@makaio/framework 1.0.0-dev-1788511348215 → 1.0.0-dev-1788811230746

package/dist/{package-efR90JGe.d.mts → package-eOEt1w6u.d.mts}

@@ -1,8 +1,9 @@
-import { l as ProviderOperationOwnershipRecord, o as ProviderOperationClaimDecision, s as ProviderOperationMutationDecision } from "./provider-operation-DbdyFwNm.mjs";
-import { A as RecordProviderOperationUncertaintyInput, C as PendingAttemptAbandonmentDecision, D as RecordAllocationInput, E as ProvisioningClaimDecision, F as TakeOverProviderOperationInput, M as RecordProvisioningAbsentInput, N as RecoverableAttemptRecord, O as RecordAllocationTerminatedInput, P as RenewProviderOperationClaimInput, T as ProvisioningAbsenceDecision, a as BeginProvisioningInput, b as HandoffProviderOperationInput, c as DurableOutcome, g as ExecutionAttemptRepository, i as AllocationTerminationDecision, j as RecordProvisionerIncarnationLostInput, k as RecordInfrastructureFailureInput, m as ExecutionAttemptRecord, n as AllocationRefEvolution, o as DiscoveredAllocationDecision, p as ExecutionAttemptOutcomeDecision, r as AllocationRefEvolutionDecision, t as AllocationRecordingDecision, w as ProvisionerIncarnationLossDecision, x as InfrastructureFailureDecision, y as ExecutionOwnerId } from "./execution-attempt-repository-DY4KTptE.mjs";
+import { l as ProviderOperationOwnershipRecord, o as ProviderOperationClaimDecision, s as ProviderOperationMutationDecision } from "./provider-operation-B2wQST6N.mjs";
+import { $ as RuntimeReadinessDecision, A as MarkRuntimeReadyInput, B as ReadBootstrapStartStateInput, C as ExecutionAttemptRepository, D as GetInstructionInput, E as ExecutionOwnerId, F as PendingAttemptAbandonmentDecision, G as RecordProvisionerIncarnationLostInput, H as RecordAllocationTerminatedInput, J as RegisterRuntimeInput, K as RecordProvisioningAbsentInput, L as ProvisionerIncarnationLossDecision, M as OperationCompletionDecision, N as OperationReportDecision, O as HandoffProviderOperationInput, P as OutcomeCodec, R as ProvisioningAbsenceDecision, U as RecordInfrastructureFailureInput, V as RecordAllocationInput, W as RecordProviderOperationUncertaintyInput, X as ReportOperationInput, Y as RenewProviderOperationClaimInput, Z as RuntimeOutcomeFence, a as AllocationRefEvolutionDecision, b as ExecutionAttemptOutcomeDecision, et as RuntimeRegistrationDecision, f as CompleteOperationInput, h as DurableOutcome, i as AllocationRefEvolution, j as OperationAdmissionDecision, k as InfrastructureFailureDecision, n as AdmitOperationInput, o as AllocationTerminationDecision, p as DiscoveredAllocationDecision, q as RecoverableAttemptRecord, r as AllocationRecordingDecision, s as AttemptControlState, tt as TakeOverProviderOperationInput, u as BeginProvisioningInput, x as ExecutionAttemptRecord, z as ProvisioningClaimDecision } from "./execution-attempt-repository-OryBjQQI.mjs";
+import { z } from "zod";
 import { IMakaioBus } from "@makaio/framework/bus";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
-import { IWorkflowRunner, LoopGateHandler, MakaioNodeExtension, StationHandler, StepRunnerBusAuth, StepRunnerPlatformDefaults, WorkerMaterializationSpec, WorkflowDefinition, WorkflowExecution, WorkflowRunContext, WorkflowRunResult } from "@makaio/framework/contracts";
+import { ExecutionAttemptBootstrapAwaitStartResponse, ExecutionAttemptInstruction, ExecutionAttemptOutcome, IWorkflowRunner, LoopGateHandler, MakaioNodeExtension, StationHandler, StepRunnerBusAuth, StepRunnerPlatformDefaults, WorkerMaterializationSpec, WorkflowDefinition, WorkflowExecution, WorkflowRunContext, WorkflowRunResult } from "@makaio/framework/contracts";
 import { BaseService } from "@makaio/framework/service-base";
 import { MakaioDatabase } from "@makaio/framework/storage/drizzle";
 import { AutomationTriggerBindingRuntime } from "@makaio/framework/services/automation-trigger";
@@ -83,6 +84,24 @@ interface WorkflowMaterializationSpecResolver {
   resolve(input: WorkflowMaterializationSpecResolution): Promise<WorkerMaterializationSpec | undefined>;
 }
 //#endregion
+//#region subsystems/workflow-engine/src/bootstrap-start.d.ts
+/** A single bounded observation, not a new bootstrap budget. */
+interface BootstrapStartOptions {
+  /** Request cancellation or owner shutdown. */
+  readonly signal: AbortSignal;
+  /** Absolute request deadline in Unix milliseconds. */
+  readonly deadline: number;
+}
+/** Start authorization shared by credential ingress and authenticated runtime ingress. */
+interface BootstrapStartAuthority {
+  /**
+   * Observe the durable allocation before entering runtime registration.
+   * @param identity - Trusted owner and attempt identity.
+   * @param options - Cancellation and the current request's deadline.
+   */
+  awaitBootstrapStart(identity: ReadBootstrapStartStateInput, options: BootstrapStartOptions): Promise<ExecutionAttemptBootstrapAwaitStartResponse>;
+}
+//#endregion
 //#region subsystems/workflow-engine/src/execution-attempt-authority.d.ts
 /**
  * Execution attempt Authority service.
@@ -113,8 +132,9 @@ interface WorkflowMaterializationSpecResolver {
  * are lost on crash; the host recovery coordinator owns recovery decisions.
  * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
  */
-declare class ExecutionAttemptAuthority<TOutcome> {
+declare class ExecutionAttemptAuthority<TOutcome> implements BootstrapStartAuthority {
   private readonly repository;
+  private readonly bootstrapTimeoutMs;
   /**
    * In-process waiters keyed by `executionAttemptId`.
    *
@@ -125,17 +145,40 @@ declare class ExecutionAttemptAuthority<TOutcome> {
   private readonly waiters;
   /**
    * @param repository - Injected durable attempt persistence port.
+   * @param options - Explicit host-owned bootstrap budget frozen when each attempt is created.
+   */
+  constructor(repository: ExecutionAttemptRepository<TOutcome>, options: {
+    readonly bootstrapTimeoutMs: number;
+  });
+  /**
+   * Wait for durable allocation without registering or admitting a Runtime.
+   * @param identity - Trusted owner and attempt identity.
+   * @param options - Request cancellation and absolute deadline.
+   * @returns A bounded, renewable start decision.
    */
-  constructor(repository: ExecutionAttemptRepository<TOutcome>);
+  awaitBootstrapStart(identity: ReadBootstrapStartStateInput, options: BootstrapStartOptions): Promise<ExecutionAttemptBootstrapAwaitStartResponse>;
   /**
    * Create a new execution attempt with an Authority-generated ID.
    *
    * Persists the attempt through the repository and installs an in-process
    * waiter for the committed outcome. Must be called before dispatch.
    * @param executionId - Owner identifier the attempt belongs to.
+   * @param instruction - Portable immutable assignment to snapshot before dispatch.
    * @returns The persisted attempt record.
    */
-  createAttempt(executionId: ExecutionOwnerId): Promise<ExecutionAttemptRecord>;
+  createAttempt(executionId: ExecutionOwnerId, instruction: ExecutionAttemptInstruction): Promise<ExecutionAttemptRecord>;
+  /**
+   * Read this attempt's frozen assignment through the owner-scoped repository port.
+   * @param input - Attempt and trusted owner identity.
+   * @returns The stored assignment, or null for an owner mismatch or missing attempt.
+   */
+  getInstruction(input: GetInstructionInput): Promise<ExecutionAttemptInstruction | null>;
+  /**
+   * Accept successful Preparation without settling the attempt's outcome waiter.
+   * @param input - Preparation result, operation correlation and trusted owner identity.
+   * @returns The repository's durable acceptance, replay or refusal.
+   */
+  reportOperation(input: ReportOperationInput): Promise<OperationReportDecision>;
   /**
    * Claim durable ownership of provider provisioning for an active attempt.
    *
@@ -219,6 +262,54 @@ declare class ExecutionAttemptAuthority<TOutcome> {
    * @returns The durable termination decision.
    */
   recordAllocationTerminated(input: RecordAllocationTerminatedInput): Promise<AllocationTerminationDecision>;
+  /**
+   * Register a runtime incarnation as an attempt's endpoint.
+   *
+   * Delegates directly to the repository, which allocates the generation. No
+   * waiter changes: registering an endpoint says nothing about the attempt's
+   * canonical answer, and a refusal is a statement about the runtime rather
+   * than about the outcome anybody is waiting for.
+   * @param input - Attempt identity, owning execution, and the runtime incarnation.
+   * @returns The durable registration decision.
+   */
+  registerRuntime(input: RegisterRuntimeInput): Promise<RuntimeRegistrationDecision>;
+  /**
+   * Admit one operation through an attempt's start gate.
+   *
+   * Delegates directly to the repository, which mints the operation identifier
+   * and enforces the at-most-one guard.
+   * @param input - Attempt identity, owning execution, kind, idempotency key, and fence.
+   * @returns The durable admission decision.
+   */
+  admitOperation(input: AdmitOperationInput): Promise<OperationAdmissionDecision>;
+  /**
+   * Release the attempt's active operation.
+   *
+   * Delegates directly to the repository. A completed operation is not a
+   * canonical answer, so the waiter stays pending: what settles an attempt is
+   * a committed outcome or a terminal transition, never a freed slot.
+   * @param input - Attempt identity, the operation being completed, and its fence.
+   * @returns The durable completion decision.
+   */
+  completeOperation(input: CompleteOperationInput): Promise<OperationCompletionDecision>;
+  /**
+   * Record that a registered runtime proved itself ready.
+   *
+   * Delegates directly to the repository.
+   * @param input - Attempt identity, the generation the proof belongs to, and when it was observed.
+   * @returns The durable readiness decision.
+   */
+  markRuntimeReady(input: MarkRuntimeReadyInput): Promise<RuntimeReadinessDecision>;
+  /**
+   * Read an attempt's runtime and operation control state.
+   *
+   * Delegates directly to the repository. Unfenced and regardless of status,
+   * because a process recovering its view of an attempt needs exactly the
+   * superseded and settled ones too.
+   * @param executionAttemptId - Attempt whose control state to read.
+   * @returns The control state, or `null` when no such attempt exists.
+   */
+  getAttemptControlState(executionAttemptId: string): Promise<AttemptControlState | null>;
   /**
    * Retrieve the active attempt for a given execution.
    *
@@ -267,9 +358,10 @@ declare class ExecutionAttemptAuthority<TOutcome> {
    * @param executionAttemptId - The attempt submitting the outcome.
    * @param executionId - Owner identifier the attempt belongs to.
    * @param result - The rendering to commit, from {@link canonicalizeOutcome}.
+   * @param runtimeFence - Runtime slot that must remain current for a fresh commit.
    * @returns The durable decision with the canonical outcome when applicable.
    */
-  commitOutcome(executionAttemptId: string, executionId: ExecutionOwnerId, result: DurableOutcome<TOutcome>): Promise<ExecutionAttemptOutcomeDecision<TOutcome>>;
+  commitOutcome(executionAttemptId: string, executionId: ExecutionOwnerId, result: DurableOutcome<TOutcome>, runtimeFence?: RuntimeOutcomeFence): Promise<ExecutionAttemptOutcomeDecision<TOutcome>>;
   /**
    * Obtain the in-process promise for a committed outcome.
    *
@@ -408,6 +500,371 @@ declare class ExecutionAttemptAuthority<TOutcome> {
   private settleWaiterInternal;
 }
 //#endregion
+//#region subsystems/workflow-engine/src/outcome-convergence.d.ts
+/**
+ * Input handed to {@link OutcomeConvergence.converge}.
+ *
+ * Named rather than inlined so an owner-side realization can state the shape
+ * it implements against, and so a consumer can pin it from the public surface.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface OutcomeConvergenceInput<TOutcome> {
+  /** Owner identifier the attempt belongs to. */
+  readonly executionId: ExecutionOwnerId;
+  /** Authority-created attempt identifier. */
+  readonly executionAttemptId: string;
+  /** The canonical committed outcome, never the submitter's copy of it. */
+  readonly outcome: TOutcome;
+  /** The durable decision that produced the committed outcome. */
+  readonly decision: 'accepted' | 'duplicate';
+}
+/**
+ * Owner-side convergence of a committed attempt outcome.
+ *
+ * Runs after the durable commit and before waiter settlement and ACK. It is
+ * idempotent by contract: it is re-entered for every duplicate retry, because
+ * a worker whose first submission committed but did not converge resubmits
+ * the same outcome, receives `duplicate`, and must converge again.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface OutcomeConvergence<TOutcome> {
+  /**
+   * Converge owner state with the committed outcome.
+   * @param input - Attempt identity, the canonical committed outcome, and the
+   *   durable decision that produced it.
+   */
+  converge(input: OutcomeConvergenceInput<TOutcome>): Promise<void>;
+}
+/**
+ * Owner-side validation that runs before the durable commit.
+ *
+ * Performs reads only: an outcome it rejects never becomes an immutable
+ * attempt outcome, so a corrected retry is not answered as a conflict. What
+ * it inspects is the canonical outcome the attempt will hold, obtained from
+ * `ExecutionAttemptAuthority.canonicalizeOutcome` before the commit.
+ *
+ * **A realization must be retry-stable.** {@link submitAttemptOutcome} runs it
+ * ahead of every commit, including the retry of a submission that already
+ * committed, so its verdict may depend only on the submission itself and on
+ * owner facts no convergence step rewrites — never on owner state convergence
+ * moves forward. A validator that read, say, a mutable lifecycle status would
+ * reject the identical retry of an outcome its own convergence already
+ * committed, and the waiter for that outcome would never settle.
+ *
+ * Retry-stable is measured on the outcome, not on its text. A retry need not
+ * render the same text as the first commit: `sameDurableOutcome` judges
+ * two texts the same outcome whatever member order they carry and answers
+ * `duplicate` for such a retry, while the validator sees the retry's own
+ * canonical rendering, never the stored one. Its verdict may therefore turn
+ * only on what `sameDurableOutcome` compares — the members and their values
+ * — and never on member order or any other detail of one particular
+ * rendering. A validator that keyed on which member comes first would reject
+ * the retry the repository is about to report as `duplicate`, and the
+ * committed-but-unconverged waiter could never recover. Validating the stored
+ * representation instead is not an option, for the reason the next paragraph
+ * gives: validation runs ahead of the commit, where the retry's rendering is
+ * the only one there is.
+ *
+ * The rule is stated here rather than worked around downstream because the
+ * order it constrains is the one that keeps a spoofed outcome out of durable
+ * storage: validation cannot move behind the commit without committing what
+ * it exists to reject. The workflow adapter's `validateOutcomeExecutionIdentity`
+ * satisfies it by correlating the submitted result against immutable durable
+ * identity — the execution's own id and workflow id, and the run context's
+ * terminal-authority binding, none of which outcome convergence touches.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface OutcomePreCommitValidation<TOutcome> {
+  /**
+   * Validate an outcome against owner state.
+   *
+   * Called again for every retry of the same submission, so the same outcome
+   * owes the same verdict — the same as `sameDurableOutcome` reads it,
+   * which ignores member order and every other rendering detail, not the
+   * same text.
+   *
+   * The outcome handed over is the canonical one — what the attempt will
+   * hold and what {@link OutcomeConvergence.converge} will receive — not the
+   * submitter's copy of it. A codec may normalize while serializing, so
+   * validating the copy would let an outcome the validator would have
+   * rejected become the immutable committed one.
+   * @param executionId - Owner identifier the attempt belongs to.
+   * @param outcome - Canonical outcome about to be committed.
+   * @throws When the outcome must not be committed.
+   */
+  validate(executionId: ExecutionOwnerId, outcome: TOutcome): Promise<void>;
+}
+/**
+ * Dependencies of {@link submitAttemptOutcome}.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface AttemptOutcomeSubmissionDeps<TOutcome> {
+  /** Authority that commits the outcome and holds the in-process waiter. */
+  readonly authority: ExecutionAttemptAuthority<TOutcome>;
+  /** Owner convergence that runs for `accepted` and `duplicate` decisions. */
+  readonly convergence: OutcomeConvergence<TOutcome>;
+  /** Optional owner validation that runs before the durable commit. */
+  readonly validation?: OutcomePreCommitValidation<TOutcome>;
+}
+/**
+ * Input of {@link submitAttemptOutcome}.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface AttemptOutcomeSubmission<TOutcome> {
+  /** Owner identifier the attempt belongs to. */
+  readonly executionId: ExecutionOwnerId;
+  /** Authority-created attempt identifier. */
+  readonly executionAttemptId: string;
+  /** Outcome the worker submitted. */
+  readonly outcome: TOutcome;
+  /** Originating runtime slot, checked atomically at commit after owner validation. */
+  readonly runtimeFence?: RuntimeOutcomeFence;
+}
+/**
+ * Submit an attempt outcome through the generic owner boundary.
+ *
+ * Order: one canonicalization of the submitted outcome, optional pre-commit
+ * validation of that canonical value, durable commit of that same rendering
+ * through the authority, owner convergence for `accepted` and `duplicate`,
+ * then waiter settlement on a fresh decode of the text the decision reports
+ * as committed. The decision kind is returned for the caller's
+ * acknowledgement.
+ *
+ * Invariants this function keeps:
+ * - the submission is rendered exactly once, and the submitter's object is
+ *   never read again after that: an outcome the caller mutates while an await
+ *   is pending can reach neither the validation nor the durable write;
+ * - validation and convergence see one and the same value: the canonical
+ *   outcome the attempt holds, never the submitter's copy of it;
+ * - convergence only ever sees `decision.outcome`, the repository's own
+ *   committed object;
+ * - the waiter settles on a value decoded afresh from the text the attempt
+ *   stores — the decision's own text, which for a `duplicate` is the first
+ *   commit's rather than the retry's — so what a runner receives is the
+ *   committed outcome even when convergence mutated the object it was handed;
+ * - a throwing convergence leaves the outcome durably committed and the
+ *   waiter pending, so the worker's retry yields `duplicate` and converges
+ *   again; nothing is rejected or deleted here. That recovery path runs the
+ *   validation again first, which is why {@link OutcomePreCommitValidation}
+ *   owes a retry-stable verdict;
+ * - `conflict` and `fenced` skip convergence and settlement; their waiter
+ *   rejection already happened inside `ExecutionAttemptAuthority.commitOutcome`.
+ * @param deps - Authority, convergence, and optional validation.
+ * @param input - Attempt identity and submitted outcome.
+ * @returns The durable decision kind.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+declare function submitAttemptOutcome<TOutcome>(deps: AttemptOutcomeSubmissionDeps<TOutcome>, input: AttemptOutcomeSubmission<TOutcome>): Promise<'accepted' | 'duplicate' | 'conflict' | 'fenced'>;
+//#endregion
+//#region subsystems/workflow-engine/src/execution-attempt-handlers.d.ts
+/** Owner-specific interpretation of a terminal report against its frozen assignment. */
+interface AttemptOutcomeDecodingInput {
+  /** Immutable instruction stored when the Attempt was created. */
+  readonly instruction: ExecutionAttemptInstruction;
+  /** Technical failure or adapter-produced result reported by the Runtime. */
+  readonly outcome: ExecutionAttemptOutcome;
+}
+/** Dependencies for the generic instruction, Preparation, and outcome request handlers. */
+interface ExecutionAttemptHandlersDeps<TOutcome> extends AttemptOutcomeSubmissionDeps<TOutcome> {
+  /**
+   * Decode against immutable assignment facts, not the owner's mutable current state.
+   * Must produce the same outcome for retries of the same report.
+   * @param input - Frozen instruction and terminal wire report.
+   * @returns The owner-specific outcome passed through canonical commit and convergence.
+   */
+  decodeOutcome(input: AttemptOutcomeDecodingInput): TOutcome | Promise<TOutcome>;
+}
+/**
+ * Register generic Runtime ingress; no Workflow result or owner lifecycle is assumed.
+ *
+ * Preparation acceptance and operation completion are one Authority write.
+ * Terminal reports commit, converge, settle the waiter, then receive their ACK.
+ * Local host code uses the typed Authority/submission ports directly; these wire
+ * handlers follow the same authenticated-peer rule as Runtime registration.
+ * @param bus - Bus that receives authenticated Runtime requests.
+ * @param deps - Authority and owner-side outcome adapter.
+ * @returns Cleanup function for all three handlers.
+ */
+declare function registerExecutionAttemptHandlers<TOutcome>(bus: IMakaioBus, deps: ExecutionAttemptHandlersDeps<TOutcome>): () => void;
+//#endregion
+//#region subsystems/workflow-engine/src/workflow-attempt-outcome.d.ts
+/** Technical failure retained as such rather than fabricated into a workflow-produced result. */
+type WorkflowAttemptTechnicalFailure = Extract<ExecutionAttemptOutcome, {
+  kind: 'technical-failure';
+}>;
+/** Confirmed cooperative stop retained independently of a workflow-produced result. */
+type WorkflowAttemptCancellation = Extract<ExecutionAttemptOutcome, {
+  kind: 'cancelled';
+}>;
+/** Canonical owner outcome: a workflow result, infrastructure failure, or confirmed cancellation. */
+type WorkflowAttemptOutcome = WorkflowRunResult | WorkflowAttemptTechnicalFailure | WorkflowAttemptCancellation;
+/** Production codec schema for workflow-owned Attempt outcomes. */
+declare const WorkflowAttemptOutcomeSchema: z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+  executionId: z.ZodString;
+  workflowId: z.ZodString;
+  status: z.ZodLiteral<"completed">;
+  artifact: z.ZodOptional<z.ZodObject<{
+    kind: z.ZodString;
+    id: z.ZodString;
+    revision: z.ZodString;
+    scope: z.ZodObject<{
+      level: z.ZodString;
+      ids: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    schemaVersion: z.ZodString;
+    data: z.ZodType<Record<string, unknown>, Record<string, unknown>, z.core.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>;
+    relations: z.ZodArray<z.ZodObject<{
+      type: z.ZodString;
+      target: z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        refClass: z.ZodDefault<z.ZodLiteral<"artifact">>;
+        kind: z.ZodString;
+        id: z.ZodString;
+        revision: z.ZodString;
+      }, z.core.$strip>, z.ZodObject<{
+        refClass: z.ZodDefault<z.ZodLiteral<"local">>;
+        artifact: z.ZodObject<{
+          refClass: z.ZodDefault<z.ZodLiteral<"artifact">>;
+          kind: z.ZodString;
+          id: z.ZodString;
+          revision: z.ZodString;
+        }, z.core.$strip>;
+        localId: z.ZodString;
+      }, z.core.$strip>, z.ZodObject<{
+        refClass: z.ZodDefault<z.ZodLiteral<"evidence">>;
+        kind: z.ZodString;
+        id: z.ZodString;
+        revision: z.ZodOptional<z.ZodString>;
+        locator: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>], "refClass">>;
+    }, z.core.$strip>>;
+    confidence: z.ZodOptional<z.ZodObject<{
+      level: z.ZodEnum<{
+        inferred: "inferred";
+        confirmed: "confirmed";
+        assumed: "assumed";
+        stated: "stated";
+        verified: "verified";
+      }>;
+      basis: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        actor: z.ZodObject<{
+          kind: z.ZodString;
+          id: z.ZodString;
+          displayName: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        timestamp: z.ZodNumber;
+        detail: z.ZodOptional<z.ZodString>;
+        evidenceRef: z.ZodOptional<z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          refClass: z.ZodDefault<z.ZodLiteral<"artifact">>;
+          kind: z.ZodString;
+          id: z.ZodString;
+          revision: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+          refClass: z.ZodDefault<z.ZodLiteral<"local">>;
+          artifact: z.ZodObject<{
+            refClass: z.ZodDefault<z.ZodLiteral<"artifact">>;
+            kind: z.ZodString;
+            id: z.ZodString;
+            revision: z.ZodString;
+          }, z.core.$strip>;
+          localId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+          refClass: z.ZodDefault<z.ZodLiteral<"evidence">>;
+          kind: z.ZodString;
+          id: z.ZodString;
+          revision: z.ZodOptional<z.ZodString>;
+          locator: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>], "refClass">>>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    representations: z.ZodOptional<z.ZodObject<{
+      markdown: z.ZodOptional<z.ZodString>;
+      summary: z.ZodOptional<z.ZodString>;
+      plaintext: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    actor: z.ZodObject<{
+      kind: z.ZodString;
+      id: z.ZodString;
+      displayName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    timestamp: z.ZodNumber;
+    createdAt: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+}, z.core.$strict>, z.ZodObject<{
+  executionId: z.ZodString;
+  workflowId: z.ZodString;
+  status: z.ZodLiteral<"failed">;
+  error: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  executionId: z.ZodString;
+  workflowId: z.ZodString;
+  status: z.ZodLiteral<"cancelled">;
+  reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+  executionId: z.ZodString;
+  workflowId: z.ZodString;
+  status: z.ZodLiteral<"paused">;
+  pausedAtGateId: z.ZodString;
+  pausedAtFrameId: z.ZodString;
+}, z.core.$strict>], "status">, z.ZodPipe<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  kind: z.ZodLiteral<"technical-failure">;
+  stage: z.ZodEnum<{
+    startup: "startup";
+    "workspace-preparation": "workspace-preparation";
+    "workload-invocation": "workload-invocation";
+  }>;
+  message: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"workload-result">;
+  result: z.ZodType<_$_makaio_contracts0.JsonValue, _$_makaio_contracts0.JsonValue, z.core.$ZodTypeInternals<_$_makaio_contracts0.JsonValue, _$_makaio_contracts0.JsonValue>>;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"cancelled">;
+  reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "kind">, z.ZodTransform<{
+  kind: "technical-failure";
+  stage: "startup" | "workspace-preparation" | "workload-invocation";
+  message: string;
+} | {
+  kind: "cancelled";
+  reason?: string | undefined;
+}, {
+  kind: "technical-failure";
+  stage: "startup" | "workspace-preparation" | "workload-invocation";
+  message: string;
+} | {
+  kind: "workload-result";
+  result: _$_makaio_contracts0.JsonValue;
+} | {
+  kind: "cancelled";
+  reason?: string | undefined;
+}>>]>;
+/** Durable workflow-owner codec; generic Attempt persistence does not interpret owner outcomes. */
+declare const workflowAttemptOutcomeCodec: OutcomeCodec<WorkflowAttemptOutcome>;
+/**
+ * Interpret a generic terminal report against its immutable workflow assignment.
+ * @param input - Frozen assignment and the Runtime's generic outcome report.
+ * @returns An owner-typed outcome to canonicalize, commit, and then converge.
+ */
+declare function decodeWorkflowAttemptOutcome(input: AttemptOutcomeDecodingInput): WorkflowAttemptOutcome;
+/** Workflow identity used to project an already-converged runtime outcome to a runner completion. */
+interface CommittedWorkflowOutcomeIdentity {
+  /** Workflow execution whose state has already converged. */
+  readonly executionId: string;
+  /** Workflow definition that owns that execution. */
+  readonly workflowId: string;
+}
+/**
+ * Project an already committed and converged outcome for the workflow runner API.
+ *
+ * This is an owner status projection, not a result to submit or persist. A
+ * runtime outcome retains its own kind in Attempt storage; the WorkflowExecution
+ * has already converged before this helper is called.
+ * @param outcome - Canonical outcome returned after owner convergence.
+ * @param identity - Immutable identity of the converged workflow execution.
+ * @returns Workflow status used by the runner's authority-committed completion.
+ */
+declare function toCommittedWorkflowRunnerResult(outcome: WorkflowAttemptOutcome, identity: CommittedWorkflowOutcomeIdentity): WorkflowRunResult;
+//#endregion
 //#region subsystems/workflow-engine/src/workflow-executor.d.ts
 /**
  * Core workflow executor service.
@@ -420,11 +877,14 @@ declare class ExecutionAttemptAuthority<TOutcome> {
  * - Manages cancellation and cleanup
  */
 declare class WorkflowExecutor extends BaseService {
+  private readonly workflowRunner?;
+  private readonly executionAttemptAuthority?;
   /** Drizzle storage handler registration for the composition root. */
   static readonly storage: {
     readonly drizzle: typeof registerDrizzleWorkflowStorage;
   };
   private readonly config;
+  private stopBootstrapWaits?;
   private readonly activeExecutions;
   private readonly executionTasks;
   private readonly shellAbortControllers;
@@ -440,8 +900,6 @@ declare class WorkflowExecutor extends BaseService {
   private readonly durableLifecycleTransitions;
   private readonly lifecyclePublications;
   private readonly publishingLifecycleExecutions;
-  private readonly workflowRunner?;
-  private readonly executionAttemptAuthority?;
   private readonly materializationSpecResolvers;
   /**
    * Create a new workflow executor.
@@ -450,7 +908,7 @@ declare class WorkflowExecutor extends BaseService {
    * @param workflowRunner - Optional workflow-level runner for isolated execution
    * @param executionAttemptAuthority - Optional Authority for Worker dispatch runners
    */
-  constructor(bus: IMakaioBus, config?: Partial<ExecutorConfig>, workflowRunner?: IWorkflowRunner, executionAttemptAuthority?: ExecutionAttemptAuthority<WorkflowRunResult>);
+  constructor(bus: IMakaioBus, config?: Partial<ExecutorConfig>, workflowRunner?: IWorkflowRunner | undefined, executionAttemptAuthority?: ExecutionAttemptAuthority<WorkflowAttemptOutcome> | undefined);
   /**
    * Register a host resolver used to freeze workspace materialization before a
    * path-backed execution is persisted.
@@ -485,6 +943,28 @@ declare class WorkflowExecutor extends BaseService {
     accepted: boolean;
     status: WorkflowExecution['status'];
   }>;
+  /**
+   * Fail the workflow owner after a technical Attempt outcome has been committed.
+   * Startup and Preparation failures can precede loading the workflow definition,
+   * so this path uses the durable owner context, not a fabricated runner result.
+   * @param executionId - Durable authority-owned execution identity.
+   * @param failure - Canonical technical failure retained in Attempt storage.
+   * @returns The durable status after idempotent failure convergence.
+   */
+  readonly acceptAuthorityTechnicalFailure: (executionId: string, failure: WorkflowAttemptTechnicalFailure) => Promise<{
+    accepted: boolean;
+    status: WorkflowExecution["status"];
+  }>;
+  /**
+   * Cancel the workflow owner after its technical Attempt cancellation is committed.
+   * @param executionId - Durable authority-owned execution identity.
+   * @param cancellation - Canonical cancellation retained in Attempt storage.
+   * @returns The durable status after idempotent cancellation convergence.
+   */
+  readonly acceptAuthorityCancellation: (executionId: string, cancellation: WorkflowAttemptCancellation) => Promise<{
+    accepted: boolean;
+    status: WorkflowExecution["status"];
+  }>;
   private resolveAuthorityRunnerReplay;
   private loadAuthorityRunnerContext;
   private registerAuthorityResultFinalizer;
@@ -862,7 +1342,9 @@ interface WorkflowEngineServiceOptions {
    * When omitted, the workflow engine operates without attempt tracking
    * (framework-only, in-process, and Piscina modes).
    */
-  executionAttemptRepository?: ExecutionAttemptRepository<WorkflowRunResult>;
+  executionAttemptRepository?: ExecutionAttemptRepository<WorkflowAttemptOutcome>;
+  /** Explicit creation-time bootstrap budget, required only when constructing an Authority. */
+  executionAttemptBootstrapTimeoutMs?: number;
   /**
    * Pre-built execution attempt Authority.
    *
@@ -874,7 +1356,7 @@ interface WorkflowEngineServiceOptions {
    * construction. When both are provided, the pre-built Authority is used
    * and the repository is ignored.
    */
-  executionAttemptAuthority?: ExecutionAttemptAuthority<WorkflowRunResult>;
+  executionAttemptAuthority?: ExecutionAttemptAuthority<WorkflowAttemptOutcome>;
   /** Host-owned resolvers that create portable specs for path-backed starts. */
   workflowMaterializationSpecResolvers?: readonly WorkflowMaterializationSpecResolver[];
   /**
@@ -915,12 +1397,11 @@ declare class WorkflowEngineService extends BaseService {
   /**
    * Execution attempt Authority owned by this package service.
    *
-   * Present only when an {@link ExecutionAttemptRepository} was injected at
-   * construction time (Worker dispatch mode). Returns `undefined` for
-   * framework-only, in-process, and Piscina modes.
+   * Present when the host supplies a prebuilt Authority or a repository with
+   * an explicit bootstrap budget, independently of runner mode.
    * @returns Authority instance, or `undefined` when no repository is injected.
    */
-  get executionAttemptAuthority(): ExecutionAttemptAuthority<WorkflowRunResult> | undefined;
+  get executionAttemptAuthority(): ExecutionAttemptAuthority<WorkflowAttemptOutcome> | undefined;
   /**
    * Register a named workflow success finalizer with the owned executor.
    *
@@ -1003,4 +1484,4 @@ declare function createWorkflowEnginePackage(options?: WorkflowEngineServiceOpti
  */
 declare const workflowEnginePackage: MakaioNodeExtension<IMakaioBus>;
 //#endregion
-export { WorkflowEngineServiceOptions as a, ExecutionAttemptAuthority as c, WorkflowWorkspaceRootResolver as d, registerDrizzleWorkflowStorage as f, WorkflowEngineService as i, WorkflowMaterializationSpecResolution as l, createWorkflowEnginePackage as n, WorkflowTriggerReconciler as o, workflowEnginePackage as r, WorkflowExecutor as s, WorkflowEngineToken as t, WorkflowMaterializationSpecResolver as u };
+export { WorkflowWorkspaceRootResolver as A, OutcomePreCommitValidation as C, BootstrapStartOptions as D, BootstrapStartAuthority as E, WorkflowMaterializationSpecResolution as O, OutcomeConvergenceInput as S, ExecutionAttemptAuthority as T, ExecutionAttemptHandlersDeps as _, WorkflowEngineServiceOptions as a, AttemptOutcomeSubmissionDeps as b, CommittedWorkflowOutcomeIdentity as c, WorkflowAttemptOutcomeSchema as d, WorkflowAttemptTechnicalFailure as f, AttemptOutcomeDecodingInput as g, workflowAttemptOutcomeCodec as h, WorkflowEngineService as i, registerDrizzleWorkflowStorage as j, WorkflowMaterializationSpecResolver as k, WorkflowAttemptCancellation as l, toCommittedWorkflowRunnerResult as m, createWorkflowEnginePackage as n, WorkflowTriggerReconciler as o, decodeWorkflowAttemptOutcome as p, workflowEnginePackage as r, WorkflowExecutor as s, WorkflowEngineToken as t, WorkflowAttemptOutcome as u, registerExecutionAttemptHandlers as v, submitAttemptOutcome as w, OutcomeConvergence as x, AttemptOutcomeSubmission as y };

package/dist/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@makaio/framework",
-  "version": "1.0.0-dev-1788511348215",
+  "version": "1.0.0-dev-1788811230746",
   "type": "module"
 }

package/dist/rules/index.d.mts

@@ -1,4 +1,4 @@
-import { C as RuleSetOptions, S as Rule, _ as JsonObjectShape, a as JsonObjectSchema, b as NotCondition, c as RuleSetOptionsSchema, d as CompoundCondition, f as Condition, g as JsonObject, h as FieldOperator, i as FieldOperatorSchema, l as ScalarValueSchema, m as FieldCondition, n as ExpressionConditionSchema, o as JsonValueSchema, p as ExpressionCondition, r as FieldConditionSchema, s as RuleSchema, t as ConditionSchema, u as AndCondition, v as JsonPrimitive, w as ScalarValue, x as OrCondition, y as JsonValue } from "../schemas-CF8QwRqt.mjs";
+import { C as RuleSetOptions, S as Rule, _ as JsonObjectShape, a as JsonObjectSchema, b as NotCondition, c as RuleSetOptionsSchema, d as CompoundCondition, f as Condition, g as JsonObject, h as FieldOperator, i as FieldOperatorSchema, l as ScalarValueSchema, m as FieldCondition, n as ExpressionConditionSchema, o as JsonValueSchema, p as ExpressionCondition, r as FieldConditionSchema, s as RuleSchema, t as ConditionSchema, u as AndCondition, v as JsonPrimitive, w as ScalarValue, x as OrCondition, y as JsonValue } from "../schemas-Bk50UoMA.mjs";
 
 //#region packages/rules/src/evaluator.d.ts
 /**

package/dist/rules/schemas.d.mts

@@ -1,2 +1,2 @@
-import { a as JsonObjectSchema, c as RuleSetOptionsSchema, i as FieldOperatorSchema, l as ScalarValueSchema, n as ExpressionConditionSchema, o as JsonValueSchema, r as FieldConditionSchema, s as RuleSchema, t as ConditionSchema } from "../schemas-CF8QwRqt.mjs";
+import { a as JsonObjectSchema, c as RuleSetOptionsSchema, i as FieldOperatorSchema, l as ScalarValueSchema, n as ExpressionConditionSchema, o as JsonValueSchema, r as FieldConditionSchema, s as RuleSchema, t as ConditionSchema } from "../schemas-Bk50UoMA.mjs";
 export { ConditionSchema, ExpressionConditionSchema, FieldConditionSchema, FieldOperatorSchema, JsonObjectSchema, JsonValueSchema, RuleSchema, RuleSetOptionsSchema, ScalarValueSchema };