@mnemom/mnemom 0.17.33 → 0.17.34-next.2

package/dist/vendor/shared/durable-contract/lock.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Lock preconditions (C02-R01..R27, C02 open question 1; rulings I03, r3 U02, final F06; BACKBONE
+ * A2 lock executor precondition). One order, first failure wins:
+ *
+ *   step              answer on failure                                    external probe
+ *   machine_principal 403 machine_principal_refused                        no
+ *   visible           404 agent_not_found (byte-identical to a random cid) no
+ *   owner             403 durable_not_owner {owner}                        no
+ *   terminal          410 durable_session_ended {state, state_reason}      no
+ *   locked            already locked: equal spec hash -> 200 {changed:false};
+ *                     different -> 422 durable_unsupported {feature:'launch_spec_change'}
+ *   spec              422 durable_unsupported {feature:'remote_control' | 'tool_classes'}
+ *   entitlement       403 durable_lock_not_entitled                        yes (entitlement lookup, schema probe)
+ *   executor          409 durable_no_executor                              yes (executor lookup)
+ *   mfa               403 durable_lock_mfa_required                        yes (IdP user/admin lookup)
+ *   protection        409 durable_lock_branch_unprotected {refusals}       yes (GitHub)
+ *   sharing           409 durable_lock_agent_shared {reason}               no (DB, under the lock-serialising row lock)
+ *
+ * Skipping: steps run strictly in this order and stop at the first non-pass. A later step is not
+ * evaluated, so its probe is never called (no GitHub or IdP traffic after an earlier refusal).
+ * Unavailable: a probe step whose source is down answers 503 durable_precondition_unavailable
+ * {retryable:true} at its own position (earlier refusals still win; later steps are skipped); it is
+ * never read as pass, 'MFA missing', 'unprotected' or 'not entitled'.
+ * Protection is the one step that does not short-circuit inside itself: every pushable repo of the
+ * server-held repo set is checked, and refusals[] names each failing repo (protectionRefusals).
+ */
+import { TOOL_CLASS_VALUES } from "./envelope.js";
+import { type LaunchSpec } from "./spec.js";
+export declare const LOCK_STEPS: readonly ["machine_principal", "visible", "owner", "terminal", "locked", "spec", "entitlement", "executor", "mfa", "protection", "sharing"];
+export type LockStep = (typeof LOCK_STEPS)[number];
+/** Steps that call an external source and may therefore be unavailable. */
+export declare const LOCK_PROBE_STEPS: readonly ["entitlement", "executor", "mfa", "protection"];
+export declare const LOCK_REFUSAL_REASONS: readonly ["unprotected", "unsupported_host"];
+export type LockRefusalReason = (typeof LOCK_REFUSAL_REASONS)[number];
+/** One durable_lock_branch_unprotected refusals[] element. */
+export interface LockRefusalItem {
+    /** "<owner>/<name>" for GitHub; the remote host and path otherwise. */
+    repo: string;
+    reason: LockRefusalReason;
+}
+/**
+ * What a repo looks like to the protection probe. Protected means the default branch is covered by
+ * an active ruleset (enforcement "active"; "evaluate" does not count) or by classic branch protection.
+ */
+export interface RepoProtectionFacts {
+    repo: string;
+    /** The user can push; read-only repos are ignored. */
+    pushable: boolean;
+    /** Only github.com remotes are probed; anything else fails closed. */
+    host: "github" | "other";
+    activeRulesetOnDefault: boolean;
+    classicProtectionOnDefault: boolean;
+}
+/** Every failing pushable repo, sorted by repo; empty means the step passes. */
+export declare function protectionRefusals(repos: readonly RepoProtectionFacts[]): LockRefusalItem[];
+export type LockStepResult = {
+    kind: "pass";
+} | {
+    kind: "noop";
+} | {
+    kind: "refuse";
+    status: number;
+    code: string;
+    body?: Record<string, unknown>;
+} | {
+    kind: "unavailable";
+};
+export type LockDecision = {
+    kind: "lock";
+    evaluated: LockStep[];
+} | {
+    kind: "noop";
+    status: 200;
+    step: LockStep;
+    evaluated: LockStep[];
+} | {
+    kind: "refuse";
+    step: LockStep;
+    status: number;
+    code: string;
+    body?: Record<string, unknown>;
+    evaluated: LockStep[];
+};
+/** Run the steps in order through an injected evaluator; stops at the first non-pass. */
+export declare function runLockPreconditions(evaluate: (step: LockStep) => Promise<LockStepResult>): Promise<LockDecision>;
+/**
+ * The closed own_lock request body. It carries no contract: the goal (text and ceilings) is sealed
+ * by the gateway before lock from a turn's x-mnemom-contract header, and lock commits that seal
+ * (C07-R02 allowed carriers). spec is the LaunchSpec, executor_id this machine's executor uuid,
+ * own_agent the --own-agent flag, tool_classes the optional tool -> class map.
+ */
+export declare const LOCK_BODY_KEYS: readonly ["spec", "executor_id", "own_agent", "tool_classes"];
+export interface LockBody {
+    spec: LaunchSpec;
+    executor_id: string;
+    own_agent?: boolean;
+    tool_classes?: Record<string, (typeof TOOL_CLASS_VALUES)[number]>;
+}
+export type LockBodyResult = {
+    ok: true;
+    body: LockBody;
+} | {
+    ok: false;
+    code: "durable_unsupported";
+    details: {
+        feature: "remote_control" | "tool_classes";
+    };
+} | {
+    ok: false;
+    code: "durable_lock_body_invalid";
+    details: {
+        field: string | null;
+    };
+};
+/**
+ * Validate an own_lock body before any write. First match wins:
+ *   1 a remote-control field anywhere (hasRemoteControl) -> 422 durable_unsupported {feature:'remote_control'}
+ *   2 not a JSON object                                  -> 422 durable_lock_body_invalid {field:null}
+ *   3 a key outside LOCK_BODY_KEYS (contract and limit
+ *     fields included; the first in sorted order)        -> 422 durable_lock_body_invalid {field:<key>}
+ *   4 spec absent or not a LaunchSpec                    -> 422 durable_lock_body_invalid {field:'spec'}
+ *   5 executor_id absent or not a lowercase uuid         -> 422 durable_lock_body_invalid {field:'executor_id'}
+ *   6 own_agent present and not a boolean                -> 422 durable_lock_body_invalid {field:'own_agent'}
+ *   7 tool_classes present and not a tool -> TOOL_CLASS_VALUES map
+ *                                                        -> 422 durable_lock_body_invalid {field:'tool_classes'}
+ *   8 tool_classes naming safe or idempotent             -> 422 durable_unsupported {feature:'tool_classes'}
+ */
+export declare function parseLockBody(raw: unknown): LockBodyResult;

package/dist/vendor/shared/durable-contract/lock.js

@@ -0,0 +1,151 @@
+// GENERATED from shared/durable-contract/src/lock.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * Lock preconditions (C02-R01..R27, C02 open question 1; rulings I03, r3 U02, final F06; BACKBONE
+ * A2 lock executor precondition). One order, first failure wins:
+ *
+ *   step              answer on failure                                    external probe
+ *   machine_principal 403 machine_principal_refused                        no
+ *   visible           404 agent_not_found (byte-identical to a random cid) no
+ *   owner             403 durable_not_owner {owner}                        no
+ *   terminal          410 durable_session_ended {state, state_reason}      no
+ *   locked            already locked: equal spec hash -> 200 {changed:false};
+ *                     different -> 422 durable_unsupported {feature:'launch_spec_change'}
+ *   spec              422 durable_unsupported {feature:'remote_control' | 'tool_classes'}
+ *   entitlement       403 durable_lock_not_entitled                        yes (entitlement lookup, schema probe)
+ *   executor          409 durable_no_executor                              yes (executor lookup)
+ *   mfa               403 durable_lock_mfa_required                        yes (IdP user/admin lookup)
+ *   protection        409 durable_lock_branch_unprotected {refusals}       yes (GitHub)
+ *   sharing           409 durable_lock_agent_shared {reason}               no (DB, under the lock-serialising row lock)
+ *
+ * Skipping: steps run strictly in this order and stop at the first non-pass. A later step is not
+ * evaluated, so its probe is never called (no GitHub or IdP traffic after an earlier refusal).
+ * Unavailable: a probe step whose source is down answers 503 durable_precondition_unavailable
+ * {retryable:true} at its own position (earlier refusals still win; later steps are skipped); it is
+ * never read as pass, 'MFA missing', 'unprotected' or 'not entitled'.
+ * Protection is the one step that does not short-circuit inside itself: every pushable repo of the
+ * server-held repo set is checked, and refusals[] names each failing repo (protectionRefusals).
+ */
+import { UUID_RE } from "./canonical.js";
+import { TOOL_CLASS_VALUES, toolClassesSupportedM1 } from "./envelope.js";
+import { hasRemoteControl, parseLaunchSpec } from "./spec.js";
+export const LOCK_STEPS = [
+    "machine_principal",
+    "visible",
+    "owner",
+    "terminal",
+    "locked",
+    "spec",
+    "entitlement",
+    "executor",
+    "mfa",
+    "protection",
+    "sharing",
+];
+/** Steps that call an external source and may therefore be unavailable. */
+export const LOCK_PROBE_STEPS = [
+    "entitlement",
+    "executor",
+    "mfa",
+    "protection",
+];
+export const LOCK_REFUSAL_REASONS = ["unprotected", "unsupported_host"];
+/** Every failing pushable repo, sorted by repo; empty means the step passes. */
+export function protectionRefusals(repos) {
+    const out = [];
+    for (const r of repos) {
+        if (!r.pushable)
+            continue;
+        if (r.host !== "github")
+            out.push({ repo: r.repo, reason: "unsupported_host" });
+        else if (!r.activeRulesetOnDefault && !r.classicProtectionOnDefault)
+            out.push({ repo: r.repo, reason: "unprotected" });
+    }
+    return out.sort((a, b) => (a.repo < b.repo ? -1 : a.repo > b.repo ? 1 : 0));
+}
+/** Run the steps in order through an injected evaluator; stops at the first non-pass. */
+export async function runLockPreconditions(evaluate) {
+    const evaluated = [];
+    for (const step of LOCK_STEPS) {
+        evaluated.push(step);
+        const r = await evaluate(step);
+        switch (r.kind) {
+            case "pass":
+                continue;
+            case "noop":
+                if (step !== "locked")
+                    throw new RangeError(`only the locked step can no-op, not ${step}`);
+                return { kind: "noop", status: 200, step, evaluated };
+            case "unavailable":
+                if (!LOCK_PROBE_STEPS.includes(step))
+                    throw new RangeError(`${step} has no external source to be unavailable`);
+                return {
+                    kind: "refuse",
+                    step,
+                    status: 503,
+                    code: "durable_precondition_unavailable",
+                    body: { retryable: true },
+                    evaluated,
+                };
+            case "refuse":
+                return { kind: "refuse", step, status: r.status, code: r.code, body: r.body, evaluated };
+        }
+    }
+    return { kind: "lock", evaluated };
+}
+// ---- lock request body (ruling 33.24(1)) ------------------------------------------------------
+/**
+ * The closed own_lock request body. It carries no contract: the goal (text and ceilings) is sealed
+ * by the gateway before lock from a turn's x-mnemom-contract header, and lock commits that seal
+ * (C07-R02 allowed carriers). spec is the LaunchSpec, executor_id this machine's executor uuid,
+ * own_agent the --own-agent flag, tool_classes the optional tool -> class map.
+ */
+export const LOCK_BODY_KEYS = ["spec", "executor_id", "own_agent", "tool_classes"];
+const TOOL_NAME_RE = /^[A-Za-z0-9_:.-]{1,128}$/;
+/**
+ * Validate an own_lock body before any write. First match wins:
+ *   1 a remote-control field anywhere (hasRemoteControl) -> 422 durable_unsupported {feature:'remote_control'}
+ *   2 not a JSON object                                  -> 422 durable_lock_body_invalid {field:null}
+ *   3 a key outside LOCK_BODY_KEYS (contract and limit
+ *     fields included; the first in sorted order)        -> 422 durable_lock_body_invalid {field:<key>}
+ *   4 spec absent or not a LaunchSpec                    -> 422 durable_lock_body_invalid {field:'spec'}
+ *   5 executor_id absent or not a lowercase uuid         -> 422 durable_lock_body_invalid {field:'executor_id'}
+ *   6 own_agent present and not a boolean                -> 422 durable_lock_body_invalid {field:'own_agent'}
+ *   7 tool_classes present and not a tool -> TOOL_CLASS_VALUES map
+ *                                                        -> 422 durable_lock_body_invalid {field:'tool_classes'}
+ *   8 tool_classes naming safe or idempotent             -> 422 durable_unsupported {feature:'tool_classes'}
+ */
+export function parseLockBody(raw) {
+    const invalid = (field) => ({
+        ok: false,
+        code: "durable_lock_body_invalid",
+        details: { field },
+    });
+    if (hasRemoteControl(raw))
+        return { ok: false, code: "durable_unsupported", details: { feature: "remote_control" } };
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return invalid(null);
+    const r = raw;
+    const unknown = Object.keys(r)
+        .filter((k) => !LOCK_BODY_KEYS.includes(k))
+        .sort();
+    if (unknown.length > 0)
+        return invalid(unknown[0]);
+    if (parseLaunchSpec(r.spec) === null)
+        return invalid("spec");
+    if (typeof r.executor_id !== "string" || !UUID_RE.test(r.executor_id))
+        return invalid("executor_id");
+    if ("own_agent" in r && typeof r.own_agent !== "boolean")
+        return invalid("own_agent");
+    if ("tool_classes" in r) {
+        const tc = r.tool_classes;
+        if (tc === null || typeof tc !== "object" || Array.isArray(tc))
+            return invalid("tool_classes");
+        for (const [tool, cls] of Object.entries(tc)) {
+            if (!TOOL_NAME_RE.test(tool) || !TOOL_CLASS_VALUES.includes(cls))
+                return invalid("tool_classes");
+        }
+        if (!toolClassesSupportedM1(tc))
+            return { ok: false, code: "durable_unsupported", details: { feature: "tool_classes" } };
+    }
+    return { ok: true, body: r };
+}

package/dist/vendor/shared/durable-contract/names.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Session-name grammar (C01-R19, C01 open question 4; rulings r2 on `containment`, U20 on `host`).
+ * One pure function decides; the API answers a refusal with 400 invalid_session_name and the CLI
+ * refuses before any spawn.
+ *
+ * Normalisation (applied before every check, and the stored form): trim leading and trailing
+ * whitespace, then Unicode NFC. Case is kept as typed; names compare by exact code points.
+ * Refusals, first match wins:
+ *   empty         nothing left after normalisation
+ *   too_long      more than SESSION_NAME_MAX_CHARS code points
+ *   control       NUL, any other C0 control, DEL, any C1 control, or U+2028 / U+2029
+ *   bidi          a bidi override or isolate (U+061C, U+200E, U+200F, U+202A..U+202E, U+2066..U+2069)
+ *   markup        contains "<mnemom-" (any case): the injected-block prefix the gateway strips
+ *   leading_dash  starts with "-": the CLI would read it as a flag
+ *   reserved      equals a RESERVED_SESSION_VERBS word, compared case-insensitively, so a session
+ *                 can never shadow a verb or a fix line (`host`, `containment` included)
+ */
+export declare const SESSION_NAME_MAX_CHARS = 64;
+export declare const RESERVED_SESSION_VERBS: readonly ["sessions", "show", "setup", "doctor", "config", "list", "claim", "move", "export", "help", "invite", "lock", "done", "kill", "pause", "resume", "amend", "host", "containment"];
+export declare const SESSION_NAME_REFUSALS: readonly ["empty", "too_long", "control", "bidi", "markup", "leading_dash", "reserved"];
+export type SessionNameRefusal = (typeof SESSION_NAME_REFUSALS)[number];
+export declare function normalizeSessionName(raw: string): string;
+/** The first refusal class for a raw name, or null when the name is acceptable. */
+export declare function sessionNameRefusal(raw: string): SessionNameRefusal | null;
+export declare function isValidSessionName(raw: string): boolean;

package/dist/vendor/shared/durable-contract/names.js

@@ -0,0 +1,78 @@
+// GENERATED from shared/durable-contract/src/names.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * Session-name grammar (C01-R19, C01 open question 4; rulings r2 on `containment`, U20 on `host`).
+ * One pure function decides; the API answers a refusal with 400 invalid_session_name and the CLI
+ * refuses before any spawn.
+ *
+ * Normalisation (applied before every check, and the stored form): trim leading and trailing
+ * whitespace, then Unicode NFC. Case is kept as typed; names compare by exact code points.
+ * Refusals, first match wins:
+ *   empty         nothing left after normalisation
+ *   too_long      more than SESSION_NAME_MAX_CHARS code points
+ *   control       NUL, any other C0 control, DEL, any C1 control, or U+2028 / U+2029
+ *   bidi          a bidi override or isolate (U+061C, U+200E, U+200F, U+202A..U+202E, U+2066..U+2069)
+ *   markup        contains "<mnemom-" (any case): the injected-block prefix the gateway strips
+ *   leading_dash  starts with "-": the CLI would read it as a flag
+ *   reserved      equals a RESERVED_SESSION_VERBS word, compared case-insensitively, so a session
+ *                 can never shadow a verb or a fix line (`host`, `containment` included)
+ */
+export const SESSION_NAME_MAX_CHARS = 64;
+export const RESERVED_SESSION_VERBS = [
+    "sessions",
+    "show",
+    "setup",
+    "doctor",
+    "config",
+    "list",
+    "claim",
+    "move",
+    "export",
+    "help",
+    "invite",
+    "lock",
+    "done",
+    "kill",
+    "pause",
+    "resume",
+    "amend",
+    "host",
+    "containment",
+];
+export const SESSION_NAME_REFUSALS = [
+    "empty",
+    "too_long",
+    "control",
+    "bidi",
+    "markup",
+    "leading_dash",
+    "reserved",
+];
+// eslint-disable-next-line no-control-regex
+const CONTROL_RE = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+const BIDI_RE = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/;
+const MARKUP = "<mnemom-";
+export function normalizeSessionName(raw) {
+    return raw.trim().normalize("NFC");
+}
+/** The first refusal class for a raw name, or null when the name is acceptable. */
+export function sessionNameRefusal(raw) {
+    const name = normalizeSessionName(raw);
+    if (name.length === 0)
+        return "empty";
+    if ([...name].length > SESSION_NAME_MAX_CHARS)
+        return "too_long";
+    if (CONTROL_RE.test(name))
+        return "control";
+    if (BIDI_RE.test(name))
+        return "bidi";
+    if (name.toLowerCase().includes(MARKUP))
+        return "markup";
+    if (name.startsWith("-"))
+        return "leading_dash";
+    if (RESERVED_SESSION_VERBS.includes(name.toLowerCase()))
+        return "reserved";
+    return null;
+}
+export function isValidSessionName(raw) {
+    return sessionNameRefusal(raw) === null;
+}

package/dist/vendor/shared/durable-contract/owner-verbs.d.ts

@@ -0,0 +1,175 @@
+/**
+ * The owner-verb table (BACKBONE amendments 35, 45; C11-R04..R11, R17, R23, R26, R34, R36;
+ * rulings r3 U04, I03; final F04, F06). One total pure function, first match wins:
+ *
+ *   1 machine principal                          -> 403 machine_principal_refused
+ *   2 unknown session or another org             -> 404 agent_not_found (the existing answer)
+ *   3 caller is not the owner                    -> 403 durable_not_owner {owner}
+ *   4 effective terminal (expired included)      -> 410 durable_session_ended {state, state_reason}, every verb
+ *   5 resume of paused(agent_contained) while the agent is still paused -> 409 durable_agent_contained
+ *   6 pause on suspended(identity_mismatch)      -> 409 durable_invalid_transition (done then --new)
+ *   7 no-op repeats                              -> 200 {changed:false}
+ *   8 anything else not in the §3.4 table        -> 409 durable_invalid_transition {from_state, state_reason, verb}
+ *
+ * Applied rows bump the epoch FIRST in the same transaction where they fence (pause, complete,
+ * kill); resume to parked does not bump (the home executor's next claim does). Device-step verbs
+ * (unlock, budget_raise, and resume of paused(agent_contained) once the agent is active) answer
+ * 202 and change nothing until the approval is consumed; with an API-key-only credential they are
+ * refused before any approval row (F06).
+ */
+import type { DurableCode } from "./codes.js";
+import { type FixKey } from "./fixlines.js";
+import type { DurableEventKind } from "./events.js";
+import { type DurableMode, type EffectiveState, type SessionState, type StateReason } from "./states.js";
+/**
+ * The owner verbs BACKBONE names for this table: pause, resume, complete, kill, amend. The first
+ * four are decided by `ownerVerbDecision`; `amend` is decided by `amendDecision`, which runs the
+ * same precedence rows 1-6 and then splits by direction (C07-R07, C16-R04): a budget raise goes to
+ * the device-step verb `budget_raise`, any other raise or loosening (goal text edits included, and
+ * a budget raise mixed with one) is 409 durable_amend_raise_refused {field}, and a lowering applies
+ * with journal `charter.amended {change:'lowering'}` and no state transition.
+ */
+export declare const OWNER_VERBS: readonly ["pause", "resume", "complete", "kill", "amend"];
+export type OwnerVerb = (typeof OWNER_VERBS)[number];
+/**
+ * The verbs `ownerVerbDecision` takes: the four table verbs plus the two device-step verbs that
+ * run the same precedence (`unlock`, and `budget_raise`, which is amend's raise leg).
+ */
+export declare const OWNER_TABLE_VERBS: readonly ["pause", "resume", "complete", "kill", "unlock", "budget_raise"];
+export type OwnerTableVerb = (typeof OWNER_TABLE_VERBS)[number];
+/** Verbs that run the owner_mutation device step (and so need a signed-in owner, F06). */
+export declare const DEVICE_STEP_VERBS: readonly ["unlock", "budget_raise"];
+export declare const CALLER_CREDENTIALS: readonly ["jwt", "owner_api_key", "machine"];
+export type CallerCredential = (typeof CALLER_CREDENTIALS)[number];
+export interface OwnerVerbInput {
+    verb: OwnerTableVerb;
+    credential: CallerCredential;
+    /** The session exists and is in the caller's org. */
+    visible: boolean;
+    /** The caller is the session's created_by. */
+    isOwner: boolean;
+    /** The caller is an org admin (only used for the durable_not_owner fix). */
+    callerIsAdmin: boolean;
+    durable_mode: DurableMode;
+    state: SessionState;
+    state_reason: StateReason | null;
+    effective_state: EffectiveState;
+    /** agents.containment_status of the session's agent. */
+    agentContainment: "active" | "paused" | "killed";
+    /** budget_raise only: the committed budget and the requested one (requested > committed; lowering is amend's). */
+    committedBudgetUsd?: number;
+    requestedBudgetUsd?: number;
+}
+export type OwnerVerbDecision = {
+    kind: "refuse";
+    row: 1 | 2 | 3 | 4 | 5 | 6 | 8;
+    status: number;
+    code: DurableCode | "agent_not_found";
+    fix: FixKey | null;
+    body?: Record<string, unknown>;
+} | {
+    kind: "noop";
+    row: 7;
+    status: 200;
+    fix: FixKey | null;
+} | {
+    kind: "device_step";
+    status: 202;
+    subject: "unlock" | "unpause_contained" | "budget_raise";
+} | {
+    kind: "apply";
+    status: 200;
+    to: {
+        state: SessionState | "tracked";
+        state_reason: StateReason | null;
+    } | "unchanged";
+    event: DurableEventKind | null;
+    epochBump: boolean;
+    /** Lease nonce, executor and attach_until cleared; earlier-epoch keys fenced (revoked_at stays NULL). */
+    clearsLease: boolean;
+    /** resume_failures := 0 in the same transaction (owner resume from suspended(respawn_failed|attestation_failed), BACKBONE claim rules, C20). */
+    resetsResumeFailures: boolean;
+    /** refs.change of a charter.amended event. */
+    change?: "budget_raise" | "lowering";
+};
+/**
+ * The catalogue fix for a bare row-8 refusal (wave-0 fix ruling 4). Locked rows key on the
+ * EFFECTIVE state through STOPPED_FIX (so a lapsed grant over any stored state gets grant_expired)
+ * and are never null: budget_raise on paused(owner) gets budget_while_paused, every other locked
+ * row-8 the stopped line for its state. A locked row 8 only arises on a stopped effective state;
+ * any other state, or an effective state the stored row cannot derive, throws. Tracked rows keep
+ * their tracked lines.
+ */
+export declare function invalidTransitionFix(state: SessionState, reason: StateReason | null, effective: EffectiveState, durableMode: DurableMode, verb: OwnerTableVerb, committedBudgetUsd?: number): FixKey | null;
+/** The (from_state, state_reason) a row-8 body reports: the effective pair for a lapsed grant. */
+export declare function row8FromPair(state: SessionState, reason: StateReason | null, effective: EffectiveState): {
+    from_state: SessionState;
+    state_reason: StateReason | null;
+};
+export declare function ownerVerbDecision(i: OwnerVerbInput): OwnerVerbDecision;
+/**
+ * The old contract route (POST /v1/agent/sessions/{cid}/contract) and MCP update_contract on a
+ * LOCKED session (C07-R08; wave-0 fix ruling 1.20, Wassim option 1): a lowering is applied as a
+ * chained charter amend, exactly `amendDecision` (charter.amended {change:'lowering'}); every raise
+ * or loosening is 409 durable_amend_raise_refused {field}. The gateway picks the new charter up
+ * lazily, on the next request (C07-R06); nothing is pushed. Constants only here; the route
+ * behaviour lands in Wave 1.
+ */
+export declare const OLD_ROUTE_BRANCH: "amend";
+export declare const OLD_ROUTE_REFRESH: "lazy";
+/** The charter field an amend raises budget through; every other field can only be lowered. */
+export declare const AMEND_BUDGET_FIELD = "budget";
+/**
+ * One field an amend names, with its direction ("loosen" covers goal-text edits and widened paths;
+ * "equal" is a field set to the value it already has).
+ */
+export interface AmendChange {
+    field: string;
+    direction: "raise" | "lower" | "loosen" | "equal";
+}
+export interface AmendInput extends Omit<OwnerVerbInput, "verb"> {
+    /** The fields this amend changes; at least one. A budget raise also needs committed/requestedBudgetUsd. */
+    changes: readonly AmendChange[];
+}
+/**
+ * The owner `amend` verb (BACKBONE owner-verb table; C07-R07, C16-R04, C11 final F04). First match:
+ *
+ *   rows 1-4    as for every verb (rows 5 and 6 are resume- and pause-only, so never match amend)
+ *   row 7       every change is "equal" (the new value is the current one) -> 200 {changed:false},
+ *               nothing journaled, in either mode; "equal" changes beside others are ignored
+ *   raise-refused  any non-budget raise or loosening, alone or mixed with a budget raise
+ *                  -> 409 durable_amend_raise_refused {field} (the first such field); refused whole
+ *   budget raise   -> exactly the budget_raise row (tracked line, raisable states, 422, device step)
+ *   tracked        a lowering on a tracked session -> 409 durable_invalid_transition with the tracked budget line
+ *   lowering       -> 200 applied in place: charter.amended {change:'lowering'}, no state, epoch or lease change
+ */
+export declare function amendDecision(i: AmendInput): OwnerVerbDecision;
+/**
+ * What an applied owner_mutation does on consume (C11-R07, R17, R36; C16-R29). budget_raise from
+ * suspended(budget_reached) parks; elsewhere it raises the ceiling in place.
+ */
+export declare function applyDeviceStep(subject: "unlock" | "unpause_contained" | "budget_raise", state: SessionState, reason: StateReason | null): Extract<OwnerVerbDecision, {
+    kind: "apply";
+}>;
+/**
+ * Revocation table for pre-bump keys (rulings I03, r2 I01): which transitions REVOKE (revoked_at
+ * set, a pre-bump key then answers 401 durable_key_revoked) versus only fence (revoked_at stays
+ * NULL; the key answers 410 durable_session_ended or 409 durable_lease_fenced). Exactly four
+ * transitions revoke, each in the same transaction as its epoch bump (a fault between the bump
+ * and the revoke rolls back both). The M1 sweep never writes revoked_at.
+ */
+export declare const KEY_EFFECT_OF_TRANSITION: {
+    readonly pause: "fence";
+    readonly complete: "fence";
+    readonly kill: "fence";
+    readonly expire: "fence";
+    readonly fail: "fence";
+    readonly containment: "fence";
+    readonly unlock: "revoke";
+    readonly claim_supersede: "revoke";
+    readonly executor_revoke: "revoke";
+    readonly respawn_failed_suspend: "revoke";
+};
+export type KeyTransition = keyof typeof KEY_EFFECT_OF_TRANSITION;
+/** The four revoking transitions, in ruling order (I03). */
+export declare const REVOKING_TRANSITIONS: readonly ["claim_supersede", "executor_revoke", "unlock", "respawn_failed_suspend"];