@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.2

package/dist/vendor/shared/durable-contract/codes.js

@@ -0,0 +1,475 @@
+// GENERATED from shared/durable-contract/src/codes.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * Durable error codes, their HTTP statuses and their closed body fields (BACKBONE codes list,
+ * amendments; C06, C10, C11, C16, C19). The body is the shipped error envelope (ruling 14; mnemom-api
+ * src/http-errors.ts buildErrorBody, which the gateway uses too):
+ * `{error: {code: <code>, message, details?: {fix?, ...closed fields}}}`; durableErrorBody builds it.
+ * The RFC 8628 poll endpoints (ENROLL_POLL_ERRORS, the OAuth device token poll) keep
+ * `{error: <string>}`.
+ */
+import { fieldOk } from "./admission.js";
+import { PARKED_ONLY_WAIT_REASONS, STATE_REASONS, TERMINAL_STATES, } from "./states.js";
+export const CLAIM_UNAVAILABLE_CAUSES = [
+    "schema",
+    "arm_probe",
+    "entitlement_lookup",
+    "protection_probe",
+    "guard",
+    /** A pool claim with no valid registry default cap (ruling 34.05.1 (3)). */
+    "lease_cap_config",
+];
+export const UNSUPPORTED_FEATURES = [
+    "tool_classes",
+    "launch_spec_change",
+    "above_limit_raise",
+    "remote_control",
+];
+export const CWD_KINDS = ["subdirectory", "not_git", "symlink_transcript"];
+/** Attestation check `cwd` (spawn-time) causes. */
+export const CWD_CHECK_CAUSES = ["missing", "not_toplevel"];
+/** Claim attestation checks in M1 order (3 observe-only; 6, 9, 13 cut). `cwd` is the daemon's spawn-time check. */
+export const ATTESTATION_CHECKS_M1 = [
+    "1",
+    "2",
+    "3",
+    "4",
+    "5",
+    "7",
+    "8",
+    "10",
+    "11",
+    "12",
+    "cwd",
+];
+export const AGENT_CONTAINED_STATUSES = ["paused", "killed"];
+/**
+ * Every durable code reachable in M1. `goal_contract_enforce_refused` is the existing gateway 429
+ * (gateway/src/index.ts enforce path), listed because durable fixes ride on it (G2 budget variants).
+ * Cut codes (durable_wrong_cell 421, durable_host_unattended_off 423, durable_goal_unsealed) are
+ * deliberately absent: an M1 build that emits one fails the code-closure check.
+ */
+export const DURABLE_CODES = {
+    // ---- gateway admission (precedence order: admission.ts ADMISSION_PRECEDENCE) ----
+    durable_admission_unavailable: { status: 503, surfaces: ["gateway"], fields: [] },
+    durable_key_revoked: { status: 401, surfaces: ["gateway"], fields: [] },
+    durable_identity_mismatch: { status: 409, surfaces: ["gateway"], fields: [] },
+    durable_unlocked: { status: 410, surfaces: ["gateway"], fields: [] },
+    durable_session_ended: {
+        status: 410,
+        surfaces: ["gateway", "api"],
+        fields: ["state", "state_reason"],
+    },
+    durable_lease_fenced: { status: 409, surfaces: ["gateway", "api"], fields: [] },
+    durable_session_stopped: {
+        status: 423,
+        surfaces: ["gateway"],
+        fields: ["state", "state_reason"],
+    },
+    durable_guard_unavailable: { status: 503, surfaces: ["gateway"], fields: [] },
+    durable_unattended_unavailable: { status: 503, surfaces: ["gateway"], fields: [] },
+    /** The existing gateway enforce 429 (goal-contract.ts); durable adds only its fix lines. */
+    goal_contract_enforce_refused: { status: 429, surfaces: ["gateway"], fields: [] },
+    // ---- gateway credential routing (S1 choice: C06 OQ "control-route, /router and org-metering codes") ----
+    /** An mnm_ds_ key on a control route the arm did not run for, on /router (router-auth) or on org metering. */
+    durable_route_refused: { status: 403, surfaces: ["gateway"], fields: [] },
+    /**
+     * An executor (or bridge) key presented at any gateway entry point (model routes, control
+     * routes, /router, org metering: C04 claim "refused at every gateway entry point").
+     */
+    durable_executor_key_refused: { status: 403, surfaces: ["gateway"], fields: [] },
+    // ---- credential and agent rules shared by gateway, api and cli ----
+    durable_only_agent: { status: 409, surfaces: ["gateway", "api", "cli"], fields: [] },
+    machine_principal_refused: { status: 403, surfaces: ["api"], fields: [] },
+    /** A device-step verb (unlock, budget raise, contained unpause) with an API-key-only owner credential (final F06). */
+    durable_session_login_required: { status: 403, surfaces: ["api", "cli"], fields: [] },
+    // ---- api owner verbs (owner-verbs.ts OWNER_VERB_PRECEDENCE) ----
+    durable_not_owner: { status: 403, surfaces: ["api"], fields: ["owner"] },
+    durable_agent_contained: { status: 409, surfaces: ["api"], fields: ["status"] },
+    durable_invalid_transition: {
+        status: 409,
+        surfaces: ["api"],
+        fields: ["from_state", "state_reason", "verb"],
+    },
+    durable_unsupported: { status: 422, surfaces: ["api"], fields: ["feature"] },
+    /** An own_lock body key outside LOCK_BODY_KEYS, or a malformed known field (ruling 33.24(1)); field null = not an object. */
+    durable_lock_body_invalid: { status: 422, surfaces: ["api"], fields: ["field"] },
+    /** A non-budget raise or loosening on amend (C07-R07); also a budget raise mixed with one. */
+    durable_amend_raise_refused: { status: 409, surfaces: ["api"], fields: ["field"] },
+    // ---- api lock preconditions (C02-R04, R05, R11, R22) ----
+    durable_lock_not_entitled: { status: 403, surfaces: ["api"], fields: [] },
+    durable_lock_mfa_required: { status: 403, surfaces: ["api"], fields: [] },
+    durable_lock_branch_unprotected: { status: 409, surfaces: ["api"], fields: ["refusals"] },
+    durable_lock_agent_shared: { status: 409, surfaces: ["api"], fields: ["reason"] },
+    durable_no_executor: { status: 409, surfaces: ["api"], fields: [] },
+    /** Retryable: a precondition source (IdP, GitHub, entitlement, schema probe, executor lookup) faulted. */
+    durable_precondition_unavailable: { status: 503, surfaces: ["api"], fields: ["retryable"] },
+    /** CLI-side lock refusal: no request is sent. */
+    durable_cwd_not_root: { status: null, surfaces: ["cli"], fields: ["cwd_kind"] },
+    // ---- api session registry (C01) ----
+    /** normalizeCellId(CELL_ID) is null at create: fail closed, no row. */
+    durable_cell_unmapped: { status: 503, surfaces: ["api"], fields: [] },
+    invalid_session_name: { status: 400, surfaces: ["api", "cli"], fields: [] },
+    session_name_in_use: { status: 409, surfaces: ["api", "cli"], fields: [] },
+    session_locked: { status: 409, surfaces: ["api", "cli"], fields: [] },
+    session_homed_elsewhere: { status: null, surfaces: ["cli"], fields: ["machine"] },
+    session_transcript_missing: { status: null, surfaces: ["cli"], fields: [] },
+    session_registry_unavailable: { status: null, surfaces: ["cli"], fields: [] },
+    session_resume_conflict: { status: null, surfaces: ["cli"], fields: [] },
+    session_goal_immutable: { status: null, surfaces: ["cli"], fields: [] },
+    // ---- api executor plane (C05) ----
+    durable_claim_unavailable: { status: 503, surfaces: ["api"], fields: ["cause"] },
+    durable_hello_late: { status: 409, surfaces: ["api"], fields: [] },
+    // Claim non-200 outcomes (rulings 24.22, 24.22.1), at CLAIM_OUTCOME_STATUS. lost_race's reason is
+    // a CLAIM_LOST_RACE_REASONS value; ineligible's reason a CLAIM_INELIGIBLE_REASONS value, with
+    // state_reason, check and state present per CLAIM_INELIGIBLE_DETAILS (claimIneligibleDetailsOk).
+    durable_claim_needs_key: { status: 409, surfaces: ["api"], fields: [] },
+    // org_lease_cap (ruling 34.05 (3)) adds the optional live and cap.
+    durable_claim_lost_race: { status: 409, surfaces: ["api"], fields: ["reason", "live", "cap"] },
+    // waiting (ruling 34.06 (3)) adds wait_reason.
+    durable_claim_ineligible: {
+        status: 403,
+        surfaces: ["api"],
+        fields: ["reason", "state_reason", "check", "state", "wait_reason"],
+    },
+    // The per-org claim rate limit (ruling 34.24): nothing written, no key minted. retry_after_s is
+    // the number of seconds to wait (claimRateLimitedDetailsOk).
+    durable_claim_rate_limited: { status: 429, surfaces: ["api"], fields: ["retry_after_s"] },
+    // ---- api journal (C10-R0 (i), (j), (k)) ----
+    /** Lost CAS race on (session_id, seq). */
+    durable_append_conflict: { status: 409, surfaces: ["api"], fields: ["tip_seq"] },
+    /** Same idempotency key, different content: always this one result (C10-R0 (j)). */
+    durable_idempotency_conflict: { status: 409, surfaces: ["api"], fields: ["seq"] },
+    durable_unknown_kind: { status: 422, surfaces: ["api"], fields: ["kind"] },
+    /** The caller's writer class may not append this kind (executor, gateway, api lists). */
+    durable_writer_refused: { status: 403, surfaces: ["api"], fields: ["kind"] },
+    // reason (erratum 34.06.3.1): a PARK_REFUSAL_REASONS value, only when kind is session.waiting.
+    durable_refs_invalid: { status: 422, surfaces: ["api"], fields: ["kind", "reason"] },
+    // ---- api device-step approval POST (device-step.ts APPROVAL_REFUSAL_ORDER; C16 OQ3) ----
+    durable_approval_no_session: { status: 401, surfaces: ["api"], fields: [] },
+    durable_approval_not_eligible: { status: 403, surfaces: ["api"], fields: [] },
+    durable_approval_aal_required: { status: 403, surfaces: ["api"], fields: [] },
+    durable_approval_step_up_stale: { status: 403, surfaces: ["api"], fields: [] },
+    durable_approval_requester_not_distinct: { status: 403, surfaces: ["api"], fields: [] },
+    durable_approval_expired: { status: 410, surfaces: ["api"], fields: [] },
+    durable_approval_consumed: { status: 409, surfaces: ["api"], fields: [] },
+    /** unlock refused at apply time because another locked session keeps the durable-only flag. */
+    durable_unlock_refused: { status: 409, surfaces: ["api"], fields: [] },
+    // ---- api executor enrollment start, POST ROUTES.exec_enroll (C04-R02, R03; wave-0 fix 3b) ----
+    // Names kept verbatim from C04-R03. A machine principal keeps 403 machine_principal_refused
+    // (C04-R02); a non-starter approver gets durable_approval_not_eligible (ruling 1.13). Device-poll
+    // errors are not codes here: see ENROLL_POLL_ERRORS.
+    /** The caller lacks the entitlement durable.locked. */
+    not_entitled: { status: 403, surfaces: ["api"], fields: [] },
+    /** The declared kind is not in durable.executors (M1 allows 'host' only). */
+    kind_not_allowed: { status: 403, surfaces: ["api"], fields: [] },
+    /** durable_schema_version() does not answer; retryable. */
+    schema_unavailable: { status: 503, surfaces: ["api"], fields: ["retryable"] },
+    // ---- gateway, Doors amendment (ruling 34.11) ----
+    /**
+     * An mnm_ds_ request whose x-mnemom-contract names another contract than the session's current
+     * charter version; refused before any upstream call, with no turn and no event.
+     */
+    contract_mismatch: { status: 409, surfaces: ["gateway"], fields: ["expected_version"] },
+    // ---- api internal, charter by hash (ruling 33.32) ----
+    /**
+     * POST ROUTES.int_charter names an unknown session, a hash that is not one of its charter
+     * versions, or no charter at all (a malformed body). The gateway refuses admission on it.
+     */
+    durable_charter_not_found: { status: 404, surfaces: ["api"], fields: [] },
+};
+export function isDurableCode(v) {
+    return typeof v === "string" && Object.prototype.hasOwnProperty.call(DURABLE_CODES, v);
+}
+export function statusOf(code) {
+    return DURABLE_CODES[code].status;
+}
+/**
+ * Build the error envelope for `code`, as buildErrorBody does: `details` only when given. Throws
+ * when details carries a field outside `fix` and DURABLE_CODES[code].fields, or a non-string fix.
+ */
+export function durableErrorBody(code, message, details) {
+    if (details === undefined)
+        return { error: { code, message } };
+    const allowed = ["fix", ...DURABLE_CODES[code].fields];
+    for (const k of Object.keys(details)) {
+        if (!allowed.includes(k))
+            throw new Error(`${code}: details field ${k} is not one of ${allowed.join(", ")}`);
+    }
+    if (details.fix !== undefined && typeof details.fix !== "string")
+        throw new Error(`${code}: details.fix must be a string`);
+    return { error: { code, message, details } };
+}
+/** Gateway refusal codes reachable in M1 on an mnm_ds_ request (C19 durable_refusal value set, plus `none` and `unknown_key`). */
+export const GATEWAY_REFUSAL_CODES = [
+    "durable_admission_unavailable",
+    "durable_key_revoked",
+    "durable_identity_mismatch",
+    "durable_unlocked",
+    "durable_session_ended",
+    "durable_lease_fenced",
+    "durable_session_stopped",
+    "durable_guard_unavailable",
+    "durable_unattended_unavailable",
+    "goal_contract_enforce_refused",
+    "durable_route_refused",
+    "durable_executor_key_refused",
+    /** Doors amendment (ruling 34.11): x-mnemom-contract names another contract. */
+    "contract_mismatch",
+];
+/**
+ * Retry rule (BACKBONE): every gateway durable refusal carries `x-should-retry: false`, except
+ * 503 durable_admission_unavailable on an attended chain, which carries no x-should-retry header
+ * (attended chains keep today's availability). Returns the header value, or null for "omit".
+ * durable_claim_unavailable belongs to the daemon backoff, not to this rule.
+ */
+export function shouldRetryHeader(code, attended) {
+    return code === "durable_admission_unavailable" && attended ? null : "false";
+}
+/** Codes named by the design but CUT from M1. No M1 build may emit them (code-closure check). */
+export const CUT_CODES_M1 = [
+    "durable_wrong_cell",
+    "durable_host_unattended_off",
+    "durable_goal_unsealed",
+    "durable_arm_unavailable",
+    "durable_attestation_unavailable",
+];
+/** Claim outcomes (design §4.3 plus S1 `unavailable`), the value set of `durable_claim_outcome`. */
+export const CLAIM_OUTCOMES = [
+    "acquired",
+    "reclaimed",
+    "epoch_bump",
+    "needs_key",
+    "lost_race",
+    "ineligible",
+    "unavailable",
+    "rate_limited",
+];
+/**
+ * HTTP status of each claim outcome at POST /v1/executor/sessions/{id}/claim (C05 OQ0 proposal,
+ * frozen). A foreign or unknown session is the existing 404 before any outcome is computed.
+ */
+export const CLAIM_OUTCOME_STATUS = {
+    acquired: 200,
+    reclaimed: 200,
+    epoch_bump: 200,
+    needs_key: 409,
+    lost_race: 409,
+    ineligible: 403,
+    unavailable: 503,
+    rate_limited: 429,
+};
+/** durable_claim_lost_race details.reason: A1 durable_claim_lease step 2 and step 4 (24.22.1). */
+export const CLAIM_LOST_RACE_REASONS = ["stale_tokens", "lease_live", "org_lease_cap"];
+/** durable_claim_ineligible details.reason: every value A1 durable_claim_lease returns (24.22.1). */
+export const CLAIM_INELIGIBLE_REASONS = [
+    "bad_nonce",
+    "bad_attest_failure",
+    "not_found",
+    "not_locked",
+    "not_home",
+    "not_owner",
+    "executor_revoked",
+    "executor_breakglass",
+    "terminal",
+    "expired",
+    "cell_unmapped",
+    "agent_killed",
+    "paused",
+    "agent_contained",
+    "suspended",
+    "profile",
+    "respawn_failed",
+    "attestation_failed",
+    "identity_mismatch",
+    "budget_reached",
+    "grant_expired",
+    // ---- Doors amendment ----
+    /** A pool session claimed by an executor that is not an org-scope executor of its org (34.03 (2)). */
+    "not_pool_member",
+    /** wait_reason is one of PARKED_ONLY_WAIT_REASONS (34.06 (3)). */
+    "waiting",
+];
+/**
+ * What a durable_claim_ineligible refusal carries beside reason, per reason (24.22.1). A field not
+ * named is absent. state_reason: `paused` / `suspended` = the row's existing state_reason for that
+ * state; `reason` = equal to reason (a suspension the claim writes); `agent_contained` = that
+ * literal. check: an ATTESTATION_CHECKS_M1 value, on an attestation-driven suspension the claim
+ * writes ('4' for grant_expired). state: a TERMINAL_STATES value, for terminal only. wait_reason: a
+ * PARKED_ONLY_WAIT_REASONS value, for waiting only (ruling 34.06 (3)).
+ */
+export const CLAIM_INELIGIBLE_DETAILS = Object.freeze({
+    bad_nonce: {},
+    bad_attest_failure: {},
+    not_found: {},
+    not_locked: {},
+    not_home: {},
+    not_owner: {},
+    executor_revoked: {},
+    executor_breakglass: {},
+    terminal: { state: "terminal_state" },
+    expired: {},
+    cell_unmapped: {},
+    agent_killed: {},
+    paused: { state_reason: "paused" },
+    agent_contained: { state_reason: "agent_contained" },
+    suspended: { state_reason: "suspended" },
+    profile: {},
+    respawn_failed: { state_reason: "reason" },
+    attestation_failed: { state_reason: "reason", check: "attestation_check" },
+    identity_mismatch: { state_reason: "reason", check: "attestation_check" },
+    budget_reached: { state_reason: "reason", check: "attestation_check" },
+    grant_expired: { state_reason: "reason", check: "attestation_check" },
+    not_pool_member: {},
+    waiting: { wait_reason: "parked_only" },
+});
+/**
+ * durable_claim_lost_race's details: a CLAIM_LOST_RACE_REASONS reason, an optional fix, and live and
+ * cap (non-negative and positive integers) both present exactly when the reason is org_lease_cap
+ * (ruling 34.05 (3)).
+ */
+export function claimLostRaceDetailsOk(details) {
+    if (Object.keys(details).some((k) => !["fix", ...DURABLE_CODES.durable_claim_lost_race.fields].includes(k)))
+        return false;
+    if (!CLAIM_LOST_RACE_REASONS.includes(details.reason))
+        return false;
+    if (details.reason !== "org_lease_cap")
+        return !("live" in details) && !("cap" in details);
+    return (Number.isInteger(details.live) &&
+        details.live >= 0 &&
+        Number.isInteger(details.cap) &&
+        details.cap >= 1);
+}
+/**
+ * durable_claim_rate_limited's details (ruling 34.24): retry_after_s, a non-negative finite number
+ * of seconds, required; an optional fix; nothing else.
+ */
+export function claimRateLimitedDetailsOk(details) {
+    if (Object.keys(details).some((k) => !["fix", ...DURABLE_CODES.durable_claim_rate_limited.fields].includes(k)))
+        return false;
+    const t = details.retry_after_s;
+    return typeof t === "number" && Number.isFinite(t) && t >= 0;
+}
+/** durable_claim_ineligible's details against CLAIM_INELIGIBLE_DETAILS; an optional fix; nothing else. */
+export function claimIneligibleDetailsOk(details) {
+    if (Object.keys(details).some((k) => !["fix", ...DURABLE_CODES.durable_claim_ineligible.fields].includes(k)))
+        return false;
+    const reason = details.reason;
+    if (!CLAIM_INELIGIBLE_REASONS.includes(reason))
+        return false;
+    const rule = CLAIM_INELIGIBLE_DETAILS[reason];
+    for (const k of ["state_reason", "check", "state", "wait_reason"])
+        if (k in details !== k in rule)
+            return false;
+    switch (rule.state_reason) {
+        case "paused":
+            if (!STATE_REASONS.paused.includes(details.state_reason))
+                return false;
+            break;
+        case "suspended":
+            if (!STATE_REASONS.suspended.includes(details.state_reason))
+                return false;
+            break;
+        case "reason":
+            if (details.state_reason !== reason)
+                return false;
+            break;
+        case "agent_contained":
+            if (details.state_reason !== "agent_contained")
+                return false;
+            break;
+    }
+    if (rule.check !== undefined &&
+        !ATTESTATION_CHECKS_M1.includes(details.check))
+        return false;
+    if (rule.state !== undefined && !TERMINAL_STATES.includes(details.state))
+        return false;
+    if (rule.wait_reason !== undefined &&
+        !PARKED_ONLY_WAIT_REASONS.includes(details.wait_reason))
+        return false;
+    return true;
+}
+/**
+ * durable_refs_invalid details.reason for a release whose wait cannot park (rulings 34.06.3,
+ * 34.06.3.1): the named approval is not open or is past expires_at, belongs to another session, or
+ * has the wrong subject, or wait_ref is not the canonical WAIT_REF_KEYS text for its reason.
+ */
+export const PARK_REFUSAL_REASONS = [
+    "approval_not_open",
+    "approval_wrong_session",
+    "approval_wrong_subject",
+    "wait_ref_shape",
+];
+/**
+ * durable_refs_invalid's details: a string kind, an optional fix, and an optional reason that is
+ * a PARK_REFUSAL_REASONS value and may appear only when kind is session.waiting (34.06.3.1).
+ */
+export function refsInvalidDetailsOk(details) {
+    if (Object.keys(details).some((k) => !["fix", ...DURABLE_CODES.durable_refs_invalid.fields].includes(k)))
+        return false;
+    if (typeof details.kind !== "string")
+        return false;
+    if (!("reason" in details))
+        return true;
+    return (details.kind === "session.waiting" &&
+        PARK_REFUSAL_REASONS.includes(details.reason));
+}
+/** Reasons a heartbeat entry answers extended=false (C05 OQ0; the per-session batched array). */
+export const HEARTBEAT_REASONS = [
+    "extended",
+    "revived",
+    "fenced",
+    "not_hello_spawn",
+    "not_revivable",
+    "contained",
+    "terminal",
+    // ---- Doors amendment ----
+    /** wait_reason is set: never revived, the wait kept, the rest of the batch unaffected (34.06.4). */
+    "waiting",
+];
+/**
+ * The heartbeat wire shape (ruling 24.15; A1 durable_heartbeat). The request names each session as
+ * {session_id, epoch, spawn_id}; the response body is {results: [...]}, one entry per session,
+ * {session_id, extended, reason, lease_expires_at?}, lease_expires_at present exactly when extended.
+ * Entry order is NOT promised (A1 answers in session_id order): match entries by session_id.
+ */
+export const HEARTBEAT_ENTRY_FIELDS = ["session_id", "epoch", "spawn_id"];
+export const HEARTBEAT_RESULT_FIELDS = [
+    "session_id",
+    "extended",
+    "reason",
+    "lease_expires_at",
+];
+/** One response entry: the frozen keys only, a uuid session_id, a HEARTBEAT_REASONS reason. */
+export function heartbeatResultOk(v) {
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        return false;
+    const o = v;
+    if (Object.keys(o).some((k) => !HEARTBEAT_RESULT_FIELDS.includes(k)))
+        return false;
+    if (!fieldOk({ type: "uuid", nullable: false }, o.session_id))
+        return false;
+    if (typeof o.extended !== "boolean")
+        return false;
+    if (!fieldOk({ type: "enum", nullable: false, values: HEARTBEAT_REASONS }, o.reason))
+        return false;
+    // a waiting session is never extended (34.06.4): reason waiting only answers extended false
+    if (o.extended && o.reason === "waiting")
+        return false;
+    return o.extended
+        ? fieldOk({ type: "timestamp", nullable: false }, o.lease_expires_at)
+        : !("lease_expires_at" in o);
+}
+/**
+ * The enroll poll's errors (POST ROUTES.exec_enroll_poll), in the RFC 8628 section 3.5 poll
+ * vocabulary plus `already_consumed` (wave-0 fix 3b). Each answers HTTP ENROLL_POLL_ERROR_STATUS
+ * with body {error: <value>}; they are not DURABLE_CODES. The CLI turns already_consumed into a
+ * non-zero exit naming `mnemom agent host install`.
+ */
+export const ENROLL_POLL_ERRORS = [
+    "authorization_pending",
+    "slow_down",
+    "access_denied",
+    "expired_token",
+    "already_consumed",
+];
+export const ENROLL_POLL_ERROR_STATUS = 400;

package/dist/vendor/shared/durable-contract/constants.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Every frozen durable constant (BACKBONE "Pieces / S1", amendments 33-50). A spec or piece cites
+ * these by name and never restates a different value. The values the backbone left to "the S1
+ * freeze record" are chosen here; each carries its reason. `freeze-record.ts` copies them into
+ * the JSON record the eval runner reads as `$S1.<NAME>`.
+ */
+/** The contract version of this package. Any change to FREEZE.json bumps it. */
+export declare const DURABLE_CONTRACT_VERSION = "1.0.0";
+/**
+ * `durable_schema_version()` must return exactly this. A mismatch makes the entitlement `durable`
+ * field absent and a claim answers 503 durable_claim_unavailable {cause:"schema"} (A3).
+ */
+export declare const DURABLE_SCHEMA_VERSION = 1;
+/** durable_cell_state.lease_seconds default, CHECK LEASE_SECONDS_MIN..LEASE_SECONDS_MAX. */
+export declare const LEASE_SECONDS_DEFAULT = 90;
+export declare const LEASE_SECONDS_MIN = 5;
+export declare const LEASE_SECONDS_MAX = 90;
+/** durable_cell_state.resume_reset_seconds default, CHECK RESUME_RESET_SECONDS_MIN..MAX. */
+export declare const RESUME_RESET_SECONDS_DEFAULT = 600;
+export declare const RESUME_RESET_SECONDS_MIN = 5;
+export declare const RESUME_RESET_SECONDS_MAX = 600;
+/** Heartbeat period = lease_seconds / HEARTBEAT_DIVISOR (30 s at 90, 2 s at 6). */
+export declare const HEARTBEAT_DIVISOR = 3;
+/** resume_failures at which a session goes to suspended(respawn_failed). */
+export declare const RESPAWN_FAILURES_SUSPEND_AT = 3;
+/** Seats the daemon respawns at once. */
+export declare const RESPAWN_CONCURRENCY = 4;
+/** resolve_durable_session_key touches last_used_at only when NULL or older than this (DB clock). */
+export declare const LEASE_KEY_TOUCH_SECONDS = 60;
+/** M1 has no stale serve: every resolver fault is 503 durable_admission_unavailable (I20). */
+export declare const STALE_SERVE_M1: false;
+/** M1 honours DURABLE_ADMIT, but only for the exact bytes NOFENCE_ADMIT_VALUE (r3 I01). */
+export declare const NOFENCE_M1: true;
+export declare const NOFENCE_ADMIT_VALUE = "nofence";
+/** Upper bound for one resolver RPC; past it the gateway answers 503 (C06-R07 "timeout T"). */
+export declare const RESOLVER_TIMEOUT_MS = 2000;
+/** Claim-time arm probe (GET /internal/durable/arm at the home cell) must answer within this. */
+export declare const ARM_PROBE_TIMEOUT_MS = 2000;
+/** A parseable arm probe answer is cached at most this long. */
+export declare const ARM_PROBE_TTL_S = 10;
+/** Check 12: a `protected` answer is cached per (repo, branch) this long. */
+export declare const PROTECTION_CACHE_S = 300;
+/** Executor grant: renewal sets grant_expires_at = now() + GRANT_TTL_S. */
+export declare const GRANT_TTL_S: number;
+/** sessions, show and host status warn in the last GRANT_WARNING_S of the grant. */
+export declare const GRANT_WARNING_S: number;
+/** Clean seat exits (exit 0 after an accepted hello) beyond CLEAN_EXIT_MAX in the window count as failures. */
+export declare const CLEAN_EXIT_MAX = 3;
+export declare const CLEAN_EXIT_WINDOW_S = 600;
+/** The daemon polls GET /v1/executor/sessions every EXECUTOR_POLL_S. */
+export declare const EXECUTOR_POLL_S = 10;
+/** An executor whose last_seen_at is older than this is not live. */
+export declare const EXECUTOR_LIVE_S: number;
+/** Claim backoff on 503 durable_claim_unavailable: CLAIM_BACKOFF_BASE_S doubling to CLAIM_BACKOFF_MAX_S. */
+export declare const CLAIM_BACKOFF_BASE_S = 2;
+export declare const CLAIM_BACKOFF_MAX_S = 60;
+/** Each backoff delay is stretched by a factor in [1, 1 + CLAIM_BACKOFF_JITTER). */
+export declare const CLAIM_BACKOFF_JITTER = 0.2;
+/** host status prints the guard fix after more than this many consecutive `guard` unavailable claims. */
+export declare const CLAIM_UNAVAILABLE_SURFACE_N = 5;
+/** SIGTERM to SIGKILL grace when done/kill stops a local tracked claude (final F04). */
+export declare const TRACKED_STOP_GRACE_S = 5;
+/**
+ * Upstream attempts one typed turn may produce on a non-retryable refusal (C13-R14). Expected 1;
+ * PROVISIONAL until the day-1 spike with claude 2.1.285 records the real number.
+ */
+export declare const SEAT_MAX_ATTEMPTS_NONRETRY = 1;
+/** A synced main request waits up to TURN_WAIT_MS for its prompt (= cli/src/turn-origin.mjs WAIT_MS on origin/main). */
+export declare const TURN_WAIT_MS = 500;
+/** x-mnemom-turn limits, equal to gateway/src/goal-turn-claims.ts. */
+export declare const TURN_HEADER_MAX_LEN = 8192;
+export declare const TURN_ENTRIES_MAX = 32;
+/** One global row cap across all categories per run. */
+export declare const SWEEP_MAX_ROWS = 200;
+/** Rows per batch; SWEEP_BATCH_SIZE < SWEEP_MAX_ROWS. */
+export declare const SWEEP_BATCH_SIZE = 50;
+/** Time budget T per run. */
+export declare const SWEEP_TIME_BUDGET_MS = 10000;
+export declare const SWEEP_CRON = "*/5 * * * *";
+/**
+ * The per-session budget limit in USD, code-fixed and conservative (owner Q2). The single source
+ * for the amend bound, the 422 and the gateway 429; durable_org_policy.limits is seeded from it
+ * and not read in M1 (parity test: seed == constant).
+ */
+export declare const PER_SESSION_BUDGET_LIMIT_USD = 20;
+/** durable_org_policy.limits seed, built from the constant above. */
+export declare const ORG_POLICY_LIMITS_SEED: Readonly<{
+    per_session_budget_usd: 20;
+}>;
+/** The API's frozen contract statement limit (= gateway goal-contract STATEMENT_MAX). */
+export declare const CONTRACT_STATEMENT_MAX_CHARS = 4000;
+/** canonicalJson of the whole contract plaintext (= gateway goal-contract CONTRACT_JSON_MAX). */
+export declare const CONTRACT_JSON_MAX_BYTES = 8192;
+/** agent_session_events.detail is server-generated and at most this many characters. */
+export declare const EVENT_DETAIL_MAX_CHARS = 280;
+/** contract_ciphertext is purged this long after the session ends. */
+export declare const CONTRACT_PURGE_AFTER_S: number;
+/** owner_mutation needs aal2 and a step-up no older than this. */
+export declare const DEVICE_STEP_FRESHNESS_S = 300;
+/**
+ * The cookie SessionBlob key holding the step-up time, integer unix seconds, optional (ruling 27;
+ * C16-R10). Fresh when 0 <= now - su <= DEVICE_STEP_FRESHNESS_S; an absent or future su is stale.
+ * Separate from `ia`: a step-up renews freshness without extending the session's lifetime.
+ */
+export declare const STEP_UP_BLOB_FIELD = "su";
+/** An owner_mutation approval expires with its device code (= api DEVICE_CODE_TTL_SECONDS). */
+export declare const OWNER_MUTATION_APPROVAL_TTL_S: number;
+/** The CLI polls the device grant this often (= api DEVICE_POLL_INTERVAL_SECONDS). */
+export declare const DEVICE_POLL_INTERVAL_S = 5;
+/** The laptop risk-line text version (fixlines.ts RISK_LINE_TEXT). Bump with any text change. */
+export declare const RISK_LINE_VERSION = 1;
+/** RISK_LINE_VERSION as the decimal text the A1 column, the page marker and the enrollment approval subject carry (ruling 32.30). */
+export declare const RISK_LINE_VERSION_TEXT: string;
+/** The --settings / --mcp-config renderer version recorded in attestation.passed (spec.ts). */
+export declare const RENDERER_VERSION = 1;
+/** The plugin dir-hash recipe version (spec.ts pluginDirHash). */
+export declare const PLUGIN_HASH_RECIPE_VERSION = 1;
+/** The journal preimage version (events.ts EVENT_PREIMAGE_FIELDS). */
+export declare const EVENT_PREIMAGE_VERSION = 1;
+/**
+ * L_spawn, the lease every real-claude case runs at (20..90), set by ruling 34.17 (calibration):
+ * max(20, ceil(3 x p100 claim-to-hello)) s, capped at 90, with p100 the maximum over the clean
+ * calibration runs (2.616 s, run42), so max(20, 8) = 20. Re-derived only by a new calibration ruling.
+ */
+export declare const L_SPAWN: number | null;
+export declare const L_SPAWN_MIN = 20;
+export declare const L_SPAWN_MAX = 90;
+/**
+ * T_hello, the calibrated per-seat spawn-to-hello time in seconds (C12-R31 recovery bound), set by
+ * the same ruling 34.17 calibration as L_SPAWN: p100 claim-to-hello at 4
+ * concurrent respawns, the maximum over the clean runs (run41 1.873, run42 2.616).
+ */
+export declare const T_HELLO_S: number | null;
+/**
+ * The first-party public OAuth client an owner_mutation device code is bound to (C16-R01; wave-0
+ * fix ruling 1.12). A1 seeds it; every 202 device-step body returns it as client_id; the generic
+ * /v1/oauth/device_authorization refuses it for every scope (C16-A-032). The CLI's login client is
+ * NOT frozen: it is issued by RFC 7591 dynamic registration.
+ */
+export declare const OWNER_MUTATION_CLIENT_ID = "mnemom-durable-owner-mutation";
+/** ATTACH_WAIT_S = EXECUTOR_POLL_S + lease_seconds (BACKBONE). Throws outside the lease CHECK range. */
+export declare function attachWaitSeconds(leaseSeconds: number): number;
+/** ATTACH_WAIT_S at the default 90 s lease. */
+export declare const ATTACH_WAIT_S: number;
+/** Heartbeat period in seconds for a lease, derived from the server's lease. */
+export declare function heartbeatSeconds(leaseSeconds: number): number;
+/**
+ * Delay before claim attempt `attempt` (1-based) after consecutive 503 durable_claim_unavailable
+ * answers: CLAIM_BACKOFF_BASE_S * 2^(attempt-1), capped at CLAIM_BACKOFF_MAX_S, stretched by
+ * (1 + CLAIM_BACKOFF_JITTER * r) where r in [0, 1) is the caller's random draw. So no gap is under
+ * 2 s and none is over 60 s x (1 + CLAIM_BACKOFF_JITTER) (C12-R30).
+ */
+export declare function claimBackoffMs(attempt: number, r: number): number;