@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/lanes/accounts.js

@@ -1,366 +0,0 @@
-/**
- * Provider account resolution (spec §5.5).
- *
- * Naming an account and omitting one mean different things: an explicit
- * disabled id is refused; omitting picks the least-loaded eligible account.
- * Status reports `configured` and `logged_in` separately. logged_in is
- * derived from credential-file existence or a provider status command; this
- * module never reads, prints, copies, or hashes credential files.
- */
-import * as fs from "node:fs";
-import { effectiveAccountHome } from "./account-home.js";
-import * as path from "node:path";
-import { AccountResolutionError } from "./errors.js";
-import { isTerminalLaneState } from "./types.js";
-import { accountMaxRunning } from "./config.js";
-import { listLaneIds, readLane } from "./store.js";
-import { loadQuotaState, quotaBlockFor } from "./quota.js";
-export const PROVIDER_HOME_ENV = {
-    claude: "CLAUDE_CONFIG_DIR",
-    codex: "CODEX_HOME",
-    grok: "GROK_HOME",
-};
-export const AUTH_JSON_NAME = "auth.json";
-export const CLAUDE_CREDENTIALS_NAME = ".credentials.json";
-/**
- * Credential filenames are a property of the provider. Codex and Grok write
- * auth.json. Claude Code writes .credentials.json (never auth.json) inside
- * the config dir, and can also authenticate via the OS keychain with no
- * file here at all.
- */
-export const PROVIDER_CREDENTIAL_FILES = {
-    claude: [CLAUDE_CREDENTIALS_NAME],
-    codex: [AUTH_JSON_NAME],
-    grok: [AUTH_JSON_NAME],
-};
-function defaultAccountDeps() {
-    return { existsSync: (p) => fs.existsSync(p) };
-}
-function enabledIds(provider) {
-    return Object.entries(provider.accounts)
-        .filter(([, account]) => account.enabled)
-        .map(([id]) => id);
-}
-export function credentialPaths(provider, home) {
-    return PROVIDER_CREDENTIAL_FILES[provider].map((name) => path.join(home, name));
-}
-/**
- * Existence-only probe. Callers must not read the files this returns paths to.
- */
-export function hasCredentialFile(provider, home, existsSync) {
-    for (const filePath of credentialPaths(provider, home)) {
-        if (existsSync(filePath))
-            return true;
-    }
-    return false;
-}
-/**
- * Claude with no file in the config dir is unknown, not logged out: the
- * credential may live in the OS keychain or an API-key helper. Codex and
- * Grok write auth.json when logged in, so absence is logged out.
- */
-export function authStateFor(provider, present) {
-    if (present)
-        return "file";
-    if (provider === "claude")
-        return "unknown";
-    return "absent";
-}
-export function loggedInFromAuthState(state) {
-    if (state === "file")
-        return true;
-    if (state === "absent")
-        return false;
-    return null;
-}
-/** Admission and listing share this: refuse only a conclusive logged-out. */
-export function isLoggedOut(status) {
-    return status.logged_in === false;
-}
-/** Auto-select requires a positive file or provider-status login result. */
-export function isCredentialProven(status) {
-    return status.logged_in === true;
-}
-/**
- * Occupying states hold a slot: running / awaiting_input / blocked have a
- * live (or paused-live) worker; queued holds a queue slot that will take a
- * running slot. Terminal states do not count.
- */
-export function isOccupyingLaneState(state) {
-    return !isTerminalLaneState(state);
-}
-export function occupyingLaneCount(lanes, provider, accountId) {
-    let n = 0;
-    for (const lane of lanes) {
-        if (lane.provider !== provider)
-            continue;
-        if (lane.account !== accountId)
-            continue;
-        if (!isOccupyingLaneState(lane.state))
-            continue;
-        n += 1;
-    }
-    return n;
-}
-export function runningLaneCount(lanes, provider, accountId) {
-    let n = 0;
-    for (const lane of lanes) {
-        if (lane.provider !== provider)
-            continue;
-        if (lane.account !== accountId)
-            continue;
-        if (lane.state !== "running")
-            continue;
-        n += 1;
-    }
-    return n;
-}
-/** Most recent created_at on this account+provider, any state. Null if none. */
-export function lastStartedAt(lanes, provider, accountId) {
-    let latest = null;
-    for (const lane of lanes) {
-        if (lane.provider !== provider)
-            continue;
-        if (lane.account !== accountId)
-            continue;
-        if (latest === null || lane.created_at > latest)
-            latest = lane.created_at;
-    }
-    return latest;
-}
-function defaultLoadLanes(hqRoot) {
-    return listLaneIds(hqRoot).map((id) => readLane(hqRoot, id));
-}
-function compareEligible(a, b) {
-    if (a.occupying !== b.occupying)
-        return a.occupying - b.occupying;
-    if (a.lastStarted === null && b.lastStarted === null) {
-        return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
-    }
-    if (a.lastStarted === null)
-        return -1;
-    if (b.lastStarted === null)
-        return 1;
-    if (a.lastStarted !== b.lastStarted) {
-        return a.lastStarted < b.lastStarted ? -1 : 1;
-    }
-    return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
-}
-function modelForAccount(provider, accountId, config, ctx) {
-    // Same order as resolveLaneModel: an explicit lane model, then --model,
-    // then the account default, then the provider default.
-    if (ctx.model !== undefined && ctx.model.trim().length > 0)
-        return ctx.model.trim();
-    if (ctx.cliModel !== undefined && ctx.cliModel.trim().length > 0)
-        return ctx.cliModel.trim();
-    const accountModel = config.providers[provider].accounts[accountId]?.model;
-    if (accountModel !== undefined && accountModel.trim().length > 0)
-        return accountModel.trim();
-    const providerModel = config.providers[provider].model;
-    if (providerModel !== undefined && providerModel.trim().length > 0)
-        return providerModel.trim();
-    return undefined;
-}
-function throwIfQuotaBlocked(block, provider, accountId) {
-    if (!block.blocked || !block.reason)
-        return;
-    const model = block.model ?? "(no model)";
-    if (block.reason === "account_model_unavailable") {
-        throw new AccountResolutionError("account_model_unavailable", `Account ${JSON.stringify(accountId)} cannot run model ${model}: ${block.marker ?? "needs credits"}`, {
-            provider,
-            account: accountId,
-            model: block.model ?? null,
-            marker: block.marker ?? null,
-        });
-    }
-    throw new AccountResolutionError("account_quota_exhausted", `Account ${JSON.stringify(accountId)} is out of quota${block.quota_reset_at ? ` until ${block.quota_reset_at}` : ""} for model ${model}`, {
-        provider,
-        account: accountId,
-        model: block.model ?? null,
-        quota_reset_at: block.quota_reset_at ?? null,
-    });
-}
-function boundAccount(provider, id, account, hostname) {
-    return {
-        provider,
-        id,
-        home: effectiveAccountHome(account, hostname).home,
-        enabled: true,
-        envVar: PROVIDER_HOME_ENV[provider],
-    };
-}
-/**
- * Pick among enabled, credential-proven accounts by occupying count
- * (lowest wins). Ties break to least-recently-started (oldest created_at),
- * then account id ascending. Accounts at max_running are excluded from
- * start-eligible; if every proven account is at cap the pick still returns
- * one so admission can queue rather than overflow.
- */
-export function selectBalancedAccount(provider, config, ctx = {}) {
-    const providerCfg = config.providers[provider];
-    const existsSync = ctx.existsSync ?? ((p) => fs.existsSync(p));
-    const allowed = ctx.allowedAccounts;
-    const enabled = enabledIds(providerCfg).filter((id) => allowed === undefined || allowed.includes(id));
-    if (enabled.length === 0) {
-        throw new AccountResolutionError("no_enabled_account", `No enabled account for provider ${provider}`, { provider, ineligible: "none_enabled" });
-    }
-    const proven = [];
-    for (const id of enabled) {
-        const status = accountStatus(provider, id, config, {
-            existsSync,
-            ...(ctx.accountDeps?.probe ? { probe: ctx.accountDeps.probe } : {}),
-            ...(ctx.accountDeps?.env ? { env: ctx.accountDeps.env } : {}),
-            ...(ctx.hostname !== undefined ? { hostname: ctx.hostname } : {}),
-        });
-        if (status.logged_in === true)
-            proven.push(id);
-    }
-    if (proven.length === 0) {
-        throw new AccountResolutionError("no_enabled_account", `No logged-in account for provider ${provider}`, { provider, ineligible: "none_logged_in", enabled });
-    }
-    const hqRoot = ctx.hqRoot;
-    const lanes = ctx.loadLanes !== undefined
-        ? ctx.loadLanes(hqRoot ?? "")
-        : hqRoot !== undefined
-            ? defaultLoadLanes(hqRoot)
-            : [];
-    const now = ctx.now ?? new Date();
-    const quota = hqRoot !== undefined ? loadQuotaState(hqRoot) : null;
-    const runnable = quota
-        ? proven.filter((id) => {
-            const block = quotaBlockFor(quota, provider, id, modelForAccount(provider, id, config, ctx), now);
-            return !block.blocked;
-        })
-        : proven;
-    if (quota && runnable.length === 0) {
-        const sample = proven[0];
-        const block = quotaBlockFor(quota, provider, sample, modelForAccount(provider, sample, config, ctx), now);
-        throwIfQuotaBlocked(block, provider, sample);
-    }
-    const underCap = runnable.filter((id) => {
-        const cap = accountMaxRunning(providerCfg, id);
-        return runningLaneCount(lanes, provider, id) < cap;
-    });
-    const preferred = underCap.length > 0
-        ? ctx.preferredAccounts?.find((id) => underCap.includes(id))
-        : undefined;
-    const pool = underCap.length > 0 ? underCap : runnable;
-    const ranked = pool
-        .map((id) => ({
-        id,
-        occupying: occupyingLaneCount(lanes, provider, id),
-        lastStarted: lastStartedAt(lanes, provider, id),
-    }))
-        .sort(compareEligible);
-    const chosen = preferred ?? ranked[0].id;
-    return boundAccount(provider, chosen, providerCfg.accounts[chosen], ctx.hostname);
-}
-export function resolveAccount(provider, requestedId, config, ctx = {}) {
-    const providerCfg = config.providers[provider];
-    const enabled = enabledIds(providerCfg);
-    if (requestedId !== undefined && requestedId.length > 0) {
-        const account = providerCfg.accounts[requestedId];
-        if (account === undefined) {
-            throw new AccountResolutionError("unknown_account", `Unknown account ${JSON.stringify(requestedId)} for ${provider}. Enabled: ${enabled.join(", ") || "(none)"}`, {
-                provider,
-                account: requestedId,
-                enabled,
-            });
-        }
-        if (!account.enabled) {
-            throw new AccountResolutionError("account_disabled", `Account ${JSON.stringify(requestedId)} is disabled${account.disabled_reason ? `: ${account.disabled_reason}` : ""}`, {
-                account: requestedId,
-                reason: account.disabled_reason ?? "",
-            });
-        }
-        if (ctx.hqRoot !== undefined) {
-            const now = ctx.now ?? new Date();
-            const block = quotaBlockFor(loadQuotaState(ctx.hqRoot), provider, requestedId, modelForAccount(provider, requestedId, config, ctx), now);
-            throwIfQuotaBlocked(block, provider, requestedId);
-        }
-        return boundAccount(provider, requestedId, account, ctx.hostname);
-    }
-    return selectBalancedAccount(provider, config, ctx);
-}
-/** Codex/Grok path. Kept for callers that still name auth.json. */
-export function authJsonPath(home) {
-    return path.join(home, AUTH_JSON_NAME);
-}
-export function accountStatus(provider, accountId, config, deps = defaultAccountDeps()) {
-    const envVar = PROVIDER_HOME_ENV[provider];
-    const account = config.providers[provider].accounts[accountId];
-    if (account === undefined) {
-        return {
-            provider,
-            id: accountId,
-            home: "",
-            enabled: false,
-            configured: false,
-            logged_in: false,
-            auth_state: "absent",
-            envVar,
-        };
-    }
-    const effective = effectiveAccountHome(account, deps.hostname);
-    const homeExists = deps.existsSync(effective.home);
-    const present = homeExists && hasCredentialFile(provider, effective.home, deps.existsSync);
-    let auth_state = homeExists ? authStateFor(provider, present) : "home_missing";
-    let logged_in = homeExists ? loggedInFromAuthState(auth_state) : false;
-    if (homeExists && !present && provider === "claude" && deps.probe !== undefined) {
-        try {
-            const result = deps.probe("claude", ["auth", "status"], { ...(deps.env ?? process.env), CLAUDE_CONFIG_DIR: effective.home });
-            const providerStatus = claudeLoginStatus(result);
-            if (providerStatus !== null) {
-                auth_state = "status";
-                logged_in = providerStatus;
-            }
-        }
-        catch {
-            process.stderr.write(`hq lanes: Claude auth status probe failed for account ${accountId}\n`);
-        }
-    }
-    const status = {
-        provider,
-        id: accountId,
-        home: effective.home,
-        home_source: effective.source,
-        enabled: account.enabled,
-        configured: true,
-        logged_in,
-        auth_state,
-        envVar,
-    };
-    if (account.disabled_reason !== undefined) {
-        status.disabled_reason = account.disabled_reason;
-    }
-    return status;
-}
-export function listAccountStatuses(provider, config, deps = defaultAccountDeps()) {
-    return Object.keys(config.providers[provider].accounts).map((id) => accountStatus(provider, id, config, deps));
-}
-function claudeLoginStatus(result) {
-    const text = result.stdout.trim();
-    if (text.startsWith("{")) {
-        try {
-            const parsed = JSON.parse(text);
-            if (parsed !== null &&
-                typeof parsed === "object" &&
-                !Array.isArray(parsed) &&
-                typeof parsed.loggedIn === "boolean") {
-                return parsed.loggedIn;
-            }
-        }
-        catch (err) {
-            process.stderr.write(`hq lanes: Claude auth status returned invalid JSON: ${err instanceof Error ? err.message : String(err)}\n`);
-            return null;
-        }
-    }
-    if (/\bnot logged in\b/i.test(`${result.stdout}\n${result.stderr}`))
-        return false;
-    return null;
-}
-/** Environment assignment the worker process should receive. */
-export function accountEnv(resolved) {
-    return { [resolved.envVar]: resolved.home };
-}
-//# sourceMappingURL=accounts.js.map

package/dist/lib/lanes/admission-host.d.ts

@@ -1,22 +0,0 @@
-import type { AdmissionHost } from "./admission.js";
-import type { LaneHost } from "./types.js";
-export declare const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
-export declare const OUTPOST_DIR = "/etc/outpost";
-export type OutpostIdentity = {
-    kind: "id";
-    id: string;
-} | {
-    kind: "unknown";
-} | {
-    kind: "not_outpost";
-};
-export declare function readOutpostIdentity(existsSync?: (p: string) => boolean, readFileSync?: (p: string) => string): OutpostIdentity;
-export declare function resolveAdmissionHost(deps?: {
-    hostname?: () => string;
-    readOutpostIdentity?: () => OutpostIdentity;
-    existsSync?: (p: string) => boolean;
-    readFileSync?: (p: string) => string;
-}): AdmissionHost;
-/** `primary` names the controller registry unless the caller is a different Outpost. */
-export declare function isControllerAliasOutpostId(outpostId: string, localHost: LaneHost): boolean;
-//# sourceMappingURL=admission-host.d.ts.map

package/dist/lib/lanes/admission-host.js

@@ -1,37 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-export const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
-export const OUTPOST_DIR = "/etc/outpost";
-export function readOutpostIdentity(existsSync = (p) => fs.existsSync(p), readFileSync = (p) => fs.readFileSync(p, "utf8")) {
-    const hasMarker = existsSync(OUTPOST_ID_PATH);
-    const hasDir = existsSync(OUTPOST_DIR);
-    if (hasMarker) {
-        let text;
-        try {
-            text = readFileSync(OUTPOST_ID_PATH);
-        }
-        catch (err) {
-            process.stderr.write(`hq lanes: failed to read ${OUTPOST_ID_PATH}: ${err instanceof Error ? err.message : String(err)}\n`);
-            throw err;
-        }
-        const id = text.trim();
-        if (!id)
-            return hasDir ? { kind: "unknown" } : { kind: "not_outpost" };
-        return { kind: "id", id };
-    }
-    if (hasDir)
-        return { kind: "unknown" };
-    return { kind: "not_outpost" };
-}
-export function resolveAdmissionHost(deps = {}) {
-    const identity = deps.readOutpostIdentity?.() ?? readOutpostIdentity(deps.existsSync, deps.readFileSync);
-    return {
-        hostname: (deps.hostname ?? os.hostname)(),
-        outpostId: identity.kind === "id" ? identity.id : null,
-    };
-}
-/** `primary` names the controller registry unless the caller is a different Outpost. */
-export function isControllerAliasOutpostId(outpostId, localHost) {
-    return outpostId === "primary" && !(localHost.kind === "outpost" && localHost.id !== "primary");
-}
-//# sourceMappingURL=admission-host.js.map

package/dist/lib/lanes/admission.d.ts

@@ -1,26 +0,0 @@
-import type { LaneRecord, LanesConfig } from "./types.js";
-export interface AdmissionHost {
-    hostname: string;
-    outpostId: string | null;
-}
-export type AdmissionCapReason = "provider_cap" | "account_cap" | "profile_cap";
-export declare const ADMISSION_LOCK_STALE_MS = 30000;
-export declare const ADMISSION_LOCK_TIMEOUT_MS = 5000;
-export declare const ADMISSION_RESERVATION_GRACE_MS = 30000;
-export declare function withLaneAdmissionLock<T>(hqRoot: string, provider: LaneRecord["provider"], fn: () => Promise<T>, sleep?: (ms: number) => Promise<void>): Promise<T>;
-export declare function withAllLaneAdmissionLocks<T>(hqRoot: string, fn: () => Promise<T>, sleep?: (ms: number) => Promise<void>): Promise<T>;
-export declare function laneRunsOnHost(lane: LaneRecord, host: AdmissionHost): boolean;
-export declare function compareLaneQueueOrder(a: LaneRecord, b: LaneRecord): number;
-export declare function hasActiveAdmissionReservation(lane: LaneRecord, nowMs: number): boolean;
-export declare function hasActivePendingResume(lane: LaneRecord, nowMs: number): boolean;
-/** Whether a lane currently owns a running slot for its host/provider caps. */
-export declare function laneOccupiesRunningSlot(lane: LaneRecord, nowMs?: number): boolean;
-/** Return the first capacity limit that currently prevents this lane from starting. */
-export declare function laneAdmissionCapReason(lanes: LaneRecord[], candidate: LaneRecord, config: LanesConfig, host: AdmissionHost, profileMaxConcurrent?: number, nowMs?: number): AdmissionCapReason | undefined;
-/**
- * A prior queue entry owns a free slot only when its own provider, account,
- * and profile caps allow it to use that slot. A blocked profile therefore
- * cannot hold an unrelated profile's queue position.
- */
-export declare function hasEarlierEligibleQueuedLane(lanes: LaneRecord[], candidate: LaneRecord, config: LanesConfig, host: AdmissionHost, profileMaxFor: (lane: LaneRecord) => number | undefined, nowMs?: number): boolean;
-//# sourceMappingURL=admission.d.ts.map

package/dist/lib/lanes/admission.js

@@ -1,210 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { accountMaxRunning } from "./config.js";
-import { LanesError } from "./errors.js";
-export const ADMISSION_LOCK_STALE_MS = 30_000;
-export const ADMISSION_LOCK_TIMEOUT_MS = 5_000;
-export const ADMISSION_RESERVATION_GRACE_MS = 30_000;
-function defaultAdmissionSleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function admissionLockPath(hqRoot, provider) {
-    return path.join(hqRoot, "workspace", "lanes-runs", ".admission-locks", `${provider}-provider.lock`);
-}
-function admissionLockOwnerAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        return err.code !== "ESRCH";
-    }
-}
-async function withAdmissionLock(lockPath, fn, sleep) {
-    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
-    const started = Date.now();
-    while (true) {
-        let fd;
-        try {
-            fd = fs.openSync(lockPath, "wx");
-            const ownedStat = fs.fstatSync(fd);
-            try {
-                fs.writeSync(fd, Buffer.from(`${process.pid}\n${Date.now()}\n`, "utf8"));
-            }
-            catch (err) {
-                fs.closeSync(fd);
-                fd = undefined;
-                throw err;
-            }
-            try {
-                await new Promise((resolve) => setImmediate(resolve));
-                return await fn();
-            }
-            finally {
-                try {
-                    fs.closeSync(fd);
-                }
-                catch (err) {
-                    process.stderr.write(`hq lanes: admission lock close failed for ${lockPath}: ${err instanceof Error ? err.message : String(err)}\n`);
-                }
-                try {
-                    const currentStat = fs.statSync(lockPath);
-                    if (currentStat.dev === ownedStat.dev && currentStat.ino === ownedStat.ino) {
-                        fs.unlinkSync(lockPath);
-                    }
-                }
-                catch (err) {
-                    if (err.code !== "ENOENT") {
-                        process.stderr.write(`hq lanes: admission lock unlink failed for ${lockPath}: ${err instanceof Error ? err.message : String(err)}\n`);
-                    }
-                }
-            }
-        }
-        catch (err) {
-            if (err.code !== "EEXIST")
-                throw err;
-            if (Date.now() - started > ADMISSION_LOCK_TIMEOUT_MS) {
-                throw new LanesError("store_lock_timeout", `Timed out waiting for admission lock ${lockPath}`, { path: lockPath });
-            }
-            try {
-                const raw = fs.readFileSync(lockPath, "utf8");
-                const [ownerLine, timestampLine] = raw.split("\n");
-                const ownerPid = ownerLine ? Number(ownerLine) : NaN;
-                const timestamp = timestampLine ? Number(timestampLine) : NaN;
-                if (Number.isSafeInteger(ownerPid) &&
-                    ownerPid > 0 &&
-                    Number.isFinite(timestamp) &&
-                    Date.now() - timestamp > ADMISSION_LOCK_STALE_MS &&
-                    !admissionLockOwnerAlive(ownerPid)) {
-                    if (fs.readFileSync(lockPath, "utf8") !== raw)
-                        continue;
-                    try {
-                        fs.unlinkSync(lockPath);
-                    }
-                    catch (unlinkErr) {
-                        if (unlinkErr.code !== "ENOENT")
-                            throw unlinkErr;
-                    }
-                    continue;
-                }
-            }
-            catch (probeErr) {
-                if (probeErr.code !== "ENOENT") {
-                    process.stderr.write(`hq lanes: stale admission-lock probe failed for ${lockPath}: ${probeErr instanceof Error ? probeErr.message : String(probeErr)}\n`);
-                }
-            }
-            await sleep(10);
-            await new Promise((resolve) => setImmediate(resolve));
-        }
-    }
-}
-export function withLaneAdmissionLock(hqRoot, provider, fn, sleep = defaultAdmissionSleep) {
-    return withAdmissionLock(admissionLockPath(hqRoot, provider), fn, sleep);
-}
-export async function withAllLaneAdmissionLocks(hqRoot, fn, sleep = defaultAdmissionSleep) {
-    const providers = ["claude", "codex", "grok"];
-    const acquire = (index) => {
-        const provider = providers[index];
-        if (provider === undefined)
-            return fn();
-        return withLaneAdmissionLock(hqRoot, provider, () => acquire(index + 1), sleep);
-    };
-    return acquire(0);
-}
-export function laneRunsOnHost(lane, host) {
-    if (host.outpostId && lane.host.kind === "outpost") {
-        return lane.host.id === host.outpostId;
-    }
-    return lane.host.kind === "local" && lane.host.id === host.hostname;
-}
-export function compareLaneQueueOrder(a, b) {
-    if (b.priority !== a.priority)
-        return b.priority - a.priority;
-    const byQueueAge = Date.parse(a.queued_at ?? a.created_at) - Date.parse(b.queued_at ?? b.created_at);
-    return byQueueAge || a.lane_id.localeCompare(b.lane_id);
-}
-export function hasActiveAdmissionReservation(lane, nowMs) {
-    if (lane.state !== "queued" || lane.queued_reason !== undefined || !lane.admission_reserved_at) {
-        return false;
-    }
-    const reservedAt = Date.parse(lane.admission_reserved_at);
-    const ageMs = nowMs - reservedAt;
-    return Number.isFinite(reservedAt) && ageMs >= 0 && ageMs < ADMISSION_RESERVATION_GRACE_MS;
-}
-export function hasActivePendingResume(lane, nowMs) {
-    const pending = lane.pending_resume;
-    if (!pending)
-        return false;
-    if (lane.state === "queued" && pending.trigger === "answered_questions")
-        return false;
-    // This timestamp tags automatic keep-alive resumes, including profile-derived ones.
-    if (lane.state === "queued" &&
-        pending.trigger === "resume" &&
-        pending.resumed_from === "done" &&
-        lane.keep_alive_last_resume_at === pending.at)
-        return false;
-    const reservedAt = Date.parse(pending.at);
-    const ageMs = nowMs - reservedAt;
-    return Number.isFinite(reservedAt) && ageMs >= 0 && ageMs < ADMISSION_RESERVATION_GRACE_MS;
-}
-/** Whether a lane currently owns a running slot for its host/provider caps. */
-export function laneOccupiesRunningSlot(lane, nowMs = Date.now()) {
-    // An account-cap queue is waiting behind an occupied account slot. Its
-    // pending resume must remain active for admission ordering, but it must not
-    // count as a second owner of the slot that blocked it.
-    if (lane.state === "queued" && lane.queued_reason === "account_cap")
-        return false;
-    return lane.state === "running" ||
-        hasActiveAdmissionReservation(lane, nowMs) ||
-        hasActivePendingResume(lane, nowMs);
-}
-/** Return the first capacity limit that currently prevents this lane from starting. */
-export function laneAdmissionCapReason(lanes, candidate, config, host, profileMaxConcurrent, nowMs = Date.now()) {
-    const running = lanes.filter((lane) => lane.lane_id !== candidate.lane_id &&
-        laneOccupiesRunningSlot(lane, nowMs) &&
-        laneRunsOnHost(lane, host));
-    const providerCfg = config.providers[candidate.provider];
-    const providerRunning = running.filter((lane) => lane.provider === candidate.provider);
-    if (providerRunning.length >= providerCfg.max_running)
-        return "provider_cap";
-    if (candidate.account &&
-        providerRunning.filter((lane) => lane.account === candidate.account).length >=
-            accountMaxRunning(providerCfg, candidate.account)) {
-        return "account_cap";
-    }
-    if (candidate.worker_profile &&
-        profileMaxConcurrent !== undefined &&
-        running.filter((lane) => lane.worker_profile === candidate.worker_profile).length >=
-            profileMaxConcurrent) {
-        return "profile_cap";
-    }
-    return undefined;
-}
-/**
- * A prior queue entry owns a free slot only when its own provider, account,
- * and profile caps allow it to use that slot. A blocked profile therefore
- * cannot hold an unrelated profile's queue position.
- */
-export function hasEarlierEligibleQueuedLane(lanes, candidate, config, host, profileMaxFor, nowMs = Date.now()) {
-    return lanes
-        .filter((lane) => lane.lane_id !== candidate.lane_id &&
-        lane.state === "queued" &&
-        lane.provider === candidate.provider &&
-        laneRunsOnHost(lane, host) &&
-        compareLaneQueueOrder(lane, candidate) < 0)
-        .some((lane) => {
-        const profileMaxConcurrent = profileMaxFor(lane);
-        const capReason = laneAdmissionCapReason(lanes, lane, config, host, profileMaxConcurrent, nowMs);
-        if (capReason === undefined)
-            return true;
-        if (capReason !== "account_cap" || lane.admission_accounts === undefined)
-            return false;
-        return lane.admission_accounts.some((account) => {
-            if (account === lane.account || config.providers[lane.provider].accounts[account]?.enabled !== true) {
-                return false;
-            }
-            return laneAdmissionCapReason(lanes, { ...lane, account }, config, host, profileMaxConcurrent, nowMs) === undefined;
-        });
-    });
-}
-//# sourceMappingURL=admission.js.map

package/dist/lib/lanes/approval-gate.d.ts

@@ -1,8 +0,0 @@
-import type { LaneEnvelope, LaneRecord } from "./types.js";
-export interface RegistryApprovalGateResult {
-    envelope: LaneEnvelope;
-    approvedIdsToConsume: string[];
-    violation: boolean;
-}
-export declare function enforceRegistryApprovalGate(lane: LaneRecord, envelope: LaneEnvelope): RegistryApprovalGateResult;
-//# sourceMappingURL=approval-gate.d.ts.map