@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.2

package/dist/vendor/shared/durable-contract/freeze-record.js

@@ -0,0 +1,361 @@
+// GENERATED from shared/durable-contract/src/freeze-record.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The freeze record: every frozen value by name, as the eval runner reads `$S1.<NAME>` and
+ * `$S1.<NAME>.<path>` (CASE-DSL section 5.2). Built from the modules, never restated.
+ *
+ *   FREEZE_RECORD      scalars (string, number, boolean, or null while a calibration is pending)
+ *   FREEZE_STRUCTURED  frozen lists, tables and maps (JSON values)
+ *   FREEZE_ALIASES     the DSL spellings datasets already use, each naming one canonical entry
+ *
+ * A name lives in exactly one of the three. Names the datasets cite that are not S1 values (lane
+ * URLs, installed versions, baselines, module paths of other lanes) are not here on purpose: they
+ * are lane or case bindings.
+ */
+import * as C from "./constants.js";
+import { API_CELL_ID_VECTORS_SHA256, CANONICAL_CELL_IDS } from "./cell-id.js";
+import { LEASE_KEY_PREFIX } from "./keys.js";
+import { ARM_HEADER, ARM_VERSION } from "./arm.js";
+import { CHARTER_BY_HASH_BODY_KEYS, CHARTER_BY_HASH_RESPONSE, CHARTER_SEALED_AT_RE, CLAIM_BODY_KEYS, EXEC_SESSIONS_RESPONSE, OWNER_SESSION_VIEW_FIELDS, GATEWAY_EVENTS_BODY_KEYS, EXECUTOR_KEY_HEADER, HEARTBEAT_REQUEST_KEYS, INTERNAL_KEY_HEADER, ROUTES, } from "./routes.js";
+import * as D from "./doors.js";
+import { JOURNAL_APPROVAL_KINDS } from "./journal-approvals.js";
+import { PARKED_ONLY_WAIT_REASONS, READY_USER_TEXT, WAIT_REASONS } from "./states.js";
+import { SECRET_SCOPE } from "./secret-scope.js";
+import { EXECUTOR_STATE_DIR, EXECUTOR_STATE_DIR_MODE, EXECUTOR_STATE_FILE, EXECUTOR_STATE_FILE_MODE, } from "./paths.js";
+import { ATTRIBUTE_VALUES, DEVICE_VERIFY_AAL_DEFAULT, M1_SPAN_NAMES, SPAN_ATTRIBUTE_KEYS, SPAN_DEVICE_VERIFY_WOULD_REFUSE, SPAN_DURABLE_ADMISSION, SPAN_DURABLE_CLAIM, SPAN_DURABLE_ENROLLMENT, SPAN_DURABLE_SEAT_HELLO, SPAN_DURABLE_SWEEP, SWEEP_LOG_NAME, } from "./telemetry.js";
+import { EVENT_PREIMAGE_FIELDS, EXECUTOR_WRITABLE_KINDS, GATEWAY_EVENTS_ROUTE, GATEWAY_WRITABLE_KINDS, GENESIS_PREV_HASH, READY_CAUSES, TERMINAL_EVENT_KINDS, } from "./events.js";
+import { CLAIM_INELIGIBLE_DETAILS, CLAIM_INELIGIBLE_REASONS, CLAIM_LOST_RACE_REASONS, CLAIM_OUTCOMES, DURABLE_CODES, PARK_REFUSAL_REASONS, HEARTBEAT_ENTRY_FIELDS, HEARTBEAT_RESULT_FIELDS, ENROLL_POLL_ERROR_STATUS, ENROLL_POLL_ERRORS, } from "./codes.js";
+import { DEVICE_PAGE_MARKERS, FIX_LINES, RISK_LINE_TEXT, RISK_SENTENCE_ID_HOST, STOPPED_FIX, STOPPED_REASON_TEXT, U05_CHECK_TEXT_ATTESTATION_FAILED, U05_CHECK_TEXT_RESPAWN_FAILED, U05_FIXTURE_CHECK, } from "./fixlines.js";
+import { PLUGIN_DIR, PLUGIN_MANIFEST_FAILURES, PLUGIN_MANIFEST_PATH, PLUGIN_MANIFEST_SCHEMA, } from "./spec.js";
+import { AGENT_EXECUTORS_SCOPE_CHECK, AGENT_SESSIONS_READY_CHECK, AGENT_SESSIONS_WAIT_PARKED_CHECK, DURABLE_APPROVAL_SESSIONLESS_SUBJECTS, DURABLE_APPROVAL_SUBJECTS, DURABLE_APPROVALS_TARGET_CHECK, EXECUTE_EXCEPTIONS, M1_ARBITERS, M1_COLUMNS, M1_FUNCTIONS, M1_TABLES, } from "./schema.js";
+import { ADMIT_SWEEP_VALUES, ADMIT_SWEEP_VECTORS_PATH, GUARD_STATE_FAULT, GUARD_STATE_OK, RESOLVER_SCHEMA, } from "./admission.js";
+import { GUARD_LISTS, TEST_ALLOWLIST, TEST_FLAKY_RUNS, TEST_MODE_ENV, TEST_MODE_MODULE, } from "./test-mode.js";
+import { KEY_EFFECT_OF_TRANSITION, OLD_ROUTE_BRANCH, OLD_ROUTE_REFRESH, REVOKING_TRANSITIONS, } from "./owner-verbs.js";
+import { RESERVED_SESSION_VERBS, SESSION_NAME_MAX_CHARS } from "./names.js";
+import { CLI_REFUSAL_EXIT, CLI_USAGE_EXIT, FINGERPRINT_HEX_CHARS, HOST_STATUS_JSON, HOST_STATUS_JSON_VECTORS, } from "./cli-output.js";
+import { M1_CLI_SURFACE, PRE_M1_LAUNCHER_SUBVERBS } from "./cli-surface.js";
+import { PURE_FN_EXPORTS, PURE_FN_M1_PENDING } from "./pure-fn.js";
+import { EXECUTOR_STATE_SCHEMA } from "./executor-state.js";
+import { CHARTER_HASH_EXCLUDED_COLUMNS, CHARTER_PREIMAGE_FIELDS, CHARTER_PREIMAGE_VERSION, PIN_KEYS, } from "./envelope.js";
+export const FREEZE_RECORD = Object.freeze({
+    DURABLE_CONTRACT_VERSION: C.DURABLE_CONTRACT_VERSION,
+    DURABLE_SCHEMA_VERSION: C.DURABLE_SCHEMA_VERSION,
+    LEASE_SECONDS_DEFAULT: C.LEASE_SECONDS_DEFAULT,
+    LEASE_SECONDS_MIN: C.LEASE_SECONDS_MIN,
+    LEASE_SECONDS_MAX: C.LEASE_SECONDS_MAX,
+    RESUME_RESET_SECONDS_DEFAULT: C.RESUME_RESET_SECONDS_DEFAULT,
+    RESUME_RESET_SECONDS_MIN: C.RESUME_RESET_SECONDS_MIN,
+    RESUME_RESET_SECONDS_MAX: C.RESUME_RESET_SECONDS_MAX,
+    HEARTBEAT_DIVISOR: C.HEARTBEAT_DIVISOR,
+    RESPAWN_FAILURES_SUSPEND_AT: C.RESPAWN_FAILURES_SUSPEND_AT,
+    RESPAWN_CONCURRENCY: C.RESPAWN_CONCURRENCY,
+    LEASE_KEY_TOUCH_SECONDS: C.LEASE_KEY_TOUCH_SECONDS,
+    STALE_SERVE_M1: C.STALE_SERVE_M1,
+    NOFENCE_M1: C.NOFENCE_M1,
+    NOFENCE_ADMIT_VALUE: C.NOFENCE_ADMIT_VALUE,
+    RESOLVER_TIMEOUT_MS: C.RESOLVER_TIMEOUT_MS,
+    ARM_PROBE_TIMEOUT_MS: C.ARM_PROBE_TIMEOUT_MS,
+    ARM_PROBE_TTL_S: C.ARM_PROBE_TTL_S,
+    PROTECTION_CACHE_S: C.PROTECTION_CACHE_S,
+    GRANT_TTL_S: C.GRANT_TTL_S,
+    GRANT_WARNING_S: C.GRANT_WARNING_S,
+    CLEAN_EXIT_MAX: C.CLEAN_EXIT_MAX,
+    CLEAN_EXIT_WINDOW_S: C.CLEAN_EXIT_WINDOW_S,
+    EXECUTOR_POLL_S: C.EXECUTOR_POLL_S,
+    EXECUTOR_LIVE_S: C.EXECUTOR_LIVE_S,
+    ATTACH_WAIT_S: C.ATTACH_WAIT_S,
+    CLAIM_BACKOFF_BASE_S: C.CLAIM_BACKOFF_BASE_S,
+    CLAIM_BACKOFF_MAX_S: C.CLAIM_BACKOFF_MAX_S,
+    CLAIM_BACKOFF_JITTER: C.CLAIM_BACKOFF_JITTER,
+    CLAIM_UNAVAILABLE_SURFACE_N: C.CLAIM_UNAVAILABLE_SURFACE_N,
+    TRACKED_STOP_GRACE_S: C.TRACKED_STOP_GRACE_S,
+    SEAT_MAX_ATTEMPTS_NONRETRY: C.SEAT_MAX_ATTEMPTS_NONRETRY,
+    TURN_WAIT_MS: C.TURN_WAIT_MS,
+    TURN_HEADER_MAX_LEN: C.TURN_HEADER_MAX_LEN,
+    TURN_ENTRIES_MAX: C.TURN_ENTRIES_MAX,
+    SWEEP_MAX_ROWS: C.SWEEP_MAX_ROWS,
+    SWEEP_BATCH_SIZE: C.SWEEP_BATCH_SIZE,
+    SWEEP_TIME_BUDGET_MS: C.SWEEP_TIME_BUDGET_MS,
+    SWEEP_CRON: C.SWEEP_CRON,
+    PER_SESSION_BUDGET_LIMIT_USD: C.PER_SESSION_BUDGET_LIMIT_USD,
+    CONTRACT_STATEMENT_MAX_CHARS: C.CONTRACT_STATEMENT_MAX_CHARS,
+    CONTRACT_JSON_MAX_BYTES: C.CONTRACT_JSON_MAX_BYTES,
+    EVENT_DETAIL_MAX_CHARS: C.EVENT_DETAIL_MAX_CHARS,
+    CONTRACT_PURGE_AFTER_S: C.CONTRACT_PURGE_AFTER_S,
+    DEVICE_STEP_FRESHNESS_S: C.DEVICE_STEP_FRESHNESS_S,
+    STEP_UP_BLOB_FIELD: C.STEP_UP_BLOB_FIELD,
+    /** test_integrity baseline runs and flaky retry cap (ruling 31.1). */
+    TEST_FLAKY_RUNS,
+    /** durable_approvals target CHECK text A1 mirrors (ruling 32.12). */
+    DURABLE_APPROVALS_TARGET_CHECK,
+    OWNER_MUTATION_APPROVAL_TTL_S: C.OWNER_MUTATION_APPROVAL_TTL_S,
+    DEVICE_POLL_INTERVAL_S: C.DEVICE_POLL_INTERVAL_S,
+    RISK_LINE_VERSION: C.RISK_LINE_VERSION,
+    RISK_LINE_VERSION_TEXT: C.RISK_LINE_VERSION_TEXT,
+    RENDERER_VERSION: C.RENDERER_VERSION,
+    PLUGIN_HASH_RECIPE_VERSION: C.PLUGIN_HASH_RECIPE_VERSION,
+    ADMIT_SWEEP_VECTORS_PATH,
+    FINGERPRINT_HEX_CHARS,
+    PLUGIN_DIR,
+    PLUGIN_MANIFEST_PATH,
+    EVENT_PREIMAGE_VERSION: C.EVENT_PREIMAGE_VERSION,
+    /** The calibrated names (CALIBRATED_PENDING) carry the DSL spelling; L_SPAWN / T_HELLO_S are aliases. */
+    L_spawn: C.L_SPAWN,
+    T_hello: C.T_HELLO_S,
+    L_SPAWN_MIN: C.L_SPAWN_MIN,
+    L_SPAWN_MAX: C.L_SPAWN_MAX,
+    API_CELL_ID_VECTORS_SHA256,
+    LEASE_KEY_PREFIX,
+    ARM_HEADER,
+    ARM_VERSION,
+    GENESIS_PREV_HASH,
+    GATEWAY_EVENTS_ROUTE,
+    CHARTER_PREIMAGE_VERSION,
+    SESSION_NAME_MAX_CHARS,
+    RISK_LINE_TEXT,
+    TEST_MODE_ENV,
+    DEVICE_VERIFY_AAL_DEFAULT,
+    SPAN_DURABLE_ADMISSION,
+    SPAN_DURABLE_CLAIM,
+    SPAN_DURABLE_SEAT_HELLO,
+    SPAN_DURABLE_SWEEP,
+    SPAN_DEVICE_VERIFY_WOULD_REFUSE,
+    SWEEP_LOG_NAME,
+    // ---- wave-0 fix amendment ----
+    OWNER_MUTATION_CLIENT_ID: C.OWNER_MUTATION_CLIENT_ID,
+    EXECUTOR_STATE_DIR,
+    EXECUTOR_STATE_FILE,
+    EXECUTOR_STATE_DIR_MODE,
+    EXECUTOR_STATE_FILE_MODE,
+    OLD_ROUTE_BRANCH,
+    OLD_ROUTE_REFRESH,
+    U05_FIXTURE_CHECK,
+    U05_CHECK_TEXT_RESPAWN_FAILED,
+    U05_CHECK_TEXT_ATTESTATION_FAILED,
+    RISK_SENTENCE_ID_HOST,
+    SPAN_DURABLE_ENROLLMENT,
+    ENROLL_POLL_ERROR_STATUS,
+    /** Ruling 19: every refusal exits 1 (with or without --json); usage errors and the gate exit 2. */
+    CLI_REFUSAL_EXIT,
+    CLI_USAGE_EXIT,
+    // ---- executor wire (rulings 33.28, 33.28.1) ----
+    EXECUTOR_KEY_HEADER,
+    // ---- charter by hash (ruling 33.32) ----
+    INTERNAL_KEY_HEADER,
+    CHARTER_SEALED_AT_PATTERN: CHARTER_SEALED_AT_RE.source,
+    // ---- Doors amendment (rulings 34.01-34.12) ----
+    DURABLE_POOL_CLAIM_FLAG: D.DURABLE_POOL_CLAIM_FLAG,
+    OIDC_EXCHANGE_AUDIENCE: D.OIDC_EXCHANGE_AUDIENCE,
+    LIVE_LEASE_CAP_MIN: D.LIVE_LEASE_CAP_MIN,
+    LIVE_LEASE_CAP_MAX: D.LIVE_LEASE_CAP_MAX,
+    ORG_CAP_LOCK_PREFIX: D.ORG_CAP_LOCK_PREFIX,
+    DEFAULT_LEASE_CAP_ENV: D.DEFAULT_LEASE_CAP_ENV,
+    DISPATCH_SESSION_CID_PREFIX: D.DISPATCH_SESSION_CID_PREFIX,
+    DISPATCH_SESSION_NAME_PREFIX: D.DISPATCH_SESSION_NAME_PREFIX,
+    READY_SESSIONS_LIMIT_MIN: D.READY_SESSIONS_LIMIT_MIN,
+    READY_SESSIONS_LIMIT_MAX: D.READY_SESSIONS_LIMIT_MAX,
+    READY_USER_TEXT,
+    RUNNER_FAILED_PHASE_PATTERN: D.RUNNER_FAILED_PHASE_RE.source,
+    AGENT_SESSIONS_READY_CHECK,
+    AGENT_SESSIONS_WAIT_PARKED_CHECK,
+    AGENT_EXECUTORS_SCOPE_CHECK,
+});
+const identityMap = (keys) => Object.freeze(Object.fromEntries(keys.map((k) => [k, k])));
+export const FREEZE_STRUCTURED = Object.freeze({
+    /** Every frozen error code, keyed by itself (`$S1.CODES.durable_lease_fenced` is the code). */
+    CODES: identityMap(Object.keys(DURABLE_CODES)),
+    /** durable_claim_outcome values, keyed by themselves. */
+    CLAIM_OUTCOME: identityMap(CLAIM_OUTCOMES),
+    /**
+     * The C10-R0 (i)-(k) journal refusals by role, as C10 cases cite them
+     * (`$S1.JOURNAL_CODES.unknown_kind`). No "not homed" entry: S1 freezes no such code.
+     */
+    JOURNAL_CODES: Object.freeze({
+        append_conflict: "durable_append_conflict",
+        idempotency_conflict: "durable_idempotency_conflict",
+        unknown_kind: "durable_unknown_kind",
+        writer_class: "durable_writer_refused",
+        refs_invalid: "durable_refs_invalid",
+    }),
+    EXECUTOR_WRITABLE_KINDS,
+    GATEWAY_WRITABLE_KINDS,
+    EVENT_PREIMAGE_FIELDS,
+    CHARTER_PREIMAGE_FIELDS,
+    CHARTER_HASH_EXCLUDED_COLUMNS,
+    PIN_KEYS,
+    M1_SPAN_NAMES,
+    SPAN_ATTRIBUTE_KEYS,
+    ATTRIBUTE_VALUES,
+    M1_TABLES,
+    M1_COLUMNS,
+    M1_FUNCTIONS,
+    M1_ARBITERS,
+    EXECUTE_EXCEPTIONS,
+    /** durable_approvals subjects and target rule (ruling 32.12). */
+    DURABLE_APPROVAL_SUBJECTS,
+    DURABLE_APPROVAL_SESSIONLESS_SUBJECTS,
+    FIX_LINES,
+    RESERVED_SESSION_VERBS,
+    CANONICAL_CELL_IDS,
+    KEY_EFFECT_OF_TRANSITION,
+    REVOKING_TRANSITIONS,
+    TEST_MODE_GUARD_LISTS: GUARD_LISTS,
+    TEST_MODE_MODULE,
+    /** The C17-R18 integrity allowlist (ruling 31(2)). */
+    TEST_ALLOWLIST,
+    /** M1 CLI command paths and long options (ruling 32.01; E4 D1 product_missing). */
+    M1_CLI_SURFACE,
+    /** Pre-M1 `mnemom agent` launcher sub-verbs, first word only (ruling 32.35). */
+    PRE_M1_LAUNCHER_SUBVERBS,
+    /** The exports a pure_fn step may call (ruling 32.34; CASE-DSL rule 30). */
+    PURE_FN_EXPORTS,
+    /** M1 exports a pure_fn step may name before they land (ruling 33.01; E4 detector D4). */
+    PURE_FN_M1_PENDING,
+    /** The resolver per-field schema (C06-R15). */
+    RESOLVER_SCHEMA,
+    /** guard_state fixtures (jsonb) the datasets write: passes guardStateOk / the shape fault. */
+    GUARD_STATE_OK,
+    GUARD_STATE_FAULT,
+    // ---- wave-0 fix amendment ----
+    /** Executor and internal routes: `$S1.ROUTES.<name>.path`, or `.pre` + id + `.post`. */
+    ROUTES,
+    /**
+     * The closed list of freeze-record names allowed to be null (ruling 1.03): null until ruling 34.17.
+     * Empty since the ruling 34.17 calibration set L_spawn and T_hello.
+     */
+    CALIBRATED_PENDING: Object.freeze([]),
+    TERMINAL_EVENT_KINDS,
+    SECRET_SCOPE,
+    ENROLL_POLL_ERRORS,
+    DEVICE_PAGE_MARKERS,
+    STOPPED_FIX,
+    STOPPED_REASON_TEXT,
+    // ---- batch-24 freeze (ruling 24.0) ----
+    /** executor-state.json: closed {version: 1, executor_id, executor_key, nonce, boot_id} (24.14). */
+    EXECUTOR_STATE_SCHEMA,
+    /** Heartbeat request entry / response entry keys; match results by session_id (24.15). */
+    HEARTBEAT_ENTRY_FIELDS,
+    HEARTBEAT_RESULT_FIELDS,
+    /** GET exec_sessions body: only sessions[] and each item's uuid id are frozen (24.16). */
+    EXEC_SESSIONS_RESPONSE,
+    /** Owner session view: cc_session_id present, string or null; the view is otherwise open (#1085). */
+    OWNER_SESSION_VIEW_FIELDS,
+    /** Claim refusal details (24.22.1): lost_race reasons, ineligible reasons and their presence rules. */
+    CLAIM_LOST_RACE_REASONS,
+    CLAIM_INELIGIBLE_REASONS,
+    CLAIM_INELIGIBLE_DETAILS,
+    /** durable_refs_invalid details.reason for a refused park (34.06.3.1). */
+    PARK_REFUSAL_REASONS,
+    /** host status --json, closed: top level, seats[] and sessions[] (rulings 26, 24.12). */
+    HOST_STATUS_JSON,
+    /** host status --json for no state file, enrolled with no nonce, uninstalled with a state file (26.1). */
+    HOST_STATUS_JSON_VECTORS,
+    /** C06 sweep dimension vocabulary admitSweepDigest accepts; dims arrive ordered (24.11.1). */
+    ADMIT_SWEEP_VALUES,
+    /** Pack-time plugin integrity manifest, closed (ruling 25). */
+    PLUGIN_MANIFEST_SCHEMA,
+    PLUGIN_MANIFEST_FAILURES,
+    // ---- executor wire (rulings 33.28, 33.28.1) ----
+    HEARTBEAT_REQUEST_KEYS,
+    CLAIM_BODY_KEYS,
+    // ---- charter by hash (ruling 33.32) ----
+    CHARTER_BY_HASH_BODY_KEYS,
+    CHARTER_BY_HASH_RESPONSE,
+    GATEWAY_EVENTS_BODY_KEYS,
+    // ---- Doors amendment (rulings 34.01-34.12) ----
+    READY_CAUSES,
+    WAIT_REASONS,
+    PARKED_ONLY_WAIT_REASONS,
+    WAIT_REF_KEYS: D.WAIT_REF_KEYS,
+    CLEAR_WAIT_OUTCOMES: D.CLEAR_WAIT_OUTCOMES,
+    EXECUTOR_SCOPES: D.EXECUTOR_SCOPES,
+    ORG_SCOPE_EXECUTOR_KINDS: D.ORG_SCOPE_EXECUTOR_KINDS,
+    OIDC_EXCHANGE_REFUSALS: D.OIDC_EXCHANGE_REFUSALS,
+    ORG_POLICY_LIMIT_KEYS: D.ORG_POLICY_LIMIT_KEYS,
+    POOL_CLAIM_FIELDS: D.POOL_CLAIM_FIELDS,
+    CREATE_READY_SESSION_REFUSALS: D.CREATE_READY_SESSION_REFUSALS,
+    CREATE_READY_SESSION_OUTCOMES: D.CREATE_READY_SESSION_OUTCOMES,
+    CREATE_READY_SESSION_ANSWERS: D.CREATE_READY_SESSION_ANSWERS,
+    JOURNAL_APPROVAL_KINDS,
+    RUNNER_OUTCOMES: D.RUNNER_OUTCOMES,
+    RUNNER_OUTCOME_FIELDS: D.RUNNER_OUTCOME_FIELDS,
+    RUNNER_EXIT_CODES: D.RUNNER_EXIT_CODES,
+    RUNNER_FAILED_REASONS: D.RUNNER_FAILED_REASONS,
+    RUNNER_REFUSED_REASONS: D.RUNNER_REFUSED_REASONS,
+    RUNNER_OPEN_MODE_TOLERATED: D.RUNNER_OPEN_MODE_TOLERATED,
+    RUNNER_MERGE_STRATEGIES: D.RUNNER_MERGE_STRATEGIES,
+});
+/** DSL spellings already in the case files (CASE-DSL section 5.2 names $S1.L_spawn), each to one canonical name. */
+export const FREEZE_ALIASES = Object.freeze({
+    L_SPAWN: "L_spawn",
+    T_HELLO_S: "T_hello",
+    PER_SESSION_BUDGET_LIMIT: "PER_SESSION_BUDGET_LIMIT_USD",
+    PER_SESSION_LIMIT: "PER_SESSION_BUDGET_LIMIT_USD",
+    DEFAULT_LEASE_SECONDS: "LEASE_SECONDS_DEFAULT",
+    STATEMENT_MAX: "CONTRACT_STATEMENT_MAX_CHARS",
+    GATEWAY_EVENTS_PATH: "GATEWAY_EVENTS_ROUTE",
+    SPAN_NAME_HELLO: "SPAN_DURABLE_SEAT_HELLO",
+    DEVICE_VERIFY_WOULD_REFUSE_SPAN: "SPAN_DEVICE_VERIFY_WOULD_REFUSE",
+    SPAN_NAMES_M1: "M1_SPAN_NAMES",
+    SPAN_KEYS_M1: "SPAN_ATTRIBUTE_KEYS",
+    ARBITERS: "M1_ARBITERS",
+    FUNCTION_EXECUTE_EXCEPTIONS: "EXECUTE_EXCEPTIONS",
+    TEST_MODE_GUARD_URLS: "TEST_MODE_GUARD_LISTS",
+});
+const own = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
+/** True when `name` is a frozen S1 name (canonical or alias), set or not. */
+export function s1Has(name) {
+    return own(FREEZE_RECORD, name) || own(FREEZE_STRUCTURED, name) || own(FREEZE_ALIASES, name);
+}
+/**
+ * True when `name` (canonical or alias) is a CALIBRATED_PENDING name whose value is still null: the
+ * G4 resolution check counts it RESOLVED_PENDING and the runner reports a case reading it NOT_RUN
+ * (s1_uncalibrated:<name>), never substituting a default (ruling 1.03).
+ */
+export function s1Pending(name) {
+    const canonical = own(FREEZE_ALIASES, name)
+        ? FREEZE_ALIASES[name]
+        : name;
+    return pendingIn(FREEZE_RECORD, FREEZE_STRUCTURED.CALIBRATED_PENDING, canonical);
+}
+/**
+ * The ruling 1.03 test behind s1Pending: `canonical` is listed in `pending` and still null in
+ * `record`. Kept apart so the rule stays tested while CALIBRATED_PENDING is empty (ruling 34.17).
+ */
+export function pendingIn(record, pending, canonical) {
+    return pending.includes(canonical) && record[canonical] === null;
+}
+/**
+ * `record[canonical]` for s1Value: throws on an unknown name or an unset (null) value, naming the
+ * spelling the case used. Kept apart for the same reason as pendingIn.
+ */
+export function recordValueIn(record, canonical, name) {
+    if (!own(record, canonical))
+        throw new RangeError(`unknown S1 name: ${name}`);
+    const v = record[canonical];
+    if (v === null)
+        throw new RangeError(`S1 ${name} is not set yet`);
+    return v;
+}
+/** `$S1.<NAME>` lookup for the case runner; throws on an unknown name or an unset (null) value. */
+export function s1Value(name) {
+    const canonical = own(FREEZE_ALIASES, name)
+        ? FREEZE_ALIASES[name]
+        : name;
+    if (own(FREEZE_STRUCTURED, canonical))
+        return FREEZE_STRUCTURED[canonical];
+    return recordValueIn(FREEZE_RECORD, canonical, name);
+}
+/** `$S1.<NAME>.<path>` lookup: `.field` segments and `[n]` indexes; throws on any missing segment. */
+export function s1Resolve(ref) {
+    const m = /^([A-Za-z0-9_]+)((?:\.[A-Za-z0-9_]+|\[\d+\])*)$/.exec(ref);
+    if (!m)
+        throw new RangeError(`malformed S1 reference: ${ref}`);
+    let v = s1Value(m[1]);
+    for (const seg of m[2].match(/\.[A-Za-z0-9_]+|\[\d+\]/g) ?? []) {
+        const key = seg.startsWith(".") ? seg.slice(1) : seg.slice(1, -1);
+        if (v === null || typeof v !== "object" || !own(v, key))
+            throw new RangeError(`S1 reference ${ref}: no ${seg}`);
+        v = v[key];
+    }
+    return v;
+}

package/dist/vendor/shared/durable-contract/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @mnemom/durable-contract (S1): the frozen shared contract for durable governed agents, M1.
+ * Every export is listed in FREEZE.json; adding, removing or changing one is an S1 amendment.
+ */
+export * from "./canonical.js";
+export * from "./constants.js";
+export * from "./states.js";
+export * from "./codes.js";
+export * from "./cli-output.js";
+export * from "./cli-surface.js";
+export * from "./pure-fn.js";
+export * from "./fixlines.js";
+export * from "./events.js";
+export * from "./admission.js";
+export * from "./owner-verbs.js";
+export * from "./cell-id.js";
+export * from "./session-id.js";
+export * from "./keys.js";
+export * from "./arm.js";
+export * from "./turn.js";
+export * from "./telemetry.js";
+export * from "./test-mode.js";
+export * from "./schema.js";
+export * from "./spec.js";
+export * from "./envelope.js";
+export * from "./seal.js";
+export * from "./paths.js";
+export * from "./executor-state.js";
+export * from "./routes.js";
+export * from "./doors.js";
+export * from "./journal-approvals.js";
+export * from "./secret-scope.js";
+export * from "./names.js";
+export * from "./lock.js";
+export * from "./freeze-record.js";
+export * from "./vectors.js";

package/dist/vendor/shared/durable-contract/index.js

@@ -0,0 +1,37 @@
+// GENERATED from shared/durable-contract/src/index.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * @mnemom/durable-contract (S1): the frozen shared contract for durable governed agents, M1.
+ * Every export is listed in FREEZE.json; adding, removing or changing one is an S1 amendment.
+ */
+export * from "./canonical.js";
+export * from "./constants.js";
+export * from "./states.js";
+export * from "./codes.js";
+export * from "./cli-output.js";
+export * from "./cli-surface.js";
+export * from "./pure-fn.js";
+export * from "./fixlines.js";
+export * from "./events.js";
+export * from "./admission.js";
+export * from "./owner-verbs.js";
+export * from "./cell-id.js";
+export * from "./session-id.js";
+export * from "./keys.js";
+export * from "./arm.js";
+export * from "./turn.js";
+export * from "./telemetry.js";
+export * from "./test-mode.js";
+export * from "./schema.js";
+export * from "./spec.js";
+export * from "./envelope.js";
+export * from "./seal.js";
+export * from "./paths.js";
+export * from "./executor-state.js";
+export * from "./routes.js";
+export * from "./doors.js";
+export * from "./journal-approvals.js";
+export * from "./secret-scope.js";
+export * from "./names.js";
+export * from "./lock.js";
+export * from "./freeze-record.js";
+export * from "./vectors.js";

package/dist/vendor/shared/durable-contract/journal-approvals.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Record's "approved" line (ruling 34.07; design T11): which approvals the durable journal holds
+ * as approved. Record imports countJournalApprovals and never re-derives the rule.
+ */
+import { APPROVAL_KINDS } from "./events.js";
+/** The two kinds whose pairing makes an approval count as approved (34.07 (1)). */
+export declare const JOURNAL_APPROVAL_KINDS: readonly ["approval.resolved", "approval.consumed"];
+export interface JournalApprovalEvent {
+    readonly seq: number;
+    readonly kind: string;
+    readonly refs: Readonly<Record<string, unknown>> | null;
+}
+export interface JournalApprovalCount {
+    /** resolved {decision: approved} and consumed, same approval_id. */
+    approved: number;
+    /** resolved approved with no consumed. */
+    approved_not_used: number;
+    /** approval.single_person_override events, counted apart and never as approved. */
+    single_person_overrides: number;
+    /** approved, per approval_kind. */
+    by_kind: Record<(typeof APPROVAL_KINDS)[number], number>;
+}
+/**
+ * Counts a verified chain's approvals up to and including `tipSeq` (34.07 (2)). Reads only seq,
+ * kind and refs; order-independent; each approval_id counts at most once. The caller verifies the
+ * chain (C10) first: this function judges no hash. Throws RangeError on a second approval.resolved
+ * or a second approval.consumed for one approval_id (34.14 (7)).
+ */
+export declare function countJournalApprovals(events: readonly JournalApprovalEvent[], tipSeq: number): JournalApprovalCount;

package/dist/vendor/shared/durable-contract/journal-approvals.js

@@ -0,0 +1,60 @@
+// GENERATED from shared/durable-contract/src/journal-approvals.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * Record's "approved" line (ruling 34.07; design T11): which approvals the durable journal holds
+ * as approved. Record imports countJournalApprovals and never re-derives the rule.
+ */
+import { APPROVAL_KINDS } from "./events.js";
+/** The two kinds whose pairing makes an approval count as approved (34.07 (1)). */
+export const JOURNAL_APPROVAL_KINDS = ["approval.resolved", "approval.consumed"];
+const idOf = (e) => e.refs !== null && typeof e.refs.approval_id === "string" ? e.refs.approval_id : null;
+/**
+ * Counts a verified chain's approvals up to and including `tipSeq` (34.07 (2)). Reads only seq,
+ * kind and refs; order-independent; each approval_id counts at most once. The caller verifies the
+ * chain (C10) first: this function judges no hash. Throws RangeError on a second approval.resolved
+ * or a second approval.consumed for one approval_id (34.14 (7)).
+ */
+export function countJournalApprovals(events, tipSeq) {
+    const resolvedIds = new Set();
+    const resolved = new Map();
+    const consumed = new Set();
+    const overrides = new Set();
+    for (const e of events) {
+        if (e.seq > tipSeq)
+            continue;
+        const id = idOf(e);
+        // single_person_override is a P0b kind with no frozen refs: one with no approval_id counts once per event
+        if (e.kind === "approval.single_person_override")
+            overrides.add(id ?? `seq:${e.seq}`);
+        if (id === null)
+            continue;
+        // one approval resolves, and is consumed, exactly once: a second is a writer bug or a forgery,
+        // refused as a chain error so the count never depends on event order (ruling 34.14 (7))
+        if (e.kind === "approval.resolved") {
+            if (resolvedIds.has(id))
+                throw new RangeError(`approval ${id} resolved twice`);
+            resolvedIds.add(id);
+            if (e.refs?.decision === "approved")
+                resolved.set(id, String(e.refs.approval_kind));
+        }
+        else if (e.kind === "approval.consumed") {
+            if (consumed.has(id))
+                throw new RangeError(`approval ${id} consumed twice`);
+            consumed.add(id);
+        }
+    }
+    const by_kind = Object.fromEntries(APPROVAL_KINDS.map((k) => [k, 0]));
+    let approved = 0;
+    for (const [id, kind] of resolved) {
+        if (!consumed.has(id))
+            continue;
+        approved++;
+        if (Object.prototype.hasOwnProperty.call(by_kind, kind))
+            by_kind[kind]++;
+    }
+    return {
+        approved,
+        approved_not_used: resolved.size - approved,
+        single_person_overrides: overrides.size,
+        by_kind,
+    };
+}

package/dist/vendor/shared/durable-contract/keys.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Key prefix helpers (BACKBONE S1; C06-R01). Every gateway caller of a Mnemom key branches on
+ * the exact, case-sensitive `mnm_ds_` prefix BEFORE hashing, resolve_mnemom_api_key,
+ * classifyInvalidMnemomKeyForLog or agent-hash derivation; the shared resolver never sees one.
+ */
+export declare const LEASE_KEY_PREFIX = "mnm_ds_";
+export declare const MNEMOM_KEY_PREFIX = "mnm_";
+export declare const LEASE_KEY_SCOPE = "gateway:durable";
+export declare const EXECUTOR_KEY_SCOPES: readonly ["durable:*"];
+export declare const EXECUTOR_KEY_KIND = "executor";
+/** Random part of a minted lease key: 32 bytes, base64url, 43 chars. */
+export declare const LEASE_KEY_RANDOM_BYTES = 32;
+export declare const LEASE_KEY_BODY_RE: RegExp;
+export type KeyClass = "lease" | "mnemom" | "other";
+/** Exact, case-sensitive classification; no trimming (a padded key is "other"). */
+export declare function classifyKey(key: unknown): KeyClass;
+export declare function isLeaseKey(key: unknown): key is string;
+/** A lease key in the minted shape: prefix plus 43 base64url chars. Shape only, never validity. */
+export declare function isWellFormedLeaseKey(key: unknown): boolean;
+/** Prefix vectors: the input and its class (C06 dataset (a), 32 prefix vectors). */
+export declare const KEY_PREFIX_VECTORS: readonly {
+    key: unknown;
+    class: KeyClass;
+}[];

package/dist/vendor/shared/durable-contract/keys.js

@@ -0,0 +1,66 @@
+// GENERATED from shared/durable-contract/src/keys.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * Key prefix helpers (BACKBONE S1; C06-R01). Every gateway caller of a Mnemom key branches on
+ * the exact, case-sensitive `mnm_ds_` prefix BEFORE hashing, resolve_mnemom_api_key,
+ * classifyInvalidMnemomKeyForLog or agent-hash derivation; the shared resolver never sees one.
+ */
+export const LEASE_KEY_PREFIX = "mnm_ds_";
+export const MNEMOM_KEY_PREFIX = "mnm_";
+export const LEASE_KEY_SCOPE = "gateway:durable";
+export const EXECUTOR_KEY_SCOPES = ["durable:*"];
+export const EXECUTOR_KEY_KIND = "executor";
+/** Random part of a minted lease key: 32 bytes, base64url, 43 chars. */
+export const LEASE_KEY_RANDOM_BYTES = 32;
+export const LEASE_KEY_BODY_RE = /^[A-Za-z0-9_-]{43}$/;
+/** Exact, case-sensitive classification; no trimming (a padded key is "other"). */
+export function classifyKey(key) {
+    if (typeof key !== "string")
+        return "other";
+    if (key.startsWith(LEASE_KEY_PREFIX))
+        return "lease";
+    if (key.startsWith(MNEMOM_KEY_PREFIX))
+        return "mnemom";
+    return "other";
+}
+export function isLeaseKey(key) {
+    return classifyKey(key) === "lease";
+}
+/** A lease key in the minted shape: prefix plus 43 base64url chars. Shape only, never validity. */
+export function isWellFormedLeaseKey(key) {
+    return isLeaseKey(key) && LEASE_KEY_BODY_RE.test(key.slice(LEASE_KEY_PREFIX.length));
+}
+/** Prefix vectors: the input and its class (C06 dataset (a), 32 prefix vectors). */
+export const KEY_PREFIX_VECTORS = [
+    { key: "mnm_ds_" + "A".repeat(43), class: "lease" },
+    { key: "mnm_ds_", class: "lease" },
+    { key: "mnm_ds_x", class: "lease" },
+    { key: "mnm_abc", class: "mnemom" },
+    { key: "mnm_", class: "mnemom" },
+    { key: "mnm_d", class: "mnemom" },
+    { key: "mnm_dsx", class: "mnemom" },
+    { key: "mnm_ds", class: "mnemom" },
+    { key: "mnm-ds_abc", class: "other" },
+    { key: "MNM_DS_abc", class: "other" },
+    { key: "Mnm_ds_abc", class: "other" },
+    { key: "mnm_DS_abc", class: "mnemom" },
+    { key: " mnm_ds_abc", class: "other" },
+    { key: "\tmnm_ds_abc", class: "other" },
+    { key: "mnm_ds_abc ", class: "lease" },
+    { key: "\u200bmnm_ds_abc", class: "other" },
+    { key: "\ufeffmnm_ds_abc", class: "other" },
+    { key: "\uff4dnm_ds_abc", class: "other" },
+    { key: "mnm‐ds_abc", class: "other" },
+    { key: "sk-ant-api03-abc", class: "other" },
+    { key: "Bearer mnm_ds_abc", class: "other" },
+    { key: "", class: "other" },
+    { key: "m", class: "other" },
+    { key: "mnm", class: "other" },
+    { key: "mn_ds_abc", class: "other" },
+    { key: "xmnm_ds_abc", class: "other" },
+    { key: "mnm__ds_abc", class: "mnemom" },
+    { key: "mnm_ds_mnm_ds_abc", class: "lease" },
+    { key: null, class: "other" },
+    { key: undefined, class: "other" },
+    { key: 42, class: "other" },
+    { key: ["mnm_ds_abc"], class: "other" },
+];