@cotal-ai/core 0.48.2 → 0.49.0

package/dist/run-admission.js

@@ -0,0 +1,193 @@
+import { canonicalJson } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { assertIdToken, endpointToken } from "./endpoint-subjects.js";
+import { isCasLoss } from "./endpoint-records.js";
+import { AUTHORITY_STORE_IMMUTABLE_FLAGS, WRITE_ONCE_PER_KEY, assertStoreShape, issuedPermitsPattern, issuedPermitsSubject, readIssuedSubjectPermissions, } from "./issued-authority.js";
+import { chatSubject, token } from "./subjects.js";
+export function admissionBucket(space) {
+    return `cotal_admission_${token(space)}`;
+}
+export function admissionKey(endpoint, runId) {
+    return `admission.v1.${endpointToken(endpoint)}.${assertIdToken(runId, "runId")}`;
+}
+export function revocationKey(endpoint, runId) {
+    return `revoked.v1.${endpointToken(endpoint)}.${assertIdToken(runId, "runId")}`;
+}
+function closed(value, keys, label) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} must be a plain record`);
+    for (const key of Object.keys(value))
+        if (!keys.includes(key))
+            throw new Error(`${label} carries an unsupported field ${key}`);
+    return value;
+}
+function callerSnapshot(value) {
+    const raw = closed(value, ["owner", "actor", "uid", "generation"], "admission caller");
+    if (typeof raw.owner !== "string" || typeof raw.actor !== "string" || typeof raw.uid !== "string"
+        || (raw.generation !== undefined && typeof raw.generation !== "string"))
+        throw new Error("admission caller is malformed");
+    return Object.freeze({ owner: raw.owner, actor: raw.actor, uid: raw.uid, ...(raw.generation !== undefined ? { generation: raw.generation } : {}) });
+}
+function provenanceSnapshot(value) {
+    const raw = closed(value, ["kind", "ref", "resolvedRevision", "by", "reason"], "admission provenance");
+    if (raw.kind === "issued") {
+        const ref = closed(raw.ref, ["space", "owner", "actor", "uid", "generation"], "admission issued ref");
+        if (!["space", "owner", "actor", "uid", "generation"].every((k) => typeof ref[k] === "string")
+            || typeof raw.resolvedRevision !== "number" || !Number.isSafeInteger(raw.resolvedRevision) || raw.resolvedRevision <= 0
+            || raw.by !== undefined || raw.reason !== undefined)
+            throw new Error("issued admission provenance is malformed");
+        const pinned = { space: ref.space, owner: ref.owner, actor: ref.actor, uid: ref.uid, generation: ref.generation };
+        return Object.freeze({ kind: "issued", ref: Object.freeze(pinned), resolvedRevision: raw.resolvedRevision });
+    }
+    if (raw.kind === "operator") {
+        if (typeof raw.by !== "string" || raw.by.length === 0 || typeof raw.reason !== "string" || raw.reason.length === 0
+            || raw.ref !== undefined || raw.resolvedRevision !== undefined)
+            throw new Error("operator admission provenance is malformed");
+        return Object.freeze({ kind: "operator", by: raw.by, reason: raw.reason });
+    }
+    throw new Error("unsupported admission provenance");
+}
+/** Validate a record at the consuming boundary: closed schema, version, coordinates. */
+export function admissionSnapshot(value) {
+    const raw = closed(value, ["version", "space", "endpoint", "runId", "instanceId", "caller", "ceiling", "provenance", "admittedAt"], "run admission");
+    if (raw.version !== 1)
+        throw new Error(`unsupported run admission version ${String(raw.version)}`);
+    if (typeof raw.space !== "string" || typeof raw.endpoint !== "string" || typeof raw.runId !== "string" || typeof raw.instanceId !== "string"
+        || typeof raw.admittedAt !== "number" || !Number.isSafeInteger(raw.admittedAt) || raw.admittedAt <= 0)
+        throw new Error("run admission is malformed");
+    endpointToken(raw.space);
+    endpointToken(raw.endpoint);
+    assertIdToken(raw.runId, "runId");
+    const caller = callerSnapshot(raw.caller);
+    const provenance = provenanceSnapshot(raw.provenance);
+    if (provenance.kind === "issued") {
+        const r = provenance.ref;
+        if (r.space !== raw.space || r.owner !== caller.owner || r.actor !== caller.actor || r.uid !== caller.uid || caller.generation !== r.generation)
+            throw new Error("run admission's issued reference disagrees with its caller");
+    }
+    return Object.freeze({
+        version: 1, space: raw.space, endpoint: raw.endpoint, runId: raw.runId, instanceId: raw.instanceId,
+        caller, ceiling: readIssuedSubjectPermissions(raw.ceiling), provenance, admittedAt: raw.admittedAt,
+    });
+}
+export function revocationSnapshot(value, runId) {
+    const raw = closed(value, ["version", "runId", "reason", "by", "revokedAt"], "run revocation");
+    if (raw.version !== 1 || raw.runId !== runId || typeof raw.reason !== "string" || typeof raw.by !== "string"
+        || typeof raw.revokedAt !== "number" || !Number.isSafeInteger(raw.revokedAt) || raw.revokedAt <= 0)
+        throw new Error("run revocation is malformed");
+    return Object.freeze({ version: 1, runId, reason: raw.reason, by: raw.by, revokedAt: raw.revokedAt });
+}
+const enc = new TextEncoder();
+const dec = new TextDecoder("utf-8", { fatal: true });
+/** Leader-served point read of one admission-store key. Absence is `undefined`; a deletion
+ *  marker or an unreadable value is a refusal. */
+async function readLeader(jsm, space, key) {
+    const bucket = admissionBucket(space);
+    let m;
+    try {
+        m = await jsm.streams.getMessage(`KV_${bucket}`, { last_by_subj: `$KV.${bucket}.${key}` });
+    }
+    catch (e) {
+        if (e.code === 10037)
+            return undefined;
+        throw e;
+    }
+    if (!m)
+        return undefined;
+    if (m.header?.get("KV-Operation"))
+        throw new EpEnvelopeError("failed-precondition", `admission row ${key} carries a deletion marker; a deletion is never absence (SPEC 14.8)`);
+    return { value: JSON.parse(dec.decode(m.data)), revision: m.seq };
+}
+/** Create the admission, create-only. A second create for the same run is a conflict: a run is
+ *  admitted once, and a re-admission is a new run (a fork) or an explicit migration. */
+export async function createRunAdmission(kv, admission) {
+    const snap = admissionSnapshot(admission);
+    try {
+        return await kv.create(admissionKey(snap.endpoint, snap.runId), enc.encode(canonicalJson(snap)));
+    }
+    catch (e) {
+        if (isCasLoss(e))
+            throw new EpEnvelopeError("conflict", `run ${snap.runId} is already admitted; an admission is written once (SPEC 14.8)`);
+        throw e;
+    }
+}
+/** Create the revocation marker, create-only and idempotent on an existing marker. */
+export async function revokeRunAdmission(kv, endpoint, revocation) {
+    const snap = revocationSnapshot(revocation, revocation.runId);
+    try {
+        await kv.create(revocationKey(endpoint, snap.runId), enc.encode(canonicalJson(snap)));
+    }
+    catch (e) {
+        if (!isCasLoss(e))
+            throw e;
+    }
+}
+/** The admission a host acts on: the record must exist, match its coordinates, and carry no
+ *  revocation marker. Missing, unreadable, malformed, mismatched, or revoked all refuse. */
+export async function readRunAdmission(jsm, space, endpoint, runId) {
+    const entry = await readLeader(jsm, space, admissionKey(endpoint, runId));
+    if (entry === undefined)
+        throw new EpEnvelopeError("permission-denied", `run ${runId} has no admission record on endpoint ${endpoint}; a run with no admission runs no channel effect (SPEC 14.8)`);
+    let admission;
+    try {
+        admission = admissionSnapshot(entry.value);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("permission-denied", `run ${runId}'s admission record is unreadable (${e.message}); garbled trusted state never authorizes (SPEC 14.8)`);
+    }
+    if (admission.space !== space || admission.endpoint !== endpoint || admission.runId !== runId)
+        throw new EpEnvelopeError("permission-denied", `run ${runId}'s admission record names other coordinates (${admission.space}/${admission.endpoint}/${admission.runId}); refused (SPEC 14.8)`);
+    const marker = await readLeader(jsm, space, revocationKey(endpoint, runId));
+    const revoked = marker === undefined ? undefined : revocationSnapshot(marker.value, runId);
+    return Object.freeze({ admission, revoked });
+}
+/** The channel checks a host applies, over the admitted ceiling. Concrete channels only: a
+ *  wildcard is not a channel a run can post to or await, and a generated name is checked after
+ *  it is derived, by the same rule. */
+export class RunAdmissionDenied extends EpEnvelopeError {
+    constructor(runId, what, channel) {
+        super("permission-denied", `run ${runId} is not admitted to ${what} channel "${channel}" (SPEC 14.8)`);
+        this.name = "RunAdmissionDenied";
+    }
+}
+export function assertAdmittedPublish(view, channel, caller) {
+    assertNotRevoked(view);
+    const subject = chatSubject(view.admission.space, caller.owner, caller.actor, channel);
+    if (!issuedPermitsSubject(view.admission.ceiling.publish, subject))
+        throw new RunAdmissionDenied(view.admission.runId, "publish to", channel);
+}
+export function assertAdmittedSubscribe(view, channel) {
+    assertNotRevoked(view);
+    const pattern = chatSubject(view.admission.space, "*", "*", channel);
+    if (!issuedPermitsPattern(view.admission.ceiling.subscribe, pattern))
+        throw new RunAdmissionDenied(view.admission.runId, "read", channel);
+}
+export function assertNotRevoked(view) {
+    if (view.revoked !== undefined)
+        throw new EpEnvelopeError("permission-denied", `run ${view.admission.runId} was revoked by ${view.revoked.by} (${view.revoked.reason}); no further channel effect runs (SPEC 14.8)`);
+}
+/** Create-or-verify the admission store: `allow_direct=false`, file, no eviction. */
+export async function ensureAdmissionStore(jsm, kvm, space) {
+    const bucket = admissionBucket(space);
+    const stream = `KV_${bucket}`;
+    // WRITE-ONCE PER KEY, AT THE BROKER. Both rows are create-only and the marker is permanent
+    // (SPEC 14.8), and the create-only CAS enforces neither on its own: the `run-admitter` holds a
+    // `$KV.<bucket>.<key>` publish row, and that row carries a plain replacement of the value, a
+    // `Nats-Rollup` header (which replaces the row, or with `all` empties the bucket), a deletion
+    // marker, and a per-key purge. None of them is a CAS write, so none loses the CAS, and a
+    // replacement leaves no marker for the deletion-marker read to catch. The three immutability
+    // flags close rollup, message delete and purge; write-once closes the rest, so the admission a
+    // host reads is the one that was admitted, and each run and each marker still gets its one write.
+    const shape = { ...AUTHORITY_STORE_IMMUTABLE_FLAGS, ...WRITE_ONCE_PER_KEY };
+    if (await jsm.streams.info(stream).catch(() => undefined) === undefined) {
+        await kvm.create(bucket, { allow_direct: false });
+        const created = (await jsm.streams.info(stream)).config;
+        await jsm.streams.update(stream, { ...created, ...shape });
+    }
+    const cfg = (await jsm.streams.info(stream)).config;
+    if (cfg.allow_direct !== false || cfg.storage !== "file" || (cfg.max_age ?? 0) !== 0 || (cfg.max_msgs ?? -1) > 0 || (cfg.max_bytes ?? -1) > 0
+        || !Array.isArray(cfg.subjects) || cfg.subjects.length !== 1 || cfg.subjects[0] !== `$KV.${bucket}.>`)
+        throw new Error(`the run admission store ${bucket} has a drifted shape (allow_direct=${String(cfg.allow_direct)}); an authority store is never silently adopted - reprovision it (SPEC 14.8)`);
+    assertStoreShape(cfg, shape, bucket, "SPEC 14.8");
+}
+//# sourceMappingURL=run-admission.js.map

package/dist/run-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-admission.js","sourceRoot":"","sources":["../src/run-admission.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAiB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,GAG7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,mBAAmB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAa;IAC1D,OAAO,gBAAgB,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAa;IAC3D,OAAO,cAAc,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAClF,CAAC;AAiCD,SAAS,MAAM,CAAC,KAAc,EAAE,IAAuB,EAAE,KAAa;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IAC5H,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,GAAG,EAAE,CAAC,CAAC;IAC/H,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;WAC5F,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAa,CAAC;AAClK,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACvG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACtG,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;eACzF,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,gBAAgB,IAAI,CAAC;eACpH,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAuB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,GAAG,EAAE,GAAG,CAAC,GAAa,EAAE,UAAU,EAAE,GAAG,CAAC,UAAoB,EAAE,CAAC;QACxL,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;eAC7G,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS;YAC9D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;IACrJ,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;WACvI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC;QACzB,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAK,MAAkC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAC1K,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;QAClG,MAAM,EAAE,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;KACnG,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;WACvG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEtD;kDACkD;AAClD,KAAK,UAAU,UAAU,CAAC,GAAqB,EAAE,KAAa,EAAE,GAAW;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;IACN,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAC/D,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,qEAAqE,CAAC,CAAC;IAC9I,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACpE,CAAC;AAED;wFACwF;AACxF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,SAAuB;IACtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,KAAK,gEAAgE,CAAC,CAAC;QAC3I,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,QAAgB,EAAE,UAAyB;IAC1F,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAOD;4FAC4F;AAC5F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAqB,EAAE,KAAa,EAAE,QAAgB,EAAE,KAAa;IAC1G,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,KAAK,wCAAwC,QAAQ,8DAA8D,CAAC,CAAC;IAC7K,IAAI,SAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,KAAK,sCAAuC,CAAW,CAAC,OAAO,uDAAuD,CAAC,CAAC;IAChL,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK;QAC3F,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,KAAK,gDAAgD,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,wBAAwB,CAAC,CAAC;IAC/L,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;uCAEuC;AACvC,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,KAAa,EAAE,IAAY,EAAE,OAAe;QACtD,KAAK,CAAC,mBAAmB,EAAE,OAAO,KAAK,uBAAuB,IAAI,aAAa,OAAO,eAAe,CAAC,CAAC;QACvG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAsB,EAAE,OAAe,EAAE,MAAgB;IAC7F,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAChJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAsB,EAAE,OAAe;IAC7E,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAsB;IACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,mBAAmB,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,+CAA+C,CAAC,CAAC;AACzL,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,GAAQ,EAAE,KAAa;IACvF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;IAC9B,2FAA2F;IAC3F,+FAA+F;IAC/F,6FAA6F;IAC7F,8FAA8F;IAC9F,yFAAyF;IACzF,6FAA6F;IAC7F,+FAA+F;IAC/F,kGAAkG;IAClG,MAAM,KAAK,GAAG,EAAE,GAAG,+BAA+B,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAC5E,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxD,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;WACxI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,IAAI;QACrG,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,sCAAsC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,8EAA8E,CAAC,CAAC;IACjM,gBAAgB,CAAC,GAAyC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC1F,CAAC"}

package/dist/run-driver-grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-driver-grants.d.ts","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAOA,OAAO,EAA2E,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAYhI;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGvD;AAED,mHAAmH;AACnH,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBnI;AAED;;;gGAGgG;AAChG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0DrI;AAED,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;0CAGsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB;;;iFAG6E;IAC7E,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBvI"}
+{"version":3,"file":"run-driver-grants.d.ts","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAOA,OAAO,EAA2E,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAahI;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGvD;AAED,mHAAmH;AACnH,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBnI;AAED;;;gGAGgG;AAChG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DrI;AAED,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;0CAGsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB;;;iFAG6E;IAC7E,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBvI"}

package/dist/run-driver-grants.js

@@ -7,6 +7,7 @@ import { createHash } from "node:crypto";
 import { spacePrefix, chatStream, presenceBucket, channelBucket, membersBucket, assertInboxConnId, DEV_OWNER } from "./subjects.js";
 import { endpointToken, assertIdToken, assertLifecycleToken, epCallerReplyFilter } from "./endpoint-subjects.js";
 import { recordsBucket } from "./endpoint-records.js";
+import { admissionBucket } from "./run-admission.js";
 import { runDriverJournalGrants, runJournalReplayGrants, recordsKvStreamName, epfStreamName, eptStreamName, epcStreamName, } from "./endpoint-binding.js";
 import { epRequestGrantRows, epDescribeAllGrantRow, BASELINE_LIFECYCLE_ENDPOINT } from "./endpoint-grants.js";
 /**
@@ -100,6 +101,9 @@ export function runMediatorGrants(space, args, connId) {
         ...epRequestGrantRows(space, { endpoint: BASELINE_LIFECYCLE_ENDPOINT, command: "despawn", target: { mode: "owner", tOwner: caller.owner } }, caller),
         // The contract store fetch a resolve performs (the subject-scoped form every agent holds).
         `$JS.API.DIRECT.GET.${epcStreamName(space)}.${p}.epc.>`,
+        // The run's admission and revocation rows (SPEC 14.8): a leader-served read before every
+        // channel effect. READ only; the admitter writes them.
+        `$JS.API.STREAM.MSG.GET.KV_${admissionBucket(space)}`,
         "$JS.API.INFO",
     ];
     return { publish, subscribe: [epCallerReplyFilter(space, caller), `_INBOX_${assertInboxConnId(connId)}.>`] };
@@ -128,6 +132,9 @@ export function runOperatorGrants(space, args, connId) {
         // The run and program records of the endpoint, read through the leader-served point read and
         // the consumer-free walk.
         `$JS.API.STREAM.MSG.GET.${recordsKvStreamName(space)}`,
+        // The run's admission and revocation rows (SPEC 14.8): a resume, takeback or served read
+        // decides on them before any drive. READ only; the admitter writes them.
+        `$JS.API.STREAM.MSG.GET.KV_${admissionBucket(space)}`,
         // The named run's journal replay, read-only, under this call's own takeover id.
         ...(args.runId === undefined ? [] : runJournalReplayGrants(space, args.runId, args.takeoverId)),
         // An ANSWER of one pause: its answer record (create-only), the checkpoint status a settle

package/dist/run-driver-grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-driver-grants.js","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAiB,MAAM,wBAAwB,CAAC;AAChI,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAE9G;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAcD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACrF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,OAAO,EAAE;YACP,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;YACtD,OAAO,OAAO,QAAQ,QAAQ,IAAI,GAAG,IAAI;YACzC,OAAO,OAAO,YAAY,QAAQ,IAAI,GAAG,EAAE;YAC3C,OAAO,OAAO,WAAW,QAAQ,IAAI,GAAG,IAAI;YAC5C,OAAO,OAAO,cAAc,QAAQ,IAAI,GAAG,IAAI;YAC/C,cAAc;SACf;QACD,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;;;gGAGgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACvF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG;QACd,wDAAwD;QACxD,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;QACtD,sDAAsD;QACtD,OAAO,OAAO,QAAQ,CAAC,IAAI,GAAG,IAAI;QAClC,OAAO,OAAO,YAAY,CAAC,IAAI,GAAG,EAAE;QACpC,OAAO,OAAO,WAAW,CAAC,IAAI,GAAG,IAAI;QACrC,OAAO,OAAO,cAAc,CAAC,IAAI,GAAG,IAAI;QACxC,OAAO,OAAO,OAAO,CAAC,IAAI;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,8FAA8F;QAC9F,iDAAiD;QACjD,GAAG,CAAC,QAAQ,CAAC,OAAO;QACpB,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,aAAa;QAC/C,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,0FAA0F;QAC1F,0EAA0E;QAC1E,uBAAuB,IAAI,EAAE;QAC7B,0BAA0B,IAAI,EAAE;QAChC,2BAA2B,IAAI,IAAI;QACnC,yBAAyB,IAAI,IAAI;QACjC,6BAA6B,IAAI,IAAI;QACrC,2BAA2B,IAAI,IAAI;QACnC,WAAW,IAAI,IAAI;QACnB,4FAA4F;QAC5F,oBAAoB;QACpB,uBAAuB,GAAG,EAAE;QAC5B,2BAA2B,GAAG,IAAI;QAClC,yBAAyB,GAAG,IAAI;QAChC,2BAA2B,GAAG,IAAI;QAClC,UAAU;QACV,2FAA2F;QAC3F,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,2FAA2F;QAC3F,sFAAsF;QACtF,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC;QACpC,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC;QACjG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACjJ,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACpJ,2FAA2F;QAC3F,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;QACvD,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/G,CAAC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA0B,EAAE,MAAc;IACzF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG;QACd,6FAA6F;QAC7F,0BAA0B;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,gFAAgF;QAChF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/F,0FAA0F;QAC1F,uFAAuF;QACvF,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,OAAO,OAAO,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,EAAE,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnL,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"run-driver-grants.js","sourceRoot":"","sources":["../src/run-driver-grants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAiB,MAAM,wBAAwB,CAAC;AAChI,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAE9G;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAcD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACrF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,OAAO,EAAE;YACP,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;YACtD,OAAO,OAAO,QAAQ,QAAQ,IAAI,GAAG,IAAI;YACzC,OAAO,OAAO,YAAY,QAAQ,IAAI,GAAG,EAAE;YAC3C,OAAO,OAAO,WAAW,QAAQ,IAAI,GAAG,IAAI;YAC5C,OAAO,OAAO,cAAc,QAAQ,IAAI,GAAG,IAAI;YAC/C,cAAc;SACf;QACD,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;;;gGAGgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAwB,EAAE,MAAc;IACvF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,6BAA6B,CAAC,CAAC;IAC3H,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG;QACd,wDAAwD;QACxD,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;QACtD,sDAAsD;QACtD,OAAO,OAAO,QAAQ,CAAC,IAAI,GAAG,IAAI;QAClC,OAAO,OAAO,YAAY,CAAC,IAAI,GAAG,EAAE;QACpC,OAAO,OAAO,WAAW,CAAC,IAAI,GAAG,IAAI;QACrC,OAAO,OAAO,cAAc,CAAC,IAAI,GAAG,IAAI;QACxC,OAAO,OAAO,OAAO,CAAC,IAAI;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,8FAA8F;QAC9F,iDAAiD;QACjD,GAAG,CAAC,QAAQ,CAAC,OAAO;QACpB,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,aAAa;QAC/C,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE;QAChD,0FAA0F;QAC1F,0EAA0E;QAC1E,uBAAuB,IAAI,EAAE;QAC7B,0BAA0B,IAAI,EAAE;QAChC,2BAA2B,IAAI,IAAI;QACnC,yBAAyB,IAAI,IAAI;QACjC,6BAA6B,IAAI,IAAI;QACrC,2BAA2B,IAAI,IAAI;QACnC,WAAW,IAAI,IAAI;QACnB,4FAA4F;QAC5F,oBAAoB;QACpB,uBAAuB,GAAG,EAAE;QAC5B,2BAA2B,GAAG,IAAI;QAClC,yBAAyB,GAAG,IAAI;QAChC,2BAA2B,GAAG,IAAI;QAClC,UAAU;QACV,2FAA2F;QAC3F,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;QACnD,2FAA2F;QAC3F,sFAAsF;QACtF,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC;QACpC,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC;QACjG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACjJ,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;QACpJ,2FAA2F;QAC3F,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;QACvD,yFAAyF;QACzF,uDAAuD;QACvD,6BAA6B,eAAe,CAAC,KAAK,CAAC,EAAE;QACrD,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/G,CAAC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA0B,EAAE,MAAc;IACzF,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG;QACd,6FAA6F;QAC7F,0BAA0B;QAC1B,0BAA0B,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACtD,yFAAyF;QACzF,yEAAyE;QACzE,6BAA6B,eAAe,CAAC,KAAK,CAAC,EAAE;QACrD,gFAAgF;QAChF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/F,0FAA0F;QAC1F,uFAAuF;QACvF,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,OAAO,OAAO,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,EAAE,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnL,cAAc;KACf,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC"}

package/dist/run-host.d.ts

@@ -15,6 +15,7 @@ import type { JetStreamClient, JetStreamManager } from "@nats-io/jetstream";
 import type { KV } from "@nats-io/kv";
 import type { Extension } from "./registry.js";
 import type { RunSpecValue, RunStatusValue } from "./run-record.js";
+import type { RunAdmissionView } from "./run-admission.js";
 /** The kind every run host registers under. */
 export declare const RUN_HOST_KIND = "run-host";
 /** The one language this tree ships a host for. */
@@ -67,6 +68,10 @@ export interface RunHostDriveRequest {
     readonly defaultCheckpointTimeout: string;
     /** The most bytes a settled result may take, from the connection's own `max_payload`. */
     readonly resultBytes?: number;
+    /** The run's ADMISSION (SPEC 14.8), read by the hosting runtime before the drive and re-read at
+     *  every channel effect. A drive without one performs no channel effect: the host refuses at
+     *  the boundary rather than running the effect under the mediator's own authority. */
+    readonly admission: RunAdmissionView;
 }
 /** How a drive attempt ended. `released` is the driver saying the run is not its to continue (a
  *  takeover won, a step was refused on this host, the host asked it to stop, the run was never

package/dist/run-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-host.d.ts","sourceRoot":"","sources":["../src/run-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAChD;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAChE;;;qCAGqC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C;6BAC6B;AAC7B,eAAO,MAAM,sBAAsB,QAAkC,CAAC;AAEtE;mGACmG;AACnG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;kBAEkB;AAClB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;kCAGkC;AAClC,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAClF;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACrG;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE/H;;;2DAG2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;kGAC8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;yFACyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC;mFAC+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,uCAAuC;AACvC,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjI;IACE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE;AACvB,4FAA4F;GAC1F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,aAAa,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IACvD;kFAC8E;IAC9E,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,GAAG,YAAY,CAAC;IAC9F,2FAA2F;IAC3F,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF;gGAC4F;IAC5F,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;2FACuF;IACvF,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC3J,iFAAiF;IACjF,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzF"}
+{"version":3,"file":"run-host.d.ts","sourceRoot":"","sources":["../src/run-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAChD;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAChE;;;qCAGqC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C;6BAC6B;AAC7B,eAAO,MAAM,sBAAsB,QAAkC,CAAC;AAEtE;mGACmG;AACnG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;kBAEkB;AAClB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;0FAEsF;IACtF,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACtC;AAED;;;kCAGkC;AAClC,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAClF;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACrG;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE/H;;;2DAG2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;kGAC8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;yFACyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC;mFAC+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,uCAAuC;AACvC,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjI;IACE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE;AACvB,4FAA4F;GAC1F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,aAAa,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IACvD;kFAC8E;IAC9E,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,GAAG,YAAY,CAAC;IAC9F,2FAA2F;IAC3F,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF;gGAC4F;IAC5F,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;2FACuF;IACvF,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC3J,iFAAiF;IACjF,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzF"}

package/dist/run-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-host.js","sourceRoot":"","sources":["../src/run-host.ts"],"names":[],"mappings":"AAkBA,+CAA+C;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AACxC,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAChD;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAChE;;;qCAGqC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C;6BAC6B;AAC7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,GAAG,MAAM,CAAC"}
+{"version":3,"file":"run-host.js","sourceRoot":"","sources":["../src/run-host.ts"],"names":[],"mappings":"AAmBA,+CAA+C;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AACxC,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAChD;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAChE;;;qCAGqC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C;6BAC6B;AAC7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,GAAG,MAAM,CAAC"}

package/dist/runtime.d.ts

@@ -48,6 +48,9 @@ export interface AgentHandle {
     stop(opts?: {
         graceful?: boolean;
     }): void;
+    /** Release this manager's local handle without stopping or deprovisioning the agent. Optional,
+     *  and absent means the runtime cannot survive manager exit, so callers must fail closed. */
+    release?(): void;
     /** Resolve only after the runtime has authoritatively proved the process/window/workspace is gone.
      * Optional during the preservation rollout; a manager maintenance cut must fail closed when absent. */
     waitForExit?(): Promise<void>;
@@ -61,8 +64,12 @@ export interface AgentHandle {
      *  OPTIONAL, and absent means REFUSE, never degrade: a backend that does not own the child's
      *  input stream (tmux/cmux/orca/herdr attach to an externally-owned process) leaves it off, and
      *  the manager answers `input is not supported by runtime <kind>`. A silent no-op here would be
-     *  a dropped keystroke, which is worse than an error. */
-    write?(data: string): void;
+     *  a dropped keystroke, which is worse than an error.
+     *
+     *  Resolves only after the runtime has accepted the write, with the number of UTF-8 bytes it
+     *  accepted. Rejects when the runtime cannot accept it. A caller must derive any delivery receipt
+     *  from this acknowledgement, never from the buffer it intended to send. */
+    write?(data: string): Promise<number>;
     /** What the runtime OBSERVED when the child ended: the OS exit code, and/or the signal number
      *  that killed it. Meaningful only once {@link status} reports `exited`; before that a backend
      *  returns undefined.
@@ -84,7 +91,28 @@ export interface AgentHandle {
  *  can delegate to an external terminal or process surface. */
 export interface Runtime {
     readonly kind: RuntimeKind;
-    spawn(name: string, spec: LaunchSpec, cwd: string): AgentHandle;
+    /** True only when every handle this runtime creates can release manager-local custody without
+     * stopping the underlying agent. Absent is false for PTY runtimes and irrelevant for runtimes
+     * that hold no process-owning PTY master. */
+    readonly supportsRelease?: boolean;
+    /**
+     * Mint the durable custody reference for a seat this runtime is ABOUT to spawn, before any
+     * process exists. The caller records it durably and then hands the SAME reference back to
+     * {@link spawn}, so the reference precedes the processes it addresses: a crash anywhere after
+     * the spawn leaves an orphan a successor can still address, never a live seat nobody can name.
+     * Minting the id inside `spawn` cannot give that ordering, because the processes are already
+     * running by the time it returns.
+     *
+     * OPTIONAL, and absent means this runtime has no durable custody to reserve (it also has no
+     * {@link reap}); the caller spawns without a reference, as before. A runtime that implements
+     * this MUST spawn the seat under exactly the reference it returned, and report it back on the
+     * handle: a spawn that quietly mints its own id would leave the recorded reference addressing
+     * nothing, which is worse than recording none.
+     */
+    reserve?(): RuntimeReference;
+    /** Spawn the agent. `reference` is a custody reference from {@link reserve}, and a runtime that
+     *  offers `reserve` must honour it exactly; it is absent for a runtime without durable custody. */
+    spawn(name: string, spec: LaunchSpec, cwd: string, reference?: RuntimeReference): AgentHandle;
     /**
      * Reattach this runtime to a handle it created previously. This is a local runtime operation,
      * not a mesh operation. OPTIONAL, and absent means REFUSE, never spawn a replacement: a runtime

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;wDACwD;AACxD,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;2BAE2B;AAC3B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;yGAEqG;IACrG,OAAO,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAChD,0EAA0E;IAC1E,MAAM,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACnC,yCAAyC;IACzC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kCAAkC;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED;2DAC2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC;iFAC6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,IAAI,SAAS,GAAG,QAAQ,CAAC;IAC/B;;uCAEmC;IACnC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C;2GACuG;IACvG,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,SAAS,IAAI,IAAI,CAAC;IAClB;;;;;;;;;6DASyD;IACzD,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;0CAQsC;IACtC,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D;mCAC+B;IAC/B,MAAM,IAAI,aAAa,CAAC;CACzB;AAED;+DAC+D;AAC/D,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC;IAChE;;;;;OAKG;IACH,KAAK,CAAC,CAAC,SAAS,EAAE,gBAAgB,GAAG,WAAW,CAAC;CAClD;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,kFAAkF;IAClF,SAAS,IAAI,OAAO,CAAC;IACrB;kEAC8D;IAC9D,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;CAC5C"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;wDACwD;AACxD,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;2BAE2B;AAC3B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;yGAEqG;IACrG,OAAO,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAChD,0EAA0E;IAC1E,MAAM,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACnC,yCAAyC;IACzC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kCAAkC;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED;2DAC2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC;iFAC6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,IAAI,SAAS,GAAG,QAAQ,CAAC;IAC/B;;uCAEmC;IACnC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C;iGAC6F;IAC7F,OAAO,CAAC,IAAI,IAAI,CAAC;IACjB;2GACuG;IACvG,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,SAAS,IAAI,IAAI,CAAC;IAClB;;;;;;;;;;;;;gFAa4E;IAC5E,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;;;;0CAQsC;IACtC,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D;mCAC+B;IAC/B,MAAM,IAAI,aAAa,CAAC;CACzB;AAED;+DAC+D;AAC/D,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;iDAE6C;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,IAAI,gBAAgB,CAAC;IAC7B;uGACmG;IACnG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,WAAW,CAAC;IAC9F;;;;;OAKG;IACH,KAAK,CAAC,CAAC,SAAS,EAAE,gBAAgB,GAAG,WAAW,CAAC;CAClD;AAGD;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,kFAAkF;IAClF,SAAS,IAAI,OAAO,CAAC;IACrB;kEAC8D;IAC9D,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;CAC5C"}

package/dist/secret-fs.d.ts

@@ -28,6 +28,31 @@ export declare function writeSecretFile(path: string, data: string | Buffer): vo
  * under two truly-concurrent writers to the same file is a rarer residual that would need file locking.
  */
 export declare function writeSecretFileAtomic(path: string, data: string | Buffer): void;
+/** Test-only: drive the `link`-unavailable fallback, which no POSIX CI host can reach naturally.
+ *  Pass `undefined` to restore. Not exported from the package index. */
+export declare function __setPublishLinkForTest(fn: ((from: string, to: string) => void) | undefined): void;
+/**
+ * Create a private secret file that MUST NOT already exist. Bytes are written to a unique temp
+ * sibling first, then {@link linkSync} publishes that complete inode at `path`. `link` is an
+ * atomic filesystem primitive: it fails with EEXIST if the destination exists, so of N concurrent
+ * creators exactly one succeeds and the others observe EEXIST. A concurrent reader never sees a
+ * torn destination because the name appears only after the temp write finished.
+ *
+ * `renameSync` is NOT this function. Rename replaces a winner, which would let every caller keep
+ * the identity it minted in memory. Exclusive create is the mutual-exclusion primitive; atomic
+ * replace is not.
+ *
+ * When the filesystem cannot hard-link (some Windows volumes), the fallback is `wx`
+ * (`O_CREAT|O_EXCL`) on `path` itself, which is still exclusive create, not a replace.
+ *
+ * The TEMP write is exclusive for the same reason the publish is. A temp name is unique only by
+ * probability (pid plus clock plus `Math.random`), and probability is not a concurrency argument:
+ * two creators that collided on the name would plain-overwrite each other's bytes, and then the
+ * one whose `link` succeeded would return the candidate IT minted while the published file held
+ * the OTHER one's identity: the exact split this function exists to prevent, reintroduced one
+ * step earlier. `wx` on the temp makes a collision fail loudly instead of silently swapping bytes.
+ */
+export declare function writeSecretFileCreateOnly(path: string, data: string | Buffer): void;
 /** Create a private directory chain (recursive) and harden it — call BEFORE writing secrets into it
  *  so a child file is born under a private ACL (no creation-race window). POSIX sets 0o700 at create;
  *  win32 hardens the leaf's ACL (children then inherit it). Idempotent. */

package/dist/secret-fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-fs.d.ts","sourceRoot":"","sources":["../src/secret-fs.ts"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CA2BtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAazE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/E;AAED;;2EAE2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG9C"}
+{"version":3,"file":"secret-fs.d.ts","sourceRoot":"","sources":["../src/secret-fs.ts"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CA2BtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAazE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/E;AAuED;wEACwE;AACxE,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,IAAI,CAElG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6BnF;AAED;;2EAE2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG9C"}

package/dist/secret-fs.js

@@ -7,7 +7,7 @@
  * world-readable (e.g. a `.cotal/auth` under a project on a permissive path). The fix is to harden
  * the NTFS ACL explicitly with the built-in `icacls` (no new dependency). See {@link hardenPrivate}.
  */
-import { chmodSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, linkSync, lstatSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join } from "node:path";
 const isWin = process.platform === "win32";
@@ -77,7 +77,7 @@ export function hardenPrivate(path, kind) {
 export function writeSecretFile(path, data) {
     writeFileSync(path, data, { mode: 0o600 });
     if (!isWin)
-        return; // POSIX mode set at create — nothing more to do
+        return; // POSIX mode set at create, nothing more to do
     try {
         hardenPrivate(path, "file");
     }
@@ -86,7 +86,7 @@ export function writeSecretFile(path, data) {
             unlinkSync(path); // best-effort cleanup; the hardening error below is what the caller sees
         }
         catch {
-            /* ignore — surface the original hardening failure, not a secondary unlink error */
+            /* ignore: surface the original hardening failure, not a secondary unlink error */
         }
         throw e;
     }
@@ -115,6 +115,139 @@ export function writeSecretFileAtomic(path, data) {
         throw e;
     }
 }
+/**
+ * {@link writeSecretFile} with `O_EXCL`: the bytes land only if this caller created the name.
+ * Same fail-closed hardening contract as {@link writeSecretFile}: a win32 ACL failure propagates
+ * and the just-written file is best-effort removed, so a caller never proceeds as if the secret
+ * were private. EEXIST propagates to the caller, which is the point: the name was already taken.
+ *
+ * `O_EXCL` alone does not carry that contract everywhere. On POSIX it refuses a final symlink
+ * without following it, so a DANGLING link is EEXIST (measured: file, directory and dangling link
+ * all refuse, and nothing is materialised). On Windows the reparse point resolves, the missing
+ * target is created, and the bytes land at a name this caller did NOT create, which is precisely
+ * what the contract above forbids. A win32-only `lstatSync` closes that: it reports the LINK rather
+ * than its target, so a name that exists in any form is refused before anything is written.
+ *
+ * That pre-check is deliberately NOT run on POSIX. It would be a check-then-act step guarding a
+ * case `O_EXCL` already refuses, and an unnecessary one weakens the very property this function
+ * exists to provide. Where it does run it is a refusal, never a fallback: it only converts a
+ * would-be silent write-through into the EEXIST the caller already handles, and it never decides a
+ * concurrent create: two creators that both find the name free still both reach `O_EXCL`, which is
+ * one syscall and is what picks the winner.
+ */
+function writeSecretFileCreateOnlyRaw(path, data) {
+    // WIN32 ONLY, and deliberately so. Measured on POSIX: `O_EXCL` already refuses a plain file, a
+    // directory AND a dangling symlink with EEXIST, materialising nothing, so a pre-check there
+    // would add a check-then-act step that buys nothing and can only weaken the guarantee. Windows
+    // is the platform where `O_EXCL` RESOLVES a reparse point and creates its target, which would
+    // land bytes at a name the caller never asked for; `lstatSync` reports the link rather than its
+    // target, so the name is refused before anything is written.
+    //
+    // This never decides a concurrent create. Two creators that both see the name free still both
+    // reach `O_EXCL` below, and O_EXCL, one syscall, is what picks the winner. The check only ever
+    // converts a would-be write-through into the EEXIST the caller already handles.
+    if (isWin) {
+        let exists = true;
+        try {
+            lstatSync(path); // the NAME exists (file, dir, or dangling link), never write through it
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+            exists = false;
+        }
+        if (exists) {
+            const taken = new Error(`EEXIST: file already exists, open '${path}'`);
+            taken.code = "EEXIST";
+            throw taken;
+        }
+    }
+    writeFileSync(path, data, { flag: "wx", mode: 0o600 });
+    if (!isWin)
+        return; // POSIX mode set at create, nothing more to do
+    try {
+        hardenPrivate(path, "file");
+    }
+    catch (e) {
+        try {
+            unlinkSync(path); // best-effort cleanup; the hardening error below is what the caller sees
+        }
+        catch {
+            /* ignore: surface the original hardening failure, not a secondary unlink error */
+        }
+        throw e;
+    }
+}
+/**
+ * Publish a completed temp inode at its final name. Separated from {@link writeSecretFileCreateOnly}
+ * because the hard-link primitive is the one part of exclusive create whose AVAILABILITY is
+ * platform-dependent: some Windows volumes and some network filesystems reject `link` outright, and
+ * the caller must then fall back to `O_EXCL` on the destination. Naming that seam also makes the
+ * fallback branch reachable from a suite, so the Windows-side primitive can carry a refusing case
+ * instead of being the one accepting branch nothing grades.
+ */
+let publishLink = linkSync;
+/** Test-only: drive the `link`-unavailable fallback, which no POSIX CI host can reach naturally.
+ *  Pass `undefined` to restore. Not exported from the package index. */
+export function __setPublishLinkForTest(fn) {
+    publishLink = fn ?? linkSync;
+}
+/**
+ * Create a private secret file that MUST NOT already exist. Bytes are written to a unique temp
+ * sibling first, then {@link linkSync} publishes that complete inode at `path`. `link` is an
+ * atomic filesystem primitive: it fails with EEXIST if the destination exists, so of N concurrent
+ * creators exactly one succeeds and the others observe EEXIST. A concurrent reader never sees a
+ * torn destination because the name appears only after the temp write finished.
+ *
+ * `renameSync` is NOT this function. Rename replaces a winner, which would let every caller keep
+ * the identity it minted in memory. Exclusive create is the mutual-exclusion primitive; atomic
+ * replace is not.
+ *
+ * When the filesystem cannot hard-link (some Windows volumes), the fallback is `wx`
+ * (`O_CREAT|O_EXCL`) on `path` itself, which is still exclusive create, not a replace.
+ *
+ * The TEMP write is exclusive for the same reason the publish is. A temp name is unique only by
+ * probability (pid plus clock plus `Math.random`), and probability is not a concurrency argument:
+ * two creators that collided on the name would plain-overwrite each other's bytes, and then the
+ * one whose `link` succeeded would return the candidate IT minted while the published file held
+ * the OTHER one's identity: the exact split this function exists to prevent, reintroduced one
+ * step earlier. `wx` on the temp makes a collision fail loudly instead of silently swapping bytes.
+ */
+export function writeSecretFileCreateOnly(path, data) {
+    const tmp = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+    // Exclusive, so EEXIST here means the temp name belongs to ANOTHER creator. Cleanup below must
+    // never run in that case: unlinking it would delete a live creator's bytes out from under it.
+    writeSecretFileCreateOnlyRaw(tmp, data);
+    try {
+        try {
+            publishLink(tmp, path);
+        }
+        catch (e) {
+            const code = e.code;
+            if (code === "ENOTSUP" || code === "EPERM" || code === "ENOSYS") {
+                writeSecretFileCreateOnlyRaw(path, data);
+            }
+            else {
+                throw e;
+            }
+        }
+    }
+    catch (e) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* ignore: surface the original exclusive-create error */
+        }
+        throw e;
+    }
+    try {
+        unlinkSync(tmp);
+    }
+    catch {
+        /* drop the extra nlink after a successful link, or a leftover temp */
+    }
+}
 /** Create a private directory chain (recursive) and harden it — call BEFORE writing secrets into it
  *  so a child file is born under a private ACL (no creation-race window). POSIX sets 0o700 at create;
  *  win32 hardens the leaf's ACL (children then inherit it). Idempotent. */