@mnemom/mnemom 0.17.33 → 0.17.34-next.2

package/dist/vendor/shared/durable-contract/owner-verbs.js

@@ -0,0 +1,403 @@
+// GENERATED from shared/durable-contract/src/owner-verbs.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The owner-verb table (BACKBONE amendments 35, 45; C11-R04..R11, R17, R23, R26, R34, R36;
+ * rulings r3 U04, I03; final F04, F06). One total pure function, first match wins:
+ *
+ *   1 machine principal                          -> 403 machine_principal_refused
+ *   2 unknown session or another org             -> 404 agent_not_found (the existing answer)
+ *   3 caller is not the owner                    -> 403 durable_not_owner {owner}
+ *   4 effective terminal (expired included)      -> 410 durable_session_ended {state, state_reason}, every verb
+ *   5 resume of paused(agent_contained) while the agent is still paused -> 409 durable_agent_contained
+ *   6 pause on suspended(identity_mismatch)      -> 409 durable_invalid_transition (done then --new)
+ *   7 no-op repeats                              -> 200 {changed:false}
+ *   8 anything else not in the §3.4 table        -> 409 durable_invalid_transition {from_state, state_reason, verb}
+ *
+ * Applied rows bump the epoch FIRST in the same transaction where they fence (pause, complete,
+ * kill); resume to parked does not bump (the home executor's next claim does). Device-step verbs
+ * (unlock, budget_raise, and resume of paused(agent_contained) once the agent is active) answer
+ * 202 and change nothing until the approval is consumed; with an API-key-only credential they are
+ * refused before any approval row (F06).
+ */
+import { budgetFixKey, stoppedFixKey } from "./fixlines.js";
+import { endedBody, isEffectiveStateConsistent, } from "./states.js";
+import { PER_SESSION_BUDGET_LIMIT_USD } from "./constants.js";
+/**
+ * The owner verbs BACKBONE names for this table: pause, resume, complete, kill, amend. The first
+ * four are decided by `ownerVerbDecision`; `amend` is decided by `amendDecision`, which runs the
+ * same precedence rows 1-6 and then splits by direction (C07-R07, C16-R04): a budget raise goes to
+ * the device-step verb `budget_raise`, any other raise or loosening (goal text edits included, and
+ * a budget raise mixed with one) is 409 durable_amend_raise_refused {field}, and a lowering applies
+ * with journal `charter.amended {change:'lowering'}` and no state transition.
+ */
+export const OWNER_VERBS = ["pause", "resume", "complete", "kill", "amend"];
+/**
+ * The verbs `ownerVerbDecision` takes: the four table verbs plus the two device-step verbs that
+ * run the same precedence (`unlock`, and `budget_raise`, which is amend's raise leg).
+ */
+export const OWNER_TABLE_VERBS = [
+    "pause",
+    "resume",
+    "complete",
+    "kill",
+    "unlock",
+    "budget_raise",
+];
+/** Verbs that run the owner_mutation device step (and so need a signed-in owner, F06). */
+export const DEVICE_STEP_VERBS = [
+    "unlock",
+    "budget_raise",
+];
+export const CALLER_CREDENTIALS = ["jwt", "owner_api_key", "machine"];
+/**
+ * The catalogue fix for a bare row-8 refusal (wave-0 fix ruling 4). Locked rows key on the
+ * EFFECTIVE state through STOPPED_FIX (so a lapsed grant over any stored state gets grant_expired)
+ * and are never null: budget_raise on paused(owner) gets budget_while_paused, every other locked
+ * row-8 the stopped line for its state. A locked row 8 only arises on a stopped effective state;
+ * any other state, or an effective state the stored row cannot derive, throws. Tracked rows keep
+ * their tracked lines.
+ */
+export function invalidTransitionFix(state, reason, effective, durableMode, verb, committedBudgetUsd = 0) {
+    if (durableMode === "tracked") {
+        if (verb === "pause")
+            return "tracked_pause";
+        if (verb === "resume")
+            return "tracked_resume";
+        if (verb === "budget_raise")
+            return "tracked_budget";
+        return null;
+    }
+    if (!isEffectiveStateConsistent(state, reason, effective))
+        throw new RangeError(`effective ${effective} does not derive from ${state}(${String(reason)})`);
+    if (verb === "budget_raise" && effective === "paused" && reason === "owner")
+        return "budget_while_paused";
+    return stoppedFixKey(effective, reason, { committedBudgetUsd });
+}
+/** The (from_state, state_reason) a row-8 body reports: the effective pair for a lapsed grant. */
+export function row8FromPair(state, reason, effective) {
+    return effective === "suspended_grant_expired"
+        ? { from_state: "suspended", state_reason: "grant_expired" }
+        : { from_state: state, state_reason: reason };
+}
+const NOOP_RESUME_STATES = ["running", "resuming", "parked", "detached"];
+const BUDGET_IN_PLACE = ["running", "resuming", "detached", "parked"];
+export function ownerVerbDecision(i) {
+    const row8 = () => ({
+        kind: "refuse",
+        row: 8,
+        status: 409,
+        code: "durable_invalid_transition",
+        fix: invalidTransitionFix(i.state, i.state_reason, i.effective_state, i.durable_mode, i.verb, i.committedBudgetUsd ?? 0),
+        body: i.durable_mode === "tracked"
+            ? { from_state: "tracked", state_reason: null, verb: i.verb }
+            : { ...row8FromPair(i.state, i.state_reason, i.effective_state), verb: i.verb },
+    });
+    const common = precedenceRows1to4(i, i.verb);
+    if (common !== null)
+        return common;
+    const contained = i.state === "paused" && i.state_reason === "agent_contained";
+    // 5
+    if (i.verb === "resume" && contained && i.agentContainment === "paused") {
+        return {
+            kind: "refuse",
+            row: 5,
+            status: 409,
+            code: "durable_agent_contained",
+            fix: "agent_contained",
+            body: { status: "paused" },
+        };
+    }
+    // 6
+    if (i.verb === "pause" && i.state === "suspended" && i.state_reason === "identity_mismatch") {
+        return {
+            kind: "refuse",
+            row: 6,
+            status: 409,
+            code: "durable_invalid_transition",
+            fix: "identity_mismatch",
+            body: { from_state: i.state, state_reason: i.state_reason, verb: i.verb },
+        };
+    }
+    const locked = i.durable_mode === "locked";
+    // 7
+    if (locked && i.verb === "pause" && i.state === "paused")
+        return { kind: "noop", row: 7, status: 200, fix: null };
+    if (locked && i.verb === "resume" && NOOP_RESUME_STATES.includes(i.effective_state)) {
+        return { kind: "noop", row: 7, status: 200, fix: "resume_live" };
+    }
+    // Applied rows and device steps.
+    switch (i.verb) {
+        case "complete":
+            return {
+                kind: "apply",
+                status: 200,
+                to: { state: "completed", state_reason: null },
+                event: "session.completed",
+                epochBump: true,
+                clearsLease: true,
+                resetsResumeFailures: false,
+            };
+        case "kill":
+            return {
+                kind: "apply",
+                status: 200,
+                to: { state: "killed", state_reason: null },
+                event: "session.killed",
+                epochBump: true,
+                clearsLease: true,
+                resetsResumeFailures: false,
+            };
+        case "pause":
+            if (!locked)
+                return row8();
+            return {
+                kind: "apply",
+                status: 200,
+                to: { state: "paused", state_reason: "owner" },
+                event: "session.paused",
+                epochBump: true,
+                clearsLease: true,
+                resetsResumeFailures: false,
+            };
+        case "resume":
+            if (!locked)
+                return row8();
+            if (contained)
+                return deviceStepOr(i, "unpause_contained");
+            if ((i.state === "paused" && i.state_reason === "owner") ||
+                (i.state === "suspended" &&
+                    (i.state_reason === "respawn_failed" ||
+                        i.state_reason === "attestation_failed" ||
+                        i.state_reason === "approval_expired" ||
+                        i.state_reason === "approval_denied"))) {
+                return {
+                    kind: "apply",
+                    status: 200,
+                    to: { state: "parked", state_reason: null },
+                    event: "session.unpaused",
+                    epochBump: false,
+                    clearsLease: false,
+                    resetsResumeFailures: i.state === "suspended",
+                };
+            }
+            return row8();
+        case "unlock":
+            if (!locked)
+                return { kind: "noop", row: 7, status: 200, fix: null };
+            return deviceStepOr(i, "unlock");
+        case "budget_raise": {
+            if (!locked)
+                return row8();
+            const committed = i.committedBudgetUsd;
+            const requested = i.requestedBudgetUsd;
+            if (committed === undefined || requested === undefined || !(requested > committed)) {
+                throw new RangeError("budget_raise needs requested > committed; lowering is amend's path");
+            }
+            const raisable = BUDGET_IN_PLACE.includes(i.effective_state) ||
+                (i.state === "suspended" && i.state_reason === "budget_reached") ||
+                i.effective_state === "suspended_grant_expired";
+            if (!raisable)
+                return row8();
+            if (requested > PER_SESSION_BUDGET_LIMIT_USD) {
+                return {
+                    kind: "refuse",
+                    row: 8,
+                    status: 422,
+                    code: "durable_unsupported",
+                    fix: budgetFixKey(committed, PER_SESSION_BUDGET_LIMIT_USD, "raise"),
+                    body: { feature: "above_limit_raise" },
+                };
+            }
+            return deviceStepOr(i, "budget_raise");
+        }
+    }
+}
+/**
+ * The old contract route (POST /v1/agent/sessions/{cid}/contract) and MCP update_contract on a
+ * LOCKED session (C07-R08; wave-0 fix ruling 1.20, Wassim option 1): a lowering is applied as a
+ * chained charter amend, exactly `amendDecision` (charter.amended {change:'lowering'}); every raise
+ * or loosening is 409 durable_amend_raise_refused {field}. The gateway picks the new charter up
+ * lazily, on the next request (C07-R06); nothing is pushed. Constants only here; the route
+ * behaviour lands in Wave 1.
+ */
+export const OLD_ROUTE_BRANCH = "amend";
+export const OLD_ROUTE_REFRESH = "lazy";
+/** The charter field an amend raises budget through; every other field can only be lowered. */
+export const AMEND_BUDGET_FIELD = "budget";
+/**
+ * The owner `amend` verb (BACKBONE owner-verb table; C07-R07, C16-R04, C11 final F04). First match:
+ *
+ *   rows 1-4    as for every verb (rows 5 and 6 are resume- and pause-only, so never match amend)
+ *   row 7       every change is "equal" (the new value is the current one) -> 200 {changed:false},
+ *               nothing journaled, in either mode; "equal" changes beside others are ignored
+ *   raise-refused  any non-budget raise or loosening, alone or mixed with a budget raise
+ *                  -> 409 durable_amend_raise_refused {field} (the first such field); refused whole
+ *   budget raise   -> exactly the budget_raise row (tracked line, raisable states, 422, device step)
+ *   tracked        a lowering on a tracked session -> 409 durable_invalid_transition with the tracked budget line
+ *   lowering       -> 200 applied in place: charter.amended {change:'lowering'}, no state, epoch or lease change
+ */
+export function amendDecision(i) {
+    if (i.changes.length === 0)
+        throw new RangeError("amend needs at least one change");
+    const common = precedenceRows1to4(i, "amend");
+    if (common !== null)
+        return common;
+    // 7
+    const changes = i.changes.filter((c) => c.direction !== "equal");
+    if (changes.length === 0)
+        return { kind: "noop", row: 7, status: 200, fix: null };
+    const refused = changes.find((c) => c.direction === "loosen" || (c.direction === "raise" && c.field !== AMEND_BUDGET_FIELD));
+    if (refused !== undefined) {
+        return {
+            kind: "refuse",
+            row: 8,
+            status: 409,
+            code: "durable_amend_raise_refused",
+            fix: null,
+            body: { field: refused.field },
+        };
+    }
+    if (changes.some((c) => c.direction === "raise")) {
+        const { changes: _changes, ...rest } = i;
+        return ownerVerbDecision({ ...rest, verb: "budget_raise" });
+    }
+    if (i.durable_mode === "tracked") {
+        return {
+            kind: "refuse",
+            row: 8,
+            status: 409,
+            code: "durable_invalid_transition",
+            fix: "tracked_budget",
+            body: { from_state: "tracked", state_reason: null, verb: "amend" },
+        };
+    }
+    return {
+        kind: "apply",
+        status: 200,
+        to: "unchanged",
+        event: "charter.amended",
+        epochBump: false,
+        clearsLease: false,
+        resetsResumeFailures: false,
+        change: "lowering",
+    };
+}
+/** Rows 1-4, shared by every owner verb (amend included). Null when none matches. */
+function precedenceRows1to4(i, verb) {
+    // 1-3
+    if (i.credential === "machine")
+        return { kind: "refuse", row: 1, status: 403, code: "machine_principal_refused", fix: null };
+    if (!i.visible)
+        return { kind: "refuse", row: 2, status: 404, code: "agent_not_found", fix: null };
+    if (!i.isOwner) {
+        const admin = i.callerIsAdmin && (verb === "pause" || verb === "kill");
+        return {
+            kind: "refuse",
+            row: 3,
+            status: 403,
+            code: "durable_not_owner",
+            fix: admin ? "not_owner_admin" : "not_owner_info",
+        };
+    }
+    // 4
+    const ended = endedBody(i.effective_state, i.state_reason);
+    if (ended !== null) {
+        return {
+            kind: "refuse",
+            row: 4,
+            status: 410,
+            code: "durable_session_ended",
+            fix: ended.state_reason === "agent_killed" ? "agent_killed" : "session_ended",
+            body: { ...ended },
+        };
+    }
+    return null;
+}
+/** A device step needs a signed-in owner (F06): an API-key-only owner gets the login line and nothing changes. */
+function deviceStepOr(i, subject) {
+    if (i.credential === "owner_api_key") {
+        return {
+            kind: "refuse",
+            row: 8,
+            status: 403,
+            code: "durable_session_login_required",
+            fix: "device_step_login",
+        };
+    }
+    return { kind: "device_step", status: 202, subject };
+}
+/**
+ * What an applied owner_mutation does on consume (C11-R07, R17, R36; C16-R29). budget_raise from
+ * suspended(budget_reached) parks; elsewhere it raises the ceiling in place.
+ */
+export function applyDeviceStep(subject, state, reason) {
+    switch (subject) {
+        case "unlock":
+            return {
+                kind: "apply",
+                status: 200,
+                to: { state: "tracked", state_reason: null },
+                event: "session.unlocked",
+                epochBump: true,
+                clearsLease: true,
+                resetsResumeFailures: false,
+            };
+        case "unpause_contained":
+            return {
+                kind: "apply",
+                status: 200,
+                to: { state: "parked", state_reason: null },
+                event: "session.unpaused",
+                epochBump: false,
+                clearsLease: false,
+                resetsResumeFailures: false,
+            };
+        case "budget_raise":
+            return state === "suspended" && reason === "budget_reached"
+                ? {
+                    kind: "apply",
+                    status: 200,
+                    to: { state: "parked", state_reason: null },
+                    event: "charter.amended",
+                    epochBump: false,
+                    clearsLease: false,
+                    resetsResumeFailures: false,
+                    change: "budget_raise",
+                }
+                : {
+                    kind: "apply",
+                    status: 200,
+                    to: "unchanged",
+                    event: "charter.amended",
+                    epochBump: false,
+                    clearsLease: false,
+                    resetsResumeFailures: false,
+                    change: "budget_raise",
+                };
+    }
+}
+/**
+ * Revocation table for pre-bump keys (rulings I03, r2 I01): which transitions REVOKE (revoked_at
+ * set, a pre-bump key then answers 401 durable_key_revoked) versus only fence (revoked_at stays
+ * NULL; the key answers 410 durable_session_ended or 409 durable_lease_fenced). Exactly four
+ * transitions revoke, each in the same transaction as its epoch bump (a fault between the bump
+ * and the revoke rolls back both). The M1 sweep never writes revoked_at.
+ */
+export const KEY_EFFECT_OF_TRANSITION = {
+    pause: "fence",
+    complete: "fence",
+    kill: "fence",
+    expire: "fence",
+    fail: "fence",
+    containment: "fence",
+    unlock: "revoke",
+    claim_supersede: "revoke",
+    executor_revoke: "revoke",
+    respawn_failed_suspend: "revoke",
+};
+/** The four revoking transitions, in ruling order (I03). */
+export const REVOKING_TRANSITIONS = [
+    "claim_supersede",
+    "executor_revoke",
+    "unlock",
+    "respawn_failed_suspend",
+];

package/dist/vendor/shared/durable-contract/paths.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Host paths (BACKBONE C2, C3; amendment 51). Pure functions of the HOME directory and the ids.
+ * Ids are validated so a path never escapes its directory.
+ */
+/** A session or conversation id safe to use as a path segment (the gateway cid rule). */
+export declare const ID_RE: RegExp;
+export declare const DURABLE_DIR = ".mnemom/durable";
+/** The per-conversation proxy lock (flock LOCK_EX|LOCK_NB), a pure function of the conversation id. */
+export declare function proxyLockPath(home: string, conversationId: string): string;
+/** The transcript guard copy or link for a session (C2). */
+export declare function transcriptGuardPath(home: string, sessionId: string): string;
+export declare const TRANSCRIPT_GUARD_MODES: readonly ["link", "copy"];
+/**
+ * The executor state directory and file, HOME-relative (wave-0 fix ruling 1.07; design section 4;
+ * amendment 51). The state file is the ONLY place the executor key may be stored (SECRET_SCOPE
+ * allowance). Directory mode 0700, file mode 0600.
+ */
+export declare const EXECUTOR_STATE_DIR = ".mnemom/durable";
+export declare const EXECUTOR_STATE_FILE = ".mnemom/durable/executor-state.json";
+export declare const EXECUTOR_STATE_DIR_MODE = 448;
+export declare const EXECUTOR_STATE_FILE_MODE = 384;
+/** The absolute executor state file path under `home`. */
+export declare function executorStatePath(home: string): string;

package/dist/vendor/shared/durable-contract/paths.js

@@ -0,0 +1,35 @@
+// GENERATED from shared/durable-contract/src/paths.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * Host paths (BACKBONE C2, C3; amendment 51). Pure functions of the HOME directory and the ids.
+ * Ids are validated so a path never escapes its directory.
+ */
+/** A session or conversation id safe to use as a path segment (the gateway cid rule). */
+export const ID_RE = /^[A-Za-z0-9-]{1,64}$/;
+function checkId(id) {
+    if (!ID_RE.test(id))
+        throw new RangeError(`not a safe id: ${id}`);
+    return id;
+}
+export const DURABLE_DIR = ".mnemom/durable";
+/** The per-conversation proxy lock (flock LOCK_EX|LOCK_NB), a pure function of the conversation id. */
+export function proxyLockPath(home, conversationId) {
+    return `${home}/${DURABLE_DIR}/locks/${checkId(conversationId)}.lock`;
+}
+/** The transcript guard copy or link for a session (C2). */
+export function transcriptGuardPath(home, sessionId) {
+    return `${home}/${DURABLE_DIR}/transcripts/${checkId(sessionId)}.jsonl`;
+}
+export const TRANSCRIPT_GUARD_MODES = ["link", "copy"];
+/**
+ * The executor state directory and file, HOME-relative (wave-0 fix ruling 1.07; design section 4;
+ * amendment 51). The state file is the ONLY place the executor key may be stored (SECRET_SCOPE
+ * allowance). Directory mode 0700, file mode 0600.
+ */
+export const EXECUTOR_STATE_DIR = DURABLE_DIR;
+export const EXECUTOR_STATE_FILE = `${DURABLE_DIR}/executor-state.json`;
+export const EXECUTOR_STATE_DIR_MODE = 0o700;
+export const EXECUTOR_STATE_FILE_MODE = 0o600;
+/** The absolute executor state file path under `home`. */
+export function executorStatePath(home) {
+    return `${home}/${EXECUTOR_STATE_FILE}`;
+}

package/dist/vendor/shared/durable-contract/pure-fn.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The pure exports a case's pure_fn step may call (ruling 32.34; CASE-DSL rule 30). Closed: a
+ * pure_fn step's (module, export) must be listed here, and its input must fit the arity.
+ *
+ * `module` is the specifier cases pass. S1 entries use 'shared/durable-contract'; their `source` is
+ * the S1 file and they carry no sha, because S1 is the freeze. Pre-M1 product entries are pinned at
+ * the merge-base b37bfbf1 by the git blob sha of the file. M1-built product exports join only once
+ * their builder lands them on int and a ruling or spec names them; none is listed today.
+ *
+ * Input contract: arity 1 passes `input` as the single argument. Arity n > 1 requires `input` to be
+ * an array of length n, spread as the positional arguments (pureFnArgs).
+ *
+ * Sorted by (module, export), unique, closed.
+ */
+export interface PureFnExport {
+    readonly module: string;
+    readonly export: string;
+    readonly async: boolean;
+    readonly arity: number;
+    readonly source: string;
+    /** Git blob sha of the product file at the merge-base; absent on S1 entries. */
+    readonly sha?: string;
+}
+export declare const PURE_FN_S1_MODULE = "shared/durable-contract";
+/** The merge-base product entries are pinned at (ruling 32.34). */
+export declare const PURE_FN_PRODUCT_BASE = "b37bfbf14a41a4d8adeed38f89d2dedb01f1bc76";
+export declare const PURE_FN_EXPORTS: readonly PureFnExport[];
+/** A pending M1 export: the PureFnExport shape without sha (ruling 33.01). */
+export type PureFnPending = Omit<PureFnExport, "sha">;
+/**
+ * M1 product exports a pure_fn step may name before their builder lands them (ruling 33.01; rule 30
+ * accepts them, E4 detector D4 tags a row product_missing while the module is absent). When an
+ * entry lands on int it moves to PURE_FN_EXPORTS with its int blob sha. Sorted, unique, closed,
+ * disjoint from PURE_FN_EXPORTS.
+ *
+ * validateSeatSpec (BACKBONE line 153: the daemon RC refusal as a spec-validator unit test):
+ *   input  {raw_spec: object (the spec exactly as the daemon received it, which may carry fields
+ *          outside the closed schema), name: string, launcher_key: 'off' | 'ask' | 'always'}
+ *   output {seat_spec_built: boolean, spawn_requested: boolean,
+ *          refusal: null | {code: 'durable_unsupported', feature: 'remote_control', names: string[],
+ *          fix: string}}
+ * It calls hasRemoteControl on raw_spec before parseLaunchSpec (BACKBONE line 84 order). fix is the
+ * launch_spec_change render for name, with flags = the spec's model/effort flags (remote control
+ * removed) and the launcher suffix for launcher_key.
+ */
+export declare const PURE_FN_M1_PENDING: readonly PureFnPending[];
+/** The positional arguments for a pure_fn call (a PURE_FN_EXPORTS or PURE_FN_M1_PENDING entry) under the input contract; throws on a misfit. */
+export declare function pureFnArgs(arity: number, input: unknown): unknown[];

package/dist/vendor/shared/durable-contract/pure-fn.js

@@ -0,0 +1,89 @@
+// GENERATED from shared/durable-contract/src/pure-fn.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The pure exports a case's pure_fn step may call (ruling 32.34; CASE-DSL rule 30). Closed: a
+ * pure_fn step's (module, export) must be listed here, and its input must fit the arity.
+ *
+ * `module` is the specifier cases pass. S1 entries use 'shared/durable-contract'; their `source` is
+ * the S1 file and they carry no sha, because S1 is the freeze. Pre-M1 product entries are pinned at
+ * the merge-base b37bfbf1 by the git blob sha of the file. M1-built product exports join only once
+ * their builder lands them on int and a ruling or spec names them; none is listed today.
+ *
+ * Input contract: arity 1 passes `input` as the single argument. Arity n > 1 requires `input` to be
+ * an array of length n, spread as the positional arguments (pureFnArgs).
+ *
+ * Sorted by (module, export), unique, closed.
+ */
+export const PURE_FN_S1_MODULE = "shared/durable-contract";
+/** The merge-base product entries are pinned at (ruling 32.34). */
+export const PURE_FN_PRODUCT_BASE = "b37bfbf14a41a4d8adeed38f89d2dedb01f1bc76";
+const s1 = (name, arity, isAsync, file) => Object.freeze({
+    module: PURE_FN_S1_MODULE,
+    export: name,
+    async: isAsync,
+    arity,
+    source: `shared/durable-contract/src/${file}`,
+});
+export const PURE_FN_EXPORTS = Object.freeze([
+    // Pre-M1 product, pinned at b37bfbf1. buildTurnHeader (int cli/src/turn-origin.mjs:139; arity 1,
+    // its second parameter has a default) applies entryOrigin to transcript entries (ruling 33.02).
+    Object.freeze({
+        module: "cli/src/turn-origin.mjs",
+        export: "buildTurnHeader",
+        async: false,
+        arity: 1,
+        source: "cli/src/turn-origin.mjs@b37bfbf1",
+        sha: "980d4401feb44069aa1fd0bc4ebeeffe0a9c58ab",
+    }),
+    // int cli/src/turn-origin.mjs:316.
+    Object.freeze({
+        module: "cli/src/turn-origin.mjs",
+        export: "turnHeaderFor",
+        async: true,
+        arity: 2,
+        source: "cli/src/turn-origin.mjs@b37bfbf1",
+        sha: "980d4401feb44069aa1fd0bc4ebeeffe0a9c58ab",
+    }),
+    s1("admitSweepDigest", 1, true, "admission.ts"),
+    s1("canonicalJson", 1, false, "canonical.ts"),
+    s1("eventHash", 1, true, "events.ts"),
+    s1("formatArm", 1, false, "arm.ts"),
+    s1("isLeaseKey", 1, false, "keys.ts"),
+    s1("normalizeCellId", 1, false, "cell-id.ts"),
+    s1("parseArm", 1, false, "arm.ts"),
+    s1("pluginLockArgv", 1, false, "cli-surface.ts"),
+]);
+/**
+ * M1 product exports a pure_fn step may name before their builder lands them (ruling 33.01; rule 30
+ * accepts them, E4 detector D4 tags a row product_missing while the module is absent). When an
+ * entry lands on int it moves to PURE_FN_EXPORTS with its int blob sha. Sorted, unique, closed,
+ * disjoint from PURE_FN_EXPORTS.
+ *
+ * validateSeatSpec (BACKBONE line 153: the daemon RC refusal as a spec-validator unit test):
+ *   input  {raw_spec: object (the spec exactly as the daemon received it, which may carry fields
+ *          outside the closed schema), name: string, launcher_key: 'off' | 'ask' | 'always'}
+ *   output {seat_spec_built: boolean, spawn_requested: boolean,
+ *          refusal: null | {code: 'durable_unsupported', feature: 'remote_control', names: string[],
+ *          fix: string}}
+ * It calls hasRemoteControl on raw_spec before parseLaunchSpec (BACKBONE line 84 order). fix is the
+ * launch_spec_change render for name, with flags = the spec's model/effort flags (remote control
+ * removed) and the launcher suffix for launcher_key.
+ */
+export const PURE_FN_M1_PENDING = Object.freeze([
+    Object.freeze({
+        module: "cli/src/durable/seat-spec-validator",
+        export: "validateSeatSpec",
+        async: false,
+        arity: 1,
+        source: "BACKBONE line 153; ruling 33.01",
+    }),
+]);
+/** The positional arguments for a pure_fn call (a PURE_FN_EXPORTS or PURE_FN_M1_PENDING entry) under the input contract; throws on a misfit. */
+export function pureFnArgs(arity, input) {
+    if (!Number.isInteger(arity) || arity < 1)
+        throw new RangeError(`bad arity: ${arity}`);
+    if (arity === 1)
+        return [input];
+    if (!Array.isArray(input) || input.length !== arity)
+        throw new RangeError(`arity ${arity} needs an input array of length ${arity}`);
+    return [...input];
+}