@lmzhen/dsh-evolution-state-storage 0.3.15 → 0.3.17

package/lib/index.js

@@ -8,6 +8,36 @@ import { Service } from "@deepseek-ai/cordis";
 * (IO-seam files) are the two shipped providers.
 * @module @lmzhen/dsh-evolution-state-storage
 */
+/** 0.3.17 (S3.3, E-24): 'executing' = claimed, runner in flight — a fresh
+* claim only takes 'pending', and resolve accepts 'pending'/'executing', so a
+* crash mid-approve can never double-execute the runner. */
+const PENDING_STATUSES = [
+	"pending",
+	"executing",
+	"approved",
+	"rejected"
+];
+/** 0.3.17 (S3.3): the claim lifecycle as ONE transition table — BOTH
+* providers (json/domain) must use these, never a hand-written copy (a second
+* copy is exactly the E-10 drift class). */
+const canClaimPending = (status) => status === "pending";
+const canResolvePending = (status) => status === "pending" || status === "executing";
+/** Releasing a claim on an executing record rolls it back to pending (a
+* runner FAILURE is retryable); other statuses pass through unchanged. */
+const releasedStatus = (status) => status === "executing" ? "pending" : status;
+/**
+* Claim lifecycle (S3.3): pending →(claim)→ executing →(resolve)→ approved/rejected.
+* release() rolls executing back to pending (failure path). A crash between
+* the runner execution and the resolve leaves the record executing+claimed:
+* until expiry another claim is refused (no double execution), and after
+* expiry only the operator acts — approval NEVER auto-replays an executing
+* record (the write may already have landed; a non-idempotent replay would
+* duplicate it). Operator options: reject (cleanup, no runner) or release +
+* re-stage after manual verification. Release command surface is deferred.
+*/
+/** 0.3.17 (E-75): claim expiry single source — both providers (json/domain)
+* previously hardcoded `10 * 60_000` independently. */
+const CLAIM_EXPIRY_MS = 10 * 6e4;
 var EvolutionStateStorageRegistry = class extends Service {
 	providers = /* @__PURE__ */ new Map();
 	constructor(ctx) {
@@ -32,4 +62,4 @@ var EvolutionStateStorageRegistry = class extends Service {
 	}
 };
 //#endregion
-export { EvolutionStateStorageRegistry, EvolutionStateStorageRegistry as default };
+export { CLAIM_EXPIRY_MS, EvolutionStateStorageRegistry, EvolutionStateStorageRegistry as default, PENDING_STATUSES, canClaimPending, canResolvePending, releasedStatus };

package/lib/types/index.d.ts

@@ -7,8 +7,36 @@
  * @module @deepseek-ai/dsh-evolution-state-storage
  */
 import { Context, Service } from '@deepseek-ai/cordis';
-export type PendingKind = 'memory' | 'skill' | 'skill_batch' | 'capability';
-export type PendingStatus = 'pending' | 'approved' | 'rejected';
+/** 0.3.17 (S3.5, D-4): 'skill_batch' removed — nothing ever created one
+ * (dead enum member); the historic value, if it ever reached disk, is read as
+ * an unknown kind by consumers rather than minted here. */
+export type PendingKind = 'memory' | 'skill' | 'capability';
+/** 0.3.17 (S3.3, E-24): 'executing' = claimed, runner in flight — a fresh
+ * claim only takes 'pending', and resolve accepts 'pending'/'executing', so a
+ * crash mid-approve can never double-execute the runner. */
+export declare const PENDING_STATUSES: readonly ["pending", "executing", "approved", "rejected"];
+export type PendingStatus = (typeof PENDING_STATUSES)[number];
+/** 0.3.17 (S3.3): the claim lifecycle as ONE transition table — BOTH
+ * providers (json/domain) must use these, never a hand-written copy (a second
+ * copy is exactly the E-10 drift class). */
+export declare const canClaimPending: (status: PendingStatus) => boolean;
+export declare const canResolvePending: (status: PendingStatus) => boolean;
+/** Releasing a claim on an executing record rolls it back to pending (a
+ * runner FAILURE is retryable); other statuses pass through unchanged. */
+export declare const releasedStatus: (status: PendingStatus) => PendingStatus;
+/**
+ * Claim lifecycle (S3.3): pending →(claim)→ executing →(resolve)→ approved/rejected.
+ * release() rolls executing back to pending (failure path). A crash between
+ * the runner execution and the resolve leaves the record executing+claimed:
+ * until expiry another claim is refused (no double execution), and after
+ * expiry only the operator acts — approval NEVER auto-replays an executing
+ * record (the write may already have landed; a non-idempotent replay would
+ * duplicate it). Operator options: reject (cleanup, no runner) or release +
+ * re-stage after manual verification. Release command surface is deferred.
+ */
+/** 0.3.17 (E-75): claim expiry single source — both providers (json/domain)
+ * previously hardcoded `10 * 60_000` independently. */
+export declare const CLAIM_EXPIRY_MS: number;
 export interface ReviewStateRecord {
     turnsSinceMemory: number;
     turnsSinceSkill: number;
@@ -30,6 +58,10 @@ export interface PendingRecord {
     resolvedAt?: string | undefined;
     claimedBy?: string | undefined;
     claimedAt?: string | undefined;
+    /** 0.3.17 (E-25): who staged this (foreground vs background review) and
+     * which session — kept so resolved audit history is attributable. */
+    origin?: string | undefined;
+    sessionId?: string | undefined;
 }
 export interface PendingResolution {
     record: PendingRecord | null;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-state-storage",
   "description": "Provider registry seam for durable evolution state (community build)",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "publishConfig": {
     "access": "public"
   },