@gajae-code/coding-agent 0.2.5 → 0.3.1

package/dist/types/gjc-runtime/workflow-command-ref.d.ts

@@ -0,0 +1,43 @@
+import type { CanonicalGjcWorkflowSkill } from "../skill-state/active-state";
+export type CommandRefVisibility = "public" | "hidden" | "planned";
+export type CommandRefIncludeWhen = "implemented-only" | "planned";
+export interface CommandRefCommand {
+    tokens: string[];
+    rendered: string;
+    visibility: CommandRefVisibility;
+    includeWhen: CommandRefIncludeWhen;
+    note?: string;
+}
+export interface CommandRefExample {
+    label?: string;
+    bytes: string;
+}
+export interface CommandRefBridge {
+    from: string;
+    to: string;
+    rendered: string;
+}
+export interface CommandRefBlock {
+    skill: CanonicalGjcWorkflowSkill;
+    blockId: string;
+    sourcePath: string;
+    renderOrder: number;
+    markers: {
+        start: string;
+        end: string;
+    };
+    commands: CommandRefCommand[];
+    examples: CommandRefExample[];
+    aliasesAndBridges: CommandRefBridge[];
+    notes: string[];
+}
+export interface RenderedCommandRefBlock {
+    skill: CanonicalGjcWorkflowSkill;
+    blockId: string;
+    markers: CommandRefBlock["markers"];
+    bytes: string;
+}
+export declare const WORKFLOW_COMMAND_REF_BLOCKS: readonly CommandRefBlock[];
+export declare function listCommandRefBlocks(skill?: CanonicalGjcWorkflowSkill): CommandRefBlock[];
+export declare function renderCommandRefBlock(skill: CanonicalGjcWorkflowSkill, blockId?: string): RenderedCommandRefBlock;
+export declare function isCanonicalGjcWorkflowSkill(value: string): value is CanonicalGjcWorkflowSkill;

package/dist/types/gjc-runtime/workflow-manifest.d.ts

@@ -0,0 +1,54 @@
+/**
+ * TypeScript is the authoritative source of truth for GJC workflow manifests.
+ * Any JSON manifest projection is derived from this module and must never be
+ * hand-edited.
+ */
+import type { CanonicalGjcWorkflowSkill } from "../skill-state/active-state";
+export interface WorkflowState {
+    id: string;
+    initial?: boolean;
+    terminal?: boolean;
+}
+export interface WorkflowTransition {
+    from: string;
+    to: string;
+    verb: string;
+}
+export interface WorkflowVerb {
+    name: string;
+    planned?: boolean;
+    /** Invocation surface that exposes this verb in the real CLI parser. */
+    surface?: "state-action" | "command-positional" | "command-flag";
+}
+export interface TypedArgSpec {
+    name: string;
+    type: "string" | "number" | "boolean" | "enum" | "object";
+    enumValues?: string[];
+    required?: boolean;
+    appliesToVerbs?: string[];
+    planned?: boolean;
+}
+export interface RetentionPolicy {
+    category: string;
+    keep?: number;
+    maxAgeDays?: number;
+}
+export interface SkillManifest {
+    skill: CanonicalGjcWorkflowSkill;
+    states: WorkflowState[];
+    initialState: string;
+    terminalStates: string[];
+    transitions: WorkflowTransition[];
+    verbs: WorkflowVerb[];
+    typedArgs: TypedArgSpec[];
+    retention: RetentionPolicy[];
+    hudFields: string[];
+    graphLabel: string;
+}
+export declare const WORKFLOW_MANIFEST: Record<CanonicalGjcWorkflowSkill, SkillManifest>;
+export declare function getSkillManifest(skill: CanonicalGjcWorkflowSkill): SkillManifest;
+export declare function isKnownWorkflowState(skill: CanonicalGjcWorkflowSkill, state: string): boolean;
+export declare function isValidTransition(skill: CanonicalGjcWorkflowSkill, from: string, to: string): boolean;
+export declare function listVerbs(skill: CanonicalGjcWorkflowSkill): string[];
+export declare function typedArgsFor(skill: CanonicalGjcWorkflowSkill, verb: string): TypedArgSpec[];
+export declare function serializeManifestProjection(): string;

package/dist/types/harness-control-plane/classifier.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Deterministic recovery classifier (pure).
+ *
+ * Maps a bounded {@link Observation} + remaining retry budget to exactly one
+ * {@link RecoveryDecision}. Encodes the plan's hard data-loss invariants:
+ *   - dirty deltas are NEVER `restart-clean`; they map to `restart-preserve-delta`.
+ *   - unknown deltas are NEVER destructive; they map to `human-check`.
+ *   - a deleted/mismatched worktree maps to `human-check` (never recreate over unknown data).
+ * `send-enter` is intentionally never emitted: it is unsupported for the gajae-code
+ * RPC adapter in v1 (no blind key injection).
+ */
+import type { ClassifyInput, RecoveryDecision } from "./types";
+export declare function classifyRecovery(input: ClassifyInput): RecoveryDecision;

package/dist/types/harness-control-plane/control-endpoint.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Per-session control endpoint — a Unix domain socket served by the RuntimeOwner so
+ * stateless `gjc harness` CLI calls can route owner-routed primitives (submit, observe,
+ * recover, retire) to the live owner. One JSON request line in, one JSON response line out.
+ *
+ * The owner is the only listener; clients connect per call. When no socket is reachable
+ * the caller falls back to the no-owner behavior (read-only observe, owner-not-live submit).
+ *
+ * FIFO fallback (for platforms/paths where AF_UNIX is unavailable or path-length limited)
+ * is a documented seam tracked as an ADR follow-up.
+ */
+export interface EndpointRequest {
+    verb: string;
+    input: Record<string, unknown>;
+}
+export type EndpointHandler = (req: EndpointRequest) => Promise<unknown>;
+export declare class ControlServer {
+    #private;
+    readonly socketPath: string;
+    private readonly handler;
+    constructor(socketPath: string, handler: EndpointHandler);
+    listen(): Promise<void>;
+    close(): Promise<void>;
+}
+export declare class EndpointUnreachableError extends Error {
+    readonly socketPath: string;
+    readonly reason: string;
+    constructor(socketPath: string, reason?: string);
+}
+/** Call the owner's control endpoint. Rejects with {@link EndpointUnreachableError} when no owner listens or responds. */
+export declare function callEndpoint(socketPath: string, req: EndpointRequest, timeoutMs?: number): Promise<unknown>;

package/dist/types/harness-control-plane/finalize.d.ts

@@ -0,0 +1,47 @@
+export interface ValidationCommandSpec {
+    name: string;
+    command: string;
+}
+export interface ValidationRun {
+    exactCommand: string;
+    cwd: string;
+    exitStatus: number;
+    pass: boolean;
+}
+export interface FinalizeChecks {
+    runValidation(spec: ValidationCommandSpec): Promise<ValidationRun>;
+    resolveCommit(): Promise<string | null>;
+    commitOnBranch(commit: string, branch: string): Promise<boolean>;
+    prOrIssue(): Promise<{
+        prUrl: string | null;
+        issueArtifact: string | null;
+    }>;
+}
+export interface FinalizeOptions {
+    root: string;
+    sessionId: string;
+    workspace: string;
+    branch: string;
+    requireTests?: boolean;
+    requireCommit?: boolean;
+    requirePr?: boolean;
+    validationCommands?: ValidationCommandSpec[];
+    checks: FinalizeChecks;
+    clock?: () => number;
+}
+export interface FinalizeResult {
+    completed: boolean;
+    receiptPath: string | null;
+    validation: {
+        name: string;
+        valid: boolean;
+        exitStatus: number;
+    }[];
+    commitHash: string | null;
+    prUrl: string | null;
+    issueArtifact: string | null;
+    blockers: string[];
+}
+export declare function runFinalize(opts: FinalizeOptions): Promise<FinalizeResult>;
+/** Real checks: git for commit/branch, gh for PR, Bun.spawn for validation commands. */
+export declare function defaultFinalizeChecks(workspace: string): FinalizeChecks;

package/dist/types/harness-control-plane/frame-mapper.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Pure mapping from `gjc --mode rpc` event frames (docs/rpc.md) to bounded owner event kinds
+ * and {@link ObservedSignal}s. The owner feeds raw frames through this mapper and emits the
+ * result via its single-writer #emit — the mapper itself performs NO IO and NO appends.
+ *
+ * Hard rule: evidence is BOUNDED — only ids, names, categories, statuses, cursors, timestamps,
+ * and short codes/messages. Never assistant text, message deltas, command output, or raw args.
+ */
+import type { ObservedSignal } from "./types";
+export interface MappedFrame {
+    /** Owner event kind (rpc_*). */
+    kind: string;
+    /** Bounded observed signal, or null when the frame carries no user-facing signal. */
+    signal: ObservedSignal | null;
+    /** Bounded evidence — ids/names/statuses/cursors/timestamps/short codes only. */
+    evidence: Record<string, unknown>;
+    /** Severity for the emitted event. */
+    severity: "info" | "warn" | "critical";
+    /** Never-drop frames (must be enqueued in order, never coalesced away). */
+    semantic: boolean;
+    /** Coalescing key for high-frequency non-semantic frames (message id / tool id); null otherwise. */
+    coalesceKey: string | null;
+}
+export declare function isTestRunnerTool(toolName?: unknown, command?: unknown): boolean;
+/**
+ * Map a single RPC frame. Returns null for frames that carry no observability value
+ * (or that the adapter handles itself: `ready`, `response`).
+ */
+export declare function mapRpcFrame(frame: Record<string, unknown>): MappedFrame | null;

package/dist/types/harness-control-plane/operate.d.ts

@@ -0,0 +1,35 @@
+import { type FinalizeChecks, type FinalizeResult, type ValidationCommandSpec } from "./finalize";
+import { type PreserveResult } from "./preserve";
+import { type HarnessRpc } from "./rpc-adapter";
+import { type HarnessLifecycle, type Observation, type RecoveryClassification, type RetryBudget, type Severity } from "./types";
+export interface OperateOptions {
+    root: string;
+    sessionId: string;
+    workspace: string;
+    branch: string;
+    rpc: HarnessRpc;
+    /** Factory used to (re)create the RPC subprocess on restart recovery. Defaults to reusing `rpc`. */
+    rpcFactory?: () => HarnessRpc;
+    /** Bounded observation provider (scripted in tests; real = git + rpc state). */
+    observe: () => Promise<Observation>;
+    /** Real dirty-worktree preservation; injectable for tests. Defaults to git stash/diff capture. */
+    preserve?: (workspace: string) => PreserveResult;
+    finalizeChecks: FinalizeChecks;
+    validationCommands?: ValidationCommandSpec[];
+    retryBudget?: Partial<RetryBudget>;
+    acceptanceTimeoutMs?: number;
+    maxIterations?: number;
+    /** Injected event emitter. Production owner calls must pass the lease-guarded single-writer #emit. */
+    emit: (severity: Severity, kind: string, evidence: Record<string, unknown>) => Promise<void>;
+    clock?: () => number;
+}
+export interface OperateResult {
+    completed: boolean;
+    lifecycle: HarnessLifecycle;
+    iterations: number;
+    classifications: RecoveryClassification[];
+    vanishReceiptIds: string[];
+    finalize?: FinalizeResult;
+    blockers: string[];
+}
+export declare function operate(goal: string, opts: OperateOptions): Promise<OperateResult>;

package/dist/types/harness-control-plane/owner.d.ts

@@ -0,0 +1,46 @@
+/**
+ * RuntimeOwner — the detached per-session process that makes live control honest.
+ *
+ * Responsibilities:
+ *  - hold the {@link SessionLease} (single writer),
+ *  - own the {@link HarnessRpc} subprocess (injected; real `GajaeCodeRpc` in prod, fake in tests),
+ *  - serve owner-routed primitives over the {@link ControlServer} endpoint,
+ *  - be the SOLE writer of the severity event stream,
+ *  - heartbeat the lease.
+ *
+ * Stateless `gjc harness` CLI calls reach the owner via {@link resolveOwner} + the endpoint.
+ */
+import { type FinalizeChecks, type ValidationCommandSpec } from "./finalize";
+import type { HarnessRpc } from "./rpc-adapter";
+import { type SessionLease } from "./session-lease";
+export interface OwnerOptions {
+    root: string;
+    sessionId: string;
+    rpc: HarnessRpc;
+    ownerId?: string;
+    ttlMs?: number;
+    heartbeatMs?: number;
+    acceptanceTimeoutMs?: number;
+    clock?: () => number;
+    finalizeChecks?: FinalizeChecks;
+    validationCommands?: ValidationCommandSpec[];
+}
+export interface OwnerStartInfo {
+    ownerId: string;
+    socketPath: string;
+    leaseEpoch: number;
+}
+export declare class RuntimeOwner {
+    #private;
+    readonly ownerId: string;
+    constructor(opts: OwnerOptions);
+    start(): Promise<OwnerStartInfo>;
+    stop(): Promise<void>;
+}
+export interface ResolvedOwner {
+    live: boolean;
+    socketPath: string | null;
+    lease: SessionLease | null;
+}
+/** Determine whether a live owner currently holds the session (for CLI routing). */
+export declare function resolveOwner(root: string, sessionId: string): Promise<ResolvedOwner>;

package/dist/types/harness-control-plane/preserve.d.ts

@@ -0,0 +1,19 @@
+import type { GitDelta } from "./types";
+export interface UntrackedEntry {
+    path: string;
+    size: number;
+    sha256: string;
+}
+export interface PreserveResult {
+    gitDelta: GitDelta;
+    trackedDiff: string;
+    trackedDiffSha256: string;
+    untrackedManifest: UntrackedEntry[];
+    stashRef: string | null;
+    snapshotComplete: boolean;
+}
+/**
+ * Capture + snapshot a (possibly dirty) worktree without mutating it. Safe to call on a clean
+ * tree (returns empty evidence). Never deletes, resets, or cleans.
+ */
+export declare function preserveDirtyWorktree(workspace: string): PreserveResult;

package/dist/types/harness-control-plane/receipts.d.ts

@@ -0,0 +1,88 @@
+import type { GitDelta, ReceiptFamily, RecoveryClassification } from "./types";
+export interface ReceiptSubject {
+    workspace: string;
+    branch: string | null;
+    head: string | null;
+    commit: string | null;
+}
+export interface ReceiptEnvelope<E = Record<string, unknown>> {
+    receiptId: string;
+    schemaVersion: number;
+    sessionId: string;
+    family: ReceiptFamily;
+    valid: boolean;
+    createdAt: string;
+    source: string;
+    subject: ReceiptSubject;
+    evidence: E;
+    /** Hashes of out-of-line artifacts (diff patches, validation logs) folded into the receipt hash. */
+    artifactHashes: Record<string, string>;
+    sha256: string;
+}
+export declare const RECEIPT_SCHEMA_VERSION: 1;
+export declare function sha256Hex(input: string): string;
+export interface BuildReceiptInput<E> {
+    receiptId: string;
+    sessionId: string;
+    family: ReceiptFamily;
+    source: string;
+    subject: ReceiptSubject;
+    evidence: E;
+    artifactHashes?: Record<string, string>;
+    createdAt?: string;
+    valid?: boolean;
+}
+export declare function buildReceipt<E>(input: BuildReceiptInput<E>): ReceiptEnvelope<E>;
+export interface ValidationOutcome {
+    valid: boolean;
+    reasons: string[];
+}
+/** Recompute the hash and run structural family checks. Fail-closed. */
+export declare function validateReceipt(receipt: ReceiptEnvelope<unknown>): ValidationOutcome;
+export interface VanishEvidence {
+    classification: RecoveryClassification;
+    gitDelta: GitDelta;
+    gitStatusPorcelain: string;
+    untrackedManifest: {
+        path: string;
+        size: number;
+        sha256: string;
+    }[];
+    preservation: "snapshot" | "stash" | "block";
+    stashRef: string | null;
+    snapshotComplete: boolean;
+    forbiddenActions: string[];
+}
+export interface PromptAcceptanceEvidence {
+    promptSha256: string;
+    rpcCommandId: string;
+    preSubmitState: {
+        isStreaming: boolean;
+        steeringQueueDepth: number;
+        followupQueueDepth: number;
+    };
+    preSubmitCursor: number;
+    agentStartCursor: number;
+    acceptedAt: string;
+    singleFlight: true;
+}
+export interface ValidationEvidence {
+    command: string;
+    exactCommand: string;
+    cwd: string;
+    exitStatus: number;
+    pass: boolean;
+    commitUnderTest: string | null;
+}
+export interface CompletionEvidence {
+    finalCommit: string;
+    branch: string;
+    prUrl: string | null;
+    issueArtifact: string | null;
+    requiredValidationReceiptIds: string[];
+    finalLifecycle: string;
+    finalizedAt: string;
+    blockers: string[];
+}
+/** Classifications that MUST have a valid `vanish` receipt before the action proceeds. */
+export declare function requiresVanishBeforeAction(classification: RecoveryClassification): boolean;

package/dist/types/harness-control-plane/rpc-adapter.d.ts

@@ -0,0 +1,66 @@
+export interface RpcStateSnapshot {
+    isStreaming: boolean;
+    steeringQueueDepth: number;
+    followupQueueDepth: number;
+}
+/** Abstract handle to a live gajae-code RPC session. */
+export interface HarnessRpc {
+    getState(): Promise<RpcStateSnapshot>;
+    /** Send a prompt; resolves with the RPC command id and whether it was acked. Does NOT await agent_start. */
+    sendPrompt(prompt: string): Promise<{
+        commandId: string;
+        ack: boolean;
+    }>;
+    /** Monotonic count of events observed so far (the acceptance cursor). */
+    eventCursor(): number;
+    /** Resolve when an `agent_start` event arrives strictly after `afterCursor`, else null on timeout. */
+    waitForAgentStart(afterCursor: number, timeoutMs: number): Promise<{
+        cursor: number;
+    } | null>;
+    close(): Promise<void>;
+    /** Subscribe to parsed event frames (non-ready, non-response), fired AFTER the cursor advances. Returns unsubscribe. */
+    onEventFrame?(listener: (frame: Record<string, unknown>) => void): () => void;
+    /** Whether the underlying RPC subprocess is still alive. */
+    isLive?(): boolean;
+    /** ISO timestamp of the last observed event frame, or null. */
+    lastFrameAt?(): string | null;
+}
+export interface AcceptanceResult {
+    accepted: boolean;
+    reason: string;
+    commandId: string | null;
+    preSubmitCursor: number;
+    agentStartCursor: number | null;
+    preSubmitState: RpcStateSnapshot;
+}
+/**
+ * Single-flight acceptance: idle + empty-queue pre-state, ack, then the NEXT
+ * `agent_start` after the pre-submit cursor within `timeoutMs`.
+ */
+export declare function singleFlightAccept(rpc: HarnessRpc, prompt: string, timeoutMs: number): Promise<AcceptanceResult>;
+/**
+ * Real adapter: spawns `gjc --mode rpc --session-dir <dir>` and speaks the JSONL
+ * protocol from docs/rpc.md. Verified end-to-end in the M10 suite.
+ */
+export declare class GajaeCodeRpc implements HarnessRpc {
+    #private;
+    constructor(opts: {
+        sessionDir: string;
+        command?: string[];
+        cwd?: string;
+        env?: NodeJS.ProcessEnv;
+    });
+    onEventFrame(listener: (frame: Record<string, unknown>) => void): () => void;
+    isLive(): boolean;
+    lastFrameAt(): string | null;
+    getState(): Promise<RpcStateSnapshot>;
+    sendPrompt(prompt: string): Promise<{
+        commandId: string;
+        ack: boolean;
+    }>;
+    eventCursor(): number;
+    waitForAgentStart(afterCursor: number, timeoutMs: number): Promise<{
+        cursor: number;
+    } | null>;
+    close(): Promise<void>;
+}

package/dist/types/harness-control-plane/seams.d.ts

@@ -0,0 +1,21 @@
+/**
+ * v1 seams (M11). The control plane is harness-agnostic by design, but v1 ships ONLY the
+ * gajae-code adapter. Other harnesses and transports are explicit, designed-not-built seams
+ * that fail closed with a clear `seam_unsupported_in_v1` signal rather than silently degrading.
+ */
+import type { Harness } from "./types";
+export declare const SUPPORTED_HARNESSES: readonly Harness[];
+export declare const DEFERRED_SEAMS: readonly ["codex-adapter", "omx-adapter", "remote-transport", "global-daemon", "capability-token-auth", "web-viewer", "fleet-control-plane", "rich-tui-coview"];
+export type DeferredSeam = (typeof DEFERRED_SEAMS)[number];
+export declare function isHarnessSupported(harness: string): harness is Harness;
+export interface UnsupportedSeamResult {
+    ok: false;
+    error: string;
+    evidence: {
+        seam: true;
+        name: string;
+        supported: readonly Harness[];
+        deferred: readonly string[];
+    };
+}
+export declare function unsupportedSeam(name: string): UnsupportedSeamResult;

package/dist/types/harness-control-plane/session-lease.d.ts

@@ -0,0 +1,65 @@
+export interface SessionLease {
+    ownerId: string;
+    sessionId: string;
+    pid: number;
+    leaseTokenHash: string;
+    endpoint: {
+        kind: "unix-socket" | "fifo";
+        path: string;
+    } | null;
+    eventsPath: string;
+    heartbeatAt: string;
+    expiresAt: string;
+    leaseEpoch: number;
+    writer: {
+        ownerId: string;
+        leaseEpoch: number;
+    };
+}
+export declare class LeaseError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export type LeaseStatus = "missing" | "live" | "expiredAlive" | "dead" | "epermAlive";
+type PidStatus = "alive" | "dead" | "eperm";
+export declare function readLease(root: string, sessionId: string): Promise<SessionLease | null>;
+export declare function isExpired(lease: SessionLease, clock?: () => number): boolean;
+export declare function classifyLeaseStatus(lease: SessionLease | null, opts?: {
+    clock?: () => number;
+    probe?: (pid: number) => PidStatus;
+}): LeaseStatus;
+/** Liveness probe via signal 0. Defaults to the real process table; injectable for tests. */
+export declare function isOwnerAlive(pid: number, probe?: (pid: number) => boolean): boolean;
+export declare function isStale(lease: SessionLease, opts?: {
+    clock?: () => number;
+    probe?: (pid: number) => boolean;
+}): boolean;
+export interface AcquireOptions {
+    ownerId: string;
+    pid: number;
+    endpoint?: SessionLease["endpoint"];
+    eventsPath: string;
+    ttlMs: number;
+    clock?: () => number;
+    probe?: (pid: number) => boolean | PidStatus;
+}
+export interface AcquiredLease {
+    lease: SessionLease;
+    token: string;
+}
+/**
+ * Acquire (or take over a stale) lease. Fails closed with `lease_held` when a live,
+ * unexpired lease is held by a different owner. Re-acquiring as the current owner refreshes.
+ */
+export declare function acquireLease(root: string, sessionId: string, opts: AcquireOptions): Promise<AcquiredLease>;
+/** Refresh the lease expiry. Only the recorded owner may heartbeat (single-writer). */
+export declare function heartbeat(root: string, sessionId: string, ownerId: string, ttlMs: number, clock?: () => number): Promise<SessionLease>;
+/** Whether `ownerId` is the live, unexpired single writer permitted to append events. */
+export declare function canWriteEvents(lease: SessionLease, ownerId: string, clock?: () => number): boolean;
+/** Release the lease (owner shutdown). Only the holder may release. */
+export declare function releaseLease(root: string, sessionId: string, ownerId: string): Promise<void>;
+export declare function reapDeadOwnerArtifacts(root: string, sessionId: string, expectedOwnerId: string, expectedEpoch: number, opts?: {
+    clock?: () => number;
+    probe?: (pid: number) => PidStatus;
+}): Promise<boolean>;
+export {};

package/dist/types/harness-control-plane/state-machine.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Lifecycle state machine + the universal `{state, evidence, nextAllowedActions}` contract.
+ *
+ * `nextAllowedActions` is the forcing function: it tells the caller exactly which
+ * primitives are currently permitted and, when not, why. Owner-routed verbs
+ * (`submit`) report `owner-not-live` when no `RuntimeOwner` holds the session lease.
+ */
+import type { HarnessLifecycle, NextAllowedAction, PrimitiveResponse, SessionState, SessionStateView } from "./types";
+export declare function isTerminal(lifecycle: HarnessLifecycle): boolean;
+export declare function canTransition(from: HarnessLifecycle, to: HarnessLifecycle): boolean;
+export declare function assertTransition(from: HarnessLifecycle, to: HarnessLifecycle): void;
+/**
+ * Derive the permitted next actions for a session given its lifecycle and whether
+ * a live owner currently holds the lease.
+ */
+export declare function nextAllowedActions(lifecycle: HarnessLifecycle, ownerLive: boolean): NextAllowedAction[];
+export declare function buildStateView(state: SessionState, ownerLive: boolean): SessionStateView;
+/** Build the universal contract response carried by every primitive. */
+export declare function buildResponse<E extends Record<string, unknown>>(state: SessionState, ownerLive: boolean, evidence: E, ok?: boolean): PrimitiveResponse<E>;

package/dist/types/harness-control-plane/storage.d.ts

@@ -0,0 +1,53 @@
+import type { EventEnvelope, ReceiptFamily, SessionState } from "./types";
+export declare const MAX_UNIX_SOCKET_PATH_BYTES = 100;
+export declare function controlSocketPath(root: string, sessionId: string, env?: NodeJS.ProcessEnv): string;
+export declare class StorageError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** Resolve the harness state root from explicit value, env, or cwd default. */
+export declare function resolveHarnessRoot(opts?: {
+    root?: string;
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+}): string;
+export declare function assertSafeSessionId(id: string): void;
+export declare function generateSessionId(prefix?: string): string;
+export interface SessionPaths {
+    dir: string;
+    state: string;
+    lease: string;
+    events: string;
+    receiptsIndex: string;
+    receiptsDir: string;
+    artifactsDir: string;
+    controlSock: string;
+    controlFifo: string;
+    gjcSessionDir: string;
+}
+export declare function sessionPaths(root: string, sessionId: string): SessionPaths;
+export declare function readSessionState(root: string, sessionId: string): Promise<SessionState | null>;
+export declare function writeSessionState(root: string, state: SessionState): Promise<void>;
+export declare function sessionExists(root: string, sessionId: string): Promise<boolean>;
+/** Append a single severity envelope to events.jsonl. Single-writer discipline is the owner's job (M3). */
+export declare function appendEvent(root: string, sessionId: string, envelope: EventEnvelope): Promise<void>;
+/** Read events from cursor (exclusive). Tail-only: never mutates the log. */
+export declare function readEvents(root: string, sessionId: string, fromCursor?: number): Promise<EventEnvelope[]>;
+export interface ReceiptIndexEntry {
+    receiptId: string;
+    family: ReceiptFamily;
+    valid: boolean;
+    createdAt: string;
+    path: string;
+}
+/**
+ * Persist a receipt immutably. Fails closed if the receipt id already exists,
+ * then appends an index entry to receipts.jsonl.
+ */
+export declare function writeReceiptImmutable(root: string, sessionId: string, family: ReceiptFamily, receiptId: string, value: {
+    receiptId: string;
+    family: ReceiptFamily;
+    valid: boolean;
+    createdAt: string;
+}): Promise<ReceiptIndexEntry>;
+export declare function readReceiptIndex(root: string, sessionId: string, family?: ReceiptFamily): Promise<ReceiptIndexEntry[]>;