@dsh-enhanced/plugin-control-plane 0.1.65 → 0.1.67

package/lib/revision-capability-types.d.ts

@@ -0,0 +1,289 @@
+import type { ToolRunContext } from '@deepseek-ai/dsh-tools';
+import type { CreationCapabilityObservation, CreationCapabilityOwner, CreationCapabilityTool } from './creation-capability-types.js';
+import type { CreationCapabilitySourceSnapshot } from './creation-capability-source.js';
+import type { PluginCreationVerificationCertificate, PluginRevisionRegressionCertificate, PluginRevisionVerificationCertificate } from '@dsh-enhanced/assistant-growth-contract';
+/** Independent finite rollback authorization; deliberately separate from the adoption grant. */
+export interface RevisionCapabilityRollbackGrant {
+    authorityId: string;
+    expiresAt: number;
+    maxRollbacks: number;
+}
+/**
+ * Separate, finite owner authority for replacing an already adopted stable tool entry with an
+ * independently verified revision. It never signs acceptance and never grants execution: the
+ * parent creation adoption and this receipt only select which verified artifact the stable entry
+ * routes to. Absent configuration keeps every existing revision plan terminal after review.
+ */
+export interface RevisionCapabilityConfig {
+    authorityId: string;
+    keyId: string;
+    keyPath: string;
+    owner: CreationCapabilityOwner;
+    namePrefix: string;
+    expiresAt: number;
+    maxAdoptions: number;
+    maxInputBytes: number;
+    maxCallRecords: number;
+    /** New independent host-only rollback grant with its own expiry and count. */
+    rollback: RevisionCapabilityRollbackGrant;
+    /** Opt-in lifetime for an already adopted revision; never extends either use grant. */
+    retention?: {
+        maximumLifetimeMs: number;
+    };
+}
+export interface RevisionCapabilityModel {
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}
+/** Content-addressed candidate run reference bound by an adoption receipt. */
+export interface RevisionCapabilitySourceRef {
+    referenceDigest: string;
+    ownerDigest: string;
+    growthRunDigest: string;
+}
+/** A signed adoption receipt binds the exact parent adoption receipt, candidate artifact, new task and model. */
+export interface RevisionCapabilityAdoptionReceipt {
+    protocol: 'dsh-created-capability-revision-adoption/v1';
+    authorityId: string;
+    authorityDigest: string;
+    keyId: string;
+    planId: string;
+    planDigest: string;
+    verificationDigest: string;
+    parentPlanId: string;
+    parentCertificateDigest: string;
+    parentReceiptDigest: string;
+    parentArtifactSha256: string;
+    entryId: string;
+    aliasesDigest: string;
+    artifactSha256: string;
+    artifactBytes: number;
+    schemaDigest: string;
+    source: RevisionCapabilitySourceRef;
+    model: RevisionCapabilityModel;
+    /** Present exactly when an independent parent-behavior regression was configured. */
+    regressionDigest?: string;
+    /** Parent calls already running at the switch; attribution evidence only, never an authorization. */
+    inFlightParentCalls: number;
+    expiresAt: number;
+    adoptedAt: number;
+    signature: string;
+}
+export type RevisionCapabilityAdoptionStatus = 'claimed' | 'active' | 'closed' | 'unknown' | 'rejected';
+export interface RevisionCapabilityAdoptionRecord {
+    planId: string;
+    status: RevisionCapabilityAdoptionStatus;
+    parentPlanId: string;
+    certificateDigest: string;
+    claimedAt: number;
+    settledAt?: number;
+    reason?: string;
+    entryId?: string;
+    inFlightParentCalls?: number;
+}
+/** One immutable artifact version retained under a stable entry; bytes are never rewritten. */
+export interface RevisionCapabilityVersion {
+    planId: string;
+    entryId: string;
+    role: 'parent' | 'revision';
+    name: string;
+    certificate: PluginCreationVerificationCertificate | PluginRevisionVerificationCertificate;
+    certificateDigest: string;
+    /** Parent creation adoption receipt (parent) or this journal's signed adoption receipt (revision). */
+    receiptJson: string;
+    receiptDigest: string;
+    tools: readonly CreationCapabilityTool[];
+    artifact: Buffer;
+    artifactSha256: string;
+    schemaDigest: string;
+    source: RevisionCapabilitySourceRef;
+    model: RevisionCapabilityModel;
+    regressionDigest?: string;
+    adoptedAt: number;
+    expiresAt: number;
+}
+/** The stable tool entry; aliases are inherited verbatim from the parent adoption. */
+export interface RevisionCapabilityEntry {
+    entryId: string;
+    name: string;
+    aliases: readonly string[];
+    aliasesDigest: string;
+    parentPlanId: string;
+    currentPlanId: string;
+    revision: number;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface RevisionCapabilityCall {
+    key: string;
+    versionPlanId: string;
+    status: 'claimed' | 'completed' | 'unknown';
+    result?: unknown;
+}
+/** Bounded, content-free call attribution; arguments and results never escape. */
+export interface RevisionCapabilityCallEvidence {
+    protocol: 'dsh-created-capability-revision-call/v1';
+    entryId: string;
+    key: string;
+    versionPlanId: string;
+    toolAlias: string;
+    status: 'completed' | 'unknown' | 'claimed';
+    receiptDigest: string;
+    claimedAt: number;
+    settledAt?: number;
+}
+export interface RevisionCapabilityRollbackRecord {
+    protocol: 'dsh-created-capability-revision-rollback/v1';
+    rollbackId: string;
+    entryId: string;
+    fromPlanId: string;
+    toPlanId: string;
+    parentReceiptDigest: string;
+    authorityId: string;
+    at: number;
+    ordinal: number;
+    digest: string;
+}
+/** Read-only Host readiness; never a model tool and never key material. */
+export interface RevisionCapabilityReadiness {
+    protocol: 'dsh-created-capability-revision-adoption-readiness/v1';
+    available: boolean;
+    authority: {
+        authorityId: string;
+        expiresAt: number;
+    };
+    remainingAdoptions: number;
+    remainingRollbacks: number;
+    rollbackExpiresAt: number;
+}
+/** The integration owns current authenticated owner/source fences, not model parameters. */
+export interface RevisionCapabilityPorts {
+    /** Fresh independently verified candidate; the integration rechecks owner and every source fence. */
+    inspect(planId: string): RevisionCapabilityInspection;
+    recheck(planId: string, signal: AbortSignal): Promise<void>;
+    /** Current active creation adoption of the exact parent plan. */
+    parent(planId: string): RevisionCapabilityParentAdoption;
+    recheckParent(planId: string, signal: AbortSignal): Promise<void>;
+    /** Calls of the parent adoption already running at the switch; evidence only. */
+    inFlightParentCalls(planId: string): number;
+    /** Host-only alias handover; already running parent calls must keep executing. */
+    suspendParent(planId: string): Promise<void>;
+    /** Host-only recovery after a failed switch. */
+    resumeParent(planId: string): Promise<void>;
+    /** Execute a verified parent/revision artifact under the same finite behavior runner. */
+    runVersion(input: {
+        certificate: PluginCreationVerificationCertificate | PluginRevisionVerificationCertificate;
+        artifact: Buffer;
+        schemaDigest: string;
+        operation: {
+            kind: 'discover';
+        } | {
+            kind: 'invoke';
+            calls: readonly {
+                id: string;
+                toolName: string;
+                arguments: unknown;
+            }[];
+        };
+        key: string;
+        signal: AbortSignal;
+    }): Promise<CreationCapabilityObservation>;
+    /** Read-only proof of the fixed execution boundary for this candidate. */
+    recheckExecution(certificate: PluginCreationVerificationCertificate | PluginRevisionVerificationCertificate, signal: AbortSignal): Promise<void>;
+    /** Synchronous, read-only execution-boundary identity used by admission; never executes the artifact. */
+    matchesExecution(certificate: PluginCreationVerificationCertificate | PluginRevisionVerificationCertificate): boolean;
+    /** Current authenticated owner Agent admission for one mounted call. */
+    assertCaller(execution: ToolRunContext): void;
+}
+export interface RevisionCapabilityParentAdoption {
+    planId: string;
+    name: string;
+    owner: CreationCapabilityOwner;
+    certificate: PluginCreationVerificationCertificate;
+    artifact: Buffer;
+    tools: readonly CreationCapabilityTool[];
+    receiptJson: string;
+    receiptDigest: string;
+}
+export interface RevisionCapabilityInspection {
+    certificate: PluginRevisionVerificationCertificate;
+    artifact: Buffer;
+    source: CreationCapabilitySourceSnapshot;
+    plan: {
+        id: string;
+        digest: string;
+        name: string;
+    };
+    regression?: PluginRevisionRegressionCertificate;
+    owner: CreationCapabilityOwner;
+}
+/** Signed-receipt and durable state mirror for the runtime; the filesystem journal is the production port. */
+export interface RevisionCapabilityJournalPort {
+    readonly authorityDigest: string;
+    readonly publicKey: string;
+    inspectAdoption(planId: string): RevisionCapabilityAdoptionRecord | undefined;
+    listEntries(): readonly RevisionCapabilityEntry[];
+    inspectEntry(entryId: string): {
+        entry: RevisionCapabilityEntry;
+        parent: RevisionCapabilityVersion;
+        current: RevisionCapabilityVersion;
+    } | undefined;
+    inspectVersion(planId: string): RevisionCapabilityVersion | undefined;
+    usage(): {
+        adoptions: number;
+        rollbacks: number;
+        calls: number;
+    };
+    /** Sign one exact adoption receipt with the journal key; the body is validated before signing. */
+    signReceipt(body: Omit<RevisionCapabilityAdoptionReceipt, 'signature'>): RevisionCapabilityAdoptionReceipt;
+    claim(input: {
+        planId: string;
+        parentPlanId: string;
+        certificateDigest: string;
+    }): {
+        created: boolean;
+        record: RevisionCapabilityAdoptionRecord;
+    };
+    commit(input: {
+        entry: {
+            entryId: string;
+            name: string;
+            aliases: readonly string[];
+        };
+        parent: RevisionCapabilityVersion;
+        revision: RevisionCapabilityVersion;
+        receipt: RevisionCapabilityAdoptionReceipt;
+        expectedCurrentPlanId: string;
+        inFlightParentCalls: number;
+    }): RevisionCapabilityAdoptionRecord;
+    settle(planId: string, status: 'closed' | 'unknown' | 'rejected', reason: string): void;
+    rollback(input: {
+        entryId: string;
+        expectedCurrentPlanId: string;
+        authorityId: string;
+    }): {
+        created: boolean;
+        record: RevisionCapabilityRollbackRecord;
+    };
+    claimCall(input: {
+        entryId: string;
+        key: string;
+        argumentsDigest: string;
+        toolAlias: string;
+        versionPlanId: string;
+    }): {
+        created: boolean;
+        call: RevisionCapabilityCall;
+    };
+    settleCall(input: {
+        entryId: string;
+        key: string;
+        status: 'completed' | 'unknown';
+        result?: unknown;
+    }): void;
+    listCallEvidence(entryId: string): readonly RevisionCapabilityCallEvidence[];
+    recoverClaims(): void;
+    close(): void;
+}
+//# sourceMappingURL=revision-capability-types.d.ts.map

package/lib/revision-capability-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revision-capability-types.d.ts","sourceRoot":"","sources":["../src/revision-capability-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACpI,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAA;AACvF,OAAO,KAAK,EAAE,qCAAqC,EAAE,mCAAmC,EACtF,qCAAqC,EAAE,MAAM,yCAAyC,CAAA;AAExF,gGAAgG;AAChG,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,uBAAuB,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,8EAA8E;IAC9E,QAAQ,EAAE,+BAA+B,CAAA;IACzC,uFAAuF;IACvF,SAAS,CAAC,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,8EAA8E;AAC9E,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,iHAAiH;AACjH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,6CAA6C,CAAA;IACvD,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,oBAAoB,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,2BAA2B,CAAA;IACnC,KAAK,EAAE,uBAAuB,CAAA;IAC9B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,qGAAqG;IACrG,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,gCAAgC,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAA;AAEvG,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,gCAAgC,CAAA;IACxC,YAAY,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,qCAAqC,GAAG,qCAAqC,CAAA;IAC1F,iBAAiB,EAAE,MAAM,CAAA;IACzB,sGAAsG;IACtG,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,SAAS,sBAAsB,EAAE,CAAA;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,2BAA2B,CAAA;IACnC,KAAK,EAAE,uBAAuB,CAAA;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,kFAAkF;AAClF,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,yCAAyC,CAAA;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAA;IAC3C,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,6CAA6C,CAAA;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,2EAA2E;AAC3E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,uDAAuD,CAAA;IACjE,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IACrD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,4FAA4F;AAC5F,MAAM,WAAW,uBAAuB;IACtC,qGAAqG;IACrG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,4BAA4B,CAAA;IACrD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,iEAAiE;IACjE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAAA;IACxD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,iFAAiF;IACjF,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3C,kFAAkF;IAClF,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,gDAAgD;IAChD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,yFAAyF;IACzF,UAAU,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,qCAAqC,GAAG,qCAAqC,CAAA;QAC5G,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE;YAAE,IAAI,EAAE,UAAU,CAAA;SAAE,GACrE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,KAAK,EAAE,SAAS;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,OAAO,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;QACzG,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAChE,0EAA0E;IAC1E,gBAAgB,CAAC,WAAW,EAAE,qCAAqC,GAAG,qCAAqC,EACzG,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,yGAAyG;IACzG,gBAAgB,CAAC,WAAW,EAAE,qCAAqC,GAAG,qCAAqC,GAAG,OAAO,CAAA;IACrH,wEAAwE;IACxE,YAAY,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAAA;CAC9C;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,uBAAuB,CAAA;IAC9B,WAAW,EAAE,qCAAqC,CAAA;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,SAAS,sBAAsB,EAAE,CAAA;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,qCAAqC,CAAA;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,gCAAgC,CAAA;IACxC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,UAAU,CAAC,EAAE,mCAAmC,CAAA;IAChD,KAAK,EAAE,uBAAuB,CAAA;CAC/B;AAED,8GAA8G;AAC9G,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,GAAG,SAAS,CAAA;IAC7E,WAAW,IAAI,SAAS,uBAAuB,EAAE,CAAA;IACjD,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,uBAAuB,CAAC;QAAC,MAAM,EAAE,yBAAyB,CAAC;QACjG,OAAO,EAAE,yBAAyB,CAAA;KAAE,GAAG,SAAS,CAAA;IAClD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAAA;IACrE,KAAK,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChE,kGAAkG;IAClG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,iCAAiC,EAAE,WAAW,CAAC,GAAG,iCAAiC,CAAA;IAC1G,KAAK,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QACpG,MAAM,EAAE,gCAAgC,CAAA;KAAE,CAAA;IAC5C,MAAM,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;SAAE,CAAA;QAClF,MAAM,EAAE,yBAAyB,CAAC;QAAC,QAAQ,EAAE,yBAAyB,CAAA;QACtE,OAAO,EAAE,iCAAiC,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,GACxG,gCAAgC,CAAA;IAClC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACvF,QAAQ,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACrF;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,gCAAgC,CAAA;KAAE,CAAA;IAChE,SAAS,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAC1F,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAA;IAC9E,UAAU,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5G,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,8BAA8B,EAAE,CAAA;IAC5E,aAAa,IAAI,IAAI,CAAA;IACrB,KAAK,IAAI,IAAI,CAAA;CACd"}

package/lib/revision-capability-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=revision-capability-types.js.map

package/lib/revision-capability-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revision-capability-types.js","sourceRoot":"","sources":["../src/revision-capability-types.ts"],"names":[],"mappings":""}

package/lib/scanner-owner-runtime.d.ts

@@ -0,0 +1,34 @@
+import type { AssistantAutomationsService } from '@dsh-enhanced/assistant-automations';
+import type { AssistantDeliveryService, OwnerRouteValidationReceipt } from '@dsh-enhanced/assistant-delivery';
+type Automations = Pick<AssistantAutomationsService, 'inspectSystemOwnedRetirement' | 'retireSystemOwned' | 'inspectSystemOwned'>;
+type Delivery = Pick<AssistantDeliveryService, 'inspectOwnerRouteState'>;
+type Scope = {
+    authorityId: string;
+    principalId: string;
+    workspace: string;
+    agentPreset: string;
+};
+/** Availability failures must never be interpreted as obsolete task evidence. */
+export declare class ScannerOwnerUnavailable extends Error {
+}
+/** Retires only this scanner, preserving its jobs, requests, grants and budgets. */
+export declare class ScannerOwnerGuard {
+    private readonly owner;
+    private readonly automationId;
+    private readonly scope;
+    private readonly delivery;
+    private readonly automations;
+    private readonly expected?;
+    retired: boolean;
+    canReconcileScanner: boolean;
+    constructor(owner: string, automationId: string, scope: Scope, delivery: Delivery, automations: Automations, expected?: {
+        authorityHash: string;
+        principalRecordId: string;
+        principalVersion: number;
+    } | undefined);
+    check(): OwnerRouteValidationReceipt;
+}
+/** Disposal keeps ownership of in-flight work and has a finite drain deadline. */
+export declare function drainScannerFlights(flights: Set<Promise<unknown>>): Promise<void>;
+export {};
+//# sourceMappingURL=scanner-owner-runtime.d.ts.map

package/lib/scanner-owner-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner-owner-runtime.d.ts","sourceRoot":"","sources":["../src/scanner-owner-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAA;AACtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAE7G,KAAK,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,8BAA8B,GAAG,mBAAmB,GAAG,oBAAoB,CAAC,CAAA;AACjI,KAAK,QAAQ,GAAG,IAAI,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAA;AACxE,KAAK,KAAK,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAA;AAGjG,iFAAiF;AACjF,qBAAa,uBAAwB,SAAQ,KAAK;CAAG;AAErD,oFAAoF;AACpF,qBAAa,iBAAiB;IAIhB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAU,OAAO,CAAC,QAAQ,CAAC,YAAY;IACvE,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAS,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAY,OAAO,CAAC,QAAQ,CAAC,WAAW;IAChG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAL5B,OAAO,UAAQ;IAEf,mBAAmB,UAAQ;gBACE,KAAK,EAAE,MAAM,EAAmB,YAAY,EAAE,MAAM,EAC9D,KAAK,EAAE,KAAK,EAAmB,QAAQ,EAAE,QAAQ,EAAmB,WAAW,EAAE,WAAW,EAC5F,QAAQ,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,YAAA;IAE5G,KAAK,IAAI,2BAA2B;CAgDrC;AAED,kFAAkF;AAClF,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF"}

package/lib/scanner-owner-runtime.js

@@ -0,0 +1,99 @@
+import { createHash } from 'node:crypto';
+const digest = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+/** Availability failures must never be interpreted as obsolete task evidence. */
+export class ScannerOwnerUnavailable extends Error {
+}
+/** Retires only this scanner, preserving its jobs, requests, grants and budgets. */
+export class ScannerOwnerGuard {
+    owner;
+    automationId;
+    scope;
+    delivery;
+    automations;
+    expected;
+    retired = false;
+    // Only the native reconcile transaction may admit a wake-up under an unreadable retirement state.
+    canReconcileScanner = false;
+    constructor(owner, automationId, scope, delivery, automations, expected) {
+        this.owner = owner;
+        this.automationId = automationId;
+        this.scope = scope;
+        this.delivery = delivery;
+        this.automations = automations;
+        this.expected = expected;
+    }
+    check() {
+        this.canReconcileScanner = false;
+        try {
+            if (this.retired)
+                throw new ScannerOwnerUnavailable('scanner permanently retired: owner-revoked');
+            let retirement;
+            try {
+                retirement = this.automations.inspectSystemOwnedRetirement({ owner: this.owner, automationId: this.automationId });
+            }
+            catch (error) {
+                // A read outage must not strand a fresh scanner. Native reconcile checks
+                // retirement before cached receipts and again in its SQLite transaction.
+                // It can establish only this exact scanId, without touching old jobs.
+                this.canReconcileScanner = true;
+                try {
+                    if (this.delivery.inspectOwnerRouteState(this.scope).status === 'revoked')
+                        this.canReconcileScanner = false;
+                }
+                catch { /* The native retirement fence still owns activation admission. */ }
+                throw error;
+            }
+            if (retirement) {
+                this.retired = true;
+                throw new ScannerOwnerUnavailable('scanner permanently retired: owner-revoked');
+            }
+            this.canReconcileScanner = true;
+            const state = this.delivery.inspectOwnerRouteState(this.scope);
+            if (state.status === 'unavailable')
+                throw new ScannerOwnerUnavailable(`scanner owner unavailable: ${state.reason}`);
+            if (state.status === 'active')
+                return state.receipt;
+            this.canReconcileScanner = false;
+            if (this.expected && (state.authorityHash !== this.expected.authorityHash
+                || state.principalRecordId !== this.expected.principalRecordId || state.principalVersion !== this.expected.principalVersion)) {
+                throw new ScannerOwnerUnavailable('scanner owner lineage unavailable');
+            }
+            let current;
+            try {
+                current = this.automations.inspectSystemOwned({ owner: this.owner, automationId: this.automationId });
+            }
+            catch (error) {
+                if (!(error instanceof Error) || error.code !== 'not-found')
+                    throw error;
+            }
+            if (current) {
+                const evidenceDigest = digest({ protocol: 'scanner-owner-revoked/v1', scope: this.scope, state });
+                this.automations.retireSystemOwned({ owner: this.owner, automationId: this.automationId,
+                    operationId: `owner-revoked:${digest([this.owner, this.automationId, current.definitionHash, current.definitionVersion, evidenceDigest])}`,
+                    definitionHash: current.definitionHash, expectedVersion: current.definitionVersion, reason: 'owner-revoked', evidenceDigest });
+            }
+            // An absent definition must stay absent; no replacement grant or row is created.
+            this.retired = true;
+            throw new ScannerOwnerUnavailable('scanner owner explicitly revoked');
+        }
+        catch (error) {
+            if (error instanceof ScannerOwnerUnavailable)
+                throw error;
+            throw new ScannerOwnerUnavailable(`scanner owner inspection or retirement unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+/** Disposal keeps ownership of in-flight work and has a finite drain deadline. */
+export async function drainScannerFlights(flights) {
+    let timer;
+    try {
+        await Promise.race([Promise.allSettled(flights), new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('scanner shutdown timed out; in-flight outcomes remain unknown')), 5000);
+            })]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=scanner-owner-runtime.js.map

package/lib/scanner-owner-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner-owner-runtime.js","sourceRoot":"","sources":["../src/scanner-owner-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOxC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE3G,iFAAiF;AACjF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAErD,oFAAoF;AACpF,MAAM,OAAO,iBAAiB;IAIC;IAAgC;IAC1C;IAA+B;IAAqC;IACpE;IALnB,OAAO,GAAG,KAAK,CAAA;IACf,kGAAkG;IAClG,mBAAmB,GAAG,KAAK,CAAA;IAC3B,YAA6B,KAAa,EAAmB,YAAoB,EAC9D,KAAY,EAAmB,QAAkB,EAAmB,WAAwB,EAC5F,QAAyF;QAF/E,UAAK,GAAL,KAAK,CAAQ;QAAmB,iBAAY,GAAZ,YAAY,CAAQ;QAC9D,UAAK,GAAL,KAAK,CAAO;QAAmB,aAAQ,GAAR,QAAQ,CAAU;QAAmB,gBAAW,GAAX,WAAW,CAAa;QAC5F,aAAQ,GAAR,QAAQ,CAAiF;IAAG,CAAC;IAEhH,KAAK;QACH,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAA;QAChC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAA;YACjG,IAAI,UAAmE,CAAA;YACvE,IAAI,CAAC;gBAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YAAC,CAAC;YAC1H,OAAO,KAAK,EAAE,CAAC;gBACb,yEAAyE;gBACzE,yEAAyE;gBACzE,sEAAsE;gBACtE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAA;gBAC/B,IAAI,CAAC;oBACH,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,SAAS;wBAAE,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAA;gBAC7G,CAAC;gBAAC,MAAM,CAAC,CAAC,kEAAkE,CAAC,CAAC;gBAC9E,MAAM,KAAK,CAAA;YACb,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;gBACnB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAA;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;gBAAE,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YACnH,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAA;YACnD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAA;YAChC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ,CAAC,aAAa;mBACpE,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/H,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAA;YACxE,CAAC;YACD,IAAI,OAAkE,CAAA;YACtE,IAAI,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YAAC,CAAC;YAC7G,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAK,KAAmC,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,KAAK,CAAA;YACzG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,0BAA0B,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBACjG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY;oBACrF,WAAW,EAAE,iBAAiB,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,EAAE;oBAC1I,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAA;YAClI,CAAC;YACD,iFAAiF;YACjF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;YACnB,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAA;YACzD,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpJ,CAAC;IACH,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA8B;IACtE,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChF,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YACpH,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,CAAC;YAAS,CAAC;QAAC,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;AAC5D,CAAC"}