@makaio/framework 1.0.0-dev-1788955549564 → 1.0.0-dev-1788966380232

package/dist/{execution-attempt-repository-CJVlPFMM.d.mts → execution-attempt-repository--RVils5-.d.mts}

@@ -40,13 +40,16 @@ type AttemptSettlementRead<TOutcome> = {
   readonly kind: 'outcome';
   readonly attempt: ExecutionAttemptRecord;
   readonly isCurrentAttempt: boolean;
-  readonly result: DurableOutcome<TOutcome>;
+  readonly result: DurableOutcome<TOutcome>; /** Original commit-time facts, or null for a legacy outcome lacking that observation. */
+  readonly controlObservation: AttemptOutcomeControlObservation | null;
 };
 /** Raw facts a realization must read within one coherent store observation. */
 interface AttemptSettlementSnapshot {
   readonly attempt: ExecutionAttemptRecord | null;
   readonly activeAttemptId: string | null;
   readonly outcomeText: string | null;
+  /** Stored commit-time observation; never reconstructed from current cancellation state. */
+  readonly controlObservation: AttemptOutcomeControlObservation | null;
 }
 /** Required owner-recovery methods composed into every execution attempt repository. */
 interface OwnerRequestRecoveryRepository<TOutcome> {
@@ -108,6 +111,252 @@ declare function replayEnsuredAttempt(input: EnsureExecutionAttemptInput, boundA
  */
 declare function readAttemptSettlementSnapshot<TOutcome>(input: ReadAttemptSettlementInput, snapshot: AttemptSettlementSnapshot, codec: OutcomeCodec<TOutcome>): AttemptSettlementRead<TOutcome>;
 //#endregion
+//#region subsystems/workflow-engine/src/execution-attempt-cancellation.d.ts
+/** A durable request to stop an attempt, never evidence that it stopped. */
+interface ExecutionAttemptCancellationIntent {
+  /** Winning owner request key, scoped to this attempt and retained for replay. */
+  readonly requestKey: string;
+  /** Accepted control-request revision; delivery and runtime reports never advance it. */
+  readonly controlRevision: number;
+  /** First accepted request time, preserved across duplicate requests and controller handoff. */
+  readonly requestedAt: string;
+  /** Optional owner-supplied explanation. */
+  readonly reason?: string;
+}
+/** Owner-scoped cancellation of attempts that exist when the request commits. */
+interface RequestExecutionCancellationInput {
+  /** Owner authorizing the cancellation of its existing attempts. */
+  readonly executionId: ExecutionOwnerId;
+  /** Explanation retained only when this is the first request for an attempt. */
+  readonly reason?: string;
+}
+/** Trusted owner authorization to stop one exact attempt, including historical cleanup. */
+interface RequestAttemptCancellationInput extends RequestExecutionCancellationInput {
+  readonly executionAttemptId: string;
+  /** Non-empty correlation key retained by the owner across retries. */
+  readonly requestKey: string;
+}
+/** A winning request is durable intent, never evidence that work or its allocation stopped. */
+type ExecutionAttemptCancellationDecision = {
+  readonly kind: 'accepted' | 'replayed';
+  readonly intent: ExecutionAttemptCancellationIntent;
+} | {
+  readonly kind: 'not-found';
+} | {
+  readonly kind: 'conflict';
+};
+/** Accepted control requests observed atomically with the first canonical outcome commit. */
+interface AttemptOutcomeControlObservation {
+  /** Zero before Cancel; the winning request revision afterwards. */
+  readonly controlRevision: number;
+  /** A detached winning receipt, or null when no Cancel had been accepted. */
+  readonly cancellation: ExecutionAttemptCancellationIntent | null;
+}
+/**
+ * Snapshot an owner-wide request before asynchronous storage work.
+ * @param input - Trusted owner identity and optional explanation.
+ * @returns Validated scalar fields without caller-owned references.
+ */
+declare function snapshotRequestExecutionCancellationInput(input: RequestExecutionCancellationInput): RequestExecutionCancellationInput;
+/**
+ * Snapshot exact cancellation scope and correlation before the first await.
+ * @param input - Trusted owner, exact attempt, request identity and reason.
+ * @returns Validated scalar request without normalizing identities or explanations.
+ */
+declare function snapshotRequestAttemptCancellationInput(input: RequestAttemptCancellationInput): RequestAttemptCancellationInput;
+/**
+ * Decide winning-request semantics after the store has established exact owner membership.
+ * The store supplies one commit instant and owns atomic receipt/gate mutation. This helper
+ * neither checks runtime reachability nor treats a settled attempt as immune to cleanup.
+ * Losing keys are no-op requests, not accepted commands requiring a command-history log.
+ * @param stored - Coherently read winning receipt, or null before cancellation.
+ * @param input - Validated candidate key and explanation.
+ * @param requestedAt - Store-generated first-acceptance instant, ignored for replay/conflict.
+ * @returns First winner or immutable replay, or conflicting reuse of the winning key.
+ */
+declare function evaluateAttemptCancellation(stored: ExecutionAttemptCancellationIntent | null, input: Pick<RequestAttemptCancellationInput, 'requestKey' | 'reason'>, requestedAt: string): Exclude<ExecutionAttemptCancellationDecision, {
+  readonly kind: 'not-found';
+}>;
+/**
+ * Capture accepted control facts alongside a fresh canonical outcome in its transaction.
+ * An absent Cancel is known revision zero, unlike a legacy outcome's unknown observation.
+ * @param cancellation - Winning request read in the same transaction as the outcome write.
+ * @returns Detached control facts that subsequent cancellation cannot rewrite.
+ */
+declare function snapshotAttemptOutcomeControl(cancellation: ExecutionAttemptCancellationIntent | null): AttemptOutcomeControlObservation;
+//#endregion
+//#region subsystems/workflow-engine/src/execution-attempt-decisions.d.ts
+/** Runtime and operation expected to remain current when an outcome becomes durable. */
+interface RuntimeOutcomeFence {
+  /** Registered runtime generation that produced the result. */
+  readonly runtimeGeneration: number;
+  /** Admitted operation, or null for a startup failure before any operation. */
+  readonly operationId: string | null;
+}
+/** A runtime result lost its execution slot before commit; the attempt remains available to its current runtime. */
+declare class RuntimeOutcomeFenceMismatchError extends Error {
+  constructor();
+}
+/**
+ * Require a fresh runtime outcome to belong to the coherently read execution slot.
+ * Repositories call this after canonical replay/settlement decisions and repeat its
+ * predicates in the committing write. A mismatch must not settle the attempt's waiter.
+ * @param control - Current runtime and operation facts.
+ * @param fence - Expected runtime slot, absent for owner-only outcome submission.
+ * @throws RuntimeOutcomeFenceMismatchError when the originating runtime slot changed.
+ */
+declare function assertRuntimeOutcomeFence(control: AttemptControlState, fence: RuntimeOutcomeFence | undefined): void;
+/** Facts read coherently by a realization before decoding runtime control state. */
+interface AttemptReachability {
+  /** Whether the requested attempt exists and belongs to the requested owner. */
+  readonly matchesExecution: boolean;
+  /** Whether the attempt has a terminal settlement. */
+  readonly settled: boolean;
+  /** Whether this is still the owner's active attempt. */
+  readonly active: boolean;
+  /** Whether an allocation exists and is not durably terminated. */
+  readonly allocated: boolean;
+}
+/** Refusals shared by registration, admission, and readiness, before control decoding. */
+type AttemptReachabilityDecision = Extract<RuntimeRegistrationDecision, {
+  readonly kind: 'not-found' | 'resolved' | 'fenced' | 'not-allocated';
+}>;
+/**
+ * Evaluate the common reachability precedence without reading or mutating storage.
+ * A null result only permits further evaluation; it never authorizes an unguarded write.
+ * @param facts - Coherent lifecycle, owner, and allocation facts supplied by the realization.
+ * @returns The first refusal, or null when runtime control may be decoded and evaluated.
+ */
+declare function evaluateAttemptReachability(facts: AttemptReachability): AttemptReachabilityDecision | null;
+/**
+ * Evaluate process-loss applicability after evidence parsing and claim authorization.
+ * Owner, lifetime, and incarnation refusals precede a recorded allocation.
+ * A null result permits only the realization's existing guarded settlement.
+ * @param attempt - Coherently read immutable provider binding and allocation facts.
+ * @param input - Owner identity and process-loss proof whose evidence the realization already parsed.
+ * @returns The first applicability refusal, or null to attempt the guarded write.
+ */
+declare function evaluateProvisionerIncarnationLoss(attempt: Pick<ExecutionAttemptRecord, 'executionId' | 'allocationLifetime' | 'provisionerIncarnationId' | 'allocationRef'>, input: Pick<RecordProvisionerIncarnationLostInput, 'executionId' | 'proof'>): Extract<ProvisionerIncarnationLossDecision, {
+  readonly kind: 'not-found' | 'not-process-bound' | 'incarnation-mismatch' | 'allocated';
+}> | null;
+/**
+ * Evaluate registration after reachability, preserving replay before busy refusal.
+ * An orphaned runtime probe may be reclaimed; a workload operation may not.
+ * @param control - Current decoded control state, not modified by this function.
+ * @param input - Runtime registration being considered.
+ * @returns A non-write decision, or null to attempt the realization's guarded registration.
+ */
+declare function evaluateRuntimeRegistration(control: AttemptControlState, input: RegisterRuntimeInput): Exclude<RuntimeRegistrationDecision, {
+  readonly kind: 'registered';
+}> | null;
+/**
+ * Evaluate admission after reachability: replay, busy, gate, readiness, generation, then Preparation.
+ * Probe operations are admitted before readiness because they establish that proof.
+ * @param control - Current decoded control state, not modified by this function.
+ * @param input - Operation admission being considered.
+ * @param fallbackAdmittedAt - Realization-supplied instant for a duplicate missing its stored instant.
+ * @param execution - Frozen assignment and Preparation receipts read with the control state.
+ * @returns A non-write decision, or null to attempt the realization's guarded admission.
+ */
+declare function evaluateOperationAdmission(control: AttemptControlState, input: AdmitOperationInput, fallbackAdmittedAt: string, execution: AttemptExecutionState): Exclude<OperationAdmissionDecision, {
+  readonly kind: 'admitted';
+}> | null;
+/**
+ * Evaluate successful Preparation, retaining historical replay before current-runtime fences.
+ * A null decision permits only a guarded write that saves the receipt and frees the slot together.
+ * @param reachability - Coherent owner, allocation and lifecycle facts.
+ * @param control - Current operation and runtime state.
+ * @param execution - Frozen instruction and retained Preparation history.
+ * @param input - Owner-scoped successful Preparation report.
+ * @returns A historical duplicate or refusal, or null to atomically accept the result.
+ */
+declare function evaluatePreparationReport(reachability: AttemptReachability, control: AttemptControlState, execution: AttemptExecutionState, input: ReportOperationInput): Exclude<OperationReportDecision, {
+  readonly kind: 'accepted';
+}> | null;
+/**
+ * Evaluate completion after presence and settlement checks, without owner or allocation fences.
+ * A replay is recognized even after its active slot has been cleared or reused.
+ * @param control - Current decoded control state, not modified by this function.
+ * @param input - Operation completion being considered.
+ * @returns A non-write decision, or null to attempt the realization's guarded completion.
+ */
+declare function evaluateOperationCompletion(control: AttemptControlState, input: CompleteOperationInput): Exclude<OperationCompletionDecision, {
+  readonly kind: 'completed';
+}> | null;
+/**
+ * Evaluate readiness after reachability: generation fence, replay, then busy refusal.
+ * @param control - Current decoded control state, not modified by this function.
+ * @param input - Runtime readiness report being considered.
+ * @returns A non-write decision, or null to attempt the realization's guarded readiness write.
+ */
+declare function evaluateRuntimeReadiness(control: AttemptControlState, input: MarkRuntimeReadyInput): Exclude<RuntimeReadinessDecision, {
+  readonly kind: 'ready';
+}> | null;
+//#endregion
+//#region subsystems/workflow-engine/src/execution-attempt-outcome.d.ts
+/**
+ * Input for committing a terminal outcome to an attempt.
+ *
+ * The repository makes the durable accept/duplicate/conflict/fence decision
+ * and returns the canonical outcome for convergence. Outcome commitment
+ * carries no claim: a worker's answer never depends on who currently owns
+ * the attempt's provider operation.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+interface ExecutionAttemptOutcomeCommit<TOutcome> {
+  /** Authority-created attempt identifier. */
+  readonly executionAttemptId: string;
+  /** Owner identifier the attempt belongs to. */
+  readonly executionId: ExecutionOwnerId;
+  /**
+   * The rendering produced by the repository's canonicalizeOutcome method.
+   *
+   * A rendering rather than a raw outcome so the value a caller validated and
+   * the value that becomes durable are the same one: the caller renders the
+   * submission once and never reads its own object again.
+   */
+  readonly result: DurableOutcome<TOutcome>;
+  /** Runtime correlation checked atomically for a fresh commit; owner-only paths may omit it. */
+  readonly runtimeFence?: RuntimeOutcomeFence;
+}
+/**
+ * Durable decision returned by the repository's commitOutcome method.
+ *
+ * - `accepted`: the outcome was committed as canonical for the first time.
+ *   The stored text decoded is reported, never the caller's copy of it.
+ * - `duplicate`: a canonically equal outcome was submitted again; this is a
+ *   replay. The committed outcome is reported, never the caller's copy of it.
+ * - `conflict`: the attempt already reached a different terminal state — either
+ *   a different committed outcome, or a competing terminal transition that
+ *   settled it without one.
+ * - `fenced`: the attempt is no longer the active attempt for this execution.
+ *
+ * Both settling kinds carry `text`: the durable text the attempt holds for
+ * this outcome. For `accepted` that is the text the commit just wrote; for
+ * `duplicate` it is the text the earlier commit wrote, which is not
+ * necessarily the retry's own rendering — canonical equality ignores member
+ * order and other differences a codec may render between identical values.
+ * A caller needing a copy nobody else has held decodes this committed text
+ * through the repository's decodeOutcome method. Decoding its own submission
+ * instead would hand out the retry's representation rather than the committed one.
+ * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
+ */
+type ExecutionAttemptOutcomeDecision<TOutcome> = {
+  readonly kind: 'accepted';
+  readonly outcome: TOutcome;
+  readonly text: string; /** Frozen at first commit; null only for outcomes predating control observation. */
+  readonly controlObservation: AttemptOutcomeControlObservation | null;
+} | {
+  readonly kind: 'duplicate';
+  readonly outcome: TOutcome;
+  readonly text: string; /** The original observation, never the control state at retry time. */
+  readonly controlObservation: AttemptOutcomeControlObservation | null;
+} | {
+  readonly kind: 'conflict';
+} | {
+  readonly kind: 'fenced';
+};
+//#endregion
 //#region subsystems/workflow-engine/src/provider-operation.d.ts
 /**
  * Provider-operation ownership protocol.
@@ -555,94 +804,6 @@ interface ProcessBoundProvisionerLossProof {
   readonly evidence: BoundedRecoveryEvidence;
 }
 //#endregion
-//#region subsystems/workflow-engine/src/execution-attempt-decisions.d.ts
-/** Facts read coherently by a realization before decoding runtime control state. */
-interface AttemptReachability {
-  /** Whether the requested attempt exists and belongs to the requested owner. */
-  readonly matchesExecution: boolean;
-  /** Whether the attempt has a terminal settlement. */
-  readonly settled: boolean;
-  /** Whether this is still the owner's active attempt. */
-  readonly active: boolean;
-  /** Whether an allocation exists and is not durably terminated. */
-  readonly allocated: boolean;
-}
-/** Refusals shared by registration, admission, and readiness, before control decoding. */
-type AttemptReachabilityDecision = Extract<RuntimeRegistrationDecision, {
-  readonly kind: 'not-found' | 'resolved' | 'fenced' | 'not-allocated';
-}>;
-/**
- * Evaluate the common reachability precedence without reading or mutating storage.
- * A null result only permits further evaluation; it never authorizes an unguarded write.
- * @param facts - Coherent lifecycle, owner, and allocation facts supplied by the realization.
- * @returns The first refusal, or null when runtime control may be decoded and evaluated.
- */
-declare function evaluateAttemptReachability(facts: AttemptReachability): AttemptReachabilityDecision | null;
-/**
- * Evaluate process-loss applicability after evidence parsing and claim authorization.
- * Owner, lifetime, and incarnation refusals precede a recorded allocation.
- * A null result permits only the realization's existing guarded settlement.
- * @param attempt - Coherently read immutable provider binding and allocation facts.
- * @param input - Owner identity and process-loss proof whose evidence the realization already parsed.
- * @returns The first applicability refusal, or null to attempt the guarded write.
- */
-declare function evaluateProvisionerIncarnationLoss(attempt: Pick<ExecutionAttemptRecord, 'executionId' | 'allocationLifetime' | 'provisionerIncarnationId' | 'allocationRef'>, input: Pick<RecordProvisionerIncarnationLostInput, 'executionId' | 'proof'>): Extract<ProvisionerIncarnationLossDecision, {
-  readonly kind: 'not-found' | 'not-process-bound' | 'incarnation-mismatch' | 'allocated';
-}> | null;
-/**
- * Evaluate registration after reachability, preserving replay before busy refusal.
- * An orphaned runtime probe may be reclaimed; a workload operation may not.
- * @param control - Current decoded control state, not modified by this function.
- * @param input - Runtime registration being considered.
- * @returns A non-write decision, or null to attempt the realization's guarded registration.
- */
-declare function evaluateRuntimeRegistration(control: AttemptControlState, input: RegisterRuntimeInput): Exclude<RuntimeRegistrationDecision, {
-  readonly kind: 'registered';
-}> | null;
-/**
- * Evaluate admission after reachability: replay, busy, gate, readiness, generation, then Preparation.
- * Probe operations are admitted before readiness because they establish that proof.
- * @param control - Current decoded control state, not modified by this function.
- * @param input - Operation admission being considered.
- * @param fallbackAdmittedAt - Realization-supplied instant for a duplicate missing its stored instant.
- * @param execution - Frozen assignment and Preparation receipts read with the control state.
- * @returns A non-write decision, or null to attempt the realization's guarded admission.
- */
-declare function evaluateOperationAdmission(control: AttemptControlState, input: AdmitOperationInput, fallbackAdmittedAt: string, execution: AttemptExecutionState): Exclude<OperationAdmissionDecision, {
-  readonly kind: 'admitted';
-}> | null;
-/**
- * Evaluate successful Preparation, retaining historical replay before current-runtime fences.
- * A null decision permits only a guarded write that saves the receipt and frees the slot together.
- * @param reachability - Coherent owner, allocation and lifecycle facts.
- * @param control - Current operation and runtime state.
- * @param execution - Frozen instruction and retained Preparation history.
- * @param input - Owner-scoped successful Preparation report.
- * @returns A historical duplicate or refusal, or null to atomically accept the result.
- */
-declare function evaluatePreparationReport(reachability: AttemptReachability, control: AttemptControlState, execution: AttemptExecutionState, input: ReportOperationInput): Exclude<OperationReportDecision, {
-  readonly kind: 'accepted';
-}> | null;
-/**
- * Evaluate completion after presence and settlement checks, without owner or allocation fences.
- * A replay is recognized even after its active slot has been cleared or reused.
- * @param control - Current decoded control state, not modified by this function.
- * @param input - Operation completion being considered.
- * @returns A non-write decision, or null to attempt the realization's guarded completion.
- */
-declare function evaluateOperationCompletion(control: AttemptControlState, input: CompleteOperationInput): Exclude<OperationCompletionDecision, {
-  readonly kind: 'completed';
-}> | null;
-/**
- * Evaluate readiness after reachability: generation fence, replay, then busy refusal.
- * @param control - Current decoded control state, not modified by this function.
- * @param input - Runtime readiness report being considered.
- * @returns A non-write decision, or null to attempt the realization's guarded readiness write.
- */
-declare function evaluateRuntimeReadiness(control: AttemptControlState, input: MarkRuntimeReadyInput): Exclude<RuntimeReadinessDecision, {
-  readonly kind: 'ready';
-}> | null;
-//#endregion
 //#region subsystems/workflow-engine/src/execution-attempt-repository.d.ts
 /**
  * Ordered constant array of every execution attempt lifecycle status.
@@ -747,20 +908,6 @@ declare function sameAllocationRef(stored: ProviderAllocationRef, candidate: Pro
  * workflow-storage lookup keys keep plain `string`.
  */
 type ExecutionOwnerId = string;
-/** A durable request to stop an attempt, never evidence that it stopped. */
-interface ExecutionAttemptCancellationIntent {
-  /** First accepted request time, preserved across duplicate requests and controller handoff. */
-  readonly requestedAt: string;
-  /** Optional owner-supplied explanation. */
-  readonly reason?: string;
-}
-/** Owner-scoped cancellation of attempts that exist when the request commits. */
-interface RequestExecutionCancellationInput {
-  /** Owner authorizing the cancellation of its existing attempts. */
-  readonly executionId: ExecutionOwnerId;
-  /** Explanation retained only when this is the first request for an attempt. */
-  readonly reason?: string;
-}
 /**
  * Compare two durable outcome texts as values.
  *
@@ -1263,52 +1410,6 @@ interface BeginProvisioningInput {
   /** ISO-8601 deadline for the initial lease. */
   readonly leaseExpiresAt: string;
 }
-/**
- * Input for committing a terminal outcome to an attempt.
- *
- * The repository makes the durable accept/duplicate/conflict/fence decision
- * and returns the canonical outcome for convergence. Outcome commitment
- * carries no claim: a worker's answer never depends on who currently owns
- * the attempt's provider operation.
- * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
- */
-interface ExecutionAttemptOutcomeCommit<TOutcome> {
-  /** Authority-created attempt identifier. */
-  readonly executionAttemptId: string;
-  /** Owner identifier the attempt belongs to. */
-  readonly executionId: ExecutionOwnerId;
-  /**
-   * The rendering to commit, from
-   * {@link ExecutionAttemptRepository.canonicalizeOutcome}.
-   *
-   * A rendering rather than a raw outcome so the value a caller validated and
-   * the value that becomes durable are the same one: the caller renders the
-   * submission once and never reads its own object again.
-   */
-  readonly result: DurableOutcome<TOutcome>;
-  /** Runtime correlation checked atomically for a fresh commit; owner-only paths may omit it. */
-  readonly runtimeFence?: RuntimeOutcomeFence;
-}
-/** Runtime and operation expected to remain current when an outcome becomes durable. */
-interface RuntimeOutcomeFence {
-  /** Registered runtime generation that produced the result. */
-  readonly runtimeGeneration: number;
-  /** Admitted operation, or null for a startup failure before any operation. */
-  readonly operationId: string | null;
-}
-/** A runtime result lost its execution slot before commit; the attempt remains available to its current runtime. */
-declare class RuntimeOutcomeFenceMismatchError extends Error {
-  constructor();
-}
-/**
- * Require a fresh runtime outcome to belong to the coherently read execution slot.
- * Repositories call this after canonical replay/settlement decisions and repeat its
- * predicates in the committing write. A mismatch must not settle the attempt's waiter.
- * @param control - Current runtime and operation facts.
- * @param fence - Expected runtime slot, absent for owner-only outcome submission.
- * @throws RuntimeOutcomeFenceMismatchError when the originating runtime slot changed.
- */
-declare function assertRuntimeOutcomeFence(control: AttemptControlState, fence: RuntimeOutcomeFence | undefined): void;
 /** Input for recording an allocation reference against a held operation. */
 interface RecordAllocationInput {
   /** Claim authorizing the record. */
@@ -1645,44 +1746,6 @@ type PendingAttemptAbandonmentDecision = {
 } | {
   readonly kind: 'fenced';
 };
-/**
- * Durable outcome decision returned by {@link ExecutionAttemptRepository.commitOutcome}.
- *
- * - `accepted`: the outcome was committed as canonical for the first time.
- *   The stored text decoded is reported, never the caller's copy of it.
- * - `duplicate`: an outcome whose durable text {@link sameDurableOutcome}
- *   judges identical to the committed one was submitted again; this is a
- *   replay. The committed outcome is reported, never the caller's copy of it.
- * - `conflict`: the attempt already reached a different terminal state — either
- *   a different committed outcome, or a competing terminal transition that
- *   settled it without one.
- * - `fenced`: the attempt is no longer the active attempt for this execution.
- *
- * Both settling kinds carry `text`: the durable text the attempt holds for
- * this outcome. For `accepted` that is the text the commit just wrote; for
- * `duplicate` it is the text the earlier commit wrote, which is not
- * necessarily the retry's own rendering — {@link sameDurableOutcome} judges
- * two texts the same outcome while member order, and anything else a codec
- * may render differently, still differs between them. A caller that needs a
- * copy of the committed outcome nobody else has held decodes this text
- * through {@link ExecutionAttemptRepository.decodeOutcome}; decoding its own
- * submission's text instead would hand out the retry's representation rather
- * than the committed one.
- * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
- */
-type ExecutionAttemptOutcomeDecision<TOutcome> = {
-  readonly kind: 'accepted';
-  readonly outcome: TOutcome;
-  readonly text: string;
-} | {
-  readonly kind: 'duplicate';
-  readonly outcome: TOutcome;
-  readonly text: string;
-} | {
-  readonly kind: 'conflict';
-} | {
-  readonly kind: 'fenced';
-};
 /**
  * Durable decision for registering a runtime incarnation as an attempt's
  * endpoint.
@@ -2034,12 +2097,26 @@ type RuntimeReadinessDecision = {
  * @typeParam TOutcome - Owner-specific outcome type committed per attempt.
  */
 interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepository<TOutcome> {
+  /**
+   * Atomically accept an owner's exact-attempt Cancel and close its operation start gate.
+   * Pending and historical attempts remain eligible for monotone cleanup; this grants no
+   * authority to reopen them, rewrite their outcomes or settle their owner. No runtime
+   * registration, allocation or provider claim is required. Owner mismatch is not-found.
+   * The first request establishes revision one, time and reason. Reusing its key with a
+   * different reason conflicts; every other request replays the original winner. Losing
+   * keys are not accepted commands and are not recorded in a separate request history.
+   * @param input - Trusted owner, exact attempt, stable request key and optional reason.
+   * @returns Detached winning receipt or a refusal without mutation.
+   */
+  requestAttemptCancellation(input: RequestAttemptCancellationInput): Promise<ExecutionAttemptCancellationDecision>;
   /**
    * Persist first-wins cancellation intent and close operation start gates atomically
    * for every existing attempt of this owner, including historical allocations.
    * This does not settle an attempt or confirm provider termination. The owner must
    * prevent later attempts after cancellation; this port does not install a permanent
-   * owner-wide creation fence. Repeated requests preserve the first time and reason.
+   * owner-wide creation fence. One opaque request key is generated per fanout call;
+   * each target uses the exact-attempt cancellation decision inside the same transaction.
+   * Repeated requests preserve the first key, revision, time and reason.
    * @param input - Owner identity and optional explanation, snapshotted before awaiting.
    */
   requestCancellation(input: RequestExecutionCancellationInput): Promise<void>;
@@ -2479,6 +2556,13 @@ interface ExecutionAttemptRepository<TOutcome> extends OwnerRequestRecoveryRepos
    * `result.text` for `accepted`, and the stored text for `duplicate` — the
    * record's own, not the submission's, because the two are the same outcome
    * without being the same text.
+   *
+   * The first accepted commit stores its control observation in the same transaction:
+   * revision zero with no cancellation, or the winning cancellation receipt and revision.
+   * This side field never changes the opaque outcome. Duplicate decisions return that
+   * original observation even after a later cleanup Cancel; they do not reread current
+   * cancellation to reinterpret history. Null means an outcome committed before this
+   * observation existed, never a claim that no cancellation had been accepted.
    * @param input - Attempt identity and the rendering to commit.
    * @returns The durable decision with the canonical outcome when applicable.
    */
@@ -2603,4 +2687,4 @@ interface ExecutionAttemptRecoveryOperations {
   listOpenProviderOperations(input: ListOpenProviderOperationsInput): Promise<readonly OpenProviderOperationRecord[]>;
 }
 //#endregion
-export { decodeDurableOutcome as $, MarkRuntimeReadyInput as A, RecordProviderOperationUncertaintyInput as At, RecordAllocationTerminatedInput as B, readAttemptSettlementSnapshot as Bt, ExecutionAttemptRecoveryOperations as C, ProviderOperationLeasePolicy as Ct, ExecutionOwnerId as D, ProviderOperationOwnershipRecord as Dt, ExecutionAttemptStatus as E, ProviderOperationObligation as Et, PendingAttemptAbandonmentDecision as F, AttemptSettlementSnapshot as Ft, RegisterRuntimeInput as G, RecordProvisionerIncarnationLostInput as H, snapshotEnsureExecutionAttemptInput as Ht, PreparationReceipt as I, EnsureExecutionAttemptDecision as It, RuntimeOutcomeFence as J, ReportOperationInput as K, ProvisioningClaimDecision as L, EnsureExecutionAttemptInput as Lt, OperationCompletionDecision as M, TakeOverProviderOperationInput as Mt, OperationReportDecision as N, isProviderOperationResolved as Nt, GetInstructionInput as O, ProvisionerIncarnationLossDecision as Ot, OutcomeCodec as P, AttemptSettlementRead as Pt, assertRuntimeOutcomeFence as Q, ReadBootstrapStartStateInput as R, EnsureExecutionAttemptPersistenceInput as Rt, ExecutionAttemptRecord as S, ProviderOperationCompletionDecision as St, ExecutionAttemptSettlementKind as T, ProviderOperationMutationDecision as Tt, RecordProvisioningAbsentInput as U, snapshotEnsureExecutionAttemptPersistenceInput as Ut, RecordInfrastructureFailureInput as V, replayEnsuredAttempt as Vt, RecoverableAttemptRecord as W, snapshotReadAttemptSettlementInput as Wt, RuntimeReadinessDecision as X, RuntimeOutcomeFenceMismatchError as Y, RuntimeRegistrationDecision as Z, EXECUTION_ATTEMPT_STATUSES as _, OpenProviderOperationRecord as _t, AllocationRefEvolutionDecision as a, evaluateAttemptReachability as at, ExecutionAttemptOutcomeCommit as b, ProviderOperationClaim as bt, AttemptExecutionState as c, evaluatePreparationReport as ct, BootstrapStartState as d, evaluateRuntimeRegistration as dt, durableOutcome as et, CompleteOperationInput as f, CompleteProviderOperationInput as ft, EXECUTION_ATTEMPT_SETTLEMENT_KINDS as g, ListOpenProviderOperationsInput as gt, DurableOutcome as h, InitialProviderOperationClaimContextSource as ht, AllocationRefEvolution as i, AttemptReachabilityDecision as it, OperationAdmissionDecision as j, RenewProviderOperationClaimInput as jt, InfrastructureFailureDecision as k, ProvisioningAbsenceDecision as kt, AttemptOperationStartGate as l, evaluateProvisionerIncarnationLoss as lt, DuplicateExecutionAttemptError as m, InitialProviderOperationClaimContext as mt, AdmitOperationInput as n, sameDurableOutcome as nt, AllocationTerminationDecision as o, evaluateOperationAdmission as ot, DiscoveredAllocationDecision as p, HandoffProviderOperationInput as pt, RequestExecutionCancellationInput as q, AllocationRecordingDecision as r, AttemptReachability as rt, AttemptControlState as s, evaluateOperationCompletion as st, ATTEMPT_OPERATION_START_GATES as t, sameAllocationRef as tt, BeginProvisioningInput as u, evaluateRuntimeReadiness as ut, ExecutionAttemptCancellationIntent as v, PROVIDER_OPERATION_OBLIGATIONS as vt, ExecutionAttemptRepository as w, ProviderOperationLeaseRenewal as wt, ExecutionAttemptOutcomeDecision as x, ProviderOperationClaimDecision as xt, ExecutionAttemptCreate as y, ProcessBoundProvisionerLossProof as yt, RecordAllocationInput as z, ReadAttemptSettlementInput as zt };
+export { InitialProviderOperationClaimContextSource as $, OperationReportDecision as A, evaluateRuntimeReadiness as At, RecordProvisioningAbsentInput as B, snapshotRequestExecutionCancellationInput as Bt, ExecutionAttemptStatus as C, RuntimeOutcomeFenceMismatchError as Ct, MarkRuntimeReadyInput as D, evaluateOperationCompletion as Dt, InfrastructureFailureDecision as E, evaluateOperationAdmission as Et, ReadBootstrapStartStateInput as F, RequestAttemptCancellationInput as Ft, RuntimeRegistrationDecision as G, EnsureExecutionAttemptPersistenceInput as Gt, RegisterRuntimeInput as H, AttemptSettlementSnapshot as Ht, RecordAllocationInput as I, RequestExecutionCancellationInput as It, sameAllocationRef as J, replayEnsuredAttempt as Jt, decodeDurableOutcome as K, ReadAttemptSettlementInput as Kt, RecordAllocationTerminatedInput as L, evaluateAttemptCancellation as Lt, PendingAttemptAbandonmentDecision as M, AttemptOutcomeControlObservation as Mt, PreparationReceipt as N, ExecutionAttemptCancellationDecision as Nt, OperationAdmissionDecision as O, evaluatePreparationReport as Ot, ProvisioningClaimDecision as P, ExecutionAttemptCancellationIntent as Pt, InitialProviderOperationClaimContext as Q, RecordInfrastructureFailureInput as R, snapshotAttemptOutcomeControl as Rt, ExecutionAttemptSettlementKind as S, RuntimeOutcomeFence as St, GetInstructionInput as T, evaluateAttemptReachability as Tt, ReportOperationInput as U, EnsureExecutionAttemptDecision as Ut, RecoverableAttemptRecord as V, AttemptSettlementRead as Vt, RuntimeReadinessDecision as W, EnsureExecutionAttemptInput as Wt, CompleteProviderOperationInput as X, snapshotEnsureExecutionAttemptPersistenceInput as Xt, sameDurableOutcome as Y, snapshotEnsureExecutionAttemptInput as Yt, HandoffProviderOperationInput as Z, snapshotReadAttemptSettlementInput as Zt, EXECUTION_ATTEMPT_STATUSES as _, isProviderOperationResolved as _t, AllocationRefEvolutionDecision as a, ProviderOperationClaimDecision as at, ExecutionAttemptRecoveryOperations as b, AttemptReachability as bt, AttemptExecutionState as c, ProviderOperationLeaseRenewal as ct, BootstrapStartState as d, ProviderOperationOwnershipRecord as dt, ListOpenProviderOperationsInput as et, CompleteOperationInput as f, ProvisionerIncarnationLossDecision as ft, EXECUTION_ATTEMPT_SETTLEMENT_KINDS as g, TakeOverProviderOperationInput as gt, DurableOutcome as h, RenewProviderOperationClaimInput as ht, AllocationRefEvolution as i, ProviderOperationClaim as it, OutcomeCodec as j, evaluateRuntimeRegistration as jt, OperationCompletionDecision as k, evaluateProvisionerIncarnationLoss as kt, AttemptOperationStartGate as l, ProviderOperationMutationDecision as lt, DuplicateExecutionAttemptError as m, RecordProviderOperationUncertaintyInput as mt, AdmitOperationInput as n, PROVIDER_OPERATION_OBLIGATIONS as nt, AllocationTerminationDecision as o, ProviderOperationCompletionDecision as ot, DiscoveredAllocationDecision as p, ProvisioningAbsenceDecision as pt, durableOutcome as q, readAttemptSettlementSnapshot as qt, AllocationRecordingDecision as r, ProcessBoundProvisionerLossProof as rt, AttemptControlState as s, ProviderOperationLeasePolicy as st, ATTEMPT_OPERATION_START_GATES as t, OpenProviderOperationRecord as tt, BeginProvisioningInput as u, ProviderOperationObligation as ut, ExecutionAttemptCreate as v, ExecutionAttemptOutcomeCommit as vt, ExecutionOwnerId as w, assertRuntimeOutcomeFence as wt, ExecutionAttemptRepository as x, AttemptReachabilityDecision as xt, ExecutionAttemptRecord as y, ExecutionAttemptOutcomeDecision as yt, RecordProvisionerIncarnationLostInput as z, snapshotRequestAttemptCancellationInput as zt };

package/dist/execution-attempt-repository-CWbgCTwA.mjs

@@ -0,0 +1 @@
+import{canonicalStringify as e}from"@makaio/framework/utils";var t=class extends Error{constructor(){super(`Runtime outcome no longer matches the current generation and operation`),this.name=`RuntimeOutcomeFenceMismatchError`}};function n(e,n){if(n!==void 0&&(e.runtimeGeneration!==n.runtimeGeneration||e.activeOperationId!==n.operationId||n.operationId!==null&&e.activeOperationGeneration!==n.runtimeGeneration))throw new t}function r(e){return e.matchesExecution?e.settled?{kind:`resolved`}:e.active?e.allocated?null:{kind:`not-allocated`}:{kind:`fenced`}:{kind:`not-found`}}function i(e,t){return e.executionId===t.executionId?e.allocationLifetime===`provisioner-process-bound`?e.provisionerIncarnationId===null||e.provisionerIncarnationId!==t.proof.provisionerIncarnationId?{kind:`incarnation-mismatch`,provisionerIncarnationId:e.provisionerIncarnationId}:e.allocationRef===null?null:{kind:`allocated`,allocationRef:e.allocationRef}:{kind:`not-process-bound`,allocationLifetime:e.allocationLifetime}:{kind:`not-found`}}function a(e,t){return e.runtimeIncarnationId===t.runtimeIncarnationId?{kind:`duplicate`,runtimeGeneration:e.runtimeGeneration,runtimeReadyAt:e.runtimeReadyAt}:e.activeOperationId!==null&&e.activeOperationKind!==`runtime-probe`?{kind:`operation-active`,operationId:e.activeOperationId}:null}function o(e,t,n,r){if(e.activeOperationId!==null)return e.activeOperationKey===t.admissionKey?{kind:`duplicate`,operationId:e.activeOperationId,runtimeGeneration:e.activeOperationGeneration??e.runtimeGeneration,admittedAt:e.activeOperationAdmittedAt??n}:{kind:`operation-active`,operationId:e.activeOperationId};if(e.operationStartGate===`closed`)return{kind:`gate-closed`};if(t.operationKind!==`runtime-probe`&&e.runtimeReadyAt===null)return{kind:`not-ready`};if(e.runtimeGeneration!==t.runtimeGeneration)return{kind:`stale-generation`,runtimeGeneration:e.runtimeGeneration};let i=r.instruction.workspace!==void 0,a=r.preparationReceipts.some(t=>t.runtimeGeneration===e.runtimeGeneration);if(t.operationKind===`workspace-preparation`){if(!i)return{kind:`preparation-not-required`};if(a)return{kind:`preparation-already-completed`}}return(t.operationKind===`workload-invocation`||t.operationKind===`workflow-run`)&&i&&!a?{kind:`preparation-required`}:null}function s(t,n,i,a){if(!t.matchesExecution)return{kind:`not-found`};let o=i.preparationReceipts.find(e=>e.operationId===a.operationId);if(o!==void 0)return o.runtimeGeneration===a.runtimeGeneration&&e(o.result)===e(a.result)?{kind:`duplicate`,binding:o.result.binding}:{kind:`conflict`};let s=r(t);if(s!==null)return s;if(n.runtimeGeneration!==a.runtimeGeneration)return{kind:`stale-generation`};if(n.activeOperationId===null)return{kind:`no-active-operation`};if(n.activeOperationId!==a.operationId||n.activeOperationKind!==`workspace-preparation`)return{kind:`operation-mismatch`};if(n.activeOperationGeneration!==a.runtimeGeneration)return{kind:`stale-generation`};let c=i.instruction.workspace;if(c===void 0)return{kind:`preparation-not-required`};let l=c.sourceRoots.map(e=>e.id).sort(),u=a.result.binding.sourceRoots.map(e=>e.id).sort();return e(l)===e(u)?null:{kind:`binding-mismatch`}}function c(e,t){return e.lastCompletedOperationId===t.operationId?{kind:`duplicate`}:e.activeOperationId===null?{kind:`not-active`}:e.activeOperationId===t.operationId?e.activeOperationGeneration===t.runtimeGeneration?e.activeOperationKind===`workspace-preparation`||e.activeOperationKind===`workload-invocation`?{kind:`result-required`}:null:{kind:`stale-generation`}:{kind:`mismatch`,activeOperationId:e.activeOperationId}}function l(e,t){return e.runtimeGeneration===t.runtimeGeneration?e.runtimeReadyAt===null?e.activeOperationId===null?null:{kind:`operation-active`,operationId:e.activeOperationId}:{kind:`duplicate`,acceptedAt:e.runtimeReadyAt}:{kind:`stale-generation`}}function u(e,t){if(typeof e!=`string`||e.length===0)throw TypeError(`${t} must be a non-empty string`)}function d(e){let{executionId:t,reason:n}=e;if(u(t,`executionId`),n!==void 0&&typeof n!=`string`)throw TypeError(`reason must be a string when provided`);return{executionId:t,...n===void 0?{}:{reason:n}}}function f(e){let{executionAttemptId:t,requestKey:n}=e;return u(t,`executionAttemptId`),u(n,`requestKey`),{...d(e),executionAttemptId:t,requestKey:n}}function p(e,t,n){return e===null?{kind:`accepted`,intent:{requestKey:t.requestKey,controlRevision:1,requestedAt:n,...t.reason===void 0?{}:{reason:t.reason}}}:e.requestKey===t.requestKey&&e.reason!==t.reason?{kind:`conflict`}:{kind:`replayed`,intent:{...e}}}function m(e){return{controlRevision:e?.controlRevision??0,cancellation:e===null?null:{...e}}}const h=[`pending`,`provisioning`,`allocated`,`settled`],g=[`outcome`,`abandoned`,`infrastructure-failure`],_=[`open`,`closed`];function v(t,n){return e(t)===e(n)}function y(t,n){return e(JSON.parse(t))===e(JSON.parse(n))}function b(e,t){let n=e.serialize(e.parse(t));return{text:n,outcome:x(e,n)}}function x(e,t){return e.parse(JSON.parse(t))}var S=class extends Error{executionAttemptId;constructor(e,t){super(`Execution attempt '${e}' already exists`,t),this.name=`DuplicateExecutionAttemptError`,this.executionAttemptId=e}};export{c as _,x as a,l as b,y as c,f as d,d as f,o as g,r as h,h as i,p as l,n as m,S as n,b as o,t as p,g as r,v as s,_ as t,m as u,s as v,a as x,i as y};

package/dist/{execution-target-B9jZgDQz.mjs → execution-target-_oVNW6Zm.mjs}

@@ -1 +1 @@
-import{A as e,E as t,M as n,N as r,O as i,_ as a,j as o,k as s,m as c,v as l,w as u}from"./schemas-BapfTRqp.mjs";import"./services/execution-target/namespace.mjs";import{z as d}from"zod";import{channelSubject as f,createBusNamespace as p,localSubject as m}from"@makaio/framework/core";const h=`docker-bootstrap`,g=p(`docker`,{"container.spawn":{request:i,response:s},"bootstrap.spawn":f({request:c,response:s}),"bootstrap.getChannelToken":m({request:d.object({}),response:d.object({token:d.string().min(1)})}),"container.stop":{request:n,response:r},"container.status":{request:e,response:o},"container.created":a,"container.started":u,"container.stopped":t,"container.destroyed":l}),_=g.subjects,v=g,y=_;export{_ as a,g as i,y as n,h as r,v as t};
+import{A as e,E as t,M as n,N as r,O as i,_ as a,j as o,k as s,m as c,v as l,w as u}from"./schemas-NYUz8K9Q.mjs";import"./services/execution-target/namespace.mjs";import{z as d}from"zod";import{channelSubject as f,createBusNamespace as p,localSubject as m}from"@makaio/framework/core";const h=`docker-bootstrap`,g=p(`docker`,{"container.spawn":{request:i,response:s},"bootstrap.spawn":f({request:c,response:s}),"bootstrap.getChannelToken":m({request:d.object({}),response:d.object({token:d.string().min(1)})}),"container.stop":{request:n,response:r},"container.status":{request:e,response:o},"container.created":a,"container.started":u,"container.stopped":t,"container.destroyed":l}),_=g.subjects,v=g,y=_;export{_ as a,g as i,y as n,h as r,v as t};