@allocator-one/rcl 4.4.19

package/dist/dispatch/utils.d.ts

@@ -0,0 +1,159 @@
+import type { ParseResult } from '../consensus/parser.js';
+import type { ModelReview, TokenUsage } from '../consensus/types.js';
+/**
+ * Anthropic bills prompt-cache reads and writes separately from
+ * `input_tokens`; all three are prompt tokens the call processed, so they
+ * are summed into `inputTokens`. Thinking is already inside `output_tokens`
+ * and is not broken out.
+ */
+export declare function usageFromAnthropic(usage: {
+    input_tokens?: number | null;
+    output_tokens?: number | null;
+    cache_read_input_tokens?: number | null;
+    cache_creation_input_tokens?: number | null;
+} | null | undefined): TokenUsage | undefined;
+/**
+ * OpenAI Chat Completions shape; OpenRouter passes the same block through.
+ * `completion_tokens` already contains the reasoning tokens, so
+ * `outputTokens` is the total and `reasoningTokens` its subset.
+ */
+export declare function usageFromOpenAI(usage: {
+    prompt_tokens?: number | null;
+    completion_tokens?: number | null;
+    completion_tokens_details?: {
+        reasoning_tokens?: number | null;
+    } | null;
+} | null | undefined): TokenUsage | undefined;
+/**
+ * Google reports answer tokens (`candidatesTokenCount`) and thinking tokens
+ * (`thoughtsTokenCount`) disjointly. `outputTokens` is their sum so it means
+ * the same thing as for every other provider — everything generated — and
+ * `reasoningTokens` is the thinking subset.
+ */
+export declare function usageFromGoogle(usage: {
+    promptTokenCount?: number | null;
+    candidatesTokenCount?: number | null;
+    thoughtsTokenCount?: number | null;
+} | null | undefined): TokenUsage | undefined;
+/**
+ * Strip a known provider prefix from a model name.
+ * Only removes anthropic/, openai/, google/, openrouter/, or openai-compat/
+ * prefixes. Returns the model name unchanged if no known prefix is found.
+ * Note: openrouter/ models keep their vendor segment — stripping
+ * "openrouter/moonshotai/kimi-k3" yields "moonshotai/kimi-k3", which is the
+ * model id OpenRouter expects on the wire.
+ */
+export declare function stripKnownProviderPrefix(model: string): string;
+/**
+ * A completed HTTP call that produced no reviewable output is a FAILED
+ * review, not a clean one. Providers decline requests in-band — Claude
+ * answers 200 with `stop_reason: "refusal"`, OpenAI-compatible endpoints
+ * with `finish_reason: "content_filter"` — and refusals cluster on exactly
+ * the security-relevant diffs a council is most valuable for.
+ *
+ * Reporting those as `success` with zero findings is worse than losing the
+ * reviewer: the run still counts it toward `successfulReviews` (so the CI
+ * "nothing was reviewed" guard stays quiet), and consensus counts it as a
+ * relevant reviewer that looked and found nothing — which *lowers* the
+ * confidence of a real finding the other models did catch.
+ */
+export declare function failedReview(opts: {
+    model: string;
+    role: string;
+    provider: string;
+    startedAt: number;
+    error: string;
+    status?: 'error' | 'timeout';
+    /** Tokens the failed attempt still consumed (a truncated answer is billed). */
+    usage?: TokenUsage;
+}): ModelReview;
+/**
+ * The provider-agnostic backstop: a 200 with an empty body reviewed nothing.
+ * Catches refusal shapes we don't yet enumerate, and plain provider hiccups,
+ * without each adapter having to guess why the body was empty.
+ */
+export declare function isBlankOutput(rawOutput: string): boolean;
+/**
+ * Turn a parsed response into a ModelReview, shared by every adapter so the
+ * degraded cases are classified the same way everywhere.
+ *
+ * The case that matters: the model answered, but every finding it produced
+ * failed schema validation. `findings: []` with `dropped > 0` is NOT a clean
+ * review — reporting it as one silently drops a whole reviewer (and, in a
+ * council, a whole role) while the report claims the round was complete.
+ * Warnings ride along so a consumer reading the JSON can see degraded
+ * coverage without scraping stdout, which the skills explicitly tell people
+ * not to read.
+ */
+export declare function reviewFromParse(opts: {
+    model: string;
+    role: string;
+    provider: string;
+    startedAt: number;
+    parsed: ParseResult;
+    usage?: TokenUsage;
+}): ModelReview;
+/**
+ * Chain an external cancellation signal (quorum round closure) onto an
+ * adapter's internal timeout controller, so canceled calls abort their
+ * in-flight request instead of holding sockets (and the process) open.
+ * Returns an unlink function for the adapter's cleanup path.
+ */
+export declare function linkAbortSignal(controller: AbortController, external: AbortSignal | undefined, onAbort?: () => void): () => void;
+/**
+ * Output budget for `ask/4` — the single-shot path behind the verification
+ * lane and `discuss`.
+ *
+ * The verifier answers one JSON entry per candidate finding, so its answer
+ * grows with the review, and a thinking model spends this budget on reasoning
+ * before emitting any of it. The old 4k/8k ceilings covered roughly ten
+ * findings; past that the answer was cut off, parsed to nothing, and every
+ * candidate was recorded "unavailable" — silently gating findings the verifier
+ * would have refuted (RCL-60). This matches the review path's budget.
+ */
+export declare const ASK_MAX_OUTPUT_TOKENS = 16384;
+/**
+ * A provider stopped at its output ceiling. Thrown from an `ask` attempt so a
+ * truncated answer fails loudly instead of arriving as a short success whose
+ * missing content is indistinguishable from a model with nothing to say.
+ */
+export declare class TruncatedAnswerError extends Error {
+    constructor(provider: string);
+}
+export declare const RETRY_DELAYS: readonly [1000, 2000, 4000];
+/**
+ * Whether an HTTP status from a provider API warrants a retry.
+ * Covers rate limits (429), transient server errors (500/502/503/504),
+ * and Anthropic's overloaded_error (529).
+ */
+export declare function isRetryableStatus(status: number | undefined): boolean;
+/**
+ * Recognize bounded transport causes without guessing from error prose. An
+ * SDK connection-error class may omit its cause; arbitrary errors may not.
+ * Unknown coded causes (including TLS, DNS configuration and invalid URLs),
+ * aborts, cycles and over-depth chains remain terminal.
+ */
+export declare function isRetryableConnectionError(error: unknown, knownConnectionError?: boolean): boolean;
+export declare function retryDelay(attempt: number): number;
+export declare function sleep(ms: number): Promise<void>;
+export type AttemptOutcome<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    timedOut: boolean;
+    error: string;
+};
+/**
+ * Shared timeout-owning retry skeleton for review and one-off adapter calls.
+ * The AbortController is the sole owner of timeout classification — the
+ * caller's SDK timeout must be set above `timeoutMs` (same convention as the
+ * review paths).
+ */
+export declare function attemptWithRetries<T>(opts: {
+    timeoutMs: number;
+    maxRetries: number;
+    signal?: AbortSignal;
+    isRetryable: (err: unknown) => boolean;
+    attempt: (signal: AbortSignal) => Promise<T>;
+}): Promise<AttemptOutcome<T>>;

package/dist/dispatch/utils.js

@@ -0,0 +1,381 @@
+/**
+ * Token usage extractors — one per SDK response shape (IO-12475 section
+ * 8.3). Each returns undefined when the provider sent no usage block, so a
+ * review never carries an empty `usage: {}`; non-numeric fields are dropped
+ * rather than coerced.
+ */
+function compactUsage(usage) {
+    const out = {};
+    if (typeof usage.inputTokens === 'number')
+        out.inputTokens = usage.inputTokens;
+    if (typeof usage.outputTokens === 'number')
+        out.outputTokens = usage.outputTokens;
+    if (typeof usage.reasoningTokens === 'number')
+        out.reasoningTokens = usage.reasoningTokens;
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function sumPresent(...values) {
+    const present = values.filter((v) => typeof v === 'number');
+    return present.length > 0 ? present.reduce((sum, v) => sum + v, 0) : undefined;
+}
+/**
+ * Anthropic bills prompt-cache reads and writes separately from
+ * `input_tokens`; all three are prompt tokens the call processed, so they
+ * are summed into `inputTokens`. Thinking is already inside `output_tokens`
+ * and is not broken out.
+ */
+export function usageFromAnthropic(usage) {
+    if (!usage)
+        return undefined;
+    return compactUsage({
+        inputTokens: sumPresent(usage.input_tokens, usage.cache_read_input_tokens, usage.cache_creation_input_tokens),
+        outputTokens: usage.output_tokens ?? undefined,
+    });
+}
+/**
+ * OpenAI Chat Completions shape; OpenRouter passes the same block through.
+ * `completion_tokens` already contains the reasoning tokens, so
+ * `outputTokens` is the total and `reasoningTokens` its subset.
+ */
+export function usageFromOpenAI(usage) {
+    if (!usage)
+        return undefined;
+    return compactUsage({
+        inputTokens: usage.prompt_tokens ?? undefined,
+        outputTokens: usage.completion_tokens ?? undefined,
+        reasoningTokens: usage.completion_tokens_details?.reasoning_tokens ?? undefined,
+    });
+}
+/**
+ * Google reports answer tokens (`candidatesTokenCount`) and thinking tokens
+ * (`thoughtsTokenCount`) disjointly. `outputTokens` is their sum so it means
+ * the same thing as for every other provider — everything generated — and
+ * `reasoningTokens` is the thinking subset.
+ */
+export function usageFromGoogle(usage) {
+    if (!usage)
+        return undefined;
+    return compactUsage({
+        inputTokens: usage.promptTokenCount ?? undefined,
+        outputTokens: sumPresent(usage.candidatesTokenCount, usage.thoughtsTokenCount),
+        reasoningTokens: usage.thoughtsTokenCount ?? undefined,
+    });
+}
+const KNOWN_PROVIDER_PREFIXES = [
+    'anthropic/',
+    'openai/',
+    'google/',
+    'openrouter/',
+    'openai-compat/',
+];
+/**
+ * Strip a known provider prefix from a model name.
+ * Only removes anthropic/, openai/, google/, openrouter/, or openai-compat/
+ * prefixes. Returns the model name unchanged if no known prefix is found.
+ * Note: openrouter/ models keep their vendor segment — stripping
+ * "openrouter/moonshotai/kimi-k3" yields "moonshotai/kimi-k3", which is the
+ * model id OpenRouter expects on the wire.
+ */
+export function stripKnownProviderPrefix(model) {
+    for (const prefix of KNOWN_PROVIDER_PREFIXES) {
+        if (model.startsWith(prefix)) {
+            return model.slice(prefix.length);
+        }
+    }
+    return model;
+}
+/**
+ * A completed HTTP call that produced no reviewable output is a FAILED
+ * review, not a clean one. Providers decline requests in-band — Claude
+ * answers 200 with `stop_reason: "refusal"`, OpenAI-compatible endpoints
+ * with `finish_reason: "content_filter"` — and refusals cluster on exactly
+ * the security-relevant diffs a council is most valuable for.
+ *
+ * Reporting those as `success` with zero findings is worse than losing the
+ * reviewer: the run still counts it toward `successfulReviews` (so the CI
+ * "nothing was reviewed" guard stays quiet), and consensus counts it as a
+ * relevant reviewer that looked and found nothing — which *lowers* the
+ * confidence of a real finding the other models did catch.
+ */
+export function failedReview(opts) {
+    return {
+        model: opts.model,
+        role: opts.role,
+        provider: opts.provider,
+        findings: [],
+        durationMs: Date.now() - opts.startedAt,
+        status: opts.status ?? 'error',
+        error: opts.error,
+        ...(opts.usage ? { usage: opts.usage } : {}),
+    };
+}
+/**
+ * The provider-agnostic backstop: a 200 with an empty body reviewed nothing.
+ * Catches refusal shapes we don't yet enumerate, and plain provider hiccups,
+ * without each adapter having to guess why the body was empty.
+ */
+export function isBlankOutput(rawOutput) {
+    return rawOutput.trim().length === 0;
+}
+/**
+ * Turn a parsed response into a ModelReview, shared by every adapter so the
+ * degraded cases are classified the same way everywhere.
+ *
+ * The case that matters: the model answered, but every finding it produced
+ * failed schema validation. `findings: []` with `dropped > 0` is NOT a clean
+ * review — reporting it as one silently drops a whole reviewer (and, in a
+ * council, a whole role) while the report claims the round was complete.
+ * Warnings ride along so a consumer reading the JSON can see degraded
+ * coverage without scraping stdout, which the skills explicitly tell people
+ * not to read.
+ */
+export function reviewFromParse(opts) {
+    const { findings, warnings, dropped, unusable } = opts.parsed;
+    const base = {
+        model: opts.model,
+        role: opts.role,
+        provider: opts.provider,
+        findings,
+        durationMs: Date.now() - opts.startedAt,
+        ...(opts.usage ? { usage: opts.usage } : {}),
+        ...(dropped > 0 ? { droppedFindings: dropped } : {}),
+        ...(warnings.length > 0 ? { warnings } : {}),
+    };
+    // Gate on the parser's explicit verdict, not on the dropped counter: the
+    // counter only moves inside the salvage loop, which never runs when the
+    // response has no findings array at all — so a truncated or prose-only
+    // answer used to fall through to `success` (RCL-15).
+    if (unusable) {
+        return {
+            ...base,
+            status: 'parse_failed',
+            error: dropped > 0
+                ? `All ${dropped} finding(s) failed schema validation; this reviewer's output was lost`
+                : "Response was not a usable review; this reviewer's output was lost",
+        };
+    }
+    return { ...base, status: 'success' };
+}
+/**
+ * Chain an external cancellation signal (quorum round closure) onto an
+ * adapter's internal timeout controller, so canceled calls abort their
+ * in-flight request instead of holding sockets (and the process) open.
+ * Returns an unlink function for the adapter's cleanup path.
+ */
+export function linkAbortSignal(controller, external, onAbort = () => { }) {
+    if (!external)
+        return () => { };
+    if (external.aborted) {
+        onAbort();
+        controller.abort();
+        return () => { };
+    }
+    const abort = () => {
+        onAbort();
+        controller.abort();
+    };
+    external.addEventListener('abort', abort, { once: true });
+    return () => external.removeEventListener('abort', abort);
+}
+/**
+ * Output budget for `ask/4` — the single-shot path behind the verification
+ * lane and `discuss`.
+ *
+ * The verifier answers one JSON entry per candidate finding, so its answer
+ * grows with the review, and a thinking model spends this budget on reasoning
+ * before emitting any of it. The old 4k/8k ceilings covered roughly ten
+ * findings; past that the answer was cut off, parsed to nothing, and every
+ * candidate was recorded "unavailable" — silently gating findings the verifier
+ * would have refuted (RCL-60). This matches the review path's budget.
+ */
+export const ASK_MAX_OUTPUT_TOKENS = 16_384;
+/**
+ * A provider stopped at its output ceiling. Thrown from an `ask` attempt so a
+ * truncated answer fails loudly instead of arriving as a short success whose
+ * missing content is indistinguishable from a model with nothing to say.
+ */
+export class TruncatedAnswerError extends Error {
+    constructor(provider) {
+        super(`${provider}: answer truncated at the output limit; the response would be incomplete`);
+        this.name = 'TruncatedAnswerError';
+    }
+}
+export const RETRY_DELAYS = [1000, 2000, 4000];
+const RETRYABLE_STATUSES = new Set([429, 500, 502, 503, 504, 529]);
+/**
+ * Whether an HTTP status from a provider API warrants a retry.
+ * Covers rate limits (429), transient server errors (500/502/503/504),
+ * and Anthropic's overloaded_error (529).
+ */
+export function isRetryableStatus(status) {
+    return status !== undefined && RETRYABLE_STATUSES.has(status);
+}
+const TRANSIENT_CONNECTION_CODES = new Set([
+    'ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EPIPE', 'EAI_AGAIN',
+    'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT', 'UND_ERR_SOCKET',
+]);
+/**
+ * Recognize bounded transport causes without guessing from error prose. An
+ * SDK connection-error class may omit its cause; arbitrary errors may not.
+ * Unknown coded causes (including TLS, DNS configuration and invalid URLs),
+ * aborts, cycles and over-depth chains remain terminal.
+ */
+export function isRetryableConnectionError(error, knownConnectionError = false) {
+    const seen = new Set();
+    const pending = [{ error, depth: 0, transient: false }];
+    let hasTransientBranch = false;
+    let knownConnectionRoot = false;
+    let inspected = 0;
+    while (pending.length > 0) {
+        const { error: current, depth, transient: branchTransient } = pending.pop();
+        if (depth >= 8 || ++inspected > 32)
+            return false;
+        if (current === null || typeof current !== 'object' || seen.has(current))
+            return false;
+        seen.add(current);
+        const cause = current;
+        if (cause.name === 'AbortError' || cause.name === 'APIUserAbortError' || cause.status !== undefined)
+            return false;
+        let transient = branchTransient;
+        if (cause.code !== undefined) {
+            if (typeof cause.code !== 'string' || !TRANSIENT_CONNECTION_CODES.has(cause.code))
+                return false;
+            transient = true;
+        }
+        const children = [];
+        if (current instanceof AggregateError) {
+            const members = current.errors;
+            if (!Array.isArray(members))
+                return false;
+            const count = members.length;
+            if (count > 32 - inspected - pending.length - Number(cause.cause !== undefined))
+                return false;
+            for (let index = 0; index < count; index += 1)
+                children.push(members[index]);
+        }
+        if (cause.cause !== undefined)
+            children.push(cause.cause);
+        if (children.length === 0) {
+            if (!transient && !(knownConnectionError && seen.size === 1))
+                return false;
+            hasTransientBranch ||= transient;
+            knownConnectionRoot ||= knownConnectionError && depth === 0;
+            continue;
+        }
+        for (const child of children)
+            pending.push({ error: child, depth: depth + 1, transient });
+    }
+    return hasTransientBranch || knownConnectionRoot;
+}
+export function retryDelay(attempt) {
+    return RETRY_DELAYS[attempt] ?? RETRY_DELAYS[RETRY_DELAYS.length - 1];
+}
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function sleepUntilRetry(ms, signal) {
+    if (signal.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let timeoutHandle;
+        const finish = () => {
+            if (timeoutHandle !== undefined)
+                clearTimeout(timeoutHandle);
+            signal.removeEventListener('abort', finish);
+            resolve();
+        };
+        signal.addEventListener('abort', finish, { once: true });
+        if (signal.aborted) {
+            finish();
+            return;
+        }
+        timeoutHandle = setTimeout(finish, ms);
+    });
+}
+const ATTEMPT_ABORTED = Symbol('attempt aborted');
+function awaitAttempt(attempt, signal) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (outcome, value) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener('abort', onAbort);
+            if (outcome === 'resolve')
+                resolve(value);
+            else
+                reject(value);
+        };
+        const onAbort = () => finish('reject', ATTEMPT_ABORTED);
+        signal.addEventListener('abort', onAbort, { once: true });
+        if (signal.aborted) {
+            onAbort();
+        }
+        attempt.then((value) => finish('resolve', value), (error) => finish('reject', error));
+    });
+}
+/**
+ * Shared timeout-owning retry skeleton for review and one-off adapter calls.
+ * The AbortController is the sole owner of timeout classification — the
+ * caller's SDK timeout must be set above `timeoutMs` (same convention as the
+ * review paths).
+ */
+export async function attemptWithRetries(opts) {
+    const controller = new AbortController();
+    let abortCause;
+    const timeoutHandle = setTimeout(() => {
+        if (controller.signal.aborted)
+            return;
+        abortCause = 'timeout';
+        controller.abort();
+    }, opts.timeoutMs);
+    const unlinkAbort = linkAbortSignal(controller, opts.signal, () => {
+        abortCause ??= 'cancelled';
+    });
+    let lastErr = new Error('no attempts made');
+    const abortOutcome = () => {
+        const timedOut = abortCause === 'timeout';
+        return {
+            ok: false,
+            timedOut,
+            error: timedOut ? 'Request timed out' : 'Request cancelled',
+        };
+    };
+    if (controller.signal.aborted) {
+        clearTimeout(timeoutHandle);
+        unlinkAbort();
+        return abortOutcome();
+    }
+    if (opts.timeoutMs <= 0) {
+        clearTimeout(timeoutHandle);
+        unlinkAbort();
+        return { ok: false, timedOut: true, error: 'Request timed out' };
+    }
+    try {
+        for (let attempt = 0; attempt <= opts.maxRetries; attempt++) {
+            try {
+                const value = await awaitAttempt(opts.attempt(controller.signal), controller.signal);
+                return controller.signal.aborted ? abortOutcome() : { ok: true, value };
+            }
+            catch (err) {
+                lastErr = err;
+                if (controller.signal.aborted)
+                    return abortOutcome();
+                if (opts.isRetryable(err) && attempt < opts.maxRetries) {
+                    await sleepUntilRetry(retryDelay(attempt), controller.signal);
+                    if (controller.signal.aborted)
+                        return abortOutcome();
+                    continue;
+                }
+                break;
+            }
+        }
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+        unlinkAbort();
+    }
+    const error = lastErr instanceof Error ? `${lastErr.name}: ${lastErr.message}` : String(lastErr);
+    return { ok: false, timedOut: false, error };
+}
+//# sourceMappingURL=utils.js.map

package/dist/dispatch/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/dispatch/utils.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC/E,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAClF,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QAAE,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,MAAwC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAQa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,YAAY,CAAC;QAClB,WAAW,EAAE,UAAU,CACrB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,uBAAuB,EAC7B,KAAK,CAAC,2BAA2B,CAClC;QACD,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,SAAS;KAC/C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAOa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,YAAY,CAAC;QAClB,WAAW,EAAE,KAAK,CAAC,aAAa,IAAI,SAAS;QAC7C,YAAY,EAAE,KAAK,CAAC,iBAAiB,IAAI,SAAS;QAClD,eAAe,EAAE,KAAK,CAAC,yBAAyB,EAAE,gBAAgB,IAAI,SAAS;KAChF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAOa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,YAAY,CAAC;QAClB,WAAW,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;QAChD,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAC;QAC9E,eAAe,EAAE,KAAK,CAAC,kBAAkB,IAAI,SAAS;KACvD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,YAAY;IACZ,SAAS;IACT,SAAS;IACT,aAAa;IACb,gBAAgB;CACR,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAS5B;IACC,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9D,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QACvC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;IAEF,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,qDAAqD;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,cAAc;YACtB,KAAK,EACH,OAAO,GAAG,CAAC;gBACT,CAAC,CAAC,OAAO,OAAO,uEAAuE;gBACvF,CAAC,CAAC,mEAAmE;SAC1E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA2B,EAC3B,QAAiC,EACjC,UAAsB,GAAG,EAAE,GAAE,CAAC;IAE9B,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;QACV,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,OAAO,EAAE,CAAC;QACV,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAgB;QAC1B,KAAK,CAAC,GAAG,QAAQ,0EAA0E,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAExD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO,MAAM,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW;IAC/D,yBAAyB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gBAAgB;CAC/F,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAc,EAAE,oBAAoB,GAAG,KAAK;IACrF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAiE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtH,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC7E,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,OAAgF,CAAC;QAC/F,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClH,IAAI,SAAS,GAAG,eAAe,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChG,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,OAAO,YAAY,cAAc,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,KAAK,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3E,kBAAkB,KAAK,SAAS,CAAC;YACjC,mBAAmB,KAAK,oBAAoB,IAAI,KAAK,KAAK,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,kBAAkB,IAAI,mBAAmB,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,EAAU,EAAE,MAAmB;IACtD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,aAAwD,CAAC;QAC7D,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,IAAI,aAAa,KAAK,SAAS;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC7D,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,EAAE,CAAC;YACT,OAAO;QACT,CAAC;QACD,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAElD,SAAS,YAAY,CAAI,OAAmB,EAAE,MAAmB;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAA6B,EAAE,KAAkB,EAAQ,EAAE;YACzE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAU,CAAC,CAAC;;gBAC1C,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAE9D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EACnC,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAI,IAM3C;IACC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,UAA+C,CAAC;IACpD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QACpC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACtC,UAAU,GAAG,SAAS,CAAC;QACvB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnB,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QAChE,UAAU,KAAK,WAAW,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,GAAY,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,GAAsB,EAAE;QAC3C,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ;YACR,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB;SAC5D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,WAAW,EAAE,CAAC;QACd,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QACxB,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,WAAW,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACrF,OAAO,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAC;gBACd,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,YAAY,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBACvD,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBAC9D,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;wBAAE,OAAO,YAAY,EAAE,CAAC;oBACrD,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC"}

package/dist/dispatch/verification-execution.d.ts

@@ -0,0 +1,48 @@
+import { replayGating, type AskFn, type GatingPlan } from '../consensus/gating.js';
+import { type NativeTargetOwnership } from '../converge/target-ownership.js';
+import type { CheckpointJournal } from './checkpoint.js';
+import { type VerificationPlanInput, type VerificationResult } from './checkpoint-verification.js';
+export interface VerificationExecutionOptions {
+    commonDir: string;
+    ownership: NativeTargetOwnership;
+    journal: CheckpointJournal;
+    /** Independently regenerated from validated captured consensus/config/diff, never an uploaded plan. */
+    regeneratedPlan: GatingPlan;
+    /** Existing phase on resume; first launch is bounded by the original operation expiry. */
+    retainedPlan: VerificationPlanInput;
+    /** Other calls charged to this run (e.g. new async launches), excluding checkpoint and verifier intents. */
+    otherPhysicalCalls: number;
+    askFactory: () => AskFn;
+    /** Caller establishes source/principal/producer authority before any new physical intent. */
+    beforeLaunch: () => Promise<void>;
+    signal?: AbortSignal;
+    /** Optional stricter runtime cutoff; never changes the persisted phase plan. */
+    executionExpiresAtMs?: number;
+    nowMs?: () => number;
+    monotonicNow?: () => number;
+    /** Caller buffers until sealing and retains with its original ownership; never alters the phase proof. */
+    auditLateAnswer: (result: VerificationResult) => Promise<void>;
+    /** Register each provider continuation synchronously so caller-owned drain cannot miss a later answer. */
+    registerLateAudit: (operation: Promise<void>, batchIndex: number) => void;
+    onLateAuditError: (error: unknown, batchIndex: number) => void;
+}
+export type VerificationExecutionResult = ({
+    ok: true;
+} & ReturnType<typeof replayGating> | {
+    ok: false;
+    findings: GatingPlan['findings'];
+    failure: Error;
+}) & {
+    proof: {
+        bytes: string;
+        digest: string;
+    };
+    newPhysicalCalls: number;
+};
+/**
+ * Execute one already-authorized verifier phase. This is a request engine, not
+ * source authentication or report admission. The caller regenerates the plan,
+ * accounts for non-checkpoint calls and holds original ownership through late
+ * audit flush/drain. Unknown paid intents are never retried. SDK retries are off.
+ */
+export declare function executeVerification(input: VerificationExecutionOptions): Promise<VerificationExecutionResult>;