@happier-dev/stack 0.2.1-preview.1775586714.26562 → 0.2.12-preview.1

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionDivider.js

@@ -0,0 +1,184 @@
+import { z } from 'zod';
+/**
+ * Transition divider contract — the ONLY transition history artifact.
+ *
+ * The divider is deliberately NOT a new `AgentEventSchema` variant. That union is
+ * closed at the discriminator, so a released older reader would fail to parse an
+ * unknown `type` and drop the row. Instead the divider rides the already-shipped
+ * `type:'message'` passthrough arm as a strict nested sidecar:
+ *
+ *   { type: 'message', message: '<prose>', sessionAgentTransitionV1: { v, fromAgentId, toAgentId, ...bounds } }
+ *
+ * An old reader parses it as an ordinary informational message and renders the
+ * prose; the sidecar survives its `.passthrough()` untouched. A new reader
+ * recognizes the sidecar through {@link readSessionAgentTransitionDividerV1}.
+ *
+ * This module intentionally imports nothing but `zod` so the transcript record
+ * schema, the attention resolvers, and the transition coordinator can all depend
+ * on one owner without an import cycle.
+ */
+/** Sidecar key carried on the passthrough `type:'message'` agent-event arm. */
+export const SESSION_AGENT_TRANSITION_DIVIDER_SIDECAR_KEY = 'sessionAgentTransitionV1';
+/**
+ * Prose stored on the divider row. It exists only so a reader that does not
+ * understand the sidecar still renders something truthful. New readers render
+ * localized copy from the sidecar instead, so this string is not a UI oracle.
+ */
+export const SESSION_AGENT_TRANSITION_DIVIDER_MESSAGE = 'Continued with another Agent.';
+/**
+ * Reserved local-ID namespace for the divider. Every generic client-facing
+ * message ingress MUST reject a localId in this namespace; only the owner-only
+ * transition service may pass one to the canonical `createSessionMessage` owner.
+ */
+export const SESSION_AGENT_TRANSITION_DIVIDER_LOCAL_ID_PREFIX = 'agent-transition:';
+export const SessionAgentTransitionDividerV1Schema = z
+    .object({
+    v: z.literal(1),
+    fromAgentId: z.string().trim().min(1).max(128),
+    toAgentId: z.string().trim().min(1).max(128),
+    /**
+     * UPPER bound: the source transcript cutoff the activation brief was built
+     * from — the `upToSeqInclusive` the bounded context pass actually used.
+     *
+     * It is here because nothing else records it. `replaySeedV1.seedText` is
+     * blanked the instant the target Agent accepts it, and the metadata record
+     * holds one seed per Session, so a Session switched twice keeps only the
+     * newest. Without a per-boundary cutoff, "what was this Agent actually
+     * handed?" is unanswerable after the fact, and a reader that guessed from
+     * the divider's own seq would be wrong for every row admitted between the
+     * confirmed stop and the divider write.
+     *
+     * `0` means the observed transcript head itself was zero. A pass that
+     * produces no dialog still records its non-zero observed upper bound.
+     *
+     * REQUIRED. The only writer that ever omitted it is an unreleased
+     * intermediate build of this feature, so accepting a cutoff-less sidecar
+     * would buy nothing and cost a third state every reader has to model. Such a
+     * sidecar fails the strict parse and the row degrades through the path this
+     * shape was already designed for: the whole sidecar is dropped and the
+     * stored prose is rendered, exactly as in an older reader.
+     */
+    sourceCutoffSeqInclusive: z.number().int().nonnegative(),
+    /**
+     * LOWER bound, exclusive, on a NATIVE RETURN only: the transcript head the
+     * arriving Agent had already seen when it last ran this Session.
+     *
+     * A fresh target's handoff is bounded only above — the pass starts at the
+     * beginning of the source — so the cutoff alone rebuilds it exactly. A
+     * native return is bounded at BOTH ends and what actually crossed the
+     * boundary is the away-delta between them. That lower bound lives in the
+     * returning Agent's device-local departure record, which the very next
+     * departure overwrites, so this is the only place it can outlive the
+     * boundary that used it. Without it a rebuild reruns the same pass with no
+     * lower bound and shows the FULL prefix — more than was sent — from a card
+     * whose entire claim is that it shows what was handed over.
+     *
+     * ABSENT is the fresh target: no lower bound existed. Absence therefore
+     * means exactly one thing, which is why this is optional rather than a
+     * required nullable third state every reader would have to model.
+     */
+    returningAgentLastSeenSeqInclusive: z.number().int().nonnegative().optional(),
+})
+    .strict();
+/**
+ * True only when two dividers describe the exact same handoff boundary.
+ *
+ * The replay bounds are not decoration: together they say exactly which slice
+ * reached the target. Treating an equal Agent pair with different bounds as a
+ * retry would admit or activate against somebody else's boundary.
+ */
+export function isSameSessionAgentTransitionDividerV1(left, right) {
+    return left.v === right.v
+        && left.fromAgentId === right.fromAgentId
+        && left.toAgentId === right.toAgentId
+        && left.sourceCutoffSeqInclusive === right.sourceCutoffSeqInclusive
+        && left.returningAgentLastSeenSeqInclusive === right.returningAgentLastSeenSeqInclusive;
+}
+/**
+ * Matches only the Agent pair known to a post-cutover reconciliation request.
+ *
+ * A retry that reaches an already-target Session has no surviving candidate
+ * bounds to compare — the durable request carries its localId and Agent pair,
+ * while the original bounded pass is gone. That recovery check must therefore
+ * not impersonate exact-boundary equality. Callers that still hold the
+ * candidate divider (the cutover owner and E2EE verification gate) use
+ * {@link isSameSessionAgentTransitionDividerV1} instead.
+ */
+export function matchesSessionAgentTransitionDividerAgentsV1(divider, expected) {
+    return divider.fromAgentId === expected.fromAgentId
+        && divider.toAgentId === expected.toAgentId;
+}
+/**
+ * Deterministic divider identity: `agent-transition:{submittedLocalId}`. The
+ * submitted user-message localId is the single correlation key for the whole
+ * transition, so the divider is exactly-once without any receipt or marker.
+ */
+export function buildSessionAgentTransitionDividerLocalId(submittedLocalId) {
+    return `${SESSION_AGENT_TRANSITION_DIVIDER_LOCAL_ID_PREFIX}${submittedLocalId}`;
+}
+/** True when a localId falls in the reserved divider namespace. */
+export function isSessionAgentTransitionDividerLocalId(localId) {
+    return typeof localId === 'string'
+        && localId.startsWith(SESSION_AGENT_TRANSITION_DIVIDER_LOCAL_ID_PREFIX);
+}
+/**
+ * The single canonical "is this row a transition divider?" reader.
+ *
+ * It requires BOTH halves of the divider's identity:
+ *
+ *   - `localId` — the row's OUTER local id, which must be in the reserved
+ *     namespace. Every generic message ingress refuses that prefix, so only the
+ *     owner-only cutover service can produce a row there. This is the half that
+ *     makes the answer trustworthy.
+ *   - `event` — the agent-event payload (the `data` of a `type:'event'`
+ *     transcript record), which must carry a strictly valid sidecar.
+ *
+ * The sidecar alone is NOT proof and must never be read as one: its key name is
+ * writable by anyone who can post an agent event to the Session, so trusting it
+ * on an ordinary row would let an authorized writer silence their own message
+ * and manufacture an attribution boundary the transition never made. Attention
+ * resolvers, the separator renderer, historical attribution, and the bounded
+ * context pass all use THIS function — none of them re-implement either check.
+ */
+export function readSessionAgentTransitionDividerV1(row) {
+    if (!isSessionAgentTransitionDividerLocalId(row?.localId))
+        return null;
+    const value = row.event;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const record = value;
+    if (record.type !== 'message')
+        return null;
+    const sidecar = record[SESSION_AGENT_TRANSITION_DIVIDER_SIDECAR_KEY];
+    if (sidecar === undefined)
+        return null;
+    const parsed = SessionAgentTransitionDividerV1Schema.safeParse(sidecar);
+    return parsed.success ? parsed.data : null;
+}
+/**
+ * The stored-record shape a row MUST have before any process calls it a
+ * transition divider.
+ *
+ * {@link readSessionAgentTransitionDividerV1} answers for the reserved localId
+ * and the agent-event PAYLOAD; on its own it says nothing about the record
+ * WRAPPER carrying that payload. The divider is always written as a
+ * `role:'agent'` / `content.type:'event'` record, so a user-role (or non-event)
+ * row planted at the reserved localId with a matching sidecar must never be read
+ * as one. The server's cutover owner and the daemon's
+ * divider-evidence reader both answer that question — about the same rows, in
+ * different processes — so they answer it HERE rather than each re-deriving the
+ * wrapper checks.
+ */
+export function readSessionAgentTransitionDividerFromStoredRecordV1(row) {
+    const value = row?.record;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const record = value;
+    if (record.role !== 'agent')
+        return null;
+    const content = record.content;
+    if (!content || content.type !== 'event')
+        return null;
+    return readSessionAgentTransitionDividerV1({ localId: row.localId, event: content.data });
+}
+//# sourceMappingURL=sessionAgentTransitionDivider.js.map

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionDivider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionAgentTransitionDivider.js","sourceRoot":"","sources":["../src/sessionAgentTransitionDivider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;GAiBG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,4CAA4C,GAAG,0BAA0B,CAAC;AAEvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,+BAA+B,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,mBAAmB,CAAC;AAEpF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxD;;;;;;;;;;;;;;;;;OAiBG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC9E,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;;;;GAMG;AACH,MAAM,UAAU,qCAAqC,CACnD,IAA+C,EAC/C,KAAgD;IAEhD,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;WACpB,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;WACtC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;WAClC,IAAI,CAAC,wBAAwB,KAAK,KAAK,CAAC,wBAAwB;WAChE,IAAI,CAAC,kCAAkC,KAAK,KAAK,CAAC,kCAAkC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4CAA4C,CAC1D,OAAkD,EAClD,QAAsF;IAEtF,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;WAC9C,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CAAC,gBAAwB;IAChF,OAAO,GAAG,gDAAgD,GAAG,gBAAgB,EAAE,CAAC;AAClF,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sCAAsC,CAAC,OAAgB;IACrE,OAAO,OAAO,OAAO,KAAK,QAAQ;WAC7B,OAAO,CAAC,UAAU,CAAC,gDAAgD,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mCAAmC,CACjD,GAAmD;IAEnD,IAAI,CAAC,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,4CAA4C,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mDAAmD,CACjE,GAAoD;IAEpD,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,KAA8C,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyD,CAAC;IACjF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,mCAAmC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC"}

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.contract.test-d.d.ts

@@ -0,0 +1,2 @@
+export type {};
+//# sourceMappingURL=sessionAgentTransitionEffectStage.contract.test-d.d.ts.map

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.contract.test-d.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionAgentTransitionEffectStage.contract.test-d.d.ts","sourceRoot":"","sources":["../src/sessionAgentTransitionEffectStage.contract.test-d.ts"],"names":[],"mappings":"AAwGA,YAAY,EAAE,CAAC"}

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.contract.test-d.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sessionAgentTransitionEffectStage.contract.test-d.js.map

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.contract.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionAgentTransitionEffectStage.contract.test-d.js","sourceRoot":"","sources":["../src/sessionAgentTransitionEffectStage.contract.test-d.ts"],"names":[],"mappings":""}

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.d.ts

@@ -0,0 +1,155 @@
+import type { SessionAgentTransitionCurrentViewCommittedCodeV1, SessionAgentTransitionRejectedCodeV1, SessionAgentTransitionResultV1, SessionAgentTransitionSourceStoppedCodeV1 } from './sessionAgentTransition.js';
+/**
+ * `SessionAgentTransitionResultV1` is a promise, not a label. `rejected`
+ * guarantees `sourceEffect: 'none'` — the UI turns that into **Keep editing** —
+ * and `partially_applied` with `applied: 'source_stopped'` guarantees that
+ * nothing was committed, which is what makes resume-source safe.
+ *
+ * Those guarantees are properties of WHERE the flow is, not of the code the
+ * author picked. Nine separate defects have been found and fixed one at a time
+ * where an arm was returned from a state that could not honour it: a
+ * `rejected('stale_selection')` after a committed cutover; a thrown fence
+ * request treated as proof that no fence was applied; an already-target
+ * reconcile routed back through a rejection; a reconcile reporting
+ * `target_start_failed` for a target that was already running. Every one was a
+ * local judgement that "this particular failure is provably pre-effect", and
+ * every one was written by someone who had read the contract.
+ *
+ * So the contract stops being prose. The result arms are constructible ONLY
+ * through the stage handle that proves the effect depth the flow has actually
+ * reached, and each stage exposes exactly the arms truthful at that depth:
+ *
+ * | stage                          | may build                                            |
+ * |--------------------------------|------------------------------------------------------|
+ * | `SourceUntouched`              | `rejected`, `outcomeUnknown`                          |
+ * | `SourceFenced`                 | `rejected` (reopens the fence first), `outcomeUnknown` |
+ * | `SourceStopped`                | `sourceStopped`, `outcomeUnknown`                     |
+ * | `CurrentViewCommitted`         | `accepted`, `committed`                               |
+ *
+ * A tenth instance of the class is therefore not a review finding, a lint
+ * warning or a test that must be remembered: it does not compile. Once the flow
+ * holds a `SessionAgentTransitionSourceStopped`, the `rejected` method does not
+ * exist on it.
+ *
+ * `outcomeUnknown` is available at every depth EXCEPT the last, because it
+ * claims nothing and can therefore never over-promise — until the depth itself
+ * is an observed fact. Once the cutover is committed, "the daemon cannot
+ * establish what happened" is no longer modest, it is false: the Session
+ * demonstrably IS the target, and reporting otherwise leaves the client's armed
+ * switch alive in front of a switch that already happened. Every remaining
+ * uncertainty at that depth is a committed-view code.
+ *
+ * The stage also owns the correlation `localId`, so no site can omit it from an
+ * arm that carries one or pair an arm with the wrong one.
+ *
+ * NOTE ON SCOPE — this module encodes what the DEPTH permits. It cannot decide
+ * whether a given transport/runtime failure actually reached that depth; that
+ * remains domain evidence owned by the daemon (for example, which stop outcomes
+ * prove the runner was never signalled). What it removes is the ability to hold
+ * that judgement and still name an arm the depth forbids.
+ */
+/**
+ * Stage 1 — nothing has touched the source runtime, Session row, or input.
+ *
+ * `rejected` is truthful here and nowhere deeper.
+ */
+export type SessionAgentTransitionSourceUntouched = Readonly<{
+    /**
+     * The source is provably untouched and still running. Safe actions for the
+     * client: Keep editing, or retry after revalidation.
+     */
+    rejected: (code: SessionAgentTransitionRejectedCodeV1) => SessionAgentTransitionResultV1;
+    /** Nothing can be established. Claims no depth, so it is always truthful. */
+    outcomeUnknown: () => SessionAgentTransitionResultV1;
+    /**
+     * A runtime input fence has been REQUESTED. Call this BEFORE issuing the
+     * request, never after inspecting its answer: a fence request that throws or
+     * times out proves only that no ANSWER arrived, not that no fence was
+     * applied, and a `rejected` returned in that state leaves the source silently
+     * refusing local provider input while the UI offers Keep editing.
+     *
+     * `reopen` is invoked by this module before every exit taken from the fenced
+     * stage, so no exit site can forget it.
+     */
+    withInputFence: (reopen: () => Promise<void>) => SessionAgentTransitionSourceFenced;
+    /** The stop returned its fully confirmed stopped outcome. */
+    stopConfirmed: () => SessionAgentTransitionSourceStopped;
+    /**
+     * The target current view was OBSERVED already committed — the Session
+     * already names the target Agent, which is this operation's own cutover seen
+     * again (contract section 7.5), not a stale client view. Reporting a
+     * rejection from here would promise an untouched source in front of a dead
+     * runtime, so the depth advances on the observation itself.
+     */
+    cutoverObservedCommitted: () => SessionAgentTransitionCurrentViewCommitted;
+}>;
+/**
+ * Stage 2 — a fence request has been issued against the source runtime and the
+ * stop has not yet been confirmed.
+ *
+ * Both exits are async because both reopen the fence first. That is the whole
+ * point: `sourceEffect: 'none'` is false while the source is still refusing
+ * local provider input, and a reopen that each call site has to remember is a
+ * reopen that one call site will not.
+ */
+export type SessionAgentTransitionSourceFenced = Readonly<{
+    rejected: (code: SessionAgentTransitionRejectedCodeV1) => Promise<SessionAgentTransitionResultV1>;
+    outcomeUnknown: () => Promise<SessionAgentTransitionResultV1>;
+    /**
+     * The stop is confirmed. The fence lived in the retired source runner, so it
+     * is deliberately NOT reopened here; the target lifecycle reopens its own
+     * epoch when it starts.
+     */
+    stopConfirmed: () => SessionAgentTransitionSourceStopped;
+}>;
+/**
+ * Stage 3 — the source is CONFIRMED stopped and nothing has been committed.
+ *
+ * `rejected` is unreachable from here on, at the type level.
+ */
+export type SessionAgentTransitionSourceStopped = Readonly<{
+    sourceStopped: (code: SessionAgentTransitionSourceStoppedCodeV1) => SessionAgentTransitionResultV1;
+    outcomeUnknown: () => SessionAgentTransitionResultV1;
+    /** The target current view (and divider) committed. */
+    cutoverCommitted: () => SessionAgentTransitionCurrentViewCommitted;
+}>;
+/**
+ * Stage 4 — the Session IS the target Agent.
+ *
+ * `sourceStopped` is unreachable from here on: a committed cutover reported at
+ * the shallower depth would tell the client the Session is still the source.
+ *
+ * `outcomeUnknown` is unreachable too, and this is the one depth where its
+ * absence matters. It is the modest arm everywhere else because it claims
+ * nothing; here the claim it makes — that the daemon cannot establish what
+ * happened — is simply untrue, and the client answers it by keeping the armed
+ * switch alive in front of a Session that has already switched. Whatever else
+ * is unknown at this depth is named by a committed-view code.
+ */
+export type SessionAgentTransitionCurrentViewCommitted = Readonly<{
+    /**
+     * The exact `localId` received canonical message admission. This does not
+     * claim provider acceptance.
+     */
+    accepted: () => SessionAgentTransitionResultV1;
+    committed: (code: SessionAgentTransitionCurrentViewCommittedCodeV1) => SessionAgentTransitionResultV1;
+}>;
+/**
+ * Open the effect ledger for one transition invocation. Call it once, at the
+ * top of the flow, and thread the returned handle forward: the handle in scope
+ * is the proof of how far the transition got.
+ */
+export declare function beginSessionAgentTransitionEffects(params: Readonly<{
+    localId: string;
+}>): SessionAgentTransitionSourceUntouched;
+/**
+ * The one rejection raised before the transition was dispatched at all: the
+ * request failed schema validation, or the process holds no credentials, so no
+ * code addressed the Session and there is no `localId` to correlate.
+ *
+ * This is deliberately a separate, awkwardly named export rather than a second
+ * way to build a rejection. Inside the flow the stage handle is the only
+ * source of arms; reaching for this there is visibly wrong.
+ */
+export declare function rejectUndispatchedSessionAgentTransition(code: SessionAgentTransitionRejectedCodeV1): SessionAgentTransitionResultV1;
+//# sourceMappingURL=sessionAgentTransitionEffectStage.d.ts.map

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionAgentTransitionEffectStage.d.ts","sourceRoot":"","sources":["../src/sessionAgentTransitionEffectStage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gDAAgD,EAChD,oCAAoC,EACpC,8BAA8B,EAC9B,yCAAyC,EAC1C,MAAM,6BAA6B,CAAC;AAMrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG,QAAQ,CAAC;IAC3D;;;OAGG;IACH,QAAQ,EAAE,CAAC,IAAI,EAAE,oCAAoC,KAAK,8BAA8B,CAAC;IACzF,6EAA6E;IAC7E,cAAc,EAAE,MAAM,8BAA8B,CAAC;IACrD;;;;;;;;;OASG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,kCAAkC,CAAC;IACpF,6DAA6D;IAC7D,aAAa,EAAE,MAAM,mCAAmC,CAAC;IACzD;;;;;;OAMG;IACH,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;CAC5E,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACxD,QAAQ,EAAE,CAAC,IAAI,EAAE,oCAAoC,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAClG,cAAc,EAAE,MAAM,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC9D;;;;OAIG;IACH,aAAa,EAAE,MAAM,mCAAmC,CAAC;CAC1D,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CAAC;IACzD,aAAa,EAAE,CAAC,IAAI,EAAE,yCAAyC,KAAK,8BAA8B,CAAC;IACnG,cAAc,EAAE,MAAM,8BAA8B,CAAC;IACrD,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;CACpE,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,0CAA0C,GAAG,QAAQ,CAAC;IAChE;;;OAGG;IACH,QAAQ,EAAE,MAAM,8BAA8B,CAAC;IAC/C,SAAS,EAAE,CAAC,IAAI,EAAE,gDAAgD,KAAK,8BAA8B,CAAC;CACvG,CAAC,CAAC;AAkCH;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACpC,qCAAqC,CASvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,oCAAoC,GACzC,8BAA8B,CAEhC"}

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.js

@@ -0,0 +1,54 @@
+function buildCurrentViewCommitted(localId) {
+    return Object.freeze({
+        accepted: () => ({ type: 'accepted', localId }),
+        committed: (code) => ({ type: 'partially_applied', localId, applied: 'current_view_committed', code }),
+    });
+}
+function buildSourceStopped(localId) {
+    return Object.freeze({
+        sourceStopped: (code) => ({ type: 'partially_applied', localId, applied: 'source_stopped', code }),
+        outcomeUnknown: () => ({ type: 'outcome_unknown', localId }),
+        cutoverCommitted: () => buildCurrentViewCommitted(localId),
+    });
+}
+function buildSourceFenced(localId, reopen) {
+    return Object.freeze({
+        rejected: async (code) => {
+            await reopen();
+            return { type: 'rejected', code, sourceEffect: 'none' };
+        },
+        outcomeUnknown: async () => {
+            await reopen();
+            return { type: 'outcome_unknown', localId };
+        },
+        stopConfirmed: () => buildSourceStopped(localId),
+    });
+}
+/**
+ * Open the effect ledger for one transition invocation. Call it once, at the
+ * top of the flow, and thread the returned handle forward: the handle in scope
+ * is the proof of how far the transition got.
+ */
+export function beginSessionAgentTransitionEffects(params) {
+    const { localId } = params;
+    return Object.freeze({
+        rejected: (code) => ({ type: 'rejected', code, sourceEffect: 'none' }),
+        outcomeUnknown: () => ({ type: 'outcome_unknown', localId }),
+        withInputFence: (reopen) => buildSourceFenced(localId, reopen),
+        stopConfirmed: () => buildSourceStopped(localId),
+        cutoverObservedCommitted: () => buildCurrentViewCommitted(localId),
+    });
+}
+/**
+ * The one rejection raised before the transition was dispatched at all: the
+ * request failed schema validation, or the process holds no credentials, so no
+ * code addressed the Session and there is no `localId` to correlate.
+ *
+ * This is deliberately a separate, awkwardly named export rather than a second
+ * way to build a rejection. Inside the flow the stage handle is the only
+ * source of arms; reaching for this there is visibly wrong.
+ */
+export function rejectUndispatchedSessionAgentTransition(code) {
+    return { type: 'rejected', code, sourceEffect: 'none' };
+}
+//# sourceMappingURL=sessionAgentTransitionEffectStage.js.map

package/node_modules/@happier-dev/protocol/dist/sessionAgentTransitionEffectStage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionAgentTransitionEffectStage.js","sourceRoot":"","sources":["../src/sessionAgentTransitionEffectStage.ts"],"names":[],"mappings":"AAuJA,SAAS,yBAAyB,CAAC,OAAe;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC/C,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;QAClG,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;KACb,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,MAA2B;IAE3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,MAAM,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAC1D,CAAC;QACD,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;QAC9C,CAAC;QACD,aAAa,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC;KACJ,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAqC;IAErC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QACtE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;QAC5D,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC;QAC9D,aAAa,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAChD,wBAAwB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;KACnB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wCAAwC,CACtD,IAA0C;IAE1C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC"}