@ours.network/fleet 1.2.0-nightly.3 → 1.2.0-nightly.31

package/dist/agent-ours/file-rpc.js

@@ -0,0 +1,123 @@
+import { randomUUID } from 'node:crypto';
+import { MAX_CHUNK_BYTES } from './wire.js';
+/** Call-scoped callbacks carry no daemon credentials or upload receipts. */
+export class FileCallbacks {
+    wire;
+    pending = new Map();
+    constructor(wire) {
+        this.wire = wire;
+    }
+    receive(frame) {
+        if (frame?.kind !== 'fs-result' || typeof frame.id !== 'string')
+            throw Error('INVALID_FILE_RESPONSE');
+        const p = this.pending.get(frame.id);
+        if (!p)
+            throw Error('UNSOLICITED_FILE_RESPONSE');
+        this.pending.delete(frame.id);
+        clearTimeout(p.timer);
+        if (frame.error)
+            p.reject(Error('AGENT_FILE_OPERATION_FAILED'));
+        else
+            p.resolve(frame.value);
+    }
+    close() {
+        for (const p of this.pending.values()) {
+            clearTimeout(p.timer);
+            p.reject(Error('FILE_BRIDGE_DISCONNECTED'));
+        }
+        this.pending.clear();
+    }
+    async rpc(call, op, args, signal) {
+        signal.throwIfAborted();
+        if (this.pending.size >= 64)
+            throw Error('FILE_CALLBACK_LIMIT');
+        const id = randomUUID();
+        return new Promise((resolve, reject) => {
+            const finish = (f) => (value) => {
+                signal.removeEventListener('abort', abort);
+                f(value);
+            };
+            const fail = (reason) => {
+                const p = this.pending.get(id);
+                if (!p)
+                    return;
+                this.pending.delete(id);
+                clearTimeout(p.timer);
+                finish(reject)(reason);
+            };
+            const abort = () => fail(Error('FILE_CALLBACK_ABORTED'));
+            const timer = setTimeout(() => fail(Error('FILE_CALLBACK_TIMEOUT')), 30_000);
+            timer.unref();
+            this.pending.set(id, { resolve: finish(resolve), reject: finish(reject), timer });
+            signal.addEventListener('abort', abort, { once: true });
+            void this.wire
+                .send({ kind: 'fs', id, call, op, args })
+                .catch(() => fail(Error('FILE_BRIDGE_DISCONNECTED')));
+        });
+    }
+    async canRead(path, extra) {
+        return (await this.rpc(String(extra.requestId), 'probe', { path }, extra.signal)) === true;
+    }
+    async read(path, extra) {
+        const call = String(extra.requestId), handle = randomUUID();
+        const meta = await this.rpc(call, 'read-open', { path, handle }, extra.signal);
+        if (!meta ||
+            typeof meta.filename !== 'string' ||
+            !Number.isSafeInteger(meta.size) ||
+            meta.size < 0)
+            throw Error('INVALID_FILE_METADATA');
+        const close = async () => {
+            await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
+        };
+        const body = new ReadableStream({
+            pull: async (controller) => {
+                try {
+                    const chunk = await this.rpc(call, 'read', { handle }, extra.signal);
+                    if (chunk === null) {
+                        controller.close();
+                        return;
+                    }
+                    if (typeof chunk !== 'string' || chunk.length > Math.ceil(MAX_CHUNK_BYTES / 3) * 4)
+                        throw Error('INVALID_FILE_CHUNK');
+                    const bytes = Buffer.from(chunk, 'base64');
+                    if (bytes.length > MAX_CHUNK_BYTES)
+                        throw Error('FILE_CHUNK_TOO_LARGE');
+                    controller.enqueue(bytes);
+                }
+                catch (error) {
+                    controller.error(error);
+                    await close();
+                }
+            },
+            cancel: close,
+        });
+        return { filename: meta.filename, size: meta.size, body, close };
+    }
+    async write(path, body, extra) {
+        const call = String(extra.requestId), handle = randomUUID();
+        const reader = body.getReader();
+        try {
+            const resolved = await this.rpc(call, 'write-open', { path, handle }, extra.signal);
+            if (typeof resolved !== 'string')
+                throw Error('INVALID_FILE_PATH');
+            let size = 0;
+            for (;;) {
+                extra.signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                for (let offset = 0; offset < chunk.value.length; offset += MAX_CHUNK_BYTES) {
+                    const bytes = chunk.value.subarray(offset, offset + MAX_CHUNK_BYTES);
+                    size += bytes.length;
+                    await this.rpc(call, 'write', { handle, data: Buffer.from(bytes).toString('base64') }, extra.signal);
+                }
+            }
+            await this.rpc(call, 'close', { handle }, extra.signal);
+            return { path: resolved, size };
+        }
+        finally {
+            await reader.cancel().catch(() => { });
+            await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
+        }
+    }
+}

package/dist/agent-ours/harness.d.ts

@@ -0,0 +1,14 @@
+import type { AcpMcpServer } from '../harness/types.js';
+import type { ResolvedRole } from '../config.js';
+export interface ManagedHarnessOurs {
+    server: AcpMcpServer;
+    native: Record<string, unknown>;
+}
+/** Do not pass the supervisor's ours connection credentials to harness children. */
+export declare function managedChildEnvironment(input: NodeJS.ProcessEnv): Record<string, string>;
+/** Replace ours only; retain the user's ordinary harness configuration and plugins. */
+export declare function prepareManagedHarness(role: ResolvedRole, stateDir: string, cwd: string, descriptor: string, env: Record<string, string>): {
+    ours: ManagedHarnessOurs;
+    env: Record<string, string>;
+};
+export declare function managedClaudeMeta(base: Record<string, unknown> | undefined): Record<string, unknown>;

package/dist/agent-ours/harness.js

@@ -0,0 +1,72 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/** Do not pass the supervisor's ours connection credentials to harness children. */
+export function managedChildEnvironment(input) {
+    const out = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (value === undefined || (/^OURS_/i.test(key) && !key.startsWith('OURS_FLEET_')))
+            continue;
+        out[key] = value;
+    }
+    out.FLEET_OURS_MANAGED = '1';
+    return out;
+}
+/** Replace ours only; retain the user's ordinary harness configuration and plugins. */
+export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
+    const bridge = fileURLToPath(new URL('./bridge.js', import.meta.url));
+    const server = {
+        name: 'ours',
+        command: process.execPath,
+        args: [bridge],
+        env: [{ name: 'FLEET_OURS_BRIDGE_DESCRIPTOR', value: descriptor }],
+    };
+    // Portable allow covers bound identity messaging, not all tools on the server.
+    const tools = role.harness === 'codex' && role.permissions?.approval === 'allow'
+        ? Object.fromEntries([
+            'current_identity', 'get_messages', 'list_history', 'list_contacts', 'send_message',
+        ].map(name => [name, { approval_mode: 'approve' }]))
+        : undefined;
+    const native = {
+        mcp_servers: {
+            ours: {
+                command: process.execPath,
+                args: [bridge],
+                env: { FLEET_OURS_BRIDGE_DESCRIPTOR: descriptor },
+                ...(tools ? { tools } : {}),
+            },
+        },
+        plugins: { 'ours@ours-codex-marketplace': { enabled: false } },
+    };
+    const child = managedChildEnvironment({ ...process.env, ...env });
+    if (role.harness === 'codex') {
+        const config = child.CODEX_CONFIG ? JSON.parse(child.CODEX_CONFIG) : {};
+        child.CODEX_CONFIG = JSON.stringify({
+            ...config,
+            mcp_servers: { ...config.mcp_servers, ...native.mcp_servers },
+            plugins: { ...config.plugins, ...native.plugins },
+        });
+        // codex-acp otherwise prefers a same-name connector from the user's config.
+        child.DISABLE_MCP_CONFIG_FILTERING = 'true';
+    }
+    return { ours: { server, native }, env: child };
+}
+export function managedClaudeMeta(base) {
+    const meta = base ?? {}, claude = (meta.claudeCode ?? {});
+    const options = (claude.options ?? {});
+    const settings = typeof options.settings === 'string'
+        ? JSON.parse(readFileSync(options.settings, 'utf8'))
+        : (options.settings ?? {});
+    return {
+        ...meta,
+        claudeCode: {
+            ...claude,
+            options: {
+                ...options,
+                settings: {
+                    ...settings,
+                    enabledPlugins: { ...settings.enabledPlugins, 'ours@ours.network': false },
+                },
+            },
+        },
+    };
+}

package/dist/agent-ours/mcp-endpoint.d.ts

@@ -0,0 +1,15 @@
+import type { ApplicationIdentityStore } from '@ours.network/mcp/application-identities';
+import type { OursClient } from '@ours.network/sdk/client';
+import type { AgentOursRuntime } from './runtime.js';
+export interface EndpointOptions {
+    socket: string;
+    capability: string;
+    generation: number;
+    runtime: AgentOursRuntime;
+    client: OursClient;
+    identities: ApplicationIdentityStore;
+    remoteDaemonFiles: boolean;
+}
+export declare function startMcpEndpoint(options: EndpointOptions): Promise<{
+    close(): Promise<void>;
+}>;

package/dist/agent-ours/mcp-endpoint.js

@@ -0,0 +1,111 @@
+import { createServer } from 'node:net';
+import { chmod, unlink } from 'node:fs/promises';
+import { timingSafeEqual } from 'node:crypto';
+import { createManagedOursMcpServer } from '@ours.network/mcp/server';
+import { JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
+import { FileCallbacks } from './file-rpc.js';
+import { Wire } from './wire.js';
+export async function startMcpEndpoint(options) {
+    const sockets = new Set();
+    const server = createServer((socket) => {
+        if (sockets.size >= 4) {
+            socket.destroy();
+            return;
+        }
+        const wire = new Wire(socket);
+        sockets.add(wire);
+        const files = new FileCallbacks(wire);
+        let authenticated = false;
+        let inFlight = 0;
+        const ids = new Set();
+        const deadline = setTimeout(() => wire.close(), 5000);
+        deadline.unref();
+        const transport = {
+            start: async () => { },
+            send: async (message) => {
+                if ('id' in message &&
+                    message.id !== undefined &&
+                    ('result' in message || 'error' in message))
+                    ids.delete(message.id);
+                await wire.send({ kind: 'mcp', value: message });
+            },
+            close: async () => wire.close(),
+        };
+        const mcp = createManagedOursMcpServer(options.client, 'managed-v1', options.identities, {
+            remoteDaemonFiles: options.remoteDaemonFiles,
+            fileContext: files,
+            admit: async () => {
+                if (!authenticated || inFlight >= 32)
+                    throw Error('MCP_ADMISSION_LIMIT');
+                inFlight++;
+                try {
+                    const release = await options.runtime.admit();
+                    return () => {
+                        inFlight--;
+                        release();
+                    };
+                }
+                catch (error) {
+                    inFlight--;
+                    throw error;
+                }
+            },
+        });
+        wire.onClose = () => {
+            clearTimeout(deadline);
+            sockets.delete(wire);
+            files.close();
+            transport.onclose?.();
+        };
+        wire.onFrame = (frame) => {
+            if (!authenticated) {
+                const actual = typeof frame?.capability === 'string' ? Buffer.from(frame.capability) : Buffer.alloc(0);
+                const expected = Buffer.from(options.capability);
+                if (frame?.kind !== 'hello' ||
+                    frame.generation !== options.generation ||
+                    actual.length !== expected.length ||
+                    !timingSafeEqual(actual, expected))
+                    throw Error('UNAUTHORIZED_BRIDGE');
+                authenticated = true;
+                clearTimeout(deadline);
+                void mcp
+                    .connect(transport)
+                    .then(() => wire.send({ kind: 'ready' }))
+                    .catch(() => wire.close());
+                return;
+            }
+            if (frame?.kind === 'fs-result') {
+                files.receive(frame);
+                return;
+            }
+            if (frame?.kind !== 'mcp')
+                throw Error('UNKNOWN_BRIDGE_OPERATION');
+            const message = JSONRPCMessageSchema.parse(frame.value);
+            if ('method' in message && 'id' in message) {
+                if (ids.has(message.id) || ids.size >= 64)
+                    throw Error('MCP_REQUEST_LIMIT');
+                ids.add(message.id);
+            }
+            transport.onmessage?.(message);
+        };
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(options.socket, () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    await chmod(options.socket, 0o600);
+    return {
+        close: async () => {
+            for (const socket of sockets)
+                socket.close();
+            await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+            await unlink(options.socket).catch((error) => {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            });
+        },
+    };
+}

package/dist/agent-ours/runtime.d.ts

@@ -0,0 +1,59 @@
+import type { AgentHistoryQuery } from './correspondence.js';
+import type { OursClient } from '@ours.network/sdk/client';
+import { RuntimeJournal, type RuntimeState } from './state.js';
+export interface AssignedIdentity {
+    instance: string;
+    generation: number;
+    daemon: string;
+    name: string;
+    lifetime: 'permanent' | 'temporary';
+    action: string;
+    expectedCid?: string;
+    allowCreate: boolean;
+    bio: string;
+}
+export interface RoomAdmission {
+    id: string;
+    cid: string;
+    seat: string;
+    action: string;
+    /** The secret stays in trusted storage and is never returned to the child. */
+    redeem(client: OursClient): Promise<{
+        cid: string;
+    }>;
+    observe(agentCid: string): Promise<'pending' | 'established' | 'mismatch'>;
+    discardSecret(): Promise<void>;
+}
+export interface RuntimeDependencies {
+    journal: RuntimeJournal;
+    /** Client is already attached to the pinned daemon with its durable external owner. */
+    client: OursClient;
+    /** Checked before every operation; tied to the cross-process controller lock. */
+    assertFence(): void;
+    sleep(ms: number): Promise<void>;
+    now(): number;
+}
+/** A bridge never owns this object or its client; EOF never releases its lease. */
+export declare class AgentOursRuntime {
+    readonly assignment: AssignedIdentity;
+    private readonly deps;
+    private inFlight;
+    private drain?;
+    private accepting;
+    private state;
+    constructor(assignment: AssignedIdentity, deps: RuntimeDependencies);
+    get snapshot(): Readonly<RuntimeState>;
+    private transition;
+    private verify;
+    prepare(room?: RoomAdmission, timeoutMs?: number): Promise<void>;
+    /** Admission covers SDK calls, response rendering and agent filesystem callbacks. */
+    admit(): Promise<() => void>;
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    joinAdditionalRoom(invite: string, expectedRoomCid: string): Promise<void>;
+    readContacts(): Promise<unknown>;
+    readHistory(request: AgentHistoryQuery): Promise<unknown>;
+    startHarness<T>(start: () => Promise<T>): Promise<T>;
+    suspend(): Promise<void>;
+    terminal(): Promise<void>;
+}

package/dist/agent-ours/runtime.js

@@ -0,0 +1,283 @@
+/** A bridge never owns this object or its client; EOF never releases its lease. */
+export class AgentOursRuntime {
+    assignment;
+    deps;
+    inFlight = 0;
+    drain;
+    accepting = false;
+    state;
+    constructor(assignment, deps) {
+        this.assignment = assignment;
+        this.deps = deps;
+        const existing = deps.journal.read();
+        if (existing) {
+            if (existing.instance !== assignment.instance ||
+                existing.daemon !== assignment.daemon ||
+                existing.name !== assignment.name ||
+                existing.lifetime !== assignment.lifetime ||
+                existing.generation !== assignment.generation ||
+                existing.action !== assignment.action ||
+                (assignment.expectedCid !== undefined &&
+                    existing.cid !== undefined &&
+                    existing.cid !== assignment.expectedCid))
+                throw Error('RUNTIME_ASSIGNMENT_MISMATCH');
+            this.state = existing;
+        }
+        else {
+            // Deliberately serialize only the public ownership facts, never credentials.
+            const { instance, generation, daemon, name, lifetime, action } = assignment;
+            this.state = {
+                version: 1,
+                instance,
+                generation,
+                daemon,
+                name,
+                lifetime,
+                action,
+                phase: 'PREPARING',
+                revision: 0,
+                updatedAt: '',
+            };
+            deps.assertFence();
+            deps.journal.commit(this.state);
+            this.state = deps.journal.read();
+        }
+    }
+    get snapshot() {
+        return structuredClone(this.state);
+    }
+    transition(phase, patch = {}) {
+        this.deps.assertFence();
+        this.deps.journal.commit({ ...this.state, ...patch, phase }, this.state.revision);
+        this.state = this.deps.journal.read();
+    }
+    async verify() {
+        this.deps.assertFence();
+        if (this.assignment.expectedCid && this.state.cid !== this.assignment.expectedCid)
+            throw Error('PINNED_CID_MISMATCH');
+        const actual = await this.deps.client.currentIdentity();
+        if (actual.cid !== this.state.cid ||
+            actual.name !== this.state.name ||
+            actual.temporary !== (this.state.lifetime === 'temporary') ||
+            actual.isRoot)
+            throw Error('IDENTITY_PROOF_MISMATCH');
+        this.deps.assertFence();
+    }
+    async prepare(room, timeoutMs = 30_000) {
+        if (['TERMINAL_INTENT', 'CLEANUP_PENDING', 'RELEASED', 'FAILED', 'QUIESCING'].includes(this.state.phase))
+            throw Error('RUNTIME_NOT_RESUMABLE');
+        this.deps.assertFence();
+        if (!this.state.cid) {
+            // An existing PREPARING journal is an uncertain create, never evidence of absence.
+            if (this.state.phase === 'RECOVERING')
+                throw Error('UNCERTAIN_PROVISIONING');
+            const rows = await this.deps.client.listIdentities();
+            const row = rows.find((r) => r.name === this.state.name);
+            if (row) {
+                if (!('cid' in row) ||
+                    this.state.lifetime === 'temporary' ||
+                    !this.assignment.expectedCid ||
+                    row.cid !== this.assignment.expectedCid ||
+                    row.kind === 'root' ||
+                    row.temp)
+                    throw Error('IDENTITY_COLLISION');
+                this.transition('RECOVERING');
+                await this.deps.client.chooseIdentity({ name: this.state.name, force: false });
+                this.transition('OWNED', { cid: row.cid });
+            }
+            else {
+                if (!this.assignment.allowCreate || this.assignment.expectedCid)
+                    throw Error('IDENTITY_ABSENT');
+                // Persist uncertainty before the non-idempotent call. Crash recovery requires owner proof.
+                this.transition('RECOVERING');
+                const args = {
+                    name: this.state.name,
+                    bio: this.assignment.bio,
+                    exposeLocal: false,
+                    localAutoAccept: true,
+                };
+                const created = this.state.lifetime === 'temporary'
+                    ? await this.deps.client.createTemporaryIdentity(args)
+                    : await this.deps.client.createIdentity(args);
+                if (created.hierarchy !== 'role')
+                    throw Error('ROOT_PROVISIONING_FORBIDDEN');
+                this.transition('OWNED', { cid: created.info.cid });
+            }
+        }
+        await this.verify();
+        if (!room && (this.state.room || this.state.admissionIntent))
+            throw Error('ROOM_DESCRIPTOR_REQUIRED');
+        if (room) {
+            if (this.state.room &&
+                (this.state.room.id !== room.id ||
+                    this.state.room.cid !== room.cid ||
+                    this.state.room.seat !== room.seat ||
+                    this.state.room.agentCid !== this.state.cid ||
+                    this.state.room.action !== room.action))
+                throw Error('ROOM_ASSIGNMENT_MISMATCH');
+            const intent = this.state.admissionIntent;
+            if (intent &&
+                (intent.id !== room.id ||
+                    intent.cid !== room.cid ||
+                    intent.seat !== room.seat ||
+                    intent.action !== room.action ||
+                    intent.agentCid !== this.state.cid))
+                throw Error('ROOM_INTENT_MISMATCH');
+            if (!this.state.room && !intent) {
+                // A permanent identity may already occupy its seat after a clean supervisor stop.
+                const existing = await room.observe(this.state.cid);
+                if (existing === 'mismatch') {
+                    this.transition('FAILED');
+                    throw Error('WRONG_ROOM_SEAT');
+                }
+                this.transition('ROOM_PENDING', {
+                    admissionIntent: {
+                        id: room.id,
+                        cid: room.cid,
+                        seat: room.seat,
+                        action: room.action,
+                        agentCid: this.state.cid,
+                    },
+                });
+                if (existing !== 'established') {
+                    const result = await room.redeem(this.deps.client);
+                    if (result.cid !== room.cid) {
+                        this.transition('FAILED');
+                        throw Error('WRONG_ROOM_CID');
+                    }
+                }
+            }
+            const deadline = this.deps.now() + timeoutMs;
+            for (;;) {
+                this.deps.assertFence();
+                const observation = await room.observe(this.state.cid);
+                if (observation === 'mismatch') {
+                    this.transition('FAILED');
+                    throw Error('WRONG_ROOM_SEAT');
+                }
+                if (observation === 'established')
+                    break;
+                if (this.deps.now() >= deadline)
+                    throw Error('ROOM_PENDING');
+                await this.deps.sleep(Math.min(250, deadline - this.deps.now()));
+            }
+            this.transition('READY', {
+                room: {
+                    id: room.id,
+                    cid: room.cid,
+                    seat: room.seat,
+                    agentCid: this.state.cid,
+                    action: room.action,
+                },
+            });
+            await room.discardSecret();
+        }
+        else
+            this.transition('READY');
+        this.accepting = true;
+    }
+    /** Admission covers SDK calls, response rendering and agent filesystem callbacks. */
+    async admit() {
+        this.deps.assertFence();
+        if (!this.accepting || !['READY', 'SERVING'].includes(this.state.phase))
+            throw Error('RUNTIME_NOT_READY');
+        this.inFlight++;
+        let released = false;
+        const release = () => {
+            if (released)
+                return;
+            released = true;
+            if (--this.inFlight === 0)
+                this.drain?.();
+        };
+        try {
+            await this.verify();
+            if (!this.accepting)
+                throw Error('RUNTIME_QUIESCING');
+            return release;
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    async joinAdditionalRoom(invite, expectedRoomCid) {
+        const release = await this.admit();
+        try {
+            const contact = await this.deps.client.addContact({ invite });
+            if (contact.cid !== expectedRoomCid)
+                throw Error('ADDITIONAL_ROOM_CID_MISMATCH');
+            await this.verify();
+        }
+        finally {
+            release();
+        }
+    }
+    async readContacts() {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listContacts();
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
+    async readHistory(request) {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listHistory(request);
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
+    async startHarness(start) {
+        if (!this.accepting || this.state.phase !== 'READY')
+            throw Error('RUNTIME_NOT_READY');
+        await this.verify();
+        this.transition('SERVING');
+        return start();
+    }
+    async suspend() {
+        this.accepting = false;
+        if (this.inFlight)
+            await new Promise((resolve) => {
+                this.drain = resolve;
+            });
+        this.transition('RECOVERING');
+    }
+    async terminal() {
+        this.accepting = false;
+        if (this.state.phase === 'RELEASED')
+            return;
+        if (!['TERMINAL_INTENT', 'CLEANUP_PENDING'].includes(this.state.phase))
+            this.transition('QUIESCING');
+        if (this.inFlight)
+            await new Promise((resolve) => {
+                this.drain = resolve;
+            });
+        this.transition('TERMINAL_INTENT');
+        try {
+            this.deps.assertFence();
+            const ack = await this.deps.client.releaseLease();
+            if (!ack ||
+                !Array.isArray(ack.released) ||
+                !Array.isArray(ack.closed) ||
+                [...ack.released, ...ack.closed].some((name) => typeof name !== 'string') ||
+                [ack.attempted, ack.notified, ack.failed].some((n) => !Number.isSafeInteger(n) || n < 0) ||
+                ack.notified + ack.failed !== ack.attempted)
+                throw Error('INVALID_RELEASE_ACK');
+            this.transition('RELEASED', { releaseAck: ack });
+        }
+        catch (error) {
+            this.transition('CLEANUP_PENDING');
+            throw error;
+        }
+    }
+}