry is `expire`, and it is spent solely on `maxAttempts`.
+ */
+export declare function selectSendable<T extends SendQueueEntry>(entries: readonly T[], opts: SelectSendableOpts): SendPlan<T>;

package/node_modules/@waterplane/shared/dist/queue/queueplan.js

@@ -0,0 +1,169 @@
+// Cut from queue.ts (move only): selectSendable and its plan types
+// The one door stays `./queue.js`; this slice imports its siblings directly, never the barrel.
+/**
+ * Decide what may go on the wire right now.
+ *
+ * Nothing here expires. An entry that cannot go out stays queued and is
+ * REPORTED (`blocked`) — the row is the honest place for "this has not reached
+ * the desktop", and it costs nothing to keep. The only list that removes an
+ * entry is `expire`, and it is spent solely on `maxAttempts`.
+ */
+export function selectSendable(entries, opts) {
+    const inflight = new Set(opts.inflight ?? []);
+    const working = new Set(opts.busyLanes ?? []);
+    const serialBusy = new Set(opts.busySerial ?? []);
+    const gone = new Set(opts.goneLanes ?? []);
+    const send = [];
+    const release = [];
+    const expire = [];
+    const blocked = [];
+    const block = (e, reason) => { blocked.push({ ackId: e.ackId, sessionId: e.sessionId, reason }); };
+    // Lanes held by an entry that is already on the wire (a `pending` one whose
+    // receipt hasn't landed, or one this pass has just picked).
+    const busy = new Set();
+    for (const e of entries) {
+        if (e.status === "pending" || inflight.has(e.ackId)) {
+            busy.add(e.sessionId);
+            // …and it holds its serial GROUP too. A create is on the wire for as long
+            // as it takes the host to spawn a CLI and type into it; the session it
+            // makes does not exist (let alone report a turn) until the ack lands, so
+            // without this the very next pass would see a quiet repo and fire the
+            // second open into it. The caller's `busySerial` covers the window AFTER
+            // the ack; this covers the window before it.
+            if (e.serial)
+                serialBusy.add(e.serial);
+        }
+    }
+    for (const e of entries) {
+        if (e.status !== "queued")
+            continue;
+        if (inflight.has(e.ackId)) {
+            block(e, "inflight");
+            continue;
+        } // already out; its lane is marked busy
+        // Parked until the agent finishes this turn. Two consequences while it
+        // waits, both deliberate: the entry HOLDS its lane (anything queued behind
+        // it is meant to arrive after it, not overtake it), and it is exempt from
+        // the TTL and the attempts cap — waiting for hours is the whole point of the
+        // flag, and expiring a deliberate park would silently drop it.
+        // Waiting for a session that hasn't been created yet. Never sendable, and
+        // it HOLDS the lane so the create ahead of it stays first and anything
+        // behind it stays behind. Checked before the park branch on purpose: the
+        // lane key is not a session, so `working` can never contain it, and the
+        // release path would strip the `holdUntilIdle` flag these entries need for
+        // AFTER they are bound.
+        if (e.pendingCreate) {
+            busy.add(e.sessionId);
+            block(e, "pendingCreate");
+            continue;
+        }
+        // The session this lane names is gone, so this entry will never be typed
+        // into it. Nothing goes out; the row is where the answer lives (re-aim it,
+        // rewrite it, drop it) — see `goneLanes`.
+        //
+        // `input` ONLY, and the exclusions are not tidiness:
+        //   • a `backlog` item is added to the REPO, and the host resolves a dead
+        //     `targetSessionId` by falling back to that repo's default session
+        //     (`resolveTarget`) — holding it here would stop an item that would have
+        //     been accepted, which is a worse bug than the one this fixes;
+        //   • an `upload` is an HTTP POST to the repo inbox and never touches the
+        //     session at all;
+        //   • an `op` lane is `create:<cwd>` / `fanout` / `build:<id>`, never a
+        //     session id.
+        // And for the same reason the lane is NOT marked busy: those modes may still
+        // drain past a stranded prompt. Nothing sendable is left behind it — every
+        // `input` entry in the lane hits this branch too.
+        //
+        // AND ONLY WITH NO `cwd`. With one, this entry is precisely what the host's
+        // own rescue is for: it is sent, the host finds the session gone, writes the
+        // words to that repo's work items and answers `rescued`, and the row is
+        // dropped having become durable desktop-side. Holding it here instead is
+        // what kept that from ever happening — the rescue was unreachable for the
+        // queued-offline case it was written for, leaving only the client's own
+        // 45-second grace, which needed a foregrounded tab to tick at all.
+        if ((e.mode ?? "input") === "input" && gone.has(e.sessionId) && !e.cwd) {
+            block(e, "sessionGone");
+            continue;
+        }
+        if (e.holdUntilIdle && working.has(e.sessionId)) {
+            busy.add(e.sessionId);
+            block(e, "held");
+            continue;
+        }
+        // The two holds that are not about this entry's position in the queue: the
+        // ACCOUNT is past the usage ceiling, and this repo already has a serialized
+        // send working in it. Both used to be split in two — parked here with the
+        // TTL clock stamped forward when never attempted, checked below the clock
+        // once the entry had been on the wire — because a wait that legitimately
+        // lasts an hour would otherwise expire the whole tail of a queued plan.
+        // With no clock there is nothing to split: they are read once, below the
+        // attempts check, and the entry simply waits.
+        const budgetHeld = !!opts.budgetBlocked && !e.armed && !e.answer && e.mode !== "upload";
+        const laneBudgetHeld = !!opts.budgetHeldLanes?.has(e.sessionId) && !e.armed && !e.answer && e.mode !== "upload";
+        const serialHeld = !!e.serial && serialBusy.has(e.serial);
+        // Backing off after a failed attempt (see `retryAt`). It holds its lane
+        // while it waits, for the same reason a `pending` entry does: what is behind
+        // it was queued behind it.
+        if (e.retryAt != null && e.retryAt > opts.now) {
+            busy.add(e.sessionId);
+            block(e, "backoff");
+            continue;
+        }
+        // Out of attempts — but only out of TIME as well (`MIN_TRY_MS`). A count of
+        // eight can be spent in seconds by a radio dropping receipt windows, and
+        // "not delivered" said that fast is a verdict on the link dressed up as a
+        // verdict on the message. Under the floor the entry falls through and is
+        // attempted again; the backoff above still paces it.
+        const tryingFor = e.firstTryAt == null ? Infinity : opts.now - e.firstTryAt;
+        if ((e.attempts ?? 0) >= opts.maxAttempts && tryingFor >= (opts.minTryMs ?? 0)) {
+            expire.push({ ackId: e.ackId, reason: "delivery kept failing" });
+            continue;
+        }
+        // Past the usage ceiling the account is under, and one at a time in this
+        // repo. Both describe something OUTSIDE this entry, so they sit below the
+        // attempts check — an entry that has run out of attempts has run out of
+        // them whatever the account is doing.
+        if (budgetHeld) {
+            busy.add(e.sessionId);
+            block(e, "budget");
+            continue;
+        }
+        if (laneBudgetHeld) {
+            busy.add(e.sessionId);
+            block(e, "sessionBudget");
+            continue;
+        }
+        if (serialHeld) {
+            busy.add(e.sessionId);
+            block(e, "serial");
+            continue;
+        }
+        if (busy.has(e.sessionId)) {
+            block(e, "lane");
+            continue;
+        } // lane taken — this one waits its turn
+        busy.add(e.sessionId);
+        // One member of a group per pass, even across lanes: two opens picked in the
+        // same flush would start together, which is the entire thing this prevents.
+        if (e.serial)
+            serialBusy.add(e.serial);
+        // …and the park is OVER, because this pass is SENDING it into the quiet
+        // lane it was waiting for. Report it as released; the caller drops the flag
+        // (`applyRelease`) so the next pass sees an ordinary queued entry rather
+        // than releasing this one again for ever.
+        //
+        // Released HERE and not above the budget/serial/lane refusals, which is
+        // where it used to be: a pass that found the lane quiet and then refused
+        // the entry for the account being past its ceiling still dropped the flag,
+        // and when the ceiling lifted an hour later the entry was an ordinary send
+        // that could be typed into a RUNNING turn. That is the concatenation this
+        // flag exists to prevent, on the one job the client-side hold still owns —
+        // a chain queued behind a `session.create`, where step 2 must not be typed
+        // while step 1's turn is going.
+        if (e.holdUntilIdle)
+            release.push(e);
+        send.push(e);
+    }
+    return { send, expire, release, blocked };
+}
+//# sourceMappingURL=queueplan.js.map

package/node_modules/@waterplane/shared/dist/queue/queueplan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queueplan.js","sourceRoot":"","sources":["../../src/queue/queueplan.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,+FAA+F;AA+K/F;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,IAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAI,EAAE,MAAuB,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvH,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtB,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,6CAA6C;YAC7C,IAAI,CAAC,CAAC,MAAM;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,uCAAuC;QACtG,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,+DAA+D;QAC/D,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,wBAAwB;QACxB,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpF,yEAAyE;QACzE,2EAA2E;QAC3E,0CAA0C;QAC1C,EAAE;QACF,qDAAqD;QACrD,0EAA0E;QAC1E,uEAAuE;QACvE,6EAA6E;QAC7E,mEAAmE;QACnE,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,kBAAkB;QAClB,6EAA6E;QAC7E,2EAA2E;QAC3E,kDAAkD;QAClD,EAAE;QACF,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACvE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACvG,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;QACxF,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;QAChH,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1D,wEAAwE;QACxE,6EAA6E;QAC7E,2BAA2B;QAC3B,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtB,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,qDAAqD;QACrD,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC;QAC5E,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,IAAI,cAAc,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,uCAAuC;QAClG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtB,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,CAAC,MAAM;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,0CAA0C;QAC1C,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,gCAAgC;QAChC,IAAI,CAAC,CAAC,aAAa;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}

package/node_modules/@waterplane/shared/dist/queue/queueretarget.d.ts

@@ -0,0 +1,61 @@
+import type { SendStatus, SendMode, SendQueueEntry } from "./queueentry.js";
+/** Queue positions of one lane, in send order — what the manage-queue UI shows. */
+export declare function laneEntries<T extends SendQueueEntry>(entries: readonly T[], sessionId: string): T[];
+/**
+ * Move an entry one slot earlier/later WITHIN ITS OWN LANE, keeping the flat
+ * array consistent: the two entries swap positions outright, so a reorder can
+ * never reshuffle an unrelated session's queue.
+ */
+/** The extra fields a retarget rewrites; the client's entry carries more still. */
+export interface RetargetableEntry extends SendQueueEntry {
+    text?: string;
+    /** backlog mode only. */
+    label?: string;
+    fire?: boolean;
+    autoFire?: boolean;
+    targetSessionId?: string;
+    armed?: boolean;
+    offline?: boolean;
+}
+/** Can this entry be pointed at a different session? Only one that is still
+ *  purely local: a `pending` one may already be on a live PTY, and an `op`
+ *  carries its own subject (a fan-out's repo list, a build's id) — "send it
+ *  somewhere else" is meaningless for it. */
+export declare function canRetarget(e: {
+    status: SendStatus;
+    mode?: SendMode;
+    answer?: unknown;
+}): boolean;
+/**
+ * Point one queued entry at a different session/repo — the fix for "I typed
+ * this while offline and by the time the link was back, the session it was for
+ * had moved on (or died)".
+ *
+ * Everything it touches is there for a reason:
+ *   • the lane key (`sessionId`) and `cwd` are the retarget itself;
+ *   • `mode` may flip: sending text to a live session (`input`) and parking it
+ *     as a repo work item (`backlog`) are the same words with a different
+ *     destination, so the backlog-only fields are filled in / dropped to match;
+ *   • `attempts` resets — the failures were against the OLD target and must not
+ *     count against the new one — and `firstTryAt` goes with it, being the
+ *     old ackId's first send (`firstSentAt` on the wire);
+ *   • the ackId is MINTED FRESH (passed in, since this module is DOM-free and
+ *     has no randomness of its own). The old id may already hold a verdict in
+ *     the host's ledger for the old target — reusing it would have the host
+ *     re-ack that stale outcome and never deliver anywhere.
+ *
+ * `ts` is deliberately NOT reset: it says when these words were written, and
+ * re-aiming them does not make them newer. `armed`/`offline` carry over — the
+ * user's intent to send it, and where it came from, are unchanged.
+ *
+ * A refused entry (see `canRetarget`) is left exactly as it was; every other
+ * lane comes back untouched.
+ */
+export declare function retargetEntry<T extends RetargetableEntry>(entries: readonly T[], ackId: string, to: {
+    sessionId: string;
+    cwd: string;
+    ackId: string;
+    mode?: "input" | "backlog";
+    targetSessionId?: string;
+}): T[];
+export declare function moveInLane<T extends SendQueueEntry>(entries: readonly T[], ackId: string, dir: -1 | 1): T[];

package/node_modules/@waterplane/shared/dist/queue/queueretarget.js

@@ -0,0 +1,94 @@
+// Cut from queue.ts (move only): lane order and retargeting
+// The one door stays `./queue.js`; this slice imports its siblings directly, never the barrel.
+/** Queue positions of one lane, in send order — what the manage-queue UI shows. */
+export function laneEntries(entries, sessionId) {
+    return entries.filter((e) => e.sessionId === sessionId);
+}
+/** Can this entry be pointed at a different session? Only one that is still
+ *  purely local: a `pending` one may already be on a live PTY, and an `op`
+ *  carries its own subject (a fan-out's repo list, a build's id) — "send it
+ *  somewhere else" is meaningless for it. */
+export function canRetarget(e) {
+    // `upload` is as un-retargetable as an op: it names a repo inbox, and the
+    // queued prompt that references the path it will land at is a different entry.
+    // An ANSWER is the strongest case of all: its payload is a keystroke that
+    // means something only in one specific question box, in one specific session
+    // (it carries that box's fingerprint, and the host refuses it anywhere else).
+    // Pointing it at another session could only ever produce a stray digit.
+    return e.status === "queued" && e.mode !== "op" && e.mode !== "upload" && !e.answer;
+}
+/**
+ * Point one queued entry at a different session/repo — the fix for "I typed
+ * this while offline and by the time the link was back, the session it was for
+ * had moved on (or died)".
+ *
+ * Everything it touches is there for a reason:
+ *   • the lane key (`sessionId`) and `cwd` are the retarget itself;
+ *   • `mode` may flip: sending text to a live session (`input`) and parking it
+ *     as a repo work item (`backlog`) are the same words with a different
+ *     destination, so the backlog-only fields are filled in / dropped to match;
+ *   • `attempts` resets — the failures were against the OLD target and must not
+ *     count against the new one — and `firstTryAt` goes with it, being the
+ *     old ackId's first send (`firstSentAt` on the wire);
+ *   • the ackId is MINTED FRESH (passed in, since this module is DOM-free and
+ *     has no randomness of its own). The old id may already hold a verdict in
+ *     the host's ledger for the old target — reusing it would have the host
+ *     re-ack that stale outcome and never deliver anywhere.
+ *
+ * `ts` is deliberately NOT reset: it says when these words were written, and
+ * re-aiming them does not make them newer. `armed`/`offline` carry over — the
+ * user's intent to send it, and where it came from, are unchanged.
+ *
+ * A refused entry (see `canRetarget`) is left exactly as it was; every other
+ * lane comes back untouched.
+ */
+export function retargetEntry(entries, ackId, to) {
+    return entries.map((e) => {
+        if (e.ackId !== ackId || !canRetarget(e))
+            return e;
+        const mode = to.mode ?? (e.mode === "backlog" ? "backlog" : "input");
+        const next = { ...e, ackId: to.ackId, sessionId: to.sessionId, cwd: to.cwd, mode, attempts: 0 };
+        // `firstTryAt` belongs to the OLD ackId: it is what the wire's
+        // `firstSentAt` is read from (`sendstamp.ts`), and a fresh id carrying an
+        // old first-send would be refused as a pre-loss re-send by a desktop that
+        // lost its ledger. The new id gets its own on its first attempt — and the
+        // give-up floor restarts with `attempts`, which is the same argument.
+        delete next.firstTryAt;
+        if (mode === "backlog") {
+            next.label = (e.text ?? "").slice(0, 40);
+            // A target inherited from the old lane would send the item straight back
+            // where it came from; only an explicitly named one survives.
+            if (to.targetSessionId)
+                next.targetSessionId = to.targetSessionId;
+            else
+                delete next.targetSessionId;
+        }
+        else {
+            delete next.label;
+            delete next.fire;
+            delete next.autoFire;
+            delete next.targetSessionId;
+        }
+        return next;
+    });
+}
+export function moveInLane(entries, ackId, dir) {
+    const idx = entries.findIndex((e) => e.ackId === ackId);
+    if (idx < 0)
+        return entries.slice();
+    const me = entries[idx];
+    let other = -1;
+    for (let i = idx + dir; i >= 0 && i < entries.length; i += dir) {
+        if (entries[i].sessionId === me.sessionId) {
+            other = i;
+            break;
+        }
+    }
+    if (other < 0)
+        return entries.slice();
+    const out = entries.slice();
+    out[idx] = out[other];
+    out[other] = me;
+    return out;
+}
+//# sourceMappingURL=queueretarget.js.map

package/node_modules/@waterplane/shared/dist/queue/queueretarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queueretarget.js","sourceRoot":"","sources":["../../src/queue/queueretarget.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,+FAA+F;AAI/F,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAA2B,OAAqB,EAAE,SAAiB;IAC5F,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AAC1D,CAAC;AAmBD;;;6CAG6C;AAC7C,MAAM,UAAU,WAAW,CAAC,CAA4D;IACtF,0EAA0E;IAC1E,+EAA+E;IAC/E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAqB,EACrB,KAAa,EACb,EAA2G;IAE3G,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAa,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACnG,+DAA+D;QAC/D,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,IAAI,CAAC,UAAU,CAAC;QACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,yEAAyE;YACzE,6DAA6D;YAC7D,IAAI,EAAE,CAAC,eAAe;gBAAE,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC,eAAe,CAAC;;gBAC7D,OAAO,IAAI,CAAC,eAAe,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,KAAK,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,CAAC;YACjB,OAAO,IAAI,CAAC,QAAQ,CAAC;YACrB,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAA2B,OAAqB,EAAE,KAAa,EAAE,GAAW;IACpG,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACxD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;YAAC,KAAK,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC"}