@graphrefly/graphrefly 0.39.0 → 0.41.0

package/dist/index-CuPUehFa.d.cts

@@ -0,0 +1,218 @@
+import { N as Node, A as Actor, P as PolicyRuleData } from './node-BYInONRr.cjs';
+import { G as Graph, b as GraphDescribeOutput, a as GraphOptions, d as GraphDescribeOptions, D as DescribeFilter } from './graph-E6likq7w.cjs';
+import { P as PolicyGateGraph, a as PolicyViolation } from './index-BmSQLAZo.cjs';
+import { T as TopicGraph } from './index-Cnr1WrlX.cjs';
+
+/**
+ * Composable safety layer (roadmap §9.0b — Tier 5.1 Wave-B rebuild).
+ *
+ * {@link guardedExecution} wraps any {@link Graph} with:
+ *
+ * - {@link policyGate} — reactive ABAC (Tier 2.3 rename of `policyEnforcer`),
+ *   policies stored as a `Node` so LLMs / humans can update them at runtime.
+ *   Full transitive dynamic coverage via `watchTopologyTree`.
+ * - Reactive {@link GuardedExecutionGraph.scopedDescribeNode} — a thin
+ *   delegate over `target.describe({ reactive: true, actor })` that re-derives
+ *   on every settle (topology change, error transition, actor swap).
+ * - The enforcer's `violations` topic is republished as `violations` on
+ *   the wrapper, composable with {@link graphLens}'s `health`.
+ * - The wrapper-level `lints` topic surfaces non-policy diagnostic warnings
+ *   (`empty-policies` / `audit-no-effect` / `no-actor`) so misconfigurations
+ *   are caught reactively rather than via thrown errors at scattered call sites.
+ * - The `scope` derived publishes the current configuration tuple
+ *   (`{actor, mode, policiesCount}`) for dashboards.
+ *
+ * V1 scope: policies + actor + reactive scoped describe + lints + scope.
+ * Budget-as-option is NOT in V1 — it requires a cost-tracking design that
+ * hasn't landed yet. Callers who need a budget limit today append a
+ * budget-aware {@link PolicyRuleData} to the policies list (check current
+ * cost and `deny` when exhausted).
+ *
+ * @module
+ */
+
+/** Diagnostic warning published on {@link GuardedExecutionGraph.lints}. */
+interface GuardedExecutionLint {
+    /**
+     * - `"empty-policies"` — `policies` Node emitted an empty array in
+     *   `mode: "enforce"`. Static empty arrays throw at construction; this
+     *   covers the reactive case.
+     * - `"audit-no-effect"` — `mode: "audit"` plus the target has no per-node
+     *   guards, so `scopedDescribeNode` filters by per-node guards only and
+     *   policies will never gate visibility (they still populate `violations`
+     *   on writes).
+     * - `"no-actor"` — neither a wrapper-configured nor per-call actor was
+     *   supplied. `scopedDescribeNode` falls back to "describe everything"
+     *   for the corresponding subscription.
+     */
+    kind: "empty-policies" | "audit-no-effect" | "no-actor";
+    message: string;
+    timestamp_ns: number;
+}
+/** Configuration tuple published on {@link GuardedExecutionGraph.scope}. */
+interface GuardedScope {
+    /** The wrapper-configured default actor, or `null` when none configured. */
+    actor: Actor | null;
+    mode: "audit" | "enforce";
+    /** Current policy count (reactive — re-emits on `policies` Node updates). */
+    policiesCount: number;
+}
+/** Options for {@link guardedExecution}. */
+interface GuardedExecutionOptions {
+    /**
+     * Policies enforced against every guarded write. Static list or a live
+     * `Node<readonly PolicyRuleData[]>` (LLM-updatable).
+     *
+     * **Empty-policies handling:**
+     * - Static empty array + `mode: "enforce"` throws `RangeError` at
+     *   construction (deny-by-default is almost certainly a misconfiguration).
+     * - Node-supplied empty array + `mode: "enforce"` emits a one-time
+     *   `"empty-policies"` lint on first such emission (the wrapper can't
+     *   throw mid-run — surface the warning reactively).
+     * - `mode: "audit"` tolerates empty policies (no guards stacked; policies
+     *   only feed the `violations` channel on writes).
+     */
+    policies: readonly PolicyRuleData[] | Node<readonly PolicyRuleData[]>;
+    /**
+     * Default actor used when the caller invokes
+     * {@link GuardedExecutionGraph.scopedDescribeNode} without an override.
+     * Accepts a static {@link Actor} or a `Node<Actor>` — when a Node is
+     * supplied, the reactive describe re-derives on every actor emission so
+     * harnesses binding a per-turn actor get a single live describe Node
+     * instead of re-creating one per turn.
+     *
+     * Omit to scope per-call only. A `"no-actor"` lint fires once per instance
+     * if neither a configured nor per-call actor is ever supplied (the
+     * resulting describe is unscoped — full visibility).
+     */
+    actor?: Actor | Node<Actor>;
+    /**
+     * `"enforce"` (default) — push guards onto target nodes so disallowed
+     * writes throw {@link GuardDenied}.
+     * `"audit"` — record would-be denials to the `violations` topic without
+     * blocking writes.
+     */
+    mode?: "audit" | "enforce";
+    /** Ring-buffer cap for the `violations` topic. Default 1000 (inherited from policyGate). */
+    violationsLimit?: number;
+    /** Ring-buffer cap for the `lints` topic. Default 64 — each lint kind fires at most once per instance. */
+    lintsLimit?: number;
+    /** Wrapper graph name. Default `${target.name}_guarded`. */
+    name?: string;
+    /** Wrapper graph options. */
+    graph?: GraphOptions;
+}
+/**
+ * Wrapper over a target {@link Graph} providing reactive ABAC + reactive
+ * scoped describe + diagnostic lints. Mounts a {@link PolicyGateGraph} under
+ * `enforcer`, a {@link TopicGraph} of {@link GuardedExecutionLint} under
+ * `lints`, and a `scope` derived publishing `{actor, mode, policiesCount}`.
+ *
+ * @category patterns
+ */
+declare class GuardedExecutionGraph extends Graph {
+    readonly enforcer: PolicyGateGraph;
+    readonly violations: TopicGraph<PolicyViolation>;
+    readonly lints: TopicGraph<GuardedExecutionLint>;
+    readonly scope: Node<GuardedScope>;
+    /**
+     * Canonical reactive describe scoped to the wrapper's configured `actor`.
+     * Subscribes ONCE at construction; lifecycle owned by the wrapper (disposed
+     * on `wrapper.destroy()`). Use this property for the common case
+     * (long-lived consumer wanting "describe scoped to my actor"); use
+     * {@link scopedDescribeNode} only when a per-call actor override or
+     * different `detail`/`fields` is required.
+     *
+     * Re-derives on every settle of the target graph: structural changes,
+     * status transitions (errors flip nodes into `"errored"`), and actor
+     * emissions (when a `Node<Actor>` is bound, including the SENTINEL bridge
+     * applied internally — see qa G1B).
+     */
+    readonly scopedDescribe: Node<GraphDescribeOutput>;
+    private readonly _target;
+    private readonly _actorNode;
+    private readonly _mode;
+    private readonly _firedLintKinds;
+    constructor(target: Graph, opts: GuardedExecutionOptions);
+    private _fireLint;
+    /**
+     * **Per-call escape hatch.** Prefer {@link scopedDescribe} (the mounted
+     * property) for the common case of "describe scoped to my actor." Use
+     * this method ONLY when you need a per-call actor override or different
+     * `detail`/`fields`/`filter`.
+     *
+     * Returns a live `Node<GraphDescribeOutput>` scoped to the supplied (or
+     * configured) actor, plus an explicit `dispose` for caller-controlled
+     * lifecycle. Re-derives on every settle of the target graph: structural
+     * changes, status transitions, and actor emissions (when a `Node<Actor>`
+     * is bound).
+     *
+     * **Lifecycle (qa G1A — EC1 fix).** Each call instantiates a fresh
+     * `target.describe({reactive: true})` handle (with its own version state,
+     * observe handle, transitive topology subscriptions, derived + keepalive).
+     * The caller MUST invoke the returned `dispose()` when finished to release
+     * these resources. Disposers ARE also tracked on the wrapper graph so
+     * `wrapper.destroy()` cleans up any handles the caller forgot — but a
+     * long-lived wrapper with heavy per-call usage will leak until destroy
+     * unless `dispose()` is called explicitly.
+     *
+     * @param actorOverride - Optional per-call override. Static {@link Actor}
+     *   or `Node<Actor>`. Omit to use the wrapper-configured default.
+     * @param opts - Standard {@link GraphDescribeOptions} fields (`detail`,
+     *   `fields`, `filter`). `actor` / `reactive` / `reactiveName` are
+     *   controlled by the wrapper.
+     * @returns `{node, dispose}` — `node` is the live describe Node; `dispose`
+     *   tears down the underlying reactive describe subscription idempotently.
+     */
+    scopedDescribeNode(actorOverride?: Actor | Node<Actor>, opts?: Omit<GraphDescribeOptions, "actor" | "reactive" | "reactiveName">): {
+        node: Node<GraphDescribeOutput>;
+        dispose: () => void;
+    };
+    /** The wrapped graph (escape hatch for tooling). */
+    get target(): Graph;
+}
+/**
+ * Wrap a {@link Graph} with {@link policyGate} plus a reactive scoped describe
+ * lens. Returns a {@link GuardedExecutionGraph} that can be mounted, diffed,
+ * or composed with {@link graphLens}.
+ *
+ * @param target - The graph to guard.
+ * @param opts - See {@link GuardedExecutionOptions}.
+ *
+ * @example
+ * ```ts
+ * const guarded = guardedExecution(app, {
+ *   actor: state<Actor>({ type: "human", id: "alice" }), // reactive — re-derive on swap
+ *   policies: [
+ *     { effect: "allow", action: "read", actorType: "human" },
+ *     { effect: "deny", action: "write", pathPattern: "system::*" },
+ *   ],
+ *   mode: "enforce",
+ * });
+ *
+ * // Canonical: subscribe to the mounted reactive describe (no per-call leak).
+ * guarded.scopedDescribe.subscribe((msgs) => { /* live describe per actor / topology change *\/ });
+ * // Per-call escape hatch (different actor / detail) — caller manages dispose.
+ * const detailed = guarded.scopedDescribeNode(undefined, { detail: "standard" });
+ * try { detailed.node.subscribe(/* … *\/); } finally { detailed.dispose(); }
+ * guarded.violations.events.subscribe(msgs => console.log("violations:", msgs));
+ * guarded.lints.events.subscribe(msgs => console.warn("lints:", msgs));
+ * guarded.scope.subscribe(msgs => console.log("scope:", msgs));
+ * ```
+ *
+ * @category patterns
+ */
+declare function guardedExecution(target: Graph, opts: GuardedExecutionOptions): GuardedExecutionGraph;
+
+declare const index_DescribeFilter: typeof DescribeFilter;
+type index_GuardedExecutionGraph = GuardedExecutionGraph;
+declare const index_GuardedExecutionGraph: typeof GuardedExecutionGraph;
+type index_GuardedExecutionLint = GuardedExecutionLint;
+type index_GuardedExecutionOptions = GuardedExecutionOptions;
+type index_GuardedScope = GuardedScope;
+declare const index_guardedExecution: typeof guardedExecution;
+declare namespace index {
+  export { index_DescribeFilter as DescribeFilter, index_GuardedExecutionGraph as GuardedExecutionGraph, type index_GuardedExecutionLint as GuardedExecutionLint, type index_GuardedExecutionOptions as GuardedExecutionOptions, type index_GuardedScope as GuardedScope, index_guardedExecution as guardedExecution };
+}
+
+export { GuardedExecutionGraph as G, type GuardedExecutionLint as a, type GuardedExecutionOptions as b, type GuardedScope as c, guardedExecution as g, index as i };

package/dist/index-D1Gc7wV5.d.ts

@@ -0,0 +1,230 @@
+import { f as factoryTag, p as placeholderArgs } from './meta-D8OyedKp.js';
+import { N as Node } from './node-BYInONRr.js';
+import { S as StatusValue, C as CircuitState, R as RateLimiterState, a as RateLimiterOptions, b as CircuitBreakerOptions, c as RetryOptions, F as FallbackInput, N as NS_PER_MS, d as NS_PER_SEC } from './index-BAQrjuZF.js';
+import { G as Graph, a as GraphOptions } from './graph-BkIkog4h.js';
+import { B as BudgetConstraint } from './budget-gate-CmmVtasH.js';
+
+/**
+ * Resilience composition with correct nesting order (roadmap §9.0b — Tier 5.2 Wave-B rebuild).
+ *
+ * {@link resilientPipeline} composes the resilience primitives from
+ * `extra/resilience/` in the canonical nesting order:
+ *
+ * ```text
+ *   rateLimit → budget → breaker → timeout → retry → fallback → status
+ * ```
+ *
+ * Returns a {@link ResilientPipelineGraph} (Graph subclass) with mounted
+ * intermediate nodes and per-layer status companions, replacing the prior
+ * bundle return. Each intermediate is mounted under a stable name so
+ * `pipeline.describe()` shows the resilience chain in topology snapshots,
+ * mermaid renders, and `lens.health` aggregations.
+ *
+ * **Per-attempt timeout vs. retry ordering.** `timeout` is applied BEFORE
+ * `retry` so each retry attempt resubscribes to a fresh deadline (per-attempt
+ * semantics). If `timeout` wrapped `retry`, a single deadline would apply to
+ * the entire retry chain — not what callers expect.
+ *
+ * **`breakerOnOpen` + `retry` interaction.** With `breakerOnOpen: "error"` AND
+ * `retry`, retry sees `CircuitOpenError` and resubscribes; the next attempt
+ * very likely also breaker-open → another error → retry burns its budget
+ * against an open circuit. Either set retry's `backoff` long enough for the
+ * breaker reset window OR keep the default `breakerOnOpen: "skip"` (emits
+ * RESOLVED when open; downstream drops the beat without retry firing).
+ *
+ * **Reactive options (switchMap rebuild).** Every primitive option accepts a
+ * `T | Node<T>` (precedent-aligned with `FallbackInput<T>`). When the caller
+ * supplies a static value, the layer is built once at construction. When the
+ * caller supplies a `Node<T>`, the pipeline subscribes via `switchMap` and
+ * **rebuilds the layer on every option emission** — the chain stalls until
+ * the option Node emits its first DATA. Each rebuild creates a fresh
+ * primitive instance, so internal state is lost (rate-limiter pending buffer,
+ * breaker failure count, retry attempt count, in-flight timeout). Per-layer
+ * **companion Nodes** (`droppedCount`, `rateLimitState`, `breakerState`) are
+ * therefore exposed ONLY for the static-options path. Primitive-side widening
+ * (filed in `docs/optimizations.md` under "Tier 5.2 follow-up — primitive-side
+ * reactive-options widening") will preserve internal state once it lands and
+ * the pipeline will trivially forward Node-form options to the primitive.
+ *
+ * @module
+ */
+
+/**
+ * `T | Node<T>` for primitive options — precedent-aligned with
+ * {@link FallbackInput} and `policyGate.policies`. When the caller supplies a
+ * static value, the layer is built once at construction. When the caller
+ * supplies a `Node<T>`, the pipeline subscribes via {@link switchMap}: the
+ * layer is rebuilt on every option emission. **State-loss caveat:** each
+ * rebuild creates a fresh primitive instance — `rateLimiter` loses its pending
+ * buffer, `circuitBreaker` resets failure count, `retry` resets attempt
+ * count, `timeout` cancels in-flight deadline. This is the documented
+ * switchMap-pattern semantics; primitive-side widening (filed in
+ * `docs/optimizations.md`) will preserve internal state once it lands and the
+ * pipeline can forward Node-form options directly.
+ *
+ * Per-layer **companion Nodes** (`droppedCount`, `rateLimitState`,
+ * `breakerState`) are exposed only for the static-options path — Node-form
+ * leaves them as `undefined` because each rebuild creates new companion
+ * instances and a switchMap-mirrored companion would track only the latest
+ * bundle. Callers needing both reactive options AND companions wait for
+ * primitive-side widening.
+ */
+type NodeOrValue<T> = T | Node<T>;
+/**
+ * Options for {@link resilientPipeline}. Every layer is optional — omit a
+ * field and that layer is skipped.
+ *
+ * Reactive (`Node<T>`) forms are accepted everywhere a primitive value would
+ * fit; the pipeline subscribes via `switchMap` and rebuilds the layer on each
+ * emission. See module JSDoc for the rebuild semantics + state-loss caveat.
+ */
+interface ResilientPipelineOptions<T> {
+    /**
+     * Admission control — at most `maxEvents` `DATA` per `windowNs`. See
+     * {@link rateLimiter}.
+     *
+     * `maxBuffer` is optional at the pipeline layer (defaults to `Infinity`,
+     * preserving the historical unbounded behavior). Pass an explicit positive
+     * integer to opt in to a bounded queue.
+     */
+    rateLimit?: NodeOrValue<Omit<RateLimiterOptions, "maxBuffer"> & {
+        maxBuffer?: number;
+    }>;
+    /** Cost/constraint gate. See {@link budgetGate}. */
+    budget?: NodeOrValue<ReadonlyArray<BudgetConstraint>>;
+    /** Circuit breaker — fail-fast when the downstream resource is unhealthy. See {@link circuitBreaker}. */
+    breaker?: NodeOrValue<CircuitBreakerOptions>;
+    /**
+     * Behavior when the breaker is open:
+     * - `"skip"` (default) — emit `RESOLVED` (lets downstream drop the beat).
+     * - `"error"` — emit a `CircuitOpenError` so `retry` / `fallback` can react.
+     *   See module JSDoc for the retry-budget burn caveat.
+     *
+     * Static (configuration-only — no reactive form).
+     */
+    breakerOnOpen?: "skip" | "error";
+    /** Retry policy on terminal `ERROR`. See {@link retry}. */
+    retry?: NodeOrValue<RetryOptions>;
+    /**
+     * Per-attempt deadline in milliseconds. Converted to ns internally. Omit
+     * to skip the timeout wrap.
+     *
+     * Specified in ms (not ns) because callers consistently think in
+     * millisecond deadlines; the underlying {@link timeout} primitive takes ns
+     * internally.
+     */
+    timeoutMs?: NodeOrValue<number>;
+    /** Final fallback value emitted on terminal `ERROR` after retry exhausts. See {@link fallback}. */
+    fallback?: FallbackInput<T>;
+    /**
+     * Initial status reported by the status node. Default `"pending"`. Static.
+     */
+    initialStatus?: StatusValue;
+    /** Wrapper graph name. Default `"resilient_pipeline"`. */
+    name?: string;
+    /** Wrapper graph options. */
+    graph?: GraphOptions;
+}
+/**
+ * Graph subclass returned by {@link resilientPipeline}. Mounts each
+ * configured intermediate under a stable name and exposes per-layer status
+ * companions.
+ *
+ * @category patterns
+ */
+declare class ResilientPipelineGraph<T> extends Graph {
+    /**
+     * Final resilient node — subscribe to this for `DATA` emissions.
+     *
+     * Named `output` (not `node`) because `Graph.node(name)` already names the
+     * path-resolution method on the base class; a `readonly node` field would
+     * shadow it.
+     */
+    readonly output: Node<T>;
+    /** Live status: `"pending" | "running" | "completed" | "errored"`. */
+    readonly status: Node<StatusValue>;
+    /**
+     * Last error payload, or `null` when not errored.
+     *
+     * Named `lastError` (not `error`) because `Graph.error(name, err)` already
+     * names a method on the base class.
+     */
+    readonly lastError: Node<unknown | null>;
+    /** Breaker state when `opts.breaker` is provided; `undefined` otherwise. */
+    readonly breakerState: Node<CircuitState> | undefined;
+    /**
+     * Drop-counter when `opts.rateLimit` is provided; `undefined` otherwise.
+     *
+     * **Lifetime note:** `droppedCount` retains its final value through
+     * terminal (`COMPLETE` / `ERROR` / `TEARDOWN`); the underlying counter
+     * resets to `0` only at the next subscription cycle.
+     */
+    readonly droppedCount: Node<number> | undefined;
+    /**
+     * Combined rate-limit state when `opts.rateLimit` is provided; `undefined`
+     * otherwise. Same lifecycle as {@link droppedCount} but exposes
+     * `pendingCount` and `paused` alongside the drop counter for richer
+     * backpressure observability (Tier 5.2 D7).
+     */
+    readonly rateLimitState: Node<RateLimiterState> | undefined;
+    constructor(source: Node<T>, opts?: ResilientPipelineOptions<T>);
+}
+/**
+ * Compose a resilient pipeline around `source` in the canonical nesting
+ * order — `rateLimit → budget → breaker → timeout → retry → fallback → status`.
+ * Omit any option to skip that layer.
+ *
+ * Returns a {@link ResilientPipelineGraph} (Graph subclass) —
+ * `pipeline.output` is the externally visible final node; `pipeline.status`
+ * / `pipeline.lastError` / `pipeline.breakerState` / `pipeline.droppedCount`
+ * are the per-layer companions. Call `pipeline.describe()` to see the
+ * mounted intermediates; compose with {@link graphLens}'s `health` for
+ * aggregate status.
+ *
+ * **Naming note:** `output` and `lastError` (not `node` / `error`) avoid
+ * clashes with `Graph.node(name)` and `Graph.error(name, err)` on the base
+ * class.
+ *
+ * @param source - Upstream node to wrap.
+ * @param opts - See {@link ResilientPipelineOptions}. All fields optional.
+ *
+ * @example
+ * ```ts
+ * const safeFetch = resilientPipeline(fetchNode, {
+ *   rateLimit: { maxEvents: 10, windowNs: NS_PER_SEC },
+ *   breaker: { failureThreshold: 5 },
+ *   retry: { count: 3, backoff: "exponential" },
+ *   timeoutMs: 10_000,
+ *   fallback: null,
+ * });
+ * safeFetch.output.subscribe(msgs => console.log(msgs));
+ * safeFetch.status.subscribe(msgs => console.log(msgs));
+ * safeFetch.describe({ format: "ascii" }); // visualize the chain
+ * ```
+ *
+ * @category patterns
+ */
+declare function resilientPipeline<T>(source: Node<T>, opts?: ResilientPipelineOptions<T>): ResilientPipelineGraph<T>;
+
+declare const index_BudgetConstraint: typeof BudgetConstraint;
+declare const index_CircuitBreakerOptions: typeof CircuitBreakerOptions;
+declare const index_CircuitState: typeof CircuitState;
+declare const index_FallbackInput: typeof FallbackInput;
+declare const index_NS_PER_MS: typeof NS_PER_MS;
+declare const index_NS_PER_SEC: typeof NS_PER_SEC;
+type index_NodeOrValue<T> = NodeOrValue<T>;
+declare const index_RateLimiterOptions: typeof RateLimiterOptions;
+declare const index_RateLimiterState: typeof RateLimiterState;
+type index_ResilientPipelineGraph<T> = ResilientPipelineGraph<T>;
+declare const index_ResilientPipelineGraph: typeof ResilientPipelineGraph;
+type index_ResilientPipelineOptions<T> = ResilientPipelineOptions<T>;
+declare const index_RetryOptions: typeof RetryOptions;
+declare const index_StatusValue: typeof StatusValue;
+declare const index_factoryTag: typeof factoryTag;
+declare const index_placeholderArgs: typeof placeholderArgs;
+declare const index_resilientPipeline: typeof resilientPipeline;
+declare namespace index {
+  export { index_BudgetConstraint as BudgetConstraint, index_CircuitBreakerOptions as CircuitBreakerOptions, index_CircuitState as CircuitState, index_FallbackInput as FallbackInput, index_NS_PER_MS as NS_PER_MS, index_NS_PER_SEC as NS_PER_SEC, type index_NodeOrValue as NodeOrValue, index_RateLimiterOptions as RateLimiterOptions, index_RateLimiterState as RateLimiterState, index_ResilientPipelineGraph as ResilientPipelineGraph, type index_ResilientPipelineOptions as ResilientPipelineOptions, index_RetryOptions as RetryOptions, index_StatusValue as StatusValue, index_factoryTag as factoryTag, index_placeholderArgs as placeholderArgs, index_resilientPipeline as resilientPipeline };
+}
+
+export { type NodeOrValue as N, ResilientPipelineGraph as R, type ResilientPipelineOptions as a, index as i, resilientPipeline as r };

package/dist/{index-CWHtYmSh.d.cts → index-D4uimgee.d.cts}

@@ -1,4 +1,4 @@
-import { C as CatchOptions, a as ClassifyResult, D as Decision, b as DecisionAction, G as GateController, c as GateOptions, P as PipelineGraph, S as StepRef, T as TerminalCause, d as decisionKeyOf, p as pipelineGraph } from './pipeline-graph-BQPr2Lqs.cjs';
+import { C as CatchOptions, a as ClassifyResult, D as Decision, b as DecisionAction, G as GateController, c as GateOptions, P as PipelineGraph, S as StepRef, T as TerminalCause, d as decisionKeyOf, p as pipelineGraph } from './pipeline-graph-MWrQZXCq.cjs';
 
 /**
  * Orchestration patterns (roadmap §4.1).

package/dist/{index-xZYcDqFH.d.cts → index-DGD4_fj6.d.cts}

@@ -1,9 +1,9 @@
 import { N as Node } from './node-BYInONRr.cjs';
-import { B as BaseAuditRecord } from './index-DINuaZlJ.cjs';
+import { B as BaseAuditRecord } from './index-DVDapw2k.cjs';
 import { a as ReactiveLogBundle } from './reactive-log-_zeEnB9H.cjs';
 import { NodeInput } from './extra/sources.cjs';
 import { AppendLogStorageTier } from './extra/storage-tiers.cjs';
-import { G as Graph, a as GraphOptions } from './graph-BUwMAxJI.cjs';
+import { G as Graph, a as GraphOptions } from './graph-E6likq7w.cjs';
 
 /**
  * Job queue patterns (roadmap §4.2).
@@ -112,16 +112,31 @@ type StageDef<T> = string | {
         id: string;
         version: string | number;
     };
+    /**
+     * Per-stage cap on `claim → work → ack` cycles per pump tick.
+     * Overrides {@link JobFlowOptions.maxPerPump} for this stage. Useful
+     * when stages have asymmetric cost (e.g. an LLM-execute stage capped
+     * at 4 concurrent calls while a cheap verify stage runs unbounded).
+     *
+     * Falls back to the top-level `JobFlowOptions.maxPerPump`, which in
+     * turn falls back to `DEFAULT_MAX_PER_PUMP` (256).
+     */
+    maxPerPump?: number;
 };
 type JobFlowOptions<T = unknown> = {
     graph?: GraphOptions;
     /**
      * Stage definitions. Each stage is either a bare name string (pure
-     * pass-through) or a `{ name, work?, handlerVersion? }` object.
+     * pass-through) or a `{ name, work?, handlerVersion?, maxPerPump? }` object.
      *
      * For back-compat, `string[]` values behave as stages with no work hook.
      */
     stages?: readonly StageDef<T>[];
+    /**
+     * Default cap on claims per pump tick across all stages. Per-stage
+     * overrides can be set on each {@link StageDef.maxPerPump}; if neither is
+     * set, falls back to `DEFAULT_MAX_PER_PUMP` (256).
+     */
     maxPerPump?: number;
 };
 declare class JobFlowGraph<T> extends Graph {
@@ -168,4 +183,4 @@ declare namespace index {
   export { type index_JobEnvelope as JobEnvelope, type index_JobEvent as JobEvent, type index_JobEventAction as JobEventAction, index_JobFlowGraph as JobFlowGraph, type index_JobFlowOptions as JobFlowOptions, index_JobQueueGraph as JobQueueGraph, type index_JobQueueOptions as JobQueueOptions, type index_JobState as JobState, type index_StageDef as StageDef, type index_WorkFn as WorkFn, index_jobEventKeyOf as jobEventKeyOf, index_jobFlow as jobFlow, index_jobQueue as jobQueue };
 }
 
-export { JobQueueGraph as J, type StageDef as S, type WorkFn as W, type JobEnvelope as a, type JobEvent as b, type JobEventAction as c, JobFlowGraph as d, type JobFlowOptions as e, type JobQueueOptions as f, type JobState as g, jobFlow as h, index as i, jobEventKeyOf as j, jobQueue as k };
+export { type JobEnvelope as J, type StageDef as S, type WorkFn as W, JobFlowGraph as a, JobQueueGraph as b, type JobEvent as c, type JobEventAction as d, type JobFlowOptions as e, type JobQueueOptions as f, type JobState as g, jobFlow as h, index as i, jobEventKeyOf as j, jobQueue as k };

package/dist/{index-CwP_KAMS.d.cts → index-DGTo1yka.d.cts}

@@ -169,6 +169,13 @@ type RetryOptions = {
     count?: number;
     /** Delay between attempts; strategies use **nanoseconds**. */
     backoff?: BackoffStrategy | BackoffPreset;
+    /**
+     * Caller-supplied metadata merged into the produced node's `meta` (Tier 5.2
+     * D8 widening). Use {@link domainMeta} to tag the layer for `describe()`
+     * grouping. The primitive's `factoryTag("retry", …)` always wins against
+     * caller keys.
+     */
+    meta?: Record<string, unknown>;
 };
 /** Factory-mode-only options. `initial` seeds the outer node's cache before the first attempt. */
 type RetryFactoryOptions<T> = RetryOptions & {
@@ -323,6 +330,7 @@ type WithBreakerBundle<T> = {
  */
 declare function withBreaker<T>(breaker: CircuitBreaker, options?: {
     onOpen?: "skip" | "error";
+    meta?: Record<string, unknown>;
 }): (source: Node<T>) => WithBreakerBundle<T>;
 interface TokenBucket {
     /**
@@ -409,6 +417,15 @@ type RateLimiterOptions = {
     maxBuffer: number;
     /** Overflow policy when `maxBuffer` is exceeded. Default: `"drop-newest"`. */
     onOverflow?: RateLimiterOverflowPolicy;
+    /**
+     * Caller-supplied metadata merged into the produced node's `meta` (Tier 5.2
+     * D8 widening). Use {@link domainMeta} to tag the layer for `describe()` /
+     * mermaid grouping (e.g. `domainMeta("resilient", "rate-limit")`). The
+     * primitive's own `factoryTag("rateLimiter", opts)` and the `droppedCount`
+     * / `rateLimitState` companion seeds always win against caller-supplied
+     * keys so the audit trail can't be silently overwritten.
+     */
+    meta?: Record<string, unknown>;
 };
 /**
  * Thrown by {@link rateLimiter} when `onOverflow: "error"` and the pending buffer is full.
@@ -419,24 +436,60 @@ declare class RateLimiterOverflowError extends Error {
     name: string;
     constructor(maxBuffer: number);
 }
+/**
+ * Combined runtime state surfaced by {@link rateLimiter} alongside `droppedCount`.
+ * Tier 5.2 D7 widening — exposes pending-buffer occupancy and a `paused`
+ * flag so consumers can render backpressure (UI), feed `lens.health`, or
+ * gate downstream effects.
+ */
+type RateLimiterState = {
+    /** Cumulative `DATA` items dropped due to overflow since this subscription cycle started. */
+    droppedCount: number;
+    /** Items currently buffered awaiting a token refill. `0` when the limiter is passing through. */
+    pendingCount: number;
+    /** `true` when at least one item is queued (the limiter is actively throttling). */
+    paused: boolean;
+};
 /** Bundle returned by {@link rateLimiter}. */
 type RateLimiterBundle<T> = {
     /** The throttled stream — at most `maxEvents` `DATA` per `windowNs`. */
     node: Node<T>;
     /**
-     * Reactive companion: count of `DATA` items dropped since subscription start.
+     * Reactive companion: count of `DATA` items dropped since the producer
+     * activated.
      *
      * - Increments on every drop under any overflow policy (`drop-newest`,
      *   `drop-oldest`). The `error` policy terminates the stream after a single
      *   overflow, so `droppedCount` increments at most once in that path.
-     * - Resets to `0` on terminal (`COMPLETE` / `ERROR` / `TEARDOWN`) — i.e. the
-     *   counter scopes to the active subscription cycle.
+     * - **Lifecycle scoping (qa A1 + EC7):** the counter retains its final
+     *   value through terminal (`COMPLETE` / `ERROR` / `TEARDOWN`) so consumers
+     *   see the final drop count, not zero. The closure-held counter resets to
+     *   `0` only when the producer fn re-runs — which only happens on a new
+     *   subscription cycle, and only if the producer was constructed with
+     *   `resubscribable: true`. The default `rateLimiter` producer is NOT
+     *   resubscribable, so a single producer-fn run is the typical lifetime.
      * - Producer-pattern note: this companion is invisible to `describe()`
      *   traversal from `node` (effect-mirror limitation; same shape as
      *   `withBreaker.breakerState` and `withStatus.status`). Surface it via
      *   `node.meta.droppedCount` if you need it in topology snapshots.
      */
     droppedCount: Node<number>;
+    /**
+     * Reactive companion: combined `{droppedCount, pendingCount, paused}` view.
+     *
+     * - `pendingCount` reflects the live buffer occupancy and updates on every
+     *   push / shift / overflow drop; `paused` is shorthand for
+     *   `pendingCount > 0`.
+     * - Equality-deduped — re-emits only when one of the three fields actually
+     *   changes (so a busy steady-state where every DATA passes immediately
+     *   produces one `paused: false` emission, not one per DATA).
+     * - **Lifecycle scoping (qa EC7):** same contract as `droppedCount` —
+     *   retains its final value through terminal; resets to the initial
+     *   `{droppedCount: 0, pendingCount: 0, paused: false}` only on a new
+     *   producer-fn run (resubscribable upstream required).
+     * - Same producer-pattern caveat as `droppedCount` re: `describe()` visibility.
+     */
+    rateLimitState: Node<RateLimiterState>;
 };
 /**
  * Token-bucket rate limiter: at most `maxEvents` `DATA` values per `windowNs`.
@@ -519,6 +572,7 @@ type WithStatusBundle<T> = {
  */
 declare function withStatus<T>(src: Node<T>, options?: {
     initialStatus?: StatusValue;
+    meta?: Record<string, unknown>;
 }): WithStatusBundle<T>;
 /**
  * Thrown by {@link timeout} when no `DATA` arrives within the deadline.
@@ -562,7 +616,9 @@ type FallbackInput<T> = T | Node<T> | PromiseLike<T> | AsyncIterable<T>;
  *
  * @category extra
  */
-declare function fallback<T>(source: Node<T>, fb: FallbackInput<T>): Node<T>;
+declare function fallback<T>(source: Node<T>, fb: FallbackInput<T>, options?: {
+    meta?: Record<string, unknown>;
+}): Node<T>;
 /**
  * Emits `ERROR` with {@link TimeoutError} if no `DATA` arrives within the deadline.
  *
@@ -588,6 +644,8 @@ declare function fallback<T>(source: Node<T>, fb: FallbackInput<T>): Node<T>;
  *
  * @category extra
  */
-declare function timeout<T>(source: Node<T>, timeoutNs: number): Node<T>;
+declare function timeout<T>(source: Node<T>, timeoutNs: number, options?: {
+    meta?: Record<string, unknown>;
+}): Node<T>;
 
-export { type BackoffPreset as B, type CircuitState as C, type ExponentialBackoffOptions as E, type FallbackInput as F, type JitterMode as J, NS_PER_MS as N, type RateLimiterOptions as R, type StatusValue as S, TimeoutError as T, type WithBreakerBundle as W, type CircuitBreakerOptions as a, type RetryOptions as b, NS_PER_SEC as c, type BackoffStrategy as d, type CircuitBreaker as e, CircuitOpenError as f, RateLimiterOverflowError as g, type RateLimiterOverflowPolicy as h, type TokenBucket as i, type WithStatusBundle as j, circuitBreaker as k, constant as l, decorrelatedJitter as m, exponential as n, fallback as o, fibonacci as p, linear as q, rateLimiter as r, resolveBackoffPreset as s, retry as t, timeout as u, tokenBucket as v, withBreaker as w, withMaxAttempts as x, withStatus as y };
+export { type BackoffPreset as B, type CircuitState as C, type ExponentialBackoffOptions as E, type FallbackInput as F, type JitterMode as J, NS_PER_MS as N, type RateLimiterState as R, type StatusValue as S, TimeoutError as T, type WithBreakerBundle as W, type RateLimiterOptions as a, type CircuitBreakerOptions as b, type RetryOptions as c, NS_PER_SEC as d, type BackoffStrategy as e, type CircuitBreaker as f, CircuitOpenError as g, RateLimiterOverflowError as h, type RateLimiterOverflowPolicy as i, type TokenBucket as j, type WithStatusBundle as k, circuitBreaker as l, constant as m, decorrelatedJitter as n, exponential as o, fallback as p, fibonacci as q, linear as r, rateLimiter as s, resolveBackoffPreset as t, retry as u, timeout as v, tokenBucket as w, withBreaker as x, withMaxAttempts as y, withStatus as z };

package/dist/{index-BUPVld1w.d.ts → index-DH4fm2Ck.d.ts}

@@ -1,5 +1,5 @@
-import { G as Graph } from './graph-30XSgtVX.js';
-import { M as MeasurementAdapter } from './reactive-layout-DkTXxtSy.js';
+import { G as Graph } from './graph-BkIkog4h.js';
+import { M as MeasurementAdapter } from './reactive-layout-KJj4E2dT.js';
 
 /**
  * Three-pane demo shell (roadmap §7.2).

package/dist/{index-DyM4tFAe.d.cts → index-DQQCOIt8.d.cts}

@@ -1,8 +1,8 @@
 import { N as Node } from './node-BYInONRr.cjs';
-import { B as BaseAuditRecord } from './index-DINuaZlJ.cjs';
+import { B as BaseAuditRecord } from './index-DVDapw2k.cjs';
 import { a as ReactiveLogBundle } from './reactive-log-_zeEnB9H.cjs';
 import { AppendLogStorageTier } from './extra/storage-tiers.cjs';
-import { a as GraphOptions, G as Graph } from './graph-BUwMAxJI.cjs';
+import { a as GraphOptions, G as Graph } from './graph-E6likq7w.cjs';
 
 /**
  * CQRS patterns (roadmap §4.5).