@aiwg/cli 2026.9.20 → 2026.9.24

package/dist/src/decision/job-store.js

@@ -0,0 +1,264 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { access, link, lstat, mkdir, open, readFile, readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { canonicalJson } from '../security/artifact-trust.js';
+import { assertJobTransition, validateDecisionJob } from './job-contract.js';
+export class JobConflictError extends Error {
+}
+function key(scope, id) { return canonicalJson({ scope, id }); }
+function validateFirst(job) {
+    validateDecisionJob(job);
+    if (job.state !== 'validating' || job.items.some(item => item.state !== 'queued' || item.attempts.length))
+        throw new JobConflictError('Initial job must be undispatched');
+}
+/** Collapse only identical, undispatched caller item IDs; never merge mismatched pins. */
+export function canonicalizeInitialJob(job) {
+    if (!Array.isArray(job?.items)) {
+        validateFirst(job);
+        return job;
+    }
+    const unique = new Map();
+    for (const item of job.items) {
+        const previous = unique.get(item?.id);
+        if (previous && canonicalJson(previous) !== canonicalJson(item))
+            throw new JobConflictError('Duplicate item ID belongs to different request');
+        if (!previous)
+            unique.set(item?.id, item);
+    }
+    if (unique.size === job.items.length) {
+        validateFirst(job);
+        return job;
+    }
+    if (job.state !== 'validating' || !job.summary || job.summary.queued !== job.items.length ||
+        Object.entries(job.summary).some(([state, count]) => state !== 'queued' && count !== 0))
+        throw new JobConflictError('Duplicate item summary mismatch');
+    const normalized = structuredClone(job);
+    normalized.items = [...unique.values()].map(item => structuredClone(item));
+    normalized.summary.queued = normalized.items.length;
+    validateFirst(normalized);
+    return normalized;
+}
+function assertIdentity(initial, existing) {
+    if (initial.fingerprint !== existing.fingerprint ||
+        canonicalJson(initial.items.map(({ id, fingerprint, subjectDigest, definitionDigest, bindingDigest, rulesetDigest }) => ({ id, fingerprint, subjectDigest, definitionDigest, bindingDigest,
+            ...(rulesetDigest ? { rulesetDigest } : {}) }))) !==
+            canonicalJson(existing.items.map(({ id, fingerprint, subjectDigest, definitionDigest, bindingDigest, rulesetDigest }) => ({ id, fingerprint, subjectDigest, definitionDigest, bindingDigest,
+                ...(rulesetDigest ? { rulesetDigest } : {}) }))) ||
+        canonicalJson(initial.budget) !== canonicalJson(existing.budget) ||
+        initial.createdAtEpochMs !== existing.createdAtEpochMs || initial.expiresAtEpochMs !== existing.expiresAtEpochMs)
+        throw new JobConflictError('Job ID belongs to a different immutable request');
+}
+function validateNext(previous, next) {
+    if (previous.deleted || next.revision !== previous.revision + 1 || (next.legalHold !== undefined && typeof next.legalHold !== 'boolean') ||
+        (next.deleted && (previous.legalHold || next.legalHold || next.job.state !== previous.job.state)))
+        throw new JobConflictError('Invalid job revision or tombstone');
+    if (Boolean(previous.legalHold) !== Boolean(next.legalHold)) {
+        if (next.deleted || canonicalJson(previous.job) !== canonicalJson(next.job))
+            throw new JobConflictError('Legal hold cannot change during job transition');
+    }
+    else if (next.deleted) {
+        if (canonicalJson(previous.job) !== canonicalJson(next.job))
+            throw new JobConflictError('Tombstone changed job');
+    }
+    else
+        assertJobTransition(previous.job, next.job);
+}
+const copy = (value) => structuredClone(value);
+export class MemoryJobStore {
+    records = new Map();
+    async acquire(job) {
+        job = canonicalizeInitialJob(job);
+        const id = key(job.scope, job.id);
+        const existing = this.records.get(id);
+        if (existing) {
+            assertIdentity(job, existing.job);
+            return { owner: false, snapshot: copy(existing) };
+        }
+        const snapshot = { revision: 1, job: structuredClone(job), deleted: false, legalHold: false };
+        this.records.set(id, snapshot);
+        return { owner: true, snapshot: copy(snapshot) };
+    }
+    async read(scope, id) {
+        const record = this.records.get(key(scope, id));
+        return record ? copy(record) : null;
+    }
+    async compareAndSwap(previous, next) {
+        validateNext(previous, next);
+        const id = key(previous.job.scope, previous.job.id);
+        const current = this.records.get(id);
+        if (!current || canonicalJson(current) !== canonicalJson(previous))
+            return false;
+        this.records.set(id, copy(next));
+        return true;
+    }
+}
+/** Append-only, immutable revision journal. Link publication is atomic across processes on one local filesystem. */
+export class FileJobStore {
+    directory;
+    externallyDeleted;
+    constructor(directory, externallyDeleted) {
+        this.directory = directory;
+        this.externallyDeleted = externallyDeleted;
+    }
+    async acquire(job) {
+        job = canonicalizeInitialJob(job);
+        await this.ensureDirectory();
+        if (await this.isDeleted(job.scope, job.id))
+            throw new JobConflictError('Job tombstoned');
+        const snapshot = { revision: 1, job: structuredClone(job), deleted: false, legalHold: false };
+        if (await this.publish(snapshot))
+            return { owner: true, snapshot: copy(snapshot) };
+        const existing = await this.read(job.scope, job.id);
+        if (!existing)
+            throw new JobConflictError('Job revision unavailable');
+        assertIdentity(job, existing.job);
+        return { owner: false, snapshot: existing };
+    }
+    async read(scope, id) {
+        await this.ensureDirectory();
+        if (await this.isDeleted(scope, id))
+            return null;
+        const prefix = this.prefix(scope, id);
+        const revisions = (await readdir(this.directory)).flatMap(name => {
+            const match = name.match(new RegExp(`^${prefix}\\.r([0-9]+)\\.json$`));
+            return match ? [Number(match[1])] : [];
+        }).sort((a, b) => a - b);
+        let previous = null;
+        for (const [index, revision] of revisions.entries()) {
+            if (revision !== index + 1)
+                throw new JobConflictError('Job revision gap');
+            const snapshot = JSON.parse(await readFile(join(this.directory, `${prefix}.r${revision}.json`), 'utf8'));
+            if (snapshot.revision !== revision || key(snapshot.job.scope, snapshot.job.id) !== key(scope, id))
+                throw new JobConflictError('Job scope substitution');
+            if (previous)
+                validateNext(previous, snapshot);
+            else {
+                validateFirst(snapshot.job);
+                if (snapshot.deleted || snapshot.legalHold)
+                    throw new JobConflictError('Invalid initial snapshot');
+            }
+            previous = snapshot;
+        }
+        return previous ? copy(previous) : null;
+    }
+    async compareAndSwap(previous, next) {
+        validateNext(previous, next);
+        const current = await this.read(previous.job.scope, previous.job.id);
+        if (!current || canonicalJson(current) !== canonicalJson(previous))
+            return false;
+        return this.publish(next);
+    }
+    /** Host-only quota scan. Validate every live journal; corrupted records fail admission closed. */
+    async listSnapshots() {
+        await this.ensureDirectory();
+        const snapshots = [];
+        for (const name of await readdir(this.directory)) {
+            if (!/^[a-f0-9]{64}\.r1\.json$/.test(name))
+                continue;
+            const first = JSON.parse(await readFile(join(this.directory, name), 'utf8'));
+            if (name !== `${this.prefix(first.job.scope, first.job.id)}.r1.json`)
+                throw new JobConflictError('Job scope substitution');
+            const current = await this.read(first.job.scope, first.job.id);
+            if (current)
+                snapshots.push(current);
+        }
+        return snapshots;
+    }
+    /** Host-only D10 eraser: call after lifecycle tombstone and authorized job deletion. */
+    async purgeDeleted(scope, id) {
+        const record = await this.read(scope, id);
+        if (record && (!record.deleted || record.legalHold))
+            throw new JobConflictError('Job not eligible for erasure');
+        if (!record && !await this.hasMarker(scope, id) && !await this.externallyDeleted?.(scope, id))
+            throw new JobConflictError('Job tombstone required before erasure');
+        await this.ensureDirectory();
+        if (!await this.hasMarker(scope, id)) {
+            try {
+                const handle = await open(this.marker(scope, id), 'wx', 0o600);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+        }
+        const base = this.prefix(scope, id);
+        for (const name of await readdir(this.directory)) {
+            if ((name.startsWith(`${base}.r`) && /^r[1-9][0-9]*\.json$/.test(name.slice(base.length + 1))) ||
+                (name.startsWith(`.${base}.job-`) && /^job-[0-9a-f-]{36}\.tmp$/.test(name.slice(base.length + 2))))
+                await rm(join(this.directory, name));
+        }
+        const directory = await open(this.directory, 'r');
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+    async ensureDirectory() {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const info = await lstat(this.directory);
+        if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o077) !== 0)
+            throw new JobConflictError('Job storage root must be private');
+    }
+    marker(scope, id) { return join(this.directory, `${this.prefix(scope, id)}.deleted`); }
+    async isDeleted(scope, id) {
+        return await this.hasMarker(scope, id) || Boolean(await this.externallyDeleted?.(scope, id));
+    }
+    async hasMarker(scope, id) {
+        try {
+            await access(this.marker(scope, id));
+            return true;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+    }
+    prefix(scope, id) {
+        return createHash('sha256').update(key(scope, id)).digest('hex');
+    }
+    async publish(snapshot) {
+        await this.ensureDirectory();
+        const prefix = this.prefix(snapshot.job.scope, snapshot.job.id);
+        const destination = join(this.directory, `${prefix}.r${snapshot.revision}.json`);
+        const temporary = join(this.directory, `.${prefix}.job-${randomUUID()}.tmp`);
+        const handle = await open(temporary, 'wx', 0o600);
+        try {
+            await handle.writeFile(`${canonicalJson(snapshot)}\n`, 'utf8');
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        try {
+            if (await this.isDeleted(snapshot.job.scope, snapshot.job.id))
+                throw new JobConflictError('Job tombstoned');
+            await link(temporary, destination);
+            const directory = await open(this.directory, 'r');
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+            return true;
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                return false;
+            throw error;
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+}
+//# sourceMappingURL=job-store.js.map

package/dist/src/decision/job-worker.js

@@ -0,0 +1,141 @@
+import { randomUUID } from 'node:crypto';
+import { recount } from './job-runtime.js';
+import { JobConflictError } from './job-store.js';
+export class OfflineJobWorker {
+    runtime;
+    effects;
+    active = new Map();
+    constructor(runtime, effects) {
+        this.runtime = runtime;
+        this.effects = effects;
+    }
+    /** Persist a dispatch fence before invoking the fixture; ambiguous failures never replay. */
+    async run(actor, jobId, itemId, executor, reservation) {
+        const previous = await this.runtime.poll(actor, jobId);
+        if (!previous)
+            throw new JobConflictError('Job unavailable');
+        const item = previous.job.items.find(candidate => candidate.id === itemId);
+        if (!item || item.state !== 'queued' || !['queued', 'running', 'partially-completed'].includes(previous.job.state) ||
+            item.attempts.length >= previous.job.budget.maxAttempts ||
+            previous.job.items.filter(candidate => candidate.state === 'running').length >= previous.job.budget.maxConcurrency)
+            throw new JobConflictError('Item cannot be dispatched');
+        if (executor.requiresReservation && !reservation)
+            throw new JobConflictError('Provider work requires budget reservation');
+        if (reservation) {
+            if (!Number.isSafeInteger(reservation.tokens) || reservation.tokens < 0 ||
+                !Number.isSafeInteger(reservation.costMicros) || reservation.costMicros < 0)
+                throw new JobConflictError('Invalid job budget reservation');
+            const attempts = previous.job.items.flatMap(candidate => candidate.attempts);
+            const spentTokens = attempts.reduce((sum, attempt) => sum + (attempt.reservedTokens ?? 0), 0);
+            const spentCost = attempts.reduce((sum, attempt) => sum + (attempt.reservedCostMicros ?? 0), 0);
+            if (spentTokens + reservation.tokens > previous.job.budget.maxTokens ||
+                spentCost + reservation.costMicros > previous.job.budget.maxCostMicros)
+                throw new JobConflictError('Job budget reservation exceeded');
+        }
+        const next = structuredClone(previous.job);
+        const scheduled = next.items.find(candidate => candidate.id === itemId);
+        scheduled.state = 'running';
+        scheduled.attempts.push({ id: randomUUID(), requestDigest: item.fingerprint, outcome: 'dispatched',
+            ...(reservation ? { reservedTokens: reservation.tokens, reservedCostMicros: reservation.costMicros } : {}) });
+        next.state = previous.job.state === 'queued' ? 'running' : previous.job.state;
+        recount(next);
+        const key = `${JSON.stringify(actor)}:${jobId}:${itemId}:${scheduled.attempts.at(-1).id}`;
+        const controller = new AbortController();
+        this.active.set(key, controller);
+        // Register cancellation before publishing the fence; CAS losers never call the executor.
+        try {
+            await this.runtime.advance(actor, jobId, previous, next);
+        }
+        catch (error) {
+            this.active.delete(key);
+            throw error;
+        }
+        let outcome = null;
+        let onAbort;
+        try {
+            if (!controller.signal.aborted) {
+                const aborted = new Promise((_resolve, reject) => {
+                    onAbort = () => reject(new JobConflictError('Execution interrupted'));
+                    controller.signal.addEventListener('abort', onAbort, { once: true });
+                });
+                outcome = await Promise.race([executor(structuredClone(scheduled), controller.signal), aborted]);
+            }
+        }
+        catch { /* A thrown/aborted fixture may have executed; do not replay. */ }
+        finally {
+            if (onAbort)
+                controller.signal.removeEventListener('abort', onAbort);
+            this.active.delete(key);
+        }
+        const fenced = scheduled.attempts.at(-1);
+        if (this.effects && outcome && !controller.signal.aborted && validOutcome(outcome) && outcome.receiptDigest &&
+            ['succeeded', 'abstained', 'review'].includes(outcome.state)) {
+            try {
+                await this.effects.recordReceipt({ scope: structuredClone(previous.job.scope), jobId, itemId, attemptId: fenced.id,
+                    requestDigest: fenced.requestDigest, receiptDigest: outcome.receiptDigest });
+            }
+            catch { /* Recovery evidence only; the job record below stays authoritative. */ }
+        }
+        // Concurrent items may finish in the same tick. Retry only the local CAS, never the executor.
+        for (let retry = 0; retry < 5; retry++) {
+            const latest = await this.runtime.poll(actor, jobId);
+            if (!latest)
+                throw new JobConflictError('Job removed during execution');
+            const current = latest.job.items.find(candidate => candidate.id === itemId);
+            if (!current || current.state !== 'running' || current.attempts.at(-1)?.id !== scheduled.attempts.at(-1)?.id)
+                throw new JobConflictError('In-flight item changed during execution');
+            const updated = structuredClone(latest.job);
+            const target = updated.items.find(candidate => candidate.id === itemId);
+            const attempt = target.attempts.at(-1);
+            if (controller.signal.aborted || !outcome || !validOutcome(outcome)) {
+                target.state = 'execution-unknown';
+                attempt.outcome = 'execution-unknown';
+            }
+            else {
+                target.state = outcome.state;
+                attempt.outcome = ['succeeded', 'abstained', 'review'].includes(outcome.state) ? 'succeeded' : 'failed';
+                if (outcome.receiptDigest)
+                    attempt.receiptDigest = outcome.receiptDigest;
+                if (outcome.resultDigest)
+                    target.resultDigest = outcome.resultDigest;
+                if (outcome.errorCode)
+                    target.errorCode = outcome.errorCode;
+            }
+            recount(updated);
+            const outstanding = updated.summary.queued + updated.summary.running + updated.summary['retryable-failed'];
+            const unknown = updated.summary['execution-unknown'] > 0;
+            if (latest.job.state === 'cancel-requested') {
+                updated.state = unknown ? 'failed' : outstanding ? 'partially-completed' : 'canceled';
+            }
+            else
+                updated.state = outstanding ? 'partially-completed' : unknown ? 'failed' : 'completed';
+            try {
+                return await this.runtime.advance(actor, jobId, latest, updated);
+            }
+            catch (error) {
+                if (!(error instanceof JobConflictError) || error.message !== 'Concurrent job update')
+                    throw error;
+            }
+        }
+        throw new JobConflictError('Concurrent job updates exhausted');
+    }
+    async cancel(actor, jobId) {
+        const snapshot = await this.runtime.cancel(actor, jobId);
+        if (snapshot)
+            for (const [key, controller] of this.active) {
+                if (key.startsWith(`${JSON.stringify(actor)}:${jobId}:`))
+                    controller.abort();
+            }
+        return snapshot;
+    }
+}
+function validOutcome(outcome) {
+    if (!outcome || !['succeeded', 'abstained', 'review', 'unsupported', 'retryable-failed', 'permanent-failed'].includes(outcome.state))
+        return false;
+    const digest = (value) => typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value);
+    if (['succeeded', 'abstained', 'review'].includes(outcome.state))
+        return digest(outcome.receiptDigest) && digest(outcome.resultDigest) && outcome.errorCode === undefined;
+    return !outcome.resultDigest && !outcome.receiptDigest &&
+        (outcome.errorCode === undefined || /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(outcome.errorCode));
+}
+//# sourceMappingURL=job-worker.js.map

package/dist/src/decision/lifecycle.js

@@ -0,0 +1,148 @@
+/** Common host-side lifecycle contract. Never derive these controls from model state. */
+export const DECISION_LIFECYCLE_VERSION = 'decision-lifecycle/v1';
+export const DECISION_LIFECYCLE_SURFACES = [
+    'state', 'receipt', 'trace', 'debug-sidecar', 'cache', 'job', 'review',
+    'calibration', 'evaluation', 'export', 'preprocessing-lineage',
+];
+export function validateDecisionLifecyclePolicy(policy) {
+    if (policy?.version !== DECISION_LIFECYCLE_VERSION || !policy.surfaces
+        || Object.keys(policy.surfaces).length !== DECISION_LIFECYCLE_SURFACES.length
+        || Object.keys(policy.surfaces).some(surface => !DECISION_LIFECYCLE_SURFACES.includes(surface))) {
+        throw new Error('Decision lifecycle policy is incomplete');
+    }
+    for (const surface of DECISION_LIFECYCLE_SURFACES) {
+        const rule = policy.surfaces[surface];
+        if (!rule || !['public', 'internal', 'confidential', 'restricted'].includes(rule.classification)
+            || !Array.isArray(rule.accessScopes) || !rule.accessScopes.length
+            || rule.accessScopes.some(scope => typeof scope !== 'string' || !scope)
+            || !Number.isSafeInteger(rule.retentionMs) || rule.retentionMs <= 0
+            || !['denied', 'sanitized'].includes(rule.export) || !['erase', 'tombstone'].includes(rule.deletion)
+            || !['not-persisted', 'expire-with-primary'].includes(rule.backup)) {
+            throw new Error('Decision lifecycle rule is incomplete');
+        }
+    }
+}
+/** Hold requires an independent authorization decision and finite expiry. */
+export async function placeDecisionLifecycleHold(hold, authorize, store, now) {
+    if (!hold.subject || !hold.reason || !hold.authorizedBy || !hold.scope.length
+        || hold.scope.some(surface => !DECISION_LIFECYCLE_SURFACES.includes(surface))
+        || !Number.isSafeInteger(hold.expiresAt) || hold.expiresAt <= now)
+        throw new Error('Decision lifecycle hold denied');
+    let approved = false;
+    try {
+        approved = await authorize(hold);
+    }
+    catch { /* authorization fails closed */ }
+    if (!approved)
+        throw new Error('Decision lifecycle hold denied');
+    const stored = structuredClone(hold);
+    try {
+        await store.recordHold(stored);
+    }
+    catch {
+        throw new Error('Decision lifecycle hold recording failed');
+    }
+    return stored;
+}
+export async function releaseDecisionLifecycleHold(hold, actor, reason, authorize, store, now) {
+    if (!actor || !reason || !Number.isSafeInteger(now) || now < 0)
+        throw new Error('Decision lifecycle hold release denied');
+    let approved = false;
+    try {
+        approved = await authorize(hold, actor);
+    }
+    catch { /* authorization fails closed */ }
+    if (!approved)
+        throw new Error('Decision lifecycle hold release denied');
+    try {
+        await store.releaseHold(hold, actor, reason, now);
+    }
+    catch {
+        throw new Error('Decision lifecycle hold release failed');
+    }
+}
+/** Cascading erasure runs only after the host resolves linked records. No body is returned. */
+export async function eraseDecisionSubject(subject, policy, store, now) {
+    validateDecisionLifecyclePolicy(policy);
+    if (!subject || !Number.isSafeInteger(now) || now < 0)
+        throw new Error('Decision lifecycle deletion denied');
+    let links;
+    let holds;
+    try {
+        links = await store.links(subject);
+        holds = await store.holds(subject);
+    }
+    catch {
+        throw new Error('Decision lifecycle lookup failed');
+    }
+    if (holds.some(hold => hold.subject === subject && hold.expiresAt > now
+        && links.some(link => hold.scope.includes(link.surface))))
+        throw new Error('Decision lifecycle deletion denied by hold');
+    const tombstones = [];
+    for (const reference of links) {
+        if (!DECISION_LIFECYCLE_SURFACES.includes(reference.surface) || !reference.opaqueId) {
+            throw new Error('Decision lifecycle reference invalid');
+        }
+        const tombstone = { subject, reference: { ...reference }, deletedAt: now };
+        // Publish the tombstone before erasure so a failed erase cannot resurrect on restore.
+        try {
+            await store.tombstone(tombstone);
+            await store.erase(reference);
+        }
+        catch {
+            throw new Error('Decision lifecycle erasure failed');
+        }
+        tombstones.push(tombstone);
+    }
+    return tombstones;
+}
+/** A restored backup cannot make erased content queryable. */
+export function mayRestoreDecisionReference(reference, createdAt, now, policy, tombstones) {
+    validateDecisionLifecyclePolicy(policy);
+    if (!DECISION_LIFECYCLE_SURFACES.includes(reference.surface) || !Number.isSafeInteger(createdAt)
+        || !Number.isSafeInteger(now) || now < createdAt)
+        return false;
+    return !tombstones.some(value => value.reference.surface === reference.surface && value.reference.opaqueId === reference.opaqueId)
+        && now - createdAt < policy.surfaces[reference.surface].retentionMs;
+}
+/**
+ * Subject-level restore across lifecycle surfaces. Each entry is checked against tombstones,
+ * the surface backup rule and primary retention before its host restore handler runs, so a
+ * backup taken before erasure cannot make erased or expired content queryable again.
+ */
+export async function restoreDecisionSubjectBackup(backup, policy, tombstones, restore, now) {
+    validateDecisionLifecyclePolicy(policy);
+    if (!Array.isArray(backup) || !Number.isSafeInteger(now) || now < 0)
+        throw new Error('Decision lifecycle restore denied');
+    const report = { restored: [], refused: [] };
+    for (const entry of backup) {
+        const reference = entry?.reference;
+        let reason = null;
+        if (!entry?.subject || !reference?.opaqueId || !DECISION_LIFECYCLE_SURFACES.includes(reference.surface)
+            || !Number.isSafeInteger(entry.createdAt) || entry.createdAt > now)
+            reason = 'invalid';
+        else if (tombstones.some(value => value.reference.surface === reference.surface
+            && value.reference.opaqueId === reference.opaqueId))
+            reason = 'tombstoned';
+        else if (policy.surfaces[reference.surface].backup === 'not-persisted')
+            reason = 'not-persisted';
+        else if (!mayRestoreDecisionReference(reference, entry.createdAt, now, policy, tombstones))
+            reason = 'expired';
+        else if (!restore[reference.surface])
+            reason = 'restore-unavailable';
+        const copy = structuredClone(entry);
+        if (reason) {
+            report.refused.push({ entry: copy, reason });
+            continue;
+        }
+        try {
+            await restore[reference.surface](reference.opaqueId);
+        }
+        catch {
+            throw new Error('Decision lifecycle restore failed');
+        }
+        report.restored.push(copy);
+    }
+    return report;
+}
+//# sourceMappingURL=lifecycle.js.map