@sema-ai/registry-core 0.10.3

package/dist/fleet.js

@@ -0,0 +1,303 @@
+/**
+ * @sema-ai/registry-core/fleet — the PURE scheduling/fleet contract for the sema-center control plane
+ * (design: cc-parity CONTROL-PLANE-SCHEDULING-DESIGN.md, clay 拍 2026-07-04 — "one contract, three orchestrators").
+ *
+ * Seven domains (rolling update / discovery / traffic / failover / LB / quota / token governance) are ONE
+ * data-plane lifecycle contract reused by three deployment forms — whoever HOLDS the engine handle orchestrates,
+ * but all three read THESE shapes:
+ *   - TOC shell (engineLifecycleManager): health readiness + upgrade classification + local blue-green demo
+ *   - TOB (user k8s / fixed baseurl):     preStop→drain semantics + readiness probe = !draining
+ *   - center (orchestrator reconciler):   instance discovery table + /api/dispatch gateway + rolling primitive
+ *
+ * 🔴 Contract discipline (same rules as scheduler-store):
+ *   - ABSTRACT: types + zod wire shapes + PURE decision functions. ZERO IO, ZERO node:* — browser-safe barrel.
+ *   - FINAL-STATE: shapes codify what is SHIPPED on the wire (server 1.96.0 drain: /health `version`/`draining`/
+ *     `drainingSince`, billable submit 503+Retry-After) — no transitional aliases, breaking changes over shims
+ *     (clay 拍: no temporary compatibility design; the target is long-term stability).
+ *   - EXTENSIBLE: enums + optional fields externalize decisions (add an LB strategy = add an enum value,
+ *     the skeleton does not move).
+ */
+import { z } from "zod";
+import { fnv1a64 } from "./hash.js";
+// ── Domain 1: drain protocol (graceful rolling update — the ground every form stands on) ──────────────────
+/** Lifecycle of a draining instance. `running`→`draining` on the stop signal; `drained` once in-flight hits
+ *  zero (clean) or the grace deadline forces the issue. Exit always follows `drained`. */
+export const DRAIN_PHASES = ["running", "draining", "drained"];
+/** Shipped default (server 1.96.0): generous by design — the only unrecoverable loss on restart is the
+ *  interactive turn currently streaming, so we wait long rather than cut short. Deployments override via
+ *  DRAIN_GRACE_MS; center overrides per-worker through the worker spec. */
+export const DEFAULT_DRAIN_GRACE_MS = 600_000;
+/** Hard floor — a grace below this is treated as this (protects against a fat-fingered 0). */
+export const DRAIN_GRACE_FLOOR_MS = 10_000;
+/** `Retry-After` (seconds) on the 503 a draining instance returns for NEW billable submissions. Read paths,
+ *  steer/cancel/respond stay open — only new work is refused. */
+export const DRAIN_RETRY_AFTER_SECONDS = 15;
+/** The drain state machine's single decision point: keep waiting, exit clean (drained), or force the exit
+ *  (grace exhausted with legs still in flight — durable legs resume cross-instance via resumeFromRunId). */
+export function drainVerdict(s) {
+    if (s.inflight <= 0)
+        return "exit_clean";
+    const grace = Math.max(DRAIN_GRACE_FLOOR_MS, s.graceMs);
+    return s.nowMs - s.startedMs >= grace ? "exit_forced" : "wait";
+}
+/** The `/health` self-description every orchestrator reads (shipped shape, server 1.96.0). Liveness and
+ *  readiness are deliberately SPLIT: `status` stays ok while draining (the process is alive); routability is
+ *  `isReadyForTraffic`. Unknown fields pass through — health is a self-description, not a closed record. */
+export const InstanceHealth = z
+    .object({
+    instanceId: z.string().min(1),
+    /** build self-description — "did the restart actually land new code" (upgrade classification) */
+    version: z.string().min(1),
+    /** absent = not draining */
+    draining: z.boolean().optional(),
+    /** epoch ms, present iff draining */
+    drainingSince: z.number().optional(),
+})
+    .passthrough();
+/** Readiness = the routability predicate (k8s readiness probe, gateway health filter, shell seam switch). */
+export function isReadyForTraffic(h) {
+    return h.draining !== true;
+}
+// ── Domain 2: instance discovery (worker announces itself; reconciler observation is the SECOND source) ───
+/** Heartbeat cadence the announcement declares (center judges staleness against the DECLARED cadence, so a
+ *  slow-heartbeat worker is not falsely reaped). */
+export const DEFAULT_HEARTBEAT_MS = 30_000;
+/** An instance is stale once silent for this many missed heartbeats (aligned with the reconciler's own
+ *  stale window: 2× cadence, not a fixed wall-clock). */
+export const STALE_HEARTBEAT_MULTIPLIER = 2;
+/** Register/heartbeat upsert (worker → center, D2: worker-active). ONE shape for both — registration is the
+ *  first heartbeat; every heartbeat re-announces the full row (idempotent upsert, no drift between a
+ *  "register" and a "renew" schema). `draining:true` is the instance SELF-removing from the routable set the
+ *  moment the stop signal lands — faster than any observer. */
+export const InstanceAnnouncement = z.object({
+    instanceId: z.string().min(1),
+    /** worker (deployment) this instance belongs to — the dispatch key */
+    worker: z.string().min(1),
+    /** reachable base URL for the deployment form: k8s pod IP:port / docker net alias / 127.0.0.1:<engine.port> */
+    address: z.string().min(1),
+    version: z.string().min(1),
+    /** self-declared: bootDone && !draining */
+    ready: z.boolean(),
+    draining: z.boolean().default(false),
+    heartbeatMs: z.number().int().positive().default(DEFAULT_HEARTBEAT_MS),
+});
+/** Explicit goodbye (stop signal handler) — removes the row immediately instead of waiting out staleness. */
+export const InstanceDeregistration = z.object({
+    instanceId: z.string().min(1),
+    worker: z.string().min(1),
+    reason: z.enum(["draining", "shutdown", "superseded"]).optional(),
+});
+/** The stored discovery-table row = last announcement + center-side bookkeeping. `observedReady` is the
+ *  reconciler's observation (phase Running) — the SECOND source; absent where no reconciler exists (TOC/TOB). */
+export const InstanceRegistration = InstanceAnnouncement.extend({
+    registeredMs: z.number().int().nonnegative(),
+    lastSeenMs: z.number().int().nonnegative(),
+    observedReady: z.boolean().optional(),
+});
+/** Silent past the declared cadence × multiplier ⇒ stale (auto-removed from the routable set). */
+export function isInstanceStale(r, nowMs) {
+    return nowMs - r.lastSeenMs > STALE_HEARTBEAT_MULTIPLIER * r.heartbeatMs;
+}
+/** Health fusion: routable ⇔ self-declared ready ∧ not draining ∧ not stale ∧ observer does not veto.
+ *  Two sources merge as an AND — EITHER source's "not ready" removes the instance (fail-closed). */
+export function isRoutable(r, nowMs) {
+    return r.ready && !r.draining && r.observedReady !== false && !isInstanceStale(r, nowMs);
+}
+export function routableInstances(rs, nowMs) {
+    return rs.filter((r) => isRoutable(r, nowMs));
+}
+// ── Domain 3: dispatch policy (traffic + failover + LB — three domains, one gateway) ──────────────────────
+export const DISPATCH_STRATEGIES = ["round-robin", "least-inflight", "consistent-hash"];
+/** Per-worker dispatch policy (center-configured; the gateway is OPTIONAL — D3: TOC/self-maintained TOB go
+ *  direct, sema-managed fleets route through /api/dispatch). Strategy is an enum on purpose: a new LB
+ *  algorithm is a new value, not a new skeleton. */
+export const DispatchPolicy = z.object({
+    strategy: z.enum(DISPATCH_STRATEGIES).default("round-robin"),
+    /** live-steer legs must return to their instance (cross-replica live-steer is 409 by design) — when true,
+     *  a request carrying an affinity key pins via consistent hash regardless of `strategy`. If the pinned
+     *  instance dies, the run resumes elsewhere via resumeFromRunId (affinity avoids the gap; resume bounds it). */
+    sessionAffinity: z.boolean().default(true),
+    /** gateway-level concurrency gate (per worker) */
+    maxInflight: z.number().int().positive().optional(),
+    /** per-actor fairness gate */
+    perActorMaxInflight: z.number().int().positive().optional(),
+    /** cost clamp applied to submissions passing the gateway */
+    maxCostUsd: z.number().finite().nonnegative().optional(),
+});
+/** 🔴 Submit idempotency — the precondition that makes failover re-routing SAFE: a new-run submission MUST
+ *  carry the client-minted durable taskId, and the server dedupes on it. Without this, "landed but the
+ *  response was lost" re-routes into a duplicate run. Re-route freely: reads (always) and submissions
+ *  (iff keyed). In-flight interactive turns are NEVER auto-retried (tool side effects are not idempotent). */
+export const SUBMIT_IDEMPOTENCY_KEY = "taskId";
+/** Stable uint32 of the affinity key (fnv1a64 hex head — single hashing source with the rest of the contract). */
+function affinityHash(key) {
+    return parseInt(fnv1a64(key).slice(0, 8), 16) >>> 0;
+}
+/**
+ * The single instance-selection decision, PURE and deterministic:
+ *   - candidates are sorted by instanceId first ⇒ the pick is stable under input reordering;
+ *   - `affinityKey` (+ sessionAffinity or consistent-hash strategy) ⇒ stable hash pick — same key, same
+ *     instance, for as long as the candidate set holds (live-steer affinity);
+ *   - round-robin consumes `cursor` (caller-held monotonic counter);
+ *   - least-inflight breaks ties by lowest instanceId.
+ * Returns null on an empty candidate set (caller surfaces "no routable instance").
+ */
+export function pickInstance(policy, candidates, opts = {}) {
+    if (candidates.length === 0)
+        return null;
+    const sorted = [...candidates].sort((a, b) => (a.instanceId < b.instanceId ? -1 : a.instanceId > b.instanceId ? 1 : 0));
+    if (opts.affinityKey !== undefined && (policy.sessionAffinity || policy.strategy === "consistent-hash")) {
+        return sorted[affinityHash(opts.affinityKey) % sorted.length];
+    }
+    switch (policy.strategy) {
+        case "least-inflight": {
+            let best = sorted[0];
+            for (const c of sorted)
+                if ((c.inflight ?? 0) < (best.inflight ?? 0))
+                    best = c;
+            return best;
+        }
+        case "consistent-hash": // no key supplied — degrade to round-robin rather than pin everyone to one node
+        case "round-robin":
+            return sorted[(opts.cursor ?? 0) % sorted.length];
+    }
+}
+// ── Domain 4: quota lease (D4: AP by default — pre-authorized grant + reconciliation, CP is per-tier opt-in) ─
+/** A pre-authorized slice of a principal's global budget, granted by center to ONE worker: the worker deducts
+ *  locally (no per-call round-trip), renews when running low, and center reconciles reported consumption
+ *  against the grant after the fact — the roaming/CDN pattern.
+ *
+ *  0.6.1 双轴 slice(EXPERT-REDESIGN §4-2/§4-6,黑板 [542] service 回执"发布即接单"):slice = **{weightedTokens,
+ *  costMicroUsd}** 双轴,带 TTL 不变。token 轴单位=**加权 tokens**(配额轴,ModelEntry.quotaWeight 的
+ *  weight-at-burn 折算——与 UsageEntry.weightedTokens 同一时点同口径,扣减与聚合两路径不歪)。判定语义在
+ *  类型层定死:**任一轴耗尽 = 拒绝**({@link leaseExhausted} deny-wins)、**任一轴达 80% = 提前续租**
+ *  ({@link shouldRenewLease})。$ 轴名 `costMicroUsd` 沿用 0.5 既定名不改(service $ 单轴已 SHIPPED)。
+ *  0.7.1(BREAKING,黑板 [551] 回执收账):0.5 轴名 `tokens` 的 preprocess shim 已撤——service 1.150.0
+ *  已切 typed 双轴,legacy 别名成死分支;老形状租约 parse 后 tokens 键被 strip(= 该轴不受此租约治理)。 */
+export const QuotaLease = z.object({
+    leaseId: z.string().min(1),
+    principal: z.string().min(1),
+    worker: z.string().min(1),
+    /** granted dimensions — either or both; a dimension absent = not governed by this lease.
+     *  `weightedTokens` = 加权 tokens(配额轴)。 */
+    grant: z.object({
+        weightedTokens: z.number().int().nonnegative().optional(),
+        costMicroUsd: z.number().int().nonnegative().optional(),
+    }),
+    consumed: z
+        .object({
+        weightedTokens: z.number().int().nonnegative().default(0),
+        costMicroUsd: z.number().int().nonnegative().default(0),
+    })
+        .default({ weightedTokens: 0, costMicroUsd: 0 }),
+    issuedMs: z.number().int().nonnegative(),
+    expiresMs: z.number().int().nonnegative(),
+});
+/** Remaining per granted dimension; null = the dimension is not governed by this lease. Never negative. */
+export function leaseRemaining(l) {
+    return {
+        weightedTokens: l.grant.weightedTokens === undefined ? null : Math.max(0, l.grant.weightedTokens - l.consumed.weightedTokens),
+        costMicroUsd: l.grant.costMicroUsd === undefined ? null : Math.max(0, l.grant.costMicroUsd - l.consumed.costMicroUsd),
+    };
+}
+/** Exhausted ⇔ ANY governed dimension is used up (deny-wins across the two axes — 任一轴耗尽即拒), or the
+ *  lease expired. */
+export function leaseExhausted(l, nowMs) {
+    if (nowMs >= l.expiresMs)
+        return true;
+    const r = leaseRemaining(l);
+    return (r.weightedTokens !== null && r.weightedTokens <= 0) || (r.costMicroUsd !== null && r.costMicroUsd <= 0);
+}
+/** Renew EARLY — at `renewAtFraction` of ANY governed dimension (default 80% — 任一轴达 80% 即提前续租) or
+ *  of the lease lifetime — so the refresh round-trip overlaps remaining headroom instead of blocking a call
+ *  at zero. */
+export function shouldRenewLease(l, nowMs, opts = {}) {
+    const f = opts.renewAtFraction ?? 0.8;
+    if (l.grant.weightedTokens !== undefined && l.grant.weightedTokens > 0 && l.consumed.weightedTokens / l.grant.weightedTokens >= f)
+        return true;
+    if (l.grant.costMicroUsd !== undefined && l.grant.costMicroUsd > 0 && l.consumed.costMicroUsd / l.grant.costMicroUsd >= f)
+        return true;
+    const life = l.expiresMs - l.issuedMs;
+    return life > 0 && (nowMs - l.issuedMs) / life >= f;
+}
+/** Reconciliation (center side): consumption is MONOTONE — the reconciled row takes the max of what center
+ *  believed and what the worker reported (a lost report can only under-count, never roll back).
+ *  0.7.1:legacy `tokens` report alias removed with the QuotaLease shim(同一收账点,[551] 回执). */
+export function reconcileLease(l, reported) {
+    return {
+        ...l,
+        consumed: {
+            weightedTokens: Math.max(l.consumed.weightedTokens, reported.weightedTokens ?? 0),
+            costMicroUsd: Math.max(l.consumed.costMicroUsd, reported.costMicroUsd ?? 0),
+        },
+    };
+}
+// ── Domain 5: usage report (worker → center — the metering feed the global view aggregates) ───────────────
+/** One principal×model line in a report window (mirrors the worker's modelUsageTracker accumulation). */
+export const UsageEntry = z.object({
+    principal: z.string().min(1),
+    model: z.string().min(1),
+    inputTokens: z.number().int().nonnegative(),
+    outputTokens: z.number().int().nonnegative(),
+    costMicroUsd: z.number().int().nonnegative(),
+    runs: z.number().int().nonnegative().optional(),
+    /** 加权 tokens(配额轴计账值,EXPERT-REDESIGN §4-1):=(input+output)×记账时的 quotaWeight,
+     *  **weight-at-burn 持久化**——倍率 publish 只影响此后记账,不回算窗口内历史(余量/恢复时间不跳变)。
+     *  0.6.0 additive optional:旧 worker 不报 → 聚合按 quotaWeight=1 兜底折算。 */
+    weightedTokens: z.number().int().nonnegative().optional(),
+    /** 记账时固化的该模型 quotaWeight(审计口径,与 weightedTokens 同时点)——lease 扣减与 registry 聚合两
+     *  路径按同一时点折算(同口径,§11-1)。 */
+    quotaWeightAtUse: z.number().finite().nonnegative().optional(),
+});
+/** Periodic batch (worker → center POST). Windows are half-open [start, end) so adjacent batches never
+ *  double-count a boundary instant. */
+export const UsageReport = z.object({
+    worker: z.string().min(1),
+    instanceId: z.string().min(1),
+    windowStartMs: z.number().int().nonnegative(),
+    windowEndMs: z.number().int().nonnegative(),
+    entries: z.array(UsageEntry),
+});
+/** 额度清零事件(EXPERT-REDESIGN §4-4,契约随 E1 冻结、E4 消费):申请刷新获批即写一条;5h/周双窗聚合
+ *  **只计最后一次 reset 之后**的 usage 报文(usage_report 是计费审计事实,全量留存,绝不删)。拒绝逻辑/
+ *  恢复时间/用量卡读数全部感知 reset;批准生效延迟 ≤ 一次租约 TTL(旧租约续租时放行)。 */
+export const QuotaResetEvent = z.object({
+    id: z.string().min(1),
+    principal: z.string().min(1),
+    /** 清零生效时刻(ISO)——双窗聚合的下边界。 */
+    reset_at: z.string().min(1),
+    /** 批准人(console username)。 */
+    decided_by: z.string().min(1),
+    /** 关联的 quota_refresh_request id;admin 直接清零(无申请)时可缺。 */
+    request_id: z.string().min(1).optional(),
+});
+/** 单条 entry 的配额轴计账值:weightedTokens 原值优先;缺失(旧 worker 不报)按 quotaWeightAtUse(缺省 1)
+ *  兜底折算 (input+output)×weight(四舍五入保持整数口径)。 */
+function entryWeightedTokens(e) {
+    return e.weightedTokens ?? Math.round((e.inputTokens + e.outputTokens) * (e.quotaWeightAtUse ?? 1));
+}
+/** Center-side fold: per-principal totals ACROSS workers/instances (the "one user, many workers, one bill"
+ *  view). Pure — storage/dedup of replayed batches is the caller's concern (key batches by
+ *  worker+instanceId+windowStartMs). */
+export function aggregateUsage(reports) {
+    const out = {};
+    for (const rep of reports) {
+        for (const e of rep.entries) {
+            const wt = entryWeightedTokens(e);
+            const p = (out[e.principal] ??= { inputTokens: 0, outputTokens: 0, costMicroUsd: 0, runs: 0, weightedTokens: 0, byModel: {} });
+            p.inputTokens += e.inputTokens;
+            p.outputTokens += e.outputTokens;
+            p.costMicroUsd += e.costMicroUsd;
+            p.runs += e.runs ?? 0;
+            p.weightedTokens += wt;
+            const m = (p.byModel[e.model] ??= { inputTokens: 0, outputTokens: 0, costMicroUsd: 0, runs: 0, weightedTokens: 0 });
+            m.inputTokens += e.inputTokens;
+            m.outputTokens += e.outputTokens;
+            m.costMicroUsd += e.costMicroUsd;
+            m.runs += e.runs ?? 0;
+            m.weightedTokens += wt;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=fleet.js.map

package/dist/fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.js","sourceRoot":"","sources":["../src/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,6GAA6G;AAE7G;0FAC0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;AAGxE;;2EAE2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAC9C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C;iEACiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAc5C;4GAC4G;AAC5G,MAAM,UAAU,YAAY,CAAC,CAAgB;IAC3C,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;4GAE4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,iGAAiG;IACjG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,6GAA6G;AAC7G,MAAM,UAAU,iBAAiB,CAAC,CAAmC;IACnE,OAAO,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC7B,CAAC;AAED,6GAA6G;AAE7G;oDACoD;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C;yDACyD;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;+DAG+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,sEAAsE;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,+GAA+G;IAC/G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;CACvE,CAAC,CAAC;AAGH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC;AAGH;iHACiH;AACjH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,CAA2D,EAAE,KAAa;IACxG,OAAO,KAAK,GAAG,CAAC,CAAC,UAAU,GAAG,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC;AAC3E,CAAC;AAED;oGACoG;AACpG,MAAM,UAAU,UAAU,CAAC,CAAuB,EAAE,KAAa;IAC/D,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,aAAa,KAAK,KAAK,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAA0B,EAAE,KAAa;IACzE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,6GAA6G;AAE7G,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,CAAU,CAAC;AAGjG;;oDAEoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC5D;;oHAEgH;IAChH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,kDAAkD;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,8BAA8B;IAC9B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,4DAA4D;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAGH;;;8GAG8G;AAC9G,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAQ/C,kHAAkH;AAClH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAsB,EACtB,UAA+B,EAC/B,OAAkD,EAAE;IAEpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB,CAAC,EAAE,CAAC;QACxG,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,CAAE,CAAC;IACjE,CAAC;IACD,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;oBAAE,IAAI,GAAG,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,gFAAgF;QACxG,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,gHAAgH;AAEhH;;;;;;;;;;4EAU4E;AAC5E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;6CACyC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACzD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACxD,CAAC;IACF,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;KACxD,CAAC;SACD,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,2GAA2G;AAC3G,MAAM,UAAU,cAAc,CAAC,CAAa;IAC1C,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC7H,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;KACtH,CAAC;AACJ,CAAC;AAED;qBACqB;AACrB,MAAM,UAAU,cAAc,CAAC,CAAa,EAAE,KAAa;IACzD,IAAI,KAAK,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;eAEe;AACf,MAAM,UAAU,gBAAgB,CAAC,CAAa,EAAE,KAAa,EAAE,OAAqC,EAAE;IACpG,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC;IACtC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/I,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvI,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC;IACtC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,cAAc,CAAC,CAAa,EAAE,QAA4D;IACxG,OAAO;QACL,GAAG,CAAC;QACJ,QAAQ,EAAE;YACR,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC;YACjF,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;SAC5E;KACF,CAAC;AACJ,CAAC;AAED,6GAA6G;AAE7G,yGAAyG;AACzG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC/C;;wEAEoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD;gCAC4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAGH;uCACuC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;CAC7B,CAAC,CAAC;AAGH;;wDAEwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,6BAA6B;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,uDAAuD;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAgBH;8CAC8C;AAC9C,SAAS,mBAAmB,CAAC,CAAa;IACxC,OAAO,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;wCAEwC;AACxC,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,MAAM,GAAG,GAA6C,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/H,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC;YAC/B,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACtB,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;YACpH,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC;YAC/B,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACtB,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/hash.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Tiny stable content hash — shared by `workerSpecHash` (reconciler drift detection) and the per-worker
+ * `/effective` ETag (so an unrelated roster change doesn't churn a worker's cache). Zero-dep, deterministic.
+ *
+ * FNV-1a **64-bit** (BigInt) → 16 hex. NOT cryptographic; it's a change-detector. 64-bit pushes the
+ * birthday-collision boundary to ~5B distinct inputs — a collision would silently SUPPRESS a needed
+ * container restart (drift) or serve a stale 304 (ETag), so we don't want the 32-bit ~77k boundary here
+ * (council finding). Output length isn't a contract (values are only compared for equality before/after).
+ */
+/** Max nesting stableStringify will hash. A real EffectiveConfig nests ~10-15 deep; this generous cap turns a
+ *  pathologically deep OR cyclic value (e.g. a poisoned `model.extraBody` = z.unknown()) into a DETERMINISTIC
+ *  throw instead of a `RangeError: Maximum call stack` that would crash every scoped-worker `/effective` poll
+ *  and local `getVersion`/`getEffective` (adversarial JSON-DoS — a cycle also reaches this cap). Round-3 fix. */
+export declare const MAX_HASH_DEPTH = 200;
+/** Wrapper headroom reserved between the extraBody validator's cap and the hash cap. CRITICAL: stableStringify
+ *  always hashes extraBody NESTED inside a wrapper — `#versionOf` hashes `{models:{models:[{…,extraBody}]}}` and
+ *  the scoped ETag hashes the same shape, putting the extraBody value root at hash-depth ~4. So a value the
+ *  extraBody guard accepts at ITS depth D sits at hash-depth `D + wrapper`; if the guard counted to the SAME 200
+ *  the wrapper overflow would let a depth-196–199 extraBody validate+persist (fail-OPEN) yet crash every later
+ *  getVersion/getEffective (hard-DoS poison pill) — the two caps were each hardened in isolation but never
+ *  reconciled (R18 codex). The real max wrapper is ~4–6; 32 is a deliberate ≫ margin. */
+export declare const MAX_HASH_WRAPPER_RESERVE = 32;
+/** Depth cap for a standalone `extraBody` value, reconciled with the hash cap MINUS the wrapper reserve so that
+ *  ANYTHING the validator accepts is guaranteed hashable in every context it's later hashed in. 168 ≫ any real
+ *  extraBody (OpenAI-style request params nest <10 deep). */
+export declare const MAX_EXTRA_BODY_DEPTH: number;
+/** Deterministic JSON with sorted object keys (so key order never affects the hash). */
+export declare function stableStringify(v: unknown, depth?: number): string;
+/** FNV-1a 64-bit of a string → 16-char hex. */
+export declare function fnv1a64(s: string): string;
+/** Stable hash of any JSON-able value. */
+export declare function stableHash(v: unknown): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;iHAGiH;AACjH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;;;;yFAMyF;AACzF,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;6DAE6D;AAC7D,eAAO,MAAM,oBAAoB,QAA4C,CAAC;AAE9E,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,MAAM,CAW7D;AAMD,+CAA+C;AAC/C,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAOzC;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAE7C"}

package/dist/hash.js

@@ -0,0 +1,60 @@
+/**
+ * Tiny stable content hash — shared by `workerSpecHash` (reconciler drift detection) and the per-worker
+ * `/effective` ETag (so an unrelated roster change doesn't churn a worker's cache). Zero-dep, deterministic.
+ *
+ * FNV-1a **64-bit** (BigInt) → 16 hex. NOT cryptographic; it's a change-detector. 64-bit pushes the
+ * birthday-collision boundary to ~5B distinct inputs — a collision would silently SUPPRESS a needed
+ * container restart (drift) or serve a stale 304 (ETag), so we don't want the 32-bit ~77k boundary here
+ * (council finding). Output length isn't a contract (values are only compared for equality before/after).
+ */
+/** Max nesting stableStringify will hash. A real EffectiveConfig nests ~10-15 deep; this generous cap turns a
+ *  pathologically deep OR cyclic value (e.g. a poisoned `model.extraBody` = z.unknown()) into a DETERMINISTIC
+ *  throw instead of a `RangeError: Maximum call stack` that would crash every scoped-worker `/effective` poll
+ *  and local `getVersion`/`getEffective` (adversarial JSON-DoS — a cycle also reaches this cap). Round-3 fix. */
+export const MAX_HASH_DEPTH = 200;
+/** Wrapper headroom reserved between the extraBody validator's cap and the hash cap. CRITICAL: stableStringify
+ *  always hashes extraBody NESTED inside a wrapper — `#versionOf` hashes `{models:{models:[{…,extraBody}]}}` and
+ *  the scoped ETag hashes the same shape, putting the extraBody value root at hash-depth ~4. So a value the
+ *  extraBody guard accepts at ITS depth D sits at hash-depth `D + wrapper`; if the guard counted to the SAME 200
+ *  the wrapper overflow would let a depth-196–199 extraBody validate+persist (fail-OPEN) yet crash every later
+ *  getVersion/getEffective (hard-DoS poison pill) — the two caps were each hardened in isolation but never
+ *  reconciled (R18 codex). The real max wrapper is ~4–6; 32 is a deliberate ≫ margin. */
+export const MAX_HASH_WRAPPER_RESERVE = 32;
+/** Depth cap for a standalone `extraBody` value, reconciled with the hash cap MINUS the wrapper reserve so that
+ *  ANYTHING the validator accepts is guaranteed hashable in every context it's later hashed in. 168 ≫ any real
+ *  extraBody (OpenAI-style request params nest <10 deep). */
+export const MAX_EXTRA_BODY_DEPTH = MAX_HASH_DEPTH - MAX_HASH_WRAPPER_RESERVE;
+/** Deterministic JSON with sorted object keys (so key order never affects the hash). */
+export function stableStringify(v, depth = 0) {
+    if (depth > MAX_HASH_DEPTH)
+        throw new Error(`stableStringify: value nested deeper than ${MAX_HASH_DEPTH} — refusing to hash (a config value is pathologically deep or cyclic)`);
+    // `JSON.stringify(undefined)` returns the value `undefined` (not a string) → would crash fnv1a64 on
+    // `.length`. Optionals are normally stripped by zod, but guard so a future default-less optional can't
+    // crash every scoped-worker poll. Treat undefined like null for hashing.
+    if (v === undefined)
+        return "null";
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v);
+    if (Array.isArray(v))
+        return `[${v.map((x) => stableStringify(x, depth + 1)).join(",")}]`;
+    const obj = v;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k], depth + 1)}`).join(",")}}`;
+}
+const FNV64_OFFSET = 0xcbf29ce484222325n;
+const FNV64_PRIME = 0x100000001b3n;
+const U64 = 0xffffffffffffffffn;
+/** FNV-1a 64-bit of a string → 16-char hex. */
+export function fnv1a64(s) {
+    let h = FNV64_OFFSET;
+    for (let i = 0; i < s.length; i++) {
+        h ^= BigInt(s.charCodeAt(i));
+        h = (h * FNV64_PRIME) & U64;
+    }
+    return h.toString(16).padStart(16, "0");
+}
+/** Stable hash of any JSON-able value. */
+export function stableHash(v) {
+    return fnv1a64(stableStringify(v));
+}
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;iHAGiH;AACjH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC;;;;;;yFAMyF;AACzF,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;6DAE6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,GAAG,wBAAwB,CAAC;AAE9E,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,KAAK,GAAG,CAAC;IACnD,IAAI,KAAK,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,cAAc,uEAAuE,CAAC,CAAC;IAChL,oGAAoG;IACpG,uGAAuG;IACvG,yEAAyE;IACzE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACxG,CAAC;AAED,MAAM,YAAY,GAAG,mBAAmB,CAAC;AACzC,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,+CAA+C;AAC/C,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,IAAI,CAAC,GAAG,YAAY,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,GAAG,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,UAAU,CAAC,CAAU;IACnC,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}