@cursor/july 0.1.76 → 0.1.78

package/dist/internal/ledger-serving.js

@@ -1,393 +0,0 @@
-/**
- * Ledger-mode serving seam (`serving: "ledger"` on `defineAgent`): an event
- * pump that routes every engine `send` through the KV session ledger
- * instead of starting turns directly.
- *
- * Delivery: ensureSession (continuation key, as today) → principal gate
- * (an existing session rejects a sender that is not its principal BEFORE
- * anything is parked; mirrors the resident `samePrincipal` check) →
- * appendEvent (payload + CAS — the source ack point moves after this) →
- * claim → drain → run the drained turns through the resident engine path →
- * commit (heartbeats while turns run) → repeat while the commit reports
- * pending. A deliver that finds the lease held walks away (the holder's
- * commit sees the append); the janitor recovers sessions whose holder
- * died. A foreign-principal envelope that reaches the mailbox anyway is
- * consumed and committed away at drain (warn log), never replayed.
- *
- * v1 scope: the mailbox envelope carries `message`, `auth`, `title`,
- * `state`, `mode`, `purpose`, and the isolation-relevant per-send
- * overrides `workspaceDir` and `cloud` — the two options
- * `resolveSessionRuntime` and harness-cwd selection read. Dropping
- * those is a sandbox escape, not a feature gap: without them a drained
- * GitHub/Slack turn falls back to the local runtime with the default
- * harness cwd, so untrusted channel content drives tools on the serve
- * host instead of the cloud VM / channel worktree. `coalesceSourceTs`
- * (when present) is used as the drain-ordering `sourceTs`. Deferred
- * (documented, not silently faked — deliver logs a warning naming what
- * it dropped): `workspaceFiles` and per-turn `images` (content
- * injection, and their base64 payloads can blow the mailbox blob past
- * hosted KV value caps), `sdkAgentId` seeding, and `admission`
- * semantics (both `"preempt"` and Slack `"coalesce"` nudge bookkeeping
- * — ledger draining already serializes turns, but nothing is
- * interrupted or coalesced through the mailbox).
- */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { randomBytes, randomUUID } from "node:crypto";
-import { createLedgerJanitor } from "../ledger/janitor.js";
-import { HEARTBEAT_INTERVAL_MS, LedgerFencedError, } from "../ledger/session-ledger.js";
-import { SessionAuthError, samePrincipal } from "./auth.js";
-import { describeError } from "./describe-error.js";
-import { newContinuationKey } from "./ids.js";
-export class LedgerServing {
-    constructor(options) {
-        var _a, _b, _c;
-        /** One pump per ledger session — the in-process face of the lease. */
-        this.pumps = new Map();
-        /** Fire-and-forget re-pump checks, awaited on close. */
-        this.background = new Set();
-        this.ledger = options.ledger;
-        this.deliverTurn = options.deliverTurn;
-        this.findSession = options.findSession;
-        this.logger = (_a = options.logger) !== null && _a !== void 0 ? _a : (() => { });
-        this.heartbeatIntervalMs = (_b = options.heartbeatIntervalMs) !== null && _b !== void 0 ? _b : HEARTBEAT_INTERVAL_MS;
-        this.clock = (_c = options.clock) !== null && _c !== void 0 ? _c : Date.now;
-        this.janitor = createLedgerJanitor(Object.assign(Object.assign({ ledger: options.ledger, onSession: (claimed) => this.serveClaimed(claimed), 
-            // Consumed mailbox blobs (full message envelopes) would otherwise
-            // accumulate forever; the default TTL (1h) is far beyond any lease
-            // or turn horizon, so only truly dead blobs are collected.
-            orphanSweep: {} }, (options.janitorIntervalMs === undefined
-            ? {}
-            : { intervalMs: options.janitorIntervalMs })), { onError: (error, sessionId) => {
-                this.logger(`[ledger] janitor error${sessionId === undefined ? "" : ` (session ${sessionId})`}: ${describeError(error)}`);
-            }, clock: this.clock }));
-    }
-    /** Start the janitor loop (recovers expired-lease sessions). */
-    start() {
-        this.janitor.start();
-    }
-    /** Stop the janitor and settle in-flight pumps and re-pump checks. */
-    close() {
-        return __awaiter(this, void 0, void 0, function* () {
-            // Awaiting stop() matters: an in-flight janitor pass can claim a
-            // session and register a pump after this method snapshots the maps.
-            yield this.janitor.stop();
-            yield Promise.allSettled([...this.pumps.values()]);
-            yield Promise.allSettled([...this.background]);
-        });
-    }
-    /**
-     * Ledger-mode `send`: append the message to the session mailbox, then
-     * serve pending events (or walk away if another holder is already
-     * serving them). Resolves with the engine session handle once one
-     * exists — the ack point is the durable append, not turn completion —
-     * so HTTP create/follow-up can return a session id while the holder is
-     * still in flight. When this process wins the claim, the pump keeps
-     * draining in the background; callers that need the turn to finish use
-     * `waitForCompletion` (and the lease releases on the pump's commit).
-     * When another holder is serving the session and no engine session
-     * exists on this pod, the delivery is still a success — the event is
-     * durably parked and the holder's commit (or the janitor) drains it —
-     * so the resolved handle is a parked stand-in carrying the durable
-     * session identity.
-     */
-    deliver(channelId, message, options) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
-            const continuationToken = (_a = options.continuationToken) !== null && _a !== void 0 ? _a : newContinuationKey();
-            this.warnOnDroppedOptions(channelId, options);
-            const ensured = yield this.ledger.ensureSession(`${channelId}/${continuationToken}`);
-            const ledgerSessionId = ensured.session.sessionId;
-            // Principal gate BEFORE the durable append: once an envelope is
-            // parked it WILL be drained, so a foreign sender must be rejected
-            // here — not on the resident path after the mailbox write. A new
-            // ledger session has no owner yet: the creating sender becomes it,
-            // exactly as on resident session creation.
-            if (!ensured.created) {
-                const existing = yield this.findSession(channelId, continuationToken);
-                if (existing !== undefined) {
-                    if (!samePrincipal(existing.info.auth, (_b = options.auth) !== null && _b !== void 0 ? _b : null)) {
-                        throw new SessionAuthError(existing.id);
-                    }
-                }
-                // No handle: the engine session does not exist yet (the first
-                // parked event has not run — the lease holder creates it) or a
-                // cross-pod restore transiently failed. Park rather than fail
-                // closed: rejecting here would bounce the legitimate owner racing
-                // the session's first turn. This is not fail-open — the resident
-                // path re-checks the principal when the event drains, and the
-                // drain treats a SessionAuthError as consume-and-commit, so a
-                // foreign envelope that parks through this window costs one warn
-                // line and never actuates, bricks, or replays the session.
-            }
-            const envelope = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ channelId,
-                continuationToken,
-                message, auth: (_c = options.auth) !== null && _c !== void 0 ? _c : null }, (options.title === undefined ? {} : { title: options.title })), (options.state === undefined ? {} : { state: options.state })), (options.mode === undefined ? {} : { mode: options.mode })), (options.purpose === undefined ? {} : { purpose: options.purpose })), (options.workspaceDir === undefined
-                ? {}
-                : { workspaceDir: options.workspaceDir })), (options.cloud === undefined ? {} : { cloud: options.cloud }));
-            yield this.ledger.appendEvent(ledgerSessionId, {
-                eventId: `evt_${randomBytes(12).toString("hex")}`,
-                envelope: envelope,
-                sourceTs: this.resolveSourceTs(options),
-            });
-            // Ack point: the event is durable (mailbox blob + ledger pending).
-            // Do not await the pump: awaiting turns here would block HTTP create
-            // until the first turn committed, so a client could never park a
-            // mid-turn follow-up and a second pod would see a released lease.
-            const serving = this.servePending(ledgerSessionId);
-            return this.resolveDeliverHandle({
-                channelId,
-                continuationToken,
-                ledgerSessionId,
-                envelope,
-                created: ensured.created,
-                serving,
-            });
-        });
-    }
-    /**
-     * The stand-in handle for a delivery whose event is parked while
-     * another holder serves the session: real durable identity, no local
-     * turn. `waitForCompletion` resolves immediately — the parked event's
-     * turn runs on the holder, so there is nothing local to await (the
-     * same contract as a coalesced send, whose outcome is not its own
-     * message's turn). The event stream and re-keying live wherever the
-     * turn runs, so both fail loudly here.
-     */
-    parkedSession(ledgerSessionId, envelope, isNew) {
-        var _a;
-        const unavailable = (what) => new Error(`ledger serving: ${what} is unavailable for session ${ledgerSessionId}: the parked event runs on the session's current lease holder, not this process`);
-        return {
-            id: ledgerSessionId,
-            continuationToken: envelope.continuationToken,
-            isNew,
-            info: Object.assign(Object.assign(Object.assign({ id: ledgerSessionId, channelId: envelope.channelId, mode: (_a = envelope.mode) !== null && _a !== void 0 ? _a : "chat", auth: envelope.auth }, (envelope.title === undefined ? {} : { title: envelope.title })), (envelope.purpose === undefined
-                ? {}
-                : { purpose: envelope.purpose })), { continuationKey: envelope.continuationToken }),
-            getEventStream: () => Promise.reject(unavailable("the event stream")),
-            waitForCompletion: () => __awaiter(this, void 0, void 0, function* () { return ({ status: "finished" }); }),
-            setContinuationToken: () => Promise.reject(unavailable("re-keying the continuation token")),
-        };
-    }
-    /**
-     * Return a handle as soon as the engine session exists, without waiting
-     * for the pump to commit. If the pump settles without creating a
-     * session (walk-away, or a throw before admit), surface that: rethrow
-     * a failed claimant turn, otherwise the parked stand-in.
-     */
-    resolveDeliverHandle(args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { channelId, continuationToken, ledgerSessionId, envelope, created, serving, } = args;
-            for (;;) {
-                const handle = yield this.findSession(channelId, continuationToken);
-                if (handle !== undefined) {
-                    return handle;
-                }
-                const pump = this.pumps.get(ledgerSessionId);
-                if (pump !== undefined) {
-                    yield Promise.race([
-                        new Promise((resolve) => {
-                            setTimeout(resolve, 15);
-                        }),
-                        pump.then(() => undefined, () => undefined),
-                    ]);
-                    continue;
-                }
-                const createdLate = yield this.findSession(channelId, continuationToken);
-                if (createdLate !== undefined) {
-                    return createdLate;
-                }
-                yield serving;
-                this.logger(`[ledger] deliver on channel "${channelId}": event parked for session ${ledgerSessionId} (continuation ${continuationToken}); another holder is serving it and no local session exists — its commit (or the janitor) drains the event`);
-                return this.parkedSession(ledgerSessionId, envelope, created);
-            }
-        });
-    }
-    /**
-     * Drain ordering: prefer the real source time over this pod's receipt
-     * time. `coalesceSourceTs` is a Slack-style seconds string
-     * (`"1712345678.000100"`); normalize sub-epoch-ms values to ms so they
-     * stay comparable with the `Date.now()` fallback.
-     */
-    resolveSourceTs(options) {
-        if (options.coalesceSourceTs !== undefined) {
-            const parsed = Number(options.coalesceSourceTs);
-            if (Number.isFinite(parsed) && parsed > 0) {
-                return parsed < 1e11 ? Math.round(parsed * 1000) : parsed;
-            }
-        }
-        return this.clock();
-    }
-    /**
-     * One warning per delivery naming the send options the mailbox does not
-     * replay — better a loud line than an author silently losing images or
-     * admission semantics on a ledger-mode agent.
-     */
-    warnOnDroppedOptions(channelId, options) {
-        const dropped = ["images", "sdkAgentId", "admission", "workspaceFiles"].filter((name) => options[name] !== undefined);
-        if (dropped.length > 0) {
-            this.logger(`[ledger] deliver on channel "${channelId}": dropping send options not replayed through the mailbox: ${dropped.join(", ")}`);
-        }
-    }
-    /**
-     * Serve a session's pending events. When a pump is already running the
-     * caller walks away (the holder's commit re-reads pending) — except
-     * that the holder's *final* commit may have released before this
-     * append landed, so a re-check is chained behind it. Deliver never
-     * awaits this promise for its full lifetime: awaiting a new pump would
-     * block HTTP until the turn committed, and awaiting a running pump
-     * would deadlock a send issued from inside one of its turns.
-     */
-    servePending(ledgerSessionId) {
-        const running = this.pumps.get(ledgerSessionId);
-        if (running !== undefined) {
-            const recheck = running
-                .catch(() => { })
-                .then(() => this.repumpIfPending(ledgerSessionId))
-                .catch(() => { });
-            this.background.add(recheck);
-            void recheck.finally(() => {
-                this.background.delete(recheck);
-            });
-            return Promise.resolve();
-        }
-        return this.track(ledgerSessionId, () => this.runPump(ledgerSessionId));
-    }
-    /** Claim-or-defer entry used after an append and after a pump settles. */
-    runPump(ledgerSessionId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const claim = yield this.ledger.claim(ledgerSessionId);
-            if (!claim.claimed) {
-                return;
-            }
-            yield this.runClaimedTurns(ledgerSessionId, claim.lease);
-        });
-    }
-    /** Janitor hand-off: the claim already happened, just run the turns. */
-    serveClaimed(claimed) {
-        return this.track(claimed.sessionId, () => this.runClaimedTurns(claimed.sessionId, claimed.lease));
-    }
-    /**
-     * Re-pump after the previous holder settled, covering the release window
-     * where an append landed after that holder's final commit.
-     */
-    repumpIfPending(ledgerSessionId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.pumps.has(ledgerSessionId)) {
-                return;
-            }
-            const snapshot = yield this.ledger.readLedger(ledgerSessionId);
-            if (snapshot === undefined || snapshot.pending.length === 0) {
-                return;
-            }
-            if (snapshot.lease !== null && snapshot.lease.expiresAt > this.clock()) {
-                return;
-            }
-            yield this.track(ledgerSessionId, () => this.runPump(ledgerSessionId));
-        });
-    }
-    /** Register a pump in the per-session map for its lifetime. */
-    track(ledgerSessionId, run) {
-        const tracked = run().finally(() => {
-            if (this.pumps.get(ledgerSessionId) === tracked) {
-                this.pumps.delete(ledgerSessionId);
-            }
-        });
-        this.pumps.set(ledgerSessionId, tracked);
-        return tracked;
-    }
-    /**
-     * The drain → turn → commit loop for a held lease. Heartbeats extend the
-     * lease while turns run; a fenced heartbeat (or fenced commit) means a
-     * new holder took over — discard without committing; the new holder
-     * re-drains (at-least-once actuation, exactly-once ledger apply).
-     */
-    runClaimedTurns(ledgerSessionId, lease) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            let fenced = false;
-            const heartbeat = setInterval(() => {
-                this.ledger.heartbeat(ledgerSessionId, lease.generation).then((result) => {
-                    if (!result.ok) {
-                        fenced = true;
-                    }
-                }, () => {
-                    // Transient KV failure: the next beat retries within the TTL.
-                });
-            }, this.heartbeatIntervalMs);
-            (_a = heartbeat.unref) === null || _a === void 0 ? void 0 : _a.call(heartbeat);
-            try {
-                for (;;) {
-                    if (fenced) {
-                        return;
-                    }
-                    const { head, events } = yield this.ledger.drain(ledgerSessionId);
-                    if (events.length === 0) {
-                        yield this.ledger.release(ledgerSessionId, lease.generation);
-                        return;
-                    }
-                    for (const event of events) {
-                        if (fenced) {
-                            return;
-                        }
-                        const envelope = event.envelope;
-                        try {
-                            const session = yield this.deliverTurn(envelope);
-                            yield session.waitForCompletion();
-                        }
-                        catch (error) {
-                            if (!(error instanceof SessionAuthError)) {
-                                throw error;
-                            }
-                            // Defense in depth behind deliver's principal gate: a parked
-                            // envelope from a foreign principal (gate raced the session's
-                            // first turn, or a pre-gate build wrote it) is consumed and
-                            // committed away like any drained event. Aborting the batch
-                            // instead would replay the already-actuated turns before it
-                            // and re-throw on every future drain — one poison event must
-                            // cost a log line, never a stuck session.
-                            this.logger(`[ledger] session ${ledgerSessionId}: discarding parked event ${event.eventId} — its sender is not the session's principal (${describeError(error)})`);
-                        }
-                    }
-                    const commit = yield this.ledger.commit(ledgerSessionId, {
-                        drainedEventIds: events.map((event) => event.eventId),
-                        generation: lease.generation,
-                        expectedHead: head,
-                        commitId: randomUUID(),
-                    });
-                    if (commit.leaseReleased) {
-                        return;
-                    }
-                }
-            }
-            catch (error) {
-                if (error instanceof LedgerFencedError) {
-                    this.logger(`[ledger] session ${ledgerSessionId} fenced mid-turn (generation ${lease.generation}); discarding — the new holder re-drains`);
-                    return;
-                }
-                // The turn never committed; free the session for the next
-                // append-driven claim instead of making it wait out the lease TTL
-                // (and the janitor cadence). Best-effort: a fenced holder's
-                // release is a no-op, and the events stay pending either way.
-                yield this.ledger
-                    .release(ledgerSessionId, lease.generation)
-                    .catch(() => { });
-                throw error;
-            }
-            finally {
-                clearInterval(heartbeat);
-            }
-        });
-    }
-}
-/** Mint the lease holder id for this process. */
-export function newLedgerPodId() {
-    return `pod_${randomBytes(6).toString("hex")}`;
-}

package/dist/ledger/janitor.d.ts

@@ -1,60 +0,0 @@
-/**
- * The ledger janitor: lazy crash recovery has a hole — a session with
- * pending events and no future events would wait forever — so serving runs
- * this loop. It scans `ledger/` by prefix, finds pending-with-expired-lease
- * sessions, claims them, and hands each claim to the execution callback.
- * Self-host runs the same loop; it is part of the library, not the control
- * plane.
- *
- * Nothing starts on construction: call `start()` for the interval loop or
- * `runOnce()` for an explicit pass (what unit tests use).
- */
-import type { LedgerLease, SessionLedger } from "./session-ledger.js";
-export declare const DEFAULT_JANITOR_INTERVAL_MS = 15000;
-export interface JanitorClaimedSession {
-    sessionId: string;
-    lease: LedgerLease;
-    head: number;
-    pending: string[];
-}
-export interface JanitorRunResult {
-    /** Ledgers scanned this pass. */
-    scanned: number;
-    /** Sessions this pass claimed and handed to the callback. */
-    claimed: JanitorClaimedSession[];
-    /** Orphan blob ids deleted (only when the sweep is enabled). */
-    orphansDeleted: string[];
-}
-export interface LedgerJanitorOptions {
-    ledger: SessionLedger;
-    /**
-     * Executes a recovered session: drain, run the turn, commit. Awaited so
-     * one pass never claims more sessions than it can serve.
-     */
-    onSession: (session: JanitorClaimedSession) => Promise<void> | void;
-    /** Scan cadence for `start()` (default {@link DEFAULT_JANITOR_INTERVAL_MS}). */
-    intervalMs?: number;
-    /**
-     * Also sweep unreferenced mailbox blobs each pass. Off by default —
-     * enable with `{ olderThanMs }` (see `SessionLedger.sweepOrphans`).
-     */
-    orphanSweep?: {
-        olderThanMs?: number;
-    };
-    /** Called with per-session or sweep failures; the pass continues. */
-    onError?: (error: unknown, sessionId?: string) => void;
-    /** Time source for lease-expiry checks (default `Date.now`). */
-    clock?: () => number;
-}
-export interface LedgerJanitor {
-    start(): void;
-    /**
-     * Clear the interval AND await any in-flight pass: a running pass can
-     * claim a session and spawn a turn, so shutdown must not proceed while
-     * one is mid-scan.
-     */
-    stop(): Promise<void>;
-    runOnce(): Promise<JanitorRunResult>;
-}
-export declare function createLedgerJanitor(options: LedgerJanitorOptions): LedgerJanitor;
-//# sourceMappingURL=janitor.d.ts.map

package/dist/ledger/janitor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"janitor.d.ts","sourceRoot":"","sources":["../../src/ledger/janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,gEAAgE;IAChE,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,SAAS,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpE,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,qEAAqE;IACrE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,IAAI,IAAI,CAAC;IACd;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CA2Hf"}

package/dist/ledger/janitor.js

@@ -1,137 +0,0 @@
-/**
- * The ledger janitor: lazy crash recovery has a hole — a session with
- * pending events and no future events would wait forever — so serving runs
- * this loop. It scans `ledger/` by prefix, finds pending-with-expired-lease
- * sessions, claims them, and hands each claim to the execution callback.
- * Self-host runs the same loop; it is part of the library, not the control
- * plane.
- *
- * Nothing starts on construction: call `start()` for the interval loop or
- * `runOnce()` for an explicit pass (what unit tests use).
- */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-export const DEFAULT_JANITOR_INTERVAL_MS = 15000;
-export function createLedgerJanitor(options) {
-    var _a, _b, _c;
-    const intervalMs = (_a = options.intervalMs) !== null && _a !== void 0 ? _a : DEFAULT_JANITOR_INTERVAL_MS;
-    const clock = (_b = options.clock) !== null && _b !== void 0 ? _b : Date.now;
-    const reportError = (_c = options.onError) !== null && _c !== void 0 ? _c : (() => {
-        // Recovery is best-effort per pass; an unobserved failure is retried
-        // on the next scan.
-    });
-    let timer;
-    let running = false;
-    /** The settled-shape promise of the pass currently scanning, if any. */
-    let inFlight;
-    const runPass = () => __awaiter(this, void 0, void 0, function* () {
-        // An unparseable ledger record is reported and skipped: it degrades
-        // that one session's recovery, never the whole agent's pass.
-        const ledgers = yield options.ledger.listLedgers((key, error) => {
-            reportError(new Error(`janitor scan: skipping unparseable ledger record at ${key}: ${String(error instanceof Error ? error.message : error)}`));
-        });
-        const claimed = [];
-        for (const snapshot of ledgers) {
-            if (snapshot.pending.length === 0) {
-                continue;
-            }
-            if (snapshot.lease !== null && snapshot.lease.expiresAt > clock()) {
-                continue;
-            }
-            let claim;
-            try {
-                claim = yield options.ledger.claim(snapshot.sessionId);
-            }
-            catch (error) {
-                reportError(error, snapshot.sessionId);
-                continue;
-            }
-            if (!claim.claimed) {
-                continue;
-            }
-            const session = {
-                sessionId: snapshot.sessionId,
-                lease: claim.lease,
-                head: claim.head,
-                pending: claim.pending,
-            };
-            claimed.push(session);
-            try {
-                yield options.onSession(session);
-            }
-            catch (error) {
-                reportError(error, snapshot.sessionId);
-            }
-        }
-        let orphansDeleted = [];
-        if (options.orphanSweep !== undefined) {
-            try {
-                const swept = yield options.ledger.sweepOrphans({
-                    olderThanMs: options.orphanSweep.olderThanMs,
-                });
-                orphansDeleted = swept.deleted;
-            }
-            catch (error) {
-                reportError(error);
-            }
-        }
-        return { scanned: ledgers.length, claimed, orphansDeleted };
-    });
-    const runOnce = () => {
-        const pass = runPass();
-        const settled = pass.then(() => undefined, () => undefined);
-        inFlight = settled;
-        void settled.finally(() => {
-            if (inFlight === settled) {
-                inFlight = undefined;
-            }
-        });
-        return pass;
-    };
-    const tick = () => __awaiter(this, void 0, void 0, function* () {
-        // Skip a tick rather than overlap passes when a scan outlasts the
-        // cadence — overlapping claims would just fence each other.
-        if (running) {
-            return;
-        }
-        running = true;
-        try {
-            yield runOnce();
-        }
-        catch (error) {
-            reportError(error);
-        }
-        finally {
-            running = false;
-        }
-    });
-    return {
-        start() {
-            var _a;
-            if (timer !== undefined) {
-                return;
-            }
-            timer = setInterval(() => {
-                void tick();
-            }, intervalMs);
-            (_a = timer.unref) === null || _a === void 0 ? void 0 : _a.call(timer);
-        },
-        stop() {
-            return __awaiter(this, void 0, void 0, function* () {
-                if (timer !== undefined) {
-                    clearInterval(timer);
-                    timer = undefined;
-                }
-                yield inFlight;
-            });
-        },
-        runOnce,
-    };
-}