@canhta/dsh-autopilot 0.1.0-alpha.1

package/docs/specs/ui-components.md

@@ -0,0 +1,96 @@
+# UI modules and components
+
+This page owns Client decomposition, data/command behavior and functional acceptance. [Web UI](web-ui.md) owns navigation, visual rules, journeys and visual acceptance. Names below are Autopilot responsibilities, not instructions to create new components when DSH already supplies them.
+
+Implement components using the [DSH Client discipline](../engineering.md#client-code), keeping data ownership and subscriptions outside presentation components.
+
+## Module ownership
+
+| Module | Responsibility | Reads | Mutations |
+| --- | --- | --- | --- |
+| Operations shell | Selected view/run, integration/recovery visibility, global scheduler controls | Host health and scheduler summary | Scheduler pause/resume/drain, explicit reconcile |
+| Runs | Browse waiting/active/history and inspect one execution | Paginated run summaries and selected run snapshot | Stop at checkpoint, resume operational pause, cancel quiescent queued/paused/blocked run |
+| Schedule | Explain when admission can happen | Effective timezone/windows/cadence, next reconcile/dispatch, recent reconciliations | None; link to Settings |
+| Budget | Explain spend authorization and paused work | Scoped caps, reservations, settled usage, coverage, window reset | None; link to Settings |
+| Deliveries | Inspect notification failures without confusing them with execution failure | Paginated event/destination receipts | Retry selected failed delivery |
+| Worktrees | Inspect retained Git work and safe removal eligibility | Managed worktrees plus explicit refreshed Git/PR inspection | Request preview, confirm valid cleanup |
+| Settings contribution | Configure providers and operational policy | Effective values, revision, provider schemas/metadata/lookups | Validate/save configuration, explicit connection/test delivery actions |
+
+Host state is authoritative. Modules use the existing DSH Remote client with Autopilot's generated query/command contributions; the browser persists only view preferences. Use the supported snapshot/stream facilities described in [plugin engineering](plugin.md#web-and-host-interface) for active views and selected details. Disposal cancels requests/subscriptions. Views neither dispatch workflows nor duplicate provider clients, and do not load full Session transcripts for a table. Query and command transitions are owned by the shared presentation components below.
+
+## Shell and list components
+
+| Component | Content and interaction |
+| --- | --- |
+| `OperationsShell` | DSH main-slot content only; owns local view and selected-run state. Contains header, conditional attention strip, local tabs and one content region. Does not redraw DSH navigation or model chat. |
+| `OperationsHeader` | Title, current project/provider identity, scheduler mode with reason, last refresh/reconcile age. One contextual primary control: Pause when enabled, Resume when paused. Drain/reconcile/settings remain labelled secondary actions. |
+| `AttentionStrip` | Only actionable health/recovery/provider failures. A concise reason and one destination action; grouped count opens filtered runs/deliveries. No permanent decorative health banner. |
+| `RunsToolbar` | Search issue key/summary, lifecycle filter, priority and age filters, attention-only toggle and visible result count. State persists when opening/closing details. Clear filters is available when results are empty. |
+| `RunsTable` | Columns in order: issue key + summary; lifecycle + reason; priority; current phase; elapsed; spend qualification; updated age. Leading identity is flexible; numbers align right. Row activation opens details; explicit links and action buttons do not activate the row twice. Host pagination and stable ids; no drag-to-reprioritize control. |
+| `RunDetailPanel` | Header with ticket identity, lifecycle/reason and allowed actions. First show required human action or pause condition; completed runs show PR and verification. Then Brief/dependencies, ordered event timeline, verification, workspace/Session, spend and deliveries as collapsible sections. No second dashboard inside the panel. |
+
+Run detail uses composition: `BlockerCallout` renders numbered questions and the exact tracker action; `VerificationSummary` renders checks/results/skips and verified Git identity; `RunTimeline` renders timestamped normalized events, grouping repeated retries; `ResourceLinks` links to tracker, DSH Session, PR and worktree details. None derives success from prose or infers a next action from status color.
+
+Supply Session evidence through existing DSH query and projection services. Restrict reads to the selected run's authorized Session/descendant identities, fetch bounded detail on demand and expose stale/unavailable evidence. Projection caches accelerate display; they do not determine run success, credit authorization or safe publication.
+
+The panel footer uses the operator-command policy below. Preserve scroll/selection if an update arrives; announce significant state changes without moving focus.
+
+## Operator-command policy
+
+| Action | Visible behavior |
+| --- | --- |
+| Pause scheduler | Explains that active work is pausing; displays unfinished pauses until checkpointed |
+| Resume scheduler | Re-evaluates paused/queued work through normal gates |
+| Drain | Stops new admission/dequeue while current runs finish |
+| Reconcile now | Fetches current tracker state under ordinary admission policy |
+| Cancel run | Available for quiescent queued/paused/blocked runs; retains worktree/history and cannot silently requeue on an unchanged tracker poll |
+| Stop at checkpoint | Requests an operational pause and durable operator hold for the selected run |
+| Resume paused run | Clears that run's operator hold and queues continuation only if all other gates permit; otherwise shows the unmet condition |
+| Retry notification | Retries selected delivery without repeating code execution |
+| Cleanup worktree | Shows exact removal preview and rejection reasons before confirmation |
+| Open ticket / Session / PR | Opens the associated system record |
+
+A blocked run shows `Waiting for a human in {trackerName}`, its questions and `Open in {trackerName}`. Human unblock authorization stays on tracker. Display the reason for unavailable actions; do not silently ignore them. Destructive cleanup requires confirmation of the preview, while ordinary reads do not.
+
+The Host rechecks current state for every command. Audit mutations with operator identity when available, timestamp, request id, target and resulting revision.
+Mapping repair is available only for failed tracker projections under [delivery repair](operations.md#repairing-a-broken-delivery-mapping). Show the old/new mapping and affected intent, validate and confirm; never expose it as an unblock shortcut.
+
+## Operational components
+
+| Component | Content and interaction |
+| --- | --- |
+| `ScheduleSummary` | Text/table of effective windows and timezone, next reconciliation versus next admissible dispatch, disabled/draining/window-closed explanations, recent reconciliation outcomes. No cron-expression-only presentation or calendar editor. Edit opens the owning Settings section. |
+| `BudgetLedger` | Per configured scope: cap, settled, reserved, remaining, reset time and enforcement mode. Unknown amounts remain unknown. A restrained labelled meter is permitted only with a known denominator; provider balance is separate. Show affected paused runs and coverage explanation; no forecast graph without data. |
+| `DeliveryTable` | Event, linked run/ticket, destination label, delivery state, attempts/next retry and sanitized error. Inspect exposes redacted payload/receipt; retry uses the operator-command policy. |
+| `WorktreeTable` | Ticket/run, branch, active/retained/missing/orphaned state, last inspection age, dirty/untracked/unpushed indicators, PR disposition, disk usage and cleanup eligibility. Unknown inspection values display explicitly. Select opens an inspector; refreshing inspection is an explicit read. |
+| `WorktreeInspector` | Exact managed path and run association, Git findings, PR link/disposition, retention basis and blocking reasons. Preview cleanup is available only for an inspectable managed target; no recursive filesystem-delete button. |
+| `CleanupDialog` | Host-issued target/revision, removable path/size, branch/data retained, checked Git/PR conditions and expiry/staleness. Cancel is the safe default; confirm names the worktree. Pending disables repeat submit. Stale preview requires re-inspection, not confirmation of old data. |
+| `ProviderBindingFields` | Provider selector from installed registrations; provider-specific project/team/workspace/repository selectors and validated mappings. Keep stable ids internally and friendly names visibly. Show missing capabilities, access, compatibility and binding-switch restrictions before save. |
+| `SettingsForm` | Sections: Providers & project; Schedule & capacity; Execution; Budget; Notifications; Retention & storage, using [Host configuration](operations.md#scheduling-and-configuration). Show defaults/effective values. One draft/revision with dirty state, validation, inline errors and save result; a stale edit returns conflict with a reload path, not an overwrite. Loading lookups cannot erase stored values. No silent autosave for operational policy. |
+
+Notifications use a destination list with add/edit/test controls inside Settings. An explicit operator test previews destination, redacted payload and disclosure before sending, and labels the delivery as a test. Credentials use supported Host reference/status controls. Never hydrate existing secret values into the Client; show only configured/missing/source/writable/error metadata and allowed replacement actions.
+
+## Shared primitives and state
+
+Compose public DSH primitives, Settings services and slots, theme and localization. The baseline exports no generic table, accessible tablist, schema form or credential editor; implement only the required domain composition over shared atoms and semantic HTML. Reusing a dialog still requires verifying focus management. Autopilot-specific shared components are limited to repeated domain presentation: `RunStateLabel`, `ProviderResourceLink`, `UsageValue`, `CommandFeedback` and `QueryState`. A domain label carries text/icon/color; unknown remains distinct from zero/success.
+
+`QueryState` distinguishes first load, empty domain, empty filtered result, denied/unavailable, stale cached data and retryable error. Preserve last known data on disconnection and visibly mark its age; disable unsafe mutations. Do not replace a useful table with a full-screen spinner during each refresh.
+
+On reconnect, fetch a current Host snapshot before enabling actions from cached data. `UsageValue` distinguishes provider-reported values, estimates, `Metering` and `Unknown`; absent evidence never renders as zero. Accompany local schedule times with their configured timezone.
+
+`CommandFeedback` distinguishes request pending, Host accepted, action in progress, succeeded and rejected. For example accepted pause remains “Pausing” until the checkpoint is confirmed; accepted cleanup is not “Removed.” Persisted Host command identifiers handle duplicate submission. Errors explain what failed and how to recover, with diagnostic details collapsed.
+
+UI language uses registered provider names on links, historical runs and instructions. Core copy says ticket, tracker, code host or PR as appropriate. Provider metadata/schema contributions own provider fields; optional Client enhancements cannot be required for a usable validated form. Unsupported required capabilities prevent activation with a reason, following [provider policy](providers.md#availability-and-deployment).
+
+## Component acceptance
+
+Test components through operator-visible outcomes, not internal state variables. Include long issue titles, missing/renamed provider objects, empty/many runs, pagination, unknown usage, inaccessible PR, stale settings, in-flight command, disconnected Host and failed cleanup. Verify no click initiates model execution outside the Host policy.
+
+- A fixture external provider supplies usable Settings without core UI changes; switching the supported provider pairs changes fields/labels but not run policy.
+- Open Operations without selecting a Session; inspect queue and health.
+- A pause command remains in progress until the Host confirms a checkpoint.
+- Reconnect retrieves the latest completed run without replaying an old command.
+- Human blockers have no Web authorization bypass; a completed PR with failed ntfy delivery shows both facts.
+- Unknown usage/PR disposition is distinct from zero/closed; cleanup rejection identifies the blocking condition.
+
+Capture integrated screenshots using [visual acceptance](web-ui.md#visual-acceptance). Component fixtures alone cannot prove slot mounting, theme compatibility or remote configuration.

package/docs/specs/web-ui.md

@@ -0,0 +1,64 @@
+# Web UI
+
+## Placement and data
+
+Add `Autopilot` as a global DSH Web sidebar entry. The panel works without selecting a conversation. Settings are a separate DSH Settings contribution; link to them from Operations rather than building two configuration editors.
+
+The default view is Queue & Runs, not a metrics dashboard. Use five local tabs: Queue & Runs, Schedule, Budget, Notifications, Worktrees. Keep provider and policy editing in DSH Settings. Do not add a second app-wide sidebar. [UI components](ui-components.md) owns the exact module/component responsibilities and query/command behavior.
+
+The supported extension points and remote configuration restrictions are owned by [plugin engineering](plugin.md). Verify the selected access mode before claiming the Settings editor works through a VPS public URL. Its placement and its ability to persist settings are separate capabilities.
+
+Data, command feedback and Settings behavior are defined in the [component specification](ui-components.md). This page owns navigation, visual rules, user journeys and visual acceptance.
+
+## Navigation and reading order
+
+Navigate from a run to its evidence and external records without losing list position. Present human blockers, operational pauses and delivery failures distinctly. Use the [component catalog](ui-components.md) for table content, filters and commands.
+
+## Layout and visual direction
+
+**Proposed visual specification:** a restrained operational tool integrated into DSH, with strong text hierarchy, aligned rows and generous space around decisions. The existing DSH theme and components are authoritative; numeric values below are fallback layout targets, not invented upstream token names. Validate against the actual shell before fixing CSS.
+
+At wide desktop widths, selecting a run opens a nonmodal detail region beside the list and preserves list filters/scroll. Give the detail approximately 420–480 px only when the remaining list stays readable; otherwise use the full-width detail view with Back to runs. At narrow widths show ticket, state/reason and priority first; secondary columns move into details rather than squeezing unreadable cells. Use one overlay at a time; cleanup confirmation may replace an inspector overlay, not stack three dialogs.
+
+```text
+DSH shell / existing navigation
+┌─────────────────────────────────────────────────────────────────┐
+│ Autopilot · project/provider               Running  [Pause]  ⋯   │
+│ Conditional attention: one blocker / access issue → action       │
+│ Queue & Runs | Schedule | Budget | Notifications | Worktrees      │
+├───────────────────────────────────────┬─────────────────────────┤
+│ Search · state · priority · attention │ Ticket · state · links  │
+│ Ticket / state / phase / spend        │ Required action or PR   │
+│ … run rows …                          │ Evidence / timeline     │
+│ Page controls                         │ Secondary details       │
+└───────────────────────────────────────┴─────────────────────────┘
+```
+
+| Visual rule | Implementation requirement |
+| --- | --- |
+| Surfaces | Inherit DSH page/panel/input surfaces and borders. No decorative gradients, glass blur, neon glow, hero banner or nested card around every field. |
+| Type | Inherit DSH font; use a compact hierarchy around 20 px page title, 14 px body/table and 12 px metadata where host tokens permit. Monospace only for paths, branch/commit ids and diagnostics; tabular numerals for aligned numbers. |
+| Spacing | Use the host spacing scale; fallback 4/8/12/16/24 px. Aim for 16–24 px panel padding and 44–48 px readable rows. Avoid both giant empty cards and dense multi-line badge clusters. |
+| Color | One inherited accent for active navigation/primary action. Neutral queued/paused/completed labels; accent implementing; amber human attention; red failure/destructive action. Pair every color with readable text and an icon where useful. A completed run with failed delivery shows both facts. |
+| Controls | One primary action per region. Label consequential actions; icon-only controls need accessible names and tooltips. No ornamental emoji or duplicate buttons scattered across cards. |
+| Motion | Subtle host-standard transitions only; honor reduced motion. No pulsing whole rows, animated counters or auto-scrolling timelines. |
+| Data | No synthetic productivity scores, token-saving claims, trend charts without data or fake progress. Use compact text/table for counts, next schedule and spend; visual meters require a meaningful denominator. |
+
+Use sample content long enough to reveal layout failures: long issue titles, multi-line blockers, large numbers, long branch names and non-English labels. Truncate only previews with an accessible full-value path; never hide the blocking reason, money qualification or destructive target. Dynamic updates must not reorder the row currently focused without a deliberate refresh path.
+
+## Primary interaction paths
+
+1. **First setup:** show what is missing and a Configure action; do not render a fake successful overview. Settings guides provider/project selection, mappings, execution/budget and notifications through section validation, not a mandatory new account/onboarding product. Valid setup does not silently enable spending; scheduler activation is explicit.
+2. **Normal operation:** enter Runs, identify current/waiting work, select a row, inspect evidence, open the external ticket/Session/PR. Closing detail restores list position.
+3. **Human blocker:** attention filter → selected run → questions and Open in the configured tracker. A reply alone does not clear the banner. Display observed authorization/eligibility only after Host confirmation.
+4. **Budget/schedule pause:** show the limiting condition and a link to its Settings section. Saving a limit is not proof of resumption; reflect queue/dispatch state from the Host.
+5. **Cleanup:** Worktrees → inspect exact target → preview with reasons → confirm → show actual result. A changed run/Git state invalidates the preview.
+6. **Provider change:** Settings explains dependent runs/intents and refuses an unsafe switch; do not offer a migration wizard or silently move history to another provider.
+
+## Visual acceptance
+
+Before accepting Client implementation, collect screenshots within the real DSH shell at 1440×900, 1024×768 and 390×844, in light and dark themes. Include populated runs + selected details, human blocker, budget pause, failed delivery, cleanup preview/rejection, provider Settings and empty/disconnected states. These are review deliverables for implementation, not evidence already produced.
+
+Check legibility and consistent alignment without page-level horizontal overflow; all important actions work with keyboard, visible focus and appropriate dialog focus return. Verify normal text contrast of at least 4.5:1 and meaningful non-text control contrast of 3:1, plus status comprehension without color. Test reduced motion, zoom/reflow, long localized copy and screen-reader names/live feedback. Review screenshots against the visual table above; reject the change if it introduces an unrelated design system or obscures operational decisions.
+
+Functional scenarios belong to [component acceptance](ui-components.md#component-acceptance). Verify public DSH Web reuse against the pinned dependency and current upstream source.

package/lib/admission/cancellation-control.d.ts

@@ -0,0 +1,11 @@
+import type { CancelledRun, RunId } from './model.js';
+import type { AdmissionDependencies } from './ports.js';
+export declare class CancellationControl {
+    private readonly dependencies;
+    constructor(dependencies: AdmissionDependencies);
+    /**
+     * Atomically end one quiescent queued, paused, or blocked run while retaining every durable identity and external
+     * intent. Cancellation performs no tracker, Session, Git, publication, or delivery effect and accepts no signal.
+     */
+    cancel(runId: RunId, requestId: string): Promise<CancelledRun>;
+}

package/lib/admission/cancellation-control.js

@@ -0,0 +1,72 @@
+import { STATE_KEY } from './constants.js';
+import { isPausedActiveRun, isPausedQueuedRun } from './policy.js';
+import { operatorCommandSchema, runIdSchema, stateSchema } from './state.js';
+export class CancellationControl {
+    dependencies;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    /**
+     * Atomically end one quiescent queued, paused, or blocked run while retaining every durable identity and external
+     * intent. Cancellation performs no tracker, Session, Git, publication, or delivery effect and accepts no signal.
+     */
+    async cancel(runId, requestId) {
+        const parsedRunId = runIdSchema.parse(runId);
+        const parsedRequestId = operatorCommandSchema.shape.requestId.parse(requestId);
+        let cancelled;
+        await this.dependencies.table().update(STATE_KEY, (current) => {
+            const index = current.runs.findIndex((run) => run.runId === parsedRunId);
+            const run = current.runs[index];
+            if (run === undefined)
+                throw new Error(`run "${parsedRunId}" does not exist`);
+            if (run.state === 'cancelled') {
+                if (run.cancellation.requestId !== parsedRequestId) {
+                    throw new Error(`run "${parsedRunId}" was already cancelled by another request`);
+                }
+                cancelled = structuredClone(run);
+                return current;
+            }
+            const nextRun = cancelRun(run, parsedRequestId);
+            cancelled = nextRun;
+            const next = structuredClone(current);
+            next.runs[index] = nextRun;
+            next.revision += 1;
+            return stateSchema.parse(next);
+        });
+        if (cancelled === undefined)
+            throw new Error(`run "${parsedRunId}" was not cancelled`);
+        return structuredClone(cancelled);
+    }
+}
+function cancelRun(run, requestId) {
+    const cancellationBase = { requestId, cancelledAt: new Date().toISOString() };
+    if (run.state === 'queued') {
+        return { ...structuredClone(run), state: 'cancelled', cancellation: { ...cancellationBase, from: 'queued' } };
+    }
+    if (isPausedQueuedRun(run)) {
+        return {
+            ...structuredClone(run),
+            state: 'cancelled',
+            cancellation: { ...cancellationBase, from: 'paused-queued' },
+        };
+    }
+    if (isPausedActiveRun(run)) {
+        return {
+            ...structuredClone(run),
+            state: 'cancelled',
+            cancellation: { ...cancellationBase, from: 'paused-active' },
+        };
+    }
+    if (run.state === 'blocked') {
+        if (run.outcome.kind !== 'blocked')
+            throw new Error(`run "${run.runId}" has an invalid blocked outcome`);
+        return {
+            ...structuredClone(run),
+            outcome: run.outcome,
+            state: 'cancelled',
+            cancellation: { ...cancellationBase, from: 'blocked' },
+        };
+    }
+    throw new Error(`run "${run.runId}" cannot be cancelled from ${run.state}`);
+}
+//# sourceMappingURL=cancellation-control.js.map

package/lib/admission/cancellation-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancellation-control.js","sourceRoot":"","sources":["../../src/admission/cancellation-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,MAAM,OAAO,mBAAmB;IACD,YAAY;IAAzC,YAA6B,YAAmC;4BAAnC,YAAY;IAA0B,CAAC;IAEpE;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,SAAiB;QAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9E,IAAI,SAAmC,CAAA;QACvC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAA;YACxE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,WAAW,kBAAkB,CAAC,CAAA;YAC7E,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,QAAQ,WAAW,4CAA4C,CAAC,CAAA;gBAClF,CAAC;gBACD,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;gBAChC,OAAO,OAAO,CAAA;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YAC/C,SAAS,GAAG,OAAO,CAAA;YAEnB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,OAAO,CAAA;YAC1B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAA;YAClB,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC,CAAC,CAAA;QACF,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,WAAW,qBAAqB,CAAC,CAAA;QACtF,OAAO,eAAe,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAiB,EAAE,SAAiB;IACrD,MAAM,gBAAgB,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7E,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAA;IAC/G,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,eAAe,CAAC,GAAG,CAAC;YACvB,KAAK,EAAE,WAAW;YAClB,YAAY,EAAE,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE;SAC7D,CAAA;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,eAAe,CAAC,GAAG,CAAC;YACvB,KAAK,EAAE,WAAW;YAClB,YAAY,EAAE,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE;SAC7D,CAAA;IACH,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,KAAK,kCAAkC,CAAC,CAAA;QACxG,OAAO;YACL,GAAG,eAAe,CAAC,GAAG,CAAC;YACvB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,WAAW;YAClB,YAAY,EAAE,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;SACvD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,KAAK,8BAA8B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;AAC7E,CAAC"}

package/lib/admission/candidates.d.ts

@@ -0,0 +1,2 @@
+import type { TrackerIssueSnapshot, TrackerProviderId, TrackerReader } from '../tracker.js';
+export declare function readEveryCandidate(reader: TrackerReader, providerId: TrackerProviderId, signal?: AbortSignal): Promise<TrackerIssueSnapshot[]>;

package/lib/admission/candidates.js

@@ -0,0 +1,23 @@
+import { TrackerProviderError } from '../tracker.js';
+import { MAX_CANDIDATE_BYTES, MAX_CANDIDATES, textEncoder } from './constants.js';
+export async function readEveryCandidate(reader, providerId, signal) {
+    const issues = [];
+    const seenCursors = new Set();
+    let totalCandidateBytes = 0;
+    let cursor;
+    do {
+        signal?.throwIfAborted();
+        const page = await reader.readCandidates(cursor, signal);
+        totalCandidateBytes += textEncoder.encode(JSON.stringify(page)).byteLength;
+        if (issues.length + page.issues.length > MAX_CANDIDATES || totalCandidateBytes > MAX_CANDIDATE_BYTES) {
+            throw new TrackerProviderError('invalid-response', `tracker provider "${providerId}" exceeded admission bounds`);
+        }
+        issues.push(...page.issues);
+        cursor = page.nextCursor;
+        if (cursor !== undefined && (!seenCursors.add(cursor) || seenCursors.size > 1000)) {
+            throw new TrackerProviderError('invalid-response', `tracker provider "${providerId}" returned a non-terminating cursor sequence`);
+        }
+    } while (cursor !== undefined);
+    return issues;
+}
+//# sourceMappingURL=candidates.js.map

package/lib/admission/candidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidates.js","sourceRoot":"","sources":["../../src/admission/candidates.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAqB,EACrB,UAA6B,EAC7B,MAAoB;IAEpB,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAC3B,IAAI,MAA0B,CAAA;IAC9B,GAAG,CAAC;QACF,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACxD,mBAAmB,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAA;QAC1E,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,cAAc,IAAI,mBAAmB,GAAG,mBAAmB,EAAE,CAAC;YACrG,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,qBAAqB,UAAU,6BAA6B,CAAC,CAAA;QAClH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;QACxB,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,EAClB,qBAAqB,UAAU,8CAA8C,CAC9E,CAAA;QACH,CAAC;IACH,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAC;IAC9B,OAAO,MAAM,CAAA;AACf,CAAC"}

package/lib/admission/composition-claim.d.ts

@@ -0,0 +1,10 @@
+import type { AgentExecutionComposition } from './model.js';
+declare const preparedCompositionBrand: unique symbol;
+/** One-shot proof that Dispatch resolved this composition through the live DSH services. */
+export interface PreparedAgentComposition {
+    readonly [preparedCompositionBrand]: true;
+    readonly composition: AgentExecutionComposition;
+}
+export declare function issuePreparedAgentComposition(composition: AgentExecutionComposition): PreparedAgentComposition;
+export declare function consumePreparedAgentComposition(claim: PreparedAgentComposition): AgentExecutionComposition;
+export {};

package/lib/admission/composition-claim.js

@@ -0,0 +1,13 @@
+const liveClaims = new WeakSet();
+export function issuePreparedAgentComposition(composition) {
+    const claim = { composition: structuredClone(composition) };
+    liveClaims.add(claim);
+    return claim;
+}
+export function consumePreparedAgentComposition(claim) {
+    if (!liveClaims.delete(claim)) {
+        throw new Error('agent composition was not prepared by the live DSH composition authority');
+    }
+    return structuredClone(claim.composition);
+}
+//# sourceMappingURL=composition-claim.js.map

package/lib/admission/composition-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition-claim.js","sourceRoot":"","sources":["../../src/admission/composition-claim.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAA;AAExC,MAAM,UAAU,6BAA6B,CAAC,WAAsC;IAClF,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC,EAA8B,CAAA;IACvF,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAA+B;IAC7E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;AAC3C,CAAC"}

package/lib/admission/constants.d.ts

@@ -0,0 +1,12 @@
+export declare const MAX_INGRESS_RECEIPTS = 2048;
+export declare const MAX_OPERATOR_COMMANDS = 64;
+export declare const MAX_STATE_BYTES: number;
+export declare const MAX_SUMMARY_BYTES = 2048;
+export declare const MAX_BRIEF_BYTES: number;
+export declare const MAX_CANDIDATES = 1000;
+export declare const MAX_CANDIDATE_BYTES: number;
+export declare const MAX_OUTCOME_TEXT_BYTES: number;
+export declare const MAX_AUTOMATIC_EXTERNAL_ATTEMPTS = 5;
+export declare const STATE_KEY: 'primary';
+export declare const ID_PATTERN: RegExp;
+export declare const textEncoder: TextEncoder;

package/lib/admission/constants.js

@@ -0,0 +1,13 @@
+export const MAX_INGRESS_RECEIPTS = 2048;
+export const MAX_OPERATOR_COMMANDS = 64;
+export const MAX_STATE_BYTES = 4 * 1024 * 1024;
+export const MAX_SUMMARY_BYTES = 2048;
+export const MAX_BRIEF_BYTES = 32 * 1024;
+export const MAX_CANDIDATES = 1000;
+export const MAX_CANDIDATE_BYTES = 16 * 1024 * 1024;
+export const MAX_OUTCOME_TEXT_BYTES = 4 * 1024;
+export const MAX_AUTOMATIC_EXTERNAL_ATTEMPTS = 5;
+export const STATE_KEY = 'primary';
+export const ID_PATTERN = /^[a-z0-9][a-z0-9._:-]*$/;
+export const textEncoder = new TextEncoder();
+//# sourceMappingURL=constants.js.map

package/lib/admission/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/admission/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAA;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAA;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,CAAA;AAC9C,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAA;AAChD,MAAM,CAAC,MAAM,SAAS,GAAG,SAAkB,CAAA;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,yBAAyB,CAAA;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA"}

package/lib/admission/deliveries.d.ts

@@ -0,0 +1,6 @@
+import type { AutopilotSettings } from '../config.js';
+import { type NotificationEvent } from '../notification.js';
+import type { AutopilotRun, DeliveryRecord, PublicationIntent, TerminalRun } from './model.js';
+export declare function appendLifecycleDeliveries(run: AutopilotRun, settings: AutopilotSettings, type: NotificationEvent['type'], runRevision: number, timestamp: string): DeliveryRecord[];
+export declare function publicationIntent(run: TerminalRun): PublicationIntent;
+export declare function sanitizeDeliveryError(error: unknown): string;

package/lib/admission/deliveries.js

@@ -0,0 +1,175 @@
+import { createHash } from 'node:crypto';
+import { notificationDestinationId, notificationProviderId } from '../notification.js';
+import { MAX_OUTCOME_TEXT_BYTES } from './constants.js';
+import { truncateUtf8 } from './policy.js';
+export function appendLifecycleDeliveries(run, settings, type, runRevision, timestamp) {
+    const eventId = stableId('event', run.runId, type, String(runRevision));
+    const event = lifecycleEvent(run, type, eventId, timestamp);
+    const deliveries = structuredClone(run.deliveries).map((delivery) => {
+        if (delivery.kind !== 'tracker-projection' || ['succeeded', 'retired'].includes(delivery.status))
+            return delivery;
+        const { exhaustedFrom: _exhaustedFrom, nextRetryAt: _nextRetryAt, owner: _owner, ...withoutOwner } = delivery;
+        return { ...withoutOwner, status: 'retired' };
+    });
+    const report = trackerDelivery(run, event, runRevision, 'report');
+    const projection = trackerDelivery(run, event, runRevision, 'projection');
+    deliveries.push(recordForTracker(run, eventId, report), recordForTracker(run, eventId, projection));
+    for (const subscription of settings.notificationSubscriptions) {
+        if (!subscription.events.includes(type))
+            continue;
+        const providerId = notificationProviderId(subscription.providerId);
+        const destinationId = notificationDestinationId(subscription.destinationId);
+        deliveries.push({
+            ...recordBase(stableId('delivery', eventId, providerId, destinationId), eventId),
+            kind: 'notification',
+            providerId,
+            destinationId,
+            payload: {
+                ...event,
+                summary: subscription.summaryDisclosure === 'full'
+                    ? event.summary
+                    : `${run.displayKey} ${type}; open the validated run link for details.`,
+                runUrl: renderUrl(settings.runUrlTemplate, '{runId}', run.runId),
+                issueUrl: renderUrl(settings.issueUrlTemplate, '{displayKey}', run.displayKey),
+            },
+        });
+    }
+    return deliveries;
+}
+export function publicationIntent(run) {
+    if (run.state !== 'publishing' || run.outcome.kind !== 'verified' || run.execution.git === undefined) {
+        throw new Error('publication intent requires a verified publishing run with exact Git facts');
+    }
+    const marker = `<!-- dsh-autopilot:run:${run.runId} -->`;
+    return {
+        id: `publication:${run.runId}`,
+        revision: 1,
+        providerId: run.execution.codeHost.providerId,
+        bindingId: run.execution.codeHost.bindingId,
+        repositoryId: run.execution.codeHost.repositoryId,
+        repository: run.execution.codeHost.repository,
+        baseBranch: run.execution.baseBranch,
+        headBranch: run.execution.branch,
+        baseHead: run.execution.git.baseHead,
+        localHead: run.execution.git.head,
+        marker,
+        title: run.outcome.suggestedPullRequest.title,
+        body: pullRequestBody(run, marker),
+        status: 'pending',
+        attempts: 0,
+    };
+}
+function lifecycleEvent(run, type, eventId, timestamp) {
+    const outcome = 'outcome' in run ? run.outcome : undefined;
+    const pullRequestUrl = 'publication' in run ? run.publication?.receipt?.url : undefined;
+    const tokens = 'budget' in run && !run.budget.usageUncertain ? run.budget.settledTokens : undefined;
+    return {
+        version: 1,
+        eventId,
+        runId: run.runId,
+        timestamp,
+        type,
+        issueIdentity: `${run.providerId}:${run.bindingId}:${run.issueId}`,
+        displayKey: run.displayKey,
+        summary: outcome?.summary ?? `${run.displayKey} ${type}`,
+        ...(type === 'blocked'
+            ? { actionNeeded: 'Resolve the reported blocker and apply a new attributable human readiness transition.' }
+            : {}),
+        ...(pullRequestUrl === undefined ? {} : { pullRequestUrl }),
+        usage: tokens === undefined
+            ? { kind: 'unknown' }
+            : {
+                kind: 'provider',
+                tokens,
+            },
+    };
+}
+function trackerDelivery(run, event, runRevision, kind) {
+    const deliveryId = stableId('tracker', event.eventId, kind);
+    if (kind === 'projection') {
+        return {
+            kind,
+            deliveryId,
+            eventId: event.eventId,
+            bindingId: run.bindingId,
+            issueId: run.issueId,
+            displayKey: run.displayKey,
+            readinessGeneration: run.readinessGeneration,
+            runRevision,
+            desiredState: event.type === 'started' ? 'implementing' : event.type,
+        };
+    }
+    return {
+        kind,
+        deliveryId,
+        eventId: event.eventId,
+        bindingId: run.bindingId,
+        issueId: run.issueId,
+        displayKey: run.displayKey,
+        body: trackerReport(run, event),
+    };
+}
+function trackerReport(run, event) {
+    const lines = [
+        `Generated by dsh-autopilot (AI-assisted execution).`,
+        `<!-- dsh-autopilot:event:${event.eventId} -->`,
+        '',
+        `Run ${run.runId} ${event.type}: ${event.summary}`,
+    ];
+    if ('outcome' in run) {
+        lines.push('', 'Evidence:', ...run.outcome.evidence.map((entry) => `- ${entry}`));
+    }
+    if (event.pullRequestUrl !== undefined)
+        lines.push('', `Pull request: ${event.pullRequestUrl}`);
+    if (event.actionNeeded !== undefined)
+        lines.push('', `Action needed: ${event.actionNeeded}`);
+    return truncateUtf8(lines.join('\n'), 32 * 1024);
+}
+function renderUrl(template, placeholder, value) {
+    const url = new URL(template.replace(placeholder, encodeURIComponent(value)));
+    if (url.protocol !== 'https:' || url.username !== '' || url.password !== '') {
+        throw new TypeError('notification links require validated HTTPS templates without credentials');
+    }
+    return url.href;
+}
+function pullRequestBody(run, marker) {
+    if (run.outcome.kind !== 'verified')
+        throw new Error('pull-request body requires a verified outcome');
+    const checks = run.outcome.verification.map(formatVerification);
+    const suffix = [
+        '',
+        '---',
+        `Tracker: ${run.displayKey}`,
+        `Autopilot run: ${run.runId}`,
+        '',
+        'Verification:',
+        ...checks,
+        '',
+        marker,
+    ].join('\n');
+    const maximumSuggestionBytes = 32 * 1024 - Buffer.byteLength(suffix);
+    if (maximumSuggestionBytes < 1)
+        throw new RangeError('publication metadata exceeds its durable bound');
+    return `${truncateUtf8(run.outcome.suggestedPullRequest.body, maximumSuggestionBytes)}${suffix}`;
+}
+function formatVerification(result) {
+    const reason = result.reason === undefined ? '' : ` (${result.reason})`;
+    return `- ${result.status}: \`${result.command.replaceAll('`', "'")}\` — ${result.summary}${reason}`;
+}
+function recordForTracker(run, eventId, payload) {
+    const base = recordBase(stableId('delivery', payload.deliveryId), eventId);
+    return payload.kind === 'report'
+        ? { ...base, kind: 'tracker-report', providerId: run.providerId, payload }
+        : { ...base, kind: 'tracker-projection', providerId: run.providerId, payload };
+}
+function recordBase(id, eventId) {
+    return { id, eventId, revision: 1, status: 'pending', attempts: 0 };
+}
+function stableId(prefix, ...parts) {
+    return `${prefix}:${createHash('sha256').update(parts.join('\0')).digest('hex').slice(0, 40)}`;
+}
+export function sanitizeDeliveryError(error) {
+    const value = error instanceof Error ? error.message : String(error);
+    return (truncateUtf8(value.replaceAll(/https?:\/\/[^\s]+/g, '[redacted-url]'), MAX_OUTCOME_TEXT_BYTES) || 'delivery failed');
+}
+//# sourceMappingURL=deliveries.js.map

package/lib/admission/deliveries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveries.js","sourceRoot":"","sources":["../../src/admission/deliveries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAA0B,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE9G,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI1C,MAAM,UAAU,yBAAyB,CACvC,GAAiB,EACjB,QAA2B,EAC3B,IAA+B,EAC/B,WAAmB,EACnB,SAAiB;IAEjB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAA;QACjH,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAA;QAC7G,OAAO,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAA;IACxD,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IACjE,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;IACzE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;IACnG,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,yBAAyB,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QACjD,MAAM,UAAU,GAAG,sBAAsB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAClE,MAAM,aAAa,GAAG,yBAAyB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;QAC3E,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC;YAChF,IAAI,EAAE,cAAc;YACpB,UAAU;YACV,aAAa;YACb,OAAO,EAAE;gBACP,GAAG,KAAK;gBACR,OAAO,EACL,YAAY,CAAC,iBAAiB,KAAK,MAAM;oBACvC,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,4CAA4C;gBAC3E,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC;gBAChE,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC;aAC/E;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAgB;IAChD,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,GAAG,CAAC,KAAK,MAAM,CAAA;IACxD,OAAO;QACL,EAAE,EAAE,eAAe,GAAG,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU;QAC7C,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS;QAC3C,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY;QACjD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU;QAC7C,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,UAAU;QACpC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;QAChC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI;QACjC,MAAM;QACN,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK;QAC7C,IAAI,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC;QAClC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,CAAC;KACZ,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CACrB,GAAiB,EACjB,IAA+B,EAC/B,OAAe,EACf,SAAiB;IAEjB,MAAM,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,MAAM,cAAc,GAAG,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,MAAM,MAAM,GAAG,QAAQ,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAA;IACnG,OAAO;QACL,OAAO,EAAE,CAAC;QACV,OAAO;QACP,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS;QACT,IAAI;QACJ,aAAa,EAAE,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE;QAClE,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE;QACxD,GAAG,CAAC,IAAI,KAAK,SAAS;YACpB,CAAC,CAAC,EAAE,YAAY,EAAE,uFAAuF,EAAE;YAC3G,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,KAAK,EACH,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;YACrB,CAAC,CAAC;gBACE,IAAI,EAAE,UAAU;gBAChB,MAAM;aACP;KACR,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CACtB,GAAiB,EACjB,KAAqB,EACrB,WAAmB,EACnB,IAAqC;IAErC,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI;YACJ,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,WAAW;YACX,YAAY,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;SACrE,CAAA;IACH,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC;KAChC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAiB,EAAE,KAAqB;IAC7D,MAAM,KAAK,GAAG;QACZ,qDAAqD;QACrD,4BAA4B,KAAK,CAAC,OAAO,MAAM;QAC/C,EAAE;QACF,OAAO,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;KACnD,CAAA;IACD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,KAAK,CAAC,cAAc,EAAE,CAAC,CAAA;IAC/F,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;IAC5F,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,WAAmB,EAAE,KAAa;IACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB,EAAE,MAAc;IACvD,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IACrG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG;QACb,EAAE;QACF,KAAK;QACL,YAAY,GAAG,CAAC,UAAU,EAAE;QAC5B,kBAAkB,GAAG,CAAC,KAAK,EAAE;QAC7B,EAAE;QACF,eAAe;QACf,GAAG,MAAM;QACT,EAAE;QACF,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACpE,IAAI,sBAAsB,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAA;IACtG,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,CAAC,GAAG,MAAM,EAAE,CAAA;AAClG,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA0B;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAA;IACvE,OAAO,KAAK,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,MAAM,CAAC,OAAO,GAAG,MAAM,EAAE,CAAA;AACtG,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAiB,EAAE,OAAe,EAAE,OAAgC;IAC5F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;IAC1E,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE;QAC1E,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAA;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,OAAe;IAC7C,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,MAAwC,EAAE,GAAG,KAAe;IAC5E,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;AAChG,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,CACL,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,IAAI,iBAAiB,CACpH,CAAA;AACH,CAAC"}

package/lib/admission/delivery-control.d.ts

@@ -0,0 +1,28 @@
+import type { NotificationReceipt } from '../notification.js';
+import type { TrackerOutboundReceipt } from '../tracker.js';
+import type { DeliveryRecord, RunId } from './model.js';
+import type { AdmissionDependencies } from './ports.js';
+export declare class DeliveryControl {
+    private readonly dependencies;
+    constructor(dependencies: AdmissionDependencies);
+    claim(deliveryId: string): Promise<{
+        runId: RunId;
+        delivery: DeliveryRecord;
+        owner: string;
+    }>;
+    assertOwner(runId: RunId, deliveryId: string, owner: string): void;
+    succeed(runId: RunId, deliveryId: string, owner: string, receipt: TrackerOutboundReceipt | NotificationReceipt): Promise<DeliveryRecord>;
+    fail(runId: RunId, deliveryId: string, owner: string, error: unknown, status: 'uncertain' | 'retryable-failure' | 'permanent-failure', retryAfterMs?: number): Promise<DeliveryRecord>;
+    retry(deliveryId: string): Promise<DeliveryRecord>;
+    /** Retire one failed mutable projection and atomically persist a revisioned replacement for current lifecycle state. */
+    repairProjection(deliveryId: string): Promise<DeliveryRecord>;
+    private updateOwned;
+}
+export declare class SupersededProjectionError extends Error {
+    readonly delivery: Extract<DeliveryRecord, {
+        kind: 'tracker-projection';
+    }>;
+    constructor(delivery: Extract<DeliveryRecord, {
+        kind: 'tracker-projection';
+    }>);
+}