@smthrs/control 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/Channels.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Channels.ts"],
+  "sourcesContent": ["/**\n * Channel contracts and the in-memory channel coordinator.\n *\n * A channel verifies opaque transport data before it decodes or maps it. The\n * resulting request is then dispatched through the Control service; channels\n * do not acquire an execution path of their own.\n *\n * @since 0.1.0\n */\n\nimport * as Sha256 from \"@smthrs/crypto/Sha256\"\nimport { Clock, Context, Effect, Layer, Ref, type Schema, Semaphore } from \"effect\"\nimport { Control } from \"./Control.ts\"\nimport { type ControlError, InvalidInput, type Unauthorized, Unavailable } from \"./ControlError.ts\"\nimport { ControlRuntime } from \"./ControlRuntime.ts\"\nimport type { FlowId, IdempotencyKey, Receipt, RunId, RunSummary, SignalPayload } from \"./ControlSchema.ts\"\nimport { alreadyApplied } from \"./internal/planning.ts\"\n\n/**\n * Opaque request data passed to a channel before decoding.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface RawInbound {\n  readonly body: Uint8Array\n  readonly headers: Readonly<Record<string, string | undefined>>\n  readonly idempotencyKey: IdempotencyKey\n}\n\n/**\n * The channel mapping after a verified payload has been decoded.\n *\n * @category models\n * @since 0.1.0\n */\nexport type InboundResult =\n  | { readonly _tag: \"Start\"; readonly flowId: FlowId; readonly input: unknown }\n  | { readonly _tag: \"Signal\"; readonly runId: RunId; readonly signal: SignalPayload }\n\n/**\n * A process-local per-channel delivery record. `messageId` identifies an existing\n * platform message, so a reconnect can update it instead of posting again.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Delivery {\n  readonly cursor: string\n  readonly messageId?: string | undefined\n}\n\n/**\n * A side-effect-free outbound projection. Network delivery belongs to the\n * transport adapter, which consumes this value after it is journaled.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface DeliveryProjection {\n  readonly cursor: string\n  readonly messageId?: string | undefined\n  readonly operation: \"post\" | \"edit\" | \"noop\"\n  readonly message: unknown\n}\n\n/**\n * A bidirectional platform adapter.\n *\n * `verify` must only inspect opaque bytes and headers. It always precedes\n * `decode`, preventing untrusted public requests from reaching planning.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Channel<A = unknown> {\n  readonly name: string\n  readonly schema: Schema.Schema<A>\n  /**\n   * Non-secret HTTP header names whose values change the decoded command.\n   * Names are matched case-insensitively and folded into durable idempotency;\n   * signature, authorization, and credential headers must not be declared.\n   */\n  readonly fingerprintHeaders?: ReadonlyArray<string> | undefined\n  readonly verify: (raw: RawInbound) => Effect.Effect<void, Unauthorized>\n  /** Deterministic, side-effect-free decoding; retries may evaluate it again. */\n  readonly decode: (raw: RawInbound) => Effect.Effect<A, InvalidInput>\n  /** Deterministic, side-effect-free mapping; retries may evaluate it again. */\n  readonly map: (payload: A) => Effect.Effect<InboundResult, InvalidInput>\n  readonly project: (run: RunSummary, delivery: Delivery | undefined) => DeliveryProjection\n}\n\n/**\n * A registered channel with its payload type hidden. Decoding and mapping stay\n * paired, so lookup never exposes a mapper accepting arbitrary unknown data.\n *\n * @category models\n * @since 1.0.0\n */\nexport interface RegisteredChannel extends Omit<Channel, \"decode\" | \"map\"> {\n  readonly decodeAndMap: (raw: RawInbound) => Effect.Effect<InboundResult, InvalidInput>\n}\n\nconst eraseChannel = <A>(channel: Channel<A>): RegisteredChannel => ({\n  name: channel.name,\n  schema: channel.schema,\n  fingerprintHeaders: channel.fingerprintHeaders,\n  verify: (raw) => channel.verify(raw),\n  decodeAndMap: (raw) => Effect.flatMap(channel.decode(raw), (payload) => channel.map(payload)),\n  project: (run, delivery) => channel.project(run, delivery)\n})\n\n/**\n * Arguments for ingesting one authenticated channel request.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface IngestRequest {\n  readonly channel: string\n  readonly raw: RawInbound\n}\n\n/**\n * Arguments for projecting one run onto a channel.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface ProjectRequest {\n  readonly channel: string\n  readonly run: RunSummary\n}\n\n/**\n * The channel coordinator.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Channels {\n  readonly register: <A>(channel: Channel<A>) => Effect.Effect<void>\n  readonly lookup: (name: string) => Effect.Effect<RegisteredChannel, Unavailable>\n  readonly ingest: (request: IngestRequest) => Effect.Effect<Receipt, ControlError>\n  readonly project: (request: ProjectRequest) => Effect.Effect<DeliveryProjection, Unavailable>\n}\n\n/**\n * Service tag for channel registration, ingestion, and pure projection.\n *\n * @category services\n * @since 0.1.0\n */\nexport const Channels: Context.Service<Channels, Channels> = Context.Service(\"/control/Channels\")\n\nconst unavailable = (feature: string): Unavailable =>\n  new Unavailable({\n    feature,\n    ticket: \"control-channel-registry\"\n  })\n\nconst deliveryKey = (channel: string, run: RunSummary): string => `${channel.length}:${channel}:${run.runId}`\n\n/** Collision-free control-plane key for one channel-owned external key. */\nconst scopedKey = (channel: string, key: IdempotencyKey): IdempotencyKey =>\n  `channel:${channel.length}:${channel}:${key}`\n\nconst mutationKey = (channel: string, key: IdempotencyKey): IdempotencyKey =>\n  `channel.ingest:${scopedKey(channel, key)}`\n\nconst typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\nconst typedArrayBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype, \"buffer\")?.get\nconst typedArrayByteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, \"byteOffset\")?.get\nconst typedArrayByteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, \"byteLength\")?.get\n\nclass InboundBoundaryError extends TypeError {\n  readonly issue: string\n  constructor(issue: string) {\n    super(issue)\n    this.issue = issue\n  }\n}\n\nconst boundary = (issue: string): never => {\n  throw new InboundBoundaryError(issue)\n}\n\nconst plainRecord = (input: unknown, path: string): Record<PropertyKey, unknown> => {\n  if (typeof input !== \"object\" || input === null || Array.isArray(input)) {\n    return boundary(`${path}: must be a plain record`)\n  }\n  const prototype = Object.getPrototypeOf(input)\n  if (prototype !== Object.prototype && prototype !== null) {\n    return boundary(`${path}: must have a plain prototype`)\n  }\n  return input as Record<PropertyKey, unknown>\n}\n\nconst ownData = (input: Record<PropertyKey, unknown>, key: PropertyKey, path: string): unknown => {\n  const descriptor = Object.getOwnPropertyDescriptor(input, key)\n  if (descriptor === undefined || !(\"value\" in descriptor)) return boundary(`${path}: must be an own data property`)\n  return descriptor.value\n}\n\nconst copyBody = (input: unknown): Uint8Array => {\n  /* v8 ignore next 4 -- every host that has `Uint8Array` has its prototype accessors; the refusal exists so a host without them fails closed rather than reading a caller-owned buffer */\n  if (\n    typedArrayBuffer === undefined || typedArrayByteOffset === undefined ||\n    typedArrayByteLength === undefined\n  ) return boundary(\"raw.body: this host cannot inspect typed arrays\")\n  try {\n    const buffer = Reflect.apply(typedArrayBuffer, input, []) as ArrayBufferLike\n    const byteOffset = Reflect.apply(typedArrayByteOffset, input, []) as number\n    const byteLength = Reflect.apply(typedArrayByteLength, input, []) as number\n    const source = new Uint8Array(buffer, byteOffset, byteLength)\n    const snapshot = new Uint8Array(byteLength)\n    snapshot.set(source)\n    return snapshot\n  } catch {\n    return boundary(\"raw.body: must be a Uint8Array\")\n  }\n}\n\nconst snapshotHeaders = (input: unknown): Readonly<Record<string, string | undefined>> => {\n  const record = plainRecord(input, \"raw.headers\")\n  const snapshot = Object.create(null) as Record<string, string | undefined>\n  for (const key of Reflect.ownKeys(record)) {\n    if (typeof key !== \"string\") return boundary(\"raw.headers: symbol keys are not supported\")\n    const descriptor = Object.getOwnPropertyDescriptor(record, key)\n    if (descriptor === undefined || !(\"value\" in descriptor) || !descriptor.enumerable) {\n      return boundary(`raw.headers.${key}: must be an enumerable data property`)\n    }\n    if (descriptor.value !== undefined && typeof descriptor.value !== \"string\") {\n      return boundary(`raw.headers.${key}: must be a string or undefined`)\n    }\n    const normalized = key.toLowerCase()\n    if (Object.hasOwn(snapshot, normalized)) {\n      return boundary(`raw.headers.${normalized}: duplicate case-insensitive name`)\n    }\n    snapshot[normalized] = descriptor.value as string | undefined\n  }\n  return Object.freeze(snapshot)\n}\n\nconst snapshotRequest = (\n  input: IngestRequest\n): Effect.Effect<{ readonly channel: string; readonly raw: RawInbound }, InvalidInput> =>\n  Effect.try({\n    try: () => {\n      const request = plainRecord(input, \"request\")\n      const channel = ownData(request, \"channel\", \"request.channel\")\n      const candidate = plainRecord(ownData(request, \"raw\", \"request.raw\"), \"request.raw\")\n      const idempotencyKey = ownData(candidate, \"idempotencyKey\", \"raw.idempotencyKey\")\n      if (typeof channel !== \"string\" || channel.length === 0) return boundary(\"request.channel: must be non-empty\")\n      if (typeof idempotencyKey !== \"string\" || idempotencyKey.length === 0) {\n        return boundary(\"raw.idempotencyKey: must be non-empty\")\n      }\n      return Object.freeze({\n        channel,\n        raw: Object.freeze({\n          body: copyBody(ownData(candidate, \"body\", \"raw.body\")),\n          headers: snapshotHeaders(ownData(candidate, \"headers\", \"raw.headers\")),\n          idempotencyKey\n        })\n      })\n    },\n    catch: (cause) =>\n      new InvalidInput({\n        issue: cause instanceof InboundBoundaryError ? cause.issue : \"channel request could not be inspected safely\"\n      })\n  })\n\nconst normalizedFingerprintHeaders = (channel: RegisteredChannel): ReadonlyArray<string> =>\n  Array.from(new Set((channel.fingerprintHeaders ?? []).map((name) => name.toLowerCase()))).sort()\n\n/** Digests the body plus only the adapter-declared, non-secret semantic headers. */\nconst fingerprint = (\n  body: Uint8Array,\n  headers: Readonly<Record<string, string | undefined>>,\n  names: ReadonlyArray<string>\n): string => {\n  const document = JSON.stringify([\n    Sha256.digestSync(body),\n    names.map((name) => [name, headers[name] ?? null])\n  ])\n  return `channel-ingress:v2:${Sha256.digestSync(new TextEncoder().encode(document))}`\n}\n\nconst externalReceipt = (receipt: Receipt, key: IdempotencyKey): Receipt => {\n  switch (receipt._tag) {\n    case \"Accepted\":\n    case \"AlreadyApplied\":\n    case \"Parked\":\n      return { ...receipt, receiptId: key }\n    default:\n      return receipt\n  }\n}\n\n/** The slice of the control runtime's mutation store that inbound idempotency uses. */\ninterface InboundReceiptStore {\n  readonly lookupMutation: (\n    key: IdempotencyKey,\n    fingerprint: string\n  ) => Effect.Effect<Receipt | undefined, ControlError>\n  readonly recordMutation: (\n    key: IdempotencyKey,\n    fingerprint: string,\n    receipt: Receipt\n  ) => Effect.Effect<void, ControlError>\n}\n\n/**\n * Builds an in-memory channel registry and delivery map over Control's durable\n * mutation store. Inbound idempotency therefore survives coordinator restarts;\n * only registration and outbound projection cursors are process-local.\n */\nconst makeWith = (runtime: InboundReceiptStore) =>\n  Effect.gen(function*() {\n    const channels = yield* Ref.make(new Map<string, RegisteredChannel>())\n    const deliveries = new Map<string, Delivery>()\n    // Live identities are never evicted. Terminal identities have a FIFO window\n    // for reconnects; retaining one per historical run would grow without bound.\n    const terminalDeliveries = new Set<string>()\n    const maximumTerminalDeliveries = 1024\n    const ingestion = yield* Semaphore.make(1)\n    const control = yield* Control\n\n    const lookup = Effect.fn(\"Channels.lookup\")(\n      function*(name: string): Effect.fn.Return<RegisteredChannel, Unavailable> {\n        return yield* Effect.flatMap(Ref.get(channels), (registered) => {\n          const channel = registered.get(name)\n          return channel === undefined\n            ? Effect.fail(unavailable(`channel \"${name}\" is not registered`))\n            : Effect.succeed(channel)\n        })\n      }\n    )\n\n    return Channels.of({\n      register: Effect.fn(\"Channels.register\")(<A>(channel: Channel<A>) =>\n        Ref.update(channels, (registered) => {\n          const next = new Map(registered)\n          next.set(channel.name, eraseChannel(channel))\n          return next\n        })\n      ),\n      lookup,\n      ingest: Effect.fn(\"Channels.ingest\")((request) =>\n        Effect.flatMap(snapshotRequest(request), (snapshot) =>\n          ingestion.withPermits(1)(Effect.gen(function*() {\n            const channel = yield* lookup(snapshot.channel)\n            const fingerprintHeaders = normalizedFingerprintHeaders(channel)\n            const bodyFingerprint = fingerprint(snapshot.raw.body, snapshot.raw.headers, fingerprintHeaders)\n            // This ordering is intentional: signature verification is the\n            // amplification guard and must happen before decode or Control access.\n            // The verifier receives its own body copy, so even a verifier that\n            // edits bytes cannot change what the decoder sees after approval.\n            yield* channel.verify({ ...snapshot.raw, body: copyBody(snapshot.raw.body) })\n            const externalKey = snapshot.raw.idempotencyKey\n            const durableKey = mutationKey(snapshot.channel, externalKey)\n            const prior = yield* runtime.lookupMutation(durableKey, bodyFingerprint)\n            if (prior !== undefined) return externalReceipt(prior, externalKey)\n\n            const mapped = yield* channel.decodeAndMap(snapshot.raw)\n            const key = scopedKey(snapshot.channel, externalKey)\n            let receipt: Receipt\n            if (mapped._tag === \"Signal\") {\n              // The channel is the caller, not the local operator: a webhook\n              // body names the run and wait, so a signal it maps to answers a\n              // human wait only if the host delegates approval to this channel.\n              receipt = yield* control.signal({\n                runId: mapped.runId,\n                signal: mapped.signal,\n                idempotencyKey: key,\n                principal: { id: snapshot.channel, kind: \"channel\", stampedAt: yield* Clock.currentTimeMillis }\n              })\n            } else {\n              const plan = yield* control.plan({\n                flowId: mapped.flowId,\n                input: mapped.input,\n                idempotencyKey: key\n              })\n              receipt = yield* control.run({\n                _tag: \"Plan\",\n                planId: plan.planId,\n                digest: plan.digest,\n                envelope: plan.envelope,\n                idempotencyKey: key\n              })\n            }\n            // A parked start has not launched. Leave ingress unsettled so a\n            // redelivery can retry the same Control key after plan approval.\n            if (receipt._tag !== \"Conflict\" && receipt._tag !== \"Parked\") {\n              yield* runtime.recordMutation(durableKey, bodyFingerprint, receipt)\n            }\n            return externalReceipt(receipt, externalKey)\n          })))\n      ),\n      project: Effect.fn(\"Channels.project\")(function*(request) {\n        const channel = yield* lookup(request.channel)\n        const key = deliveryKey(request.channel, request.run)\n        // Keep the read, projection and update synchronous so concurrent fibers\n        // cannot project from the same stale delivery identity.\n        return yield* Effect.sync(() => {\n          const prior = deliveries.get(key)\n          const projection = channel.project(request.run, prior)\n          if (\n            projection.operation !== \"noop\" &&\n            (prior === undefined || prior.cursor !== projection.cursor || prior.messageId !== projection.messageId)\n          ) {\n            deliveries.set(key, { cursor: projection.cursor, messageId: projection.messageId })\n          }\n          if (deliveries.has(key)) {\n            const status = request.run.status\n            if (status === \"completed\" || status === \"failed\" || status === \"cancelled\") {\n              terminalDeliveries.add(key)\n              if (terminalDeliveries.size > maximumTerminalDeliveries) {\n                // The set is nonempty because it just exceeded the limit.\n                const oldest = terminalDeliveries.values().next().value!\n                terminalDeliveries.delete(oldest)\n                deliveries.delete(oldest)\n              }\n            } else {\n              terminalDeliveries.delete(key)\n            }\n          }\n          return projection\n        })\n      })\n    })\n  })\n\n/**\n * Builds the coordinator over Control's durable mutation store.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const make = Effect.gen(function*() {\n  const runtime = yield* ControlRuntime\n  return yield* makeWith(runtime)\n})\n\n/**\n * Builds a process-local coordinator for adapter unit tests.\n *\n * Production hosts use {@link layer}; this constructor deliberately makes no\n * restart guarantee.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const makeMemory = Effect.gen(function*() {\n  const records = yield* Ref.make(\n    new Map<IdempotencyKey, {\n      readonly fingerprint: string\n      readonly receipt: Receipt\n    }>()\n  )\n  return yield* makeWith({\n    lookupMutation: (key, candidate) =>\n      Ref.get(records).pipe(Effect.map((stored) => {\n        const prior = stored.get(key)\n        if (prior === undefined) return undefined\n        return prior.fingerprint === candidate\n          ? alreadyApplied(key, prior.receipt)\n          : { _tag: \"Conflict\", message: `idempotency key ${key} was used for another mutation` }\n      })),\n    recordMutation: (key, candidate, receipt) =>\n      Ref.update(records, (stored) => {\n        const next = new Map(stored)\n        next.set(key, { fingerprint: candidate, receipt })\n        return next\n      })\n  })\n})\n\n/**\n * Channel layer with durable inbound receipts supplied by `ControlRuntime`.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer = Layer.effect(Channels, make)\n\n/**\n * Process-local channel layer for adapter unit tests only.\n *\n * @category layers\n * @since 1.0.0\n */\nexport const layerMemory: Layer.Layer<Channels, never, Control> = Layer.effect(Channels, makeMemory)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,aAAwB;AACxB,oBAA2E;AAC3E,qBAAwB;AACxB,0BAAgF;AAChF,4BAA+B;AAE/B,sBAA+B;AAuF/B,MAAM,eAAe,CAAI,aAA4C;AAAA,EACnE,MAAM,QAAQ;AAAA,EACd,QAAQ,QAAQ;AAAA,EAChB,oBAAoB,QAAQ;AAAA,EAC5B,QAAQ,CAAC,QAAQ,QAAQ,OAAO,GAAG;AAAA,EACnC,cAAc,CAAC,QAAQ,qBAAO,QAAQ,QAAQ,OAAO,GAAG,GAAG,CAAC,YAAY,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC5F,SAAS,CAAC,KAAK,aAAa,QAAQ,QAAQ,KAAK,QAAQ;AAC3D;AA2CO,MAAM,WAAgD,sBAAQ,QAAQ,mBAAmB;AAEhG,MAAM,cAAc,CAAC,YACnB,IAAI,gCAAY;AAAA,EACd;AAAA,EACA,QAAQ;AACV,CAAC;AAEH,MAAM,cAAc,CAAC,SAAiB,QAA4B,GAAG,QAAQ,MAAM,IAAI,OAAO,IAAI,IAAI,KAAK;AAG3G,MAAM,YAAY,CAAC,SAAiB,QAClC,WAAW,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG;AAE7C,MAAM,cAAc,CAAC,SAAiB,QACpC,kBAAkB,UAAU,SAAS,GAAG,CAAC;AAE3C,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;AACtE,MAAM,mBAAmB,OAAO,yBAAyB,qBAAqB,QAAQ,GAAG;AACzF,MAAM,uBAAuB,OAAO,yBAAyB,qBAAqB,YAAY,GAAG;AACjG,MAAM,uBAAuB,OAAO,yBAAyB,qBAAqB,YAAY,GAAG;AAEjG,MAAM,6BAA6B,UAAU;AAAA,EAClC;AAAA,EACT,YAAY,OAAe;AACzB,UAAM,KAAK;AACX,SAAK,QAAQ;AAAA,EACf;AACF;AAEA,MAAM,WAAW,CAAC,UAAyB;AACzC,QAAM,IAAI,qBAAqB,KAAK;AACtC;AAEA,MAAM,cAAc,CAAC,OAAgB,SAA+C;AAClF,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO,SAAS,GAAG,IAAI,0BAA0B;AAAA,EACnD;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,WAAO,SAAS,GAAG,IAAI,+BAA+B;AAAA,EACxD;AACA,SAAO;AACT;AAEA,MAAM,UAAU,CAAC,OAAqC,KAAkB,SAA0B;AAChG,QAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,MAAI,eAAe,UAAa,EAAE,WAAW,YAAa,QAAO,SAAS,GAAG,IAAI,gCAAgC;AACjH,SAAO,WAAW;AACpB;AAEA,MAAM,WAAW,CAAC,UAA+B;AAE/C,MACE,qBAAqB,UAAa,yBAAyB,UAC3D,yBAAyB,OACzB,QAAO,SAAS,iDAAiD;AACnE,MAAI;AACF,UAAM,SAAS,QAAQ,MAAM,kBAAkB,OAAO,CAAC,CAAC;AACxD,UAAM,aAAa,QAAQ,MAAM,sBAAsB,OAAO,CAAC,CAAC;AAChE,UAAM,aAAa,QAAQ,MAAM,sBAAsB,OAAO,CAAC,CAAC;AAChE,UAAM,SAAS,IAAI,WAAW,QAAQ,YAAY,UAAU;AAC5D,UAAM,WAAW,IAAI,WAAW,UAAU;AAC1C,aAAS,IAAI,MAAM;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,SAAS,gCAAgC;AAAA,EAClD;AACF;AAEA,MAAM,kBAAkB,CAAC,UAAiE;AACxF,QAAM,SAAS,YAAY,OAAO,aAAa;AAC/C,QAAM,WAAW,uBAAO,OAAO,IAAI;AACnC,aAAW,OAAO,QAAQ,QAAQ,MAAM,GAAG;AACzC,QAAI,OAAO,QAAQ,SAAU,QAAO,SAAS,4CAA4C;AACzF,UAAM,aAAa,OAAO,yBAAyB,QAAQ,GAAG;AAC9D,QAAI,eAAe,UAAa,EAAE,WAAW,eAAe,CAAC,WAAW,YAAY;AAClF,aAAO,SAAS,eAAe,GAAG,uCAAuC;AAAA,IAC3E;AACA,QAAI,WAAW,UAAU,UAAa,OAAO,WAAW,UAAU,UAAU;AAC1E,aAAO,SAAS,eAAe,GAAG,iCAAiC;AAAA,IACrE;AACA,UAAM,aAAa,IAAI,YAAY;AACnC,QAAI,OAAO,OAAO,UAAU,UAAU,GAAG;AACvC,aAAO,SAAS,eAAe,UAAU,mCAAmC;AAAA,IAC9E;AACA,aAAS,UAAU,IAAI,WAAW;AAAA,EACpC;AACA,SAAO,OAAO,OAAO,QAAQ;AAC/B;AAEA,MAAM,kBAAkB,CACtB,UAEA,qBAAO,IAAI;AAAA,EACT,KAAK,MAAM;AACT,UAAM,UAAU,YAAY,OAAO,SAAS;AAC5C,UAAM,UAAU,QAAQ,SAAS,WAAW,iBAAiB;AAC7D,UAAM,YAAY,YAAY,QAAQ,SAAS,OAAO,aAAa,GAAG,aAAa;AACnF,UAAM,iBAAiB,QAAQ,WAAW,kBAAkB,oBAAoB;AAChF,QAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,EAAG,QAAO,SAAS,oCAAoC;AAC7G,QAAI,OAAO,mBAAmB,YAAY,eAAe,WAAW,GAAG;AACrE,aAAO,SAAS,uCAAuC;AAAA,IACzD;AACA,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA,KAAK,OAAO,OAAO;AAAA,QACjB,MAAM,SAAS,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA,QACrD,SAAS,gBAAgB,QAAQ,WAAW,WAAW,aAAa,CAAC;AAAA,QACrE;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EACA,OAAO,CAAC,UACN,IAAI,iCAAa;AAAA,IACf,OAAO,iBAAiB,uBAAuB,MAAM,QAAQ;AAAA,EAC/D,CAAC;AACL,CAAC;AAEH,MAAM,+BAA+B,CAAC,YACpC,MAAM,KAAK,IAAI,KAAK,QAAQ,sBAAsB,CAAC,GAAG,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK;AAGjG,MAAM,cAAc,CAClB,MACA,SACA,UACW;AACX,QAAM,WAAW,KAAK,UAAU;AAAA,IAC9B,OAAO,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,IAAI,KAAK,IAAI,CAAC;AAAA,EACnD,CAAC;AACD,SAAO,sBAAsB,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC,CAAC;AACpF;AAEA,MAAM,kBAAkB,CAAC,SAAkB,QAAiC;AAC1E,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,GAAG,SAAS,WAAW,IAAI;AAAA,IACtC;AACE,aAAO;AAAA,EACX;AACF;AAoBA,MAAM,WAAW,CAAC,YAChB,qBAAO,IAAI,aAAY;AACrB,QAAM,WAAW,OAAO,kBAAI,KAAK,oBAAI,IAA+B,CAAC;AACrE,QAAM,aAAa,oBAAI,IAAsB;AAG7C,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,4BAA4B;AAClC,QAAM,YAAY,OAAO,wBAAU,KAAK,CAAC;AACzC,QAAM,UAAU,OAAO;AAEvB,QAAM,SAAS,qBAAO,GAAG,iBAAiB;AAAA,IACxC,WAAU,MAAgE;AACxE,aAAO,OAAO,qBAAO,QAAQ,kBAAI,IAAI,QAAQ,GAAG,CAAC,eAAe;AAC9D,cAAM,UAAU,WAAW,IAAI,IAAI;AACnC,eAAO,YAAY,SACf,qBAAO,KAAK,YAAY,YAAY,IAAI,qBAAqB,CAAC,IAC9D,qBAAO,QAAQ,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,SAAS,GAAG;AAAA,IACjB,UAAU,qBAAO,GAAG,mBAAmB;AAAA,MAAE,CAAI,YAC3C,kBAAI,OAAO,UAAU,CAAC,eAAe;AACnC,cAAM,OAAO,IAAI,IAAI,UAAU;AAC/B,aAAK,IAAI,QAAQ,MAAM,aAAa,OAAO,CAAC;AAC5C,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA;AAAA,IACA,QAAQ,qBAAO,GAAG,iBAAiB;AAAA,MAAE,CAAC,YACpC,qBAAO,QAAQ,gBAAgB,OAAO,GAAG,CAAC,aACxC,UAAU,YAAY,CAAC,EAAE,qBAAO,IAAI,aAAY;AAC9C,cAAM,UAAU,OAAO,OAAO,SAAS,OAAO;AAC9C,cAAM,qBAAqB,6BAA6B,OAAO;AAC/D,cAAM,kBAAkB,YAAY,SAAS,IAAI,MAAM,SAAS,IAAI,SAAS,kBAAkB;AAK/F,eAAO,QAAQ,OAAO,EAAE,GAAG,SAAS,KAAK,MAAM,SAAS,SAAS,IAAI,IAAI,EAAE,CAAC;AAC5E,cAAM,cAAc,SAAS,IAAI;AACjC,cAAM,aAAa,YAAY,SAAS,SAAS,WAAW;AAC5D,cAAM,QAAQ,OAAO,QAAQ,eAAe,YAAY,eAAe;AACvE,YAAI,UAAU,OAAW,QAAO,gBAAgB,OAAO,WAAW;AAElE,cAAM,SAAS,OAAO,QAAQ,aAAa,SAAS,GAAG;AACvD,cAAM,MAAM,UAAU,SAAS,SAAS,WAAW;AACnD,YAAI;AACJ,YAAI,OAAO,SAAS,UAAU;AAI5B,oBAAU,OAAO,QAAQ,OAAO;AAAA,YAC9B,OAAO,OAAO;AAAA,YACd,QAAQ,OAAO;AAAA,YACf,gBAAgB;AAAA,YAChB,WAAW,EAAE,IAAI,SAAS,SAAS,MAAM,WAAW,WAAW,OAAO,oBAAM,kBAAkB;AAAA,UAChG,CAAC;AAAA,QACH,OAAO;AACL,gBAAM,OAAO,OAAO,QAAQ,KAAK;AAAA,YAC/B,QAAQ,OAAO;AAAA,YACf,OAAO,OAAO;AAAA,YACd,gBAAgB;AAAA,UAClB,CAAC;AACD,oBAAU,OAAO,QAAQ,IAAI;AAAA,YAC3B,MAAM;AAAA,YACN,QAAQ,KAAK;AAAA,YACb,QAAQ,KAAK;AAAA,YACb,UAAU,KAAK;AAAA,YACf,gBAAgB;AAAA,UAClB,CAAC;AAAA,QACH;AAGA,YAAI,QAAQ,SAAS,cAAc,QAAQ,SAAS,UAAU;AAC5D,iBAAO,QAAQ,eAAe,YAAY,iBAAiB,OAAO;AAAA,QACpE;AACA,eAAO,gBAAgB,SAAS,WAAW;AAAA,MAC7C,CAAC,CAAC,CAAC;AAAA,IACP;AAAA,IACA,SAAS,qBAAO,GAAG,kBAAkB,EAAE,WAAU,SAAS;AACxD,YAAM,UAAU,OAAO,OAAO,QAAQ,OAAO;AAC7C,YAAM,MAAM,YAAY,QAAQ,SAAS,QAAQ,GAAG;AAGpD,aAAO,OAAO,qBAAO,KAAK,MAAM;AAC9B,cAAM,QAAQ,WAAW,IAAI,GAAG;AAChC,cAAM,aAAa,QAAQ,QAAQ,QAAQ,KAAK,KAAK;AACrD,YACE,WAAW,cAAc,WACxB,UAAU,UAAa,MAAM,WAAW,WAAW,UAAU,MAAM,cAAc,WAAW,YAC7F;AACA,qBAAW,IAAI,KAAK,EAAE,QAAQ,WAAW,QAAQ,WAAW,WAAW,UAAU,CAAC;AAAA,QACpF;AACA,YAAI,WAAW,IAAI,GAAG,GAAG;AACvB,gBAAM,SAAS,QAAQ,IAAI;AAC3B,cAAI,WAAW,eAAe,WAAW,YAAY,WAAW,aAAa;AAC3E,+BAAmB,IAAI,GAAG;AAC1B,gBAAI,mBAAmB,OAAO,2BAA2B;AAEvD,oBAAM,SAAS,mBAAmB,OAAO,EAAE,KAAK,EAAE;AAClD,iCAAmB,OAAO,MAAM;AAChC,yBAAW,OAAO,MAAM;AAAA,YAC1B;AAAA,UACF,OAAO;AACL,+BAAmB,OAAO,GAAG;AAAA,UAC/B;AAAA,QACF;AACA,eAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH,CAAC;AAQI,MAAM,OAAO,qBAAO,IAAI,aAAY;AACzC,QAAM,UAAU,OAAO;AACvB,SAAO,OAAO,SAAS,OAAO;AAChC,CAAC;AAWM,MAAM,aAAa,qBAAO,IAAI,aAAY;AAC/C,QAAM,UAAU,OAAO,kBAAI;AAAA,IACzB,oBAAI,IAGD;AAAA,EACL;AACA,SAAO,OAAO,SAAS;AAAA,IACrB,gBAAgB,CAAC,KAAK,cACpB,kBAAI,IAAI,OAAO,EAAE,KAAK,qBAAO,IAAI,CAAC,WAAW;AAC3C,YAAM,QAAQ,OAAO,IAAI,GAAG;AAC5B,UAAI,UAAU,OAAW,QAAO;AAChC,aAAO,MAAM,gBAAgB,gBACzB,gCAAe,KAAK,MAAM,OAAO,IACjC,EAAE,MAAM,YAAY,SAAS,mBAAmB,GAAG,iCAAiC;AAAA,IAC1F,CAAC,CAAC;AAAA,IACJ,gBAAgB,CAAC,KAAK,WAAW,YAC/B,kBAAI,OAAO,SAAS,CAAC,WAAW;AAC9B,YAAM,OAAO,IAAI,IAAI,MAAM;AAC3B,WAAK,IAAI,KAAK,EAAE,aAAa,WAAW,QAAQ,CAAC;AACjD,aAAO;AAAA,IACT,CAAC;AAAA,EACL,CAAC;AACH,CAAC;AAQM,MAAM,QAAQ,oBAAM,OAAO,UAAU,IAAI;AAQzC,MAAM,cAAqD,oBAAM,OAAO,UAAU,UAAU;",
+  "names": []
+}

package/dist/cjs/Control.d.ts

@@ -0,0 +1,202 @@
+/**
+ * Transport-independent control-plane vtable.
+ *
+ * @since 0.1.0
+ */
+import type { NotificationError } from "@smthrs/notifications/NotificationQueue";
+import { Context, Effect, Layer, Stream } from "effect";
+import type { AlreadyResolved, ClaimLost, CodeDrift, ControlError, EnvelopeMismatch, FlowNotFound, InvalidInput, LaunchFailed, NoMatchingWait, PersistenceError, PlanDenied, PlanDigestMismatch, PlanNotFound, RunNotFound, TransportError, Unauthorized, Unavailable } from "./ControlError.ts";
+import type { ApprovalPayload, ControlEvent, Envelope, FlowId, IdempotencyKey, ListRequest, ListResponse, PlanCard, Principal, Receipt, RunId, RunInputSchema, SignalInputSchema, SteerInputSchema, WatchFilter } from "./ControlSchema.ts";
+/**
+ * Raw input submitted to planning. Decoding is owned by `ControlRuntime`.
+ *
+ * This local contract accepts `unknown` so the selected flow can decode its
+ * own input. `ControlSchema.PlanInputSchema` is the narrower JSON wire
+ * contract used by RPC clients.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface PlanInput {
+    readonly flowId: FlowId;
+    readonly input: unknown;
+    readonly idempotencyKey?: IdempotencyKey | undefined;
+    /** Budget fields that replace the flow's declared ones on this plan's envelope. */
+    readonly budget?: Envelope["budget"] | undefined;
+}
+/**
+ * Starts an approved plan or joins/resumes an existing run.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type RunInput = typeof RunInputSchema.Type & {
+    /** Trusted runtime caller reserves the execution identity; absent from public RPC. */
+    readonly reservedRunId?: RunId | undefined;
+    /** Authenticated actor used only to scope durable idempotency. */
+    readonly principal?: Principal | undefined;
+};
+/**
+ * @category models
+ * @since 0.1.0
+ */
+export type { ApprovalTarget } from "./ControlSchema.ts";
+/**
+ * A listing request, restricted to one reader's runs when `reader` is set.
+ *
+ * The server sets `reader` to the authenticated principal unless its
+ * `RunVisibility` lets that principal see every run; `ControlSchema.ListRequest`
+ * excludes it from the wire, so a remote client cannot widen or borrow a view.
+ * A restricted reader sees only the runs its principal launched, and the fires
+ * that started them; an in-process caller that names no reader sees every run.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export type ListInput = ListRequest & {
+    readonly reader?: Principal | undefined;
+};
+/**
+ * A watch filter, restricted to one reader's runs when `reader` is set.
+ *
+ * A restricted reader receives the events of the runs its principal launched
+ * and nothing from a plan or from a run it did not launch. See {@link ListInput}.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export type WatchInput = WatchFilter & {
+    readonly reader?: Principal | undefined;
+};
+/**
+ * Full approval decision submitted to the authenticated server boundary.
+ *
+ * The local service may receive a runtime-stamped principal.
+ * `ControlSchema.ApprovalInputSchema` excludes it from the wire so a remote
+ * client cannot claim another identity.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface ApprovalInput extends ApprovalPayload {
+    readonly principal?: Principal | undefined;
+}
+/**
+ * Steering mutation arguments.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type SteerInput = typeof SteerInputSchema.Type & {
+    /**
+     * Set by the server to the authenticated principal unless its
+     * `RunVisibility` lets that principal see every run. A run the reader may
+     * not see fails `RunNotFound`, exactly as a missing run does. Not on the
+     * wire; an in-process caller that names no reader mutates any run.
+     */
+    readonly reader?: Principal | undefined;
+};
+/**
+ * Signal mutation arguments.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type SignalInput = typeof SignalInputSchema.Type & {
+    /** Authenticated actor used only to scope durable idempotency. */
+    readonly principal?: Principal | undefined;
+    /**
+     * Set by the server to the authenticated principal unless its
+     * `RunVisibility` lets that principal see every run. A run the reader may
+     * not see fails `RunNotFound`, exactly as a missing run does. Not on the
+     * wire; an in-process caller that names no reader mutates any run.
+     */
+    readonly reader?: Principal | undefined;
+};
+/**
+ * Run lifecycle mutation arguments.
+ *
+ * The local contract includes the runtime-stamped principal.
+ * `ControlSchema.ReasonedMutationInputSchema` carries only the caller's reason
+ * over RPC.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface RunMutationInput {
+    readonly runId: RunId;
+    readonly idempotencyKey: IdempotencyKey;
+    /**
+     * Why the run is being cancelled or resumed.
+     *
+     * Free text, recorded on the journal entry the mutation writes and projected
+     * back onto `RunSummary.cancellation`. An operator reading a cancelled run a
+     * week later asks "why", and a control plane that never carried the answer
+     * cannot produce one afterwards.
+     */
+    readonly reason?: string | undefined;
+    /**
+     * Who is asking. Stamped by the runtime, which supplies its own principal
+     * when the caller names none.
+     */
+    readonly principal?: Principal | undefined;
+    /**
+     * Resume only: run the flow's current code even when its execution digest
+     * differs from the one the run started with. Without it such a resume fails
+     * `CodeDrift` and leaves the run where it was.
+     */
+    readonly allowCodeDrift?: boolean | undefined;
+    /**
+     * Set by the server to the authenticated principal unless its
+     * `RunVisibility` lets that principal see every run. A run the reader may
+     * not see fails `RunNotFound`, exactly as a missing run does. Not on the
+     * wire; an in-process caller that names no reader mutates any run.
+     */
+    readonly reader?: Principal | undefined;
+}
+/**
+ * Transport-independent control operations.
+ *
+ * Every operation admits transport and authentication failures so the same
+ * service key can be provided by either a local implementation or an RPC client.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Service {
+    readonly plan: (input: PlanInput) => Effect.Effect<PlanCard, FlowNotFound | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized>;
+    readonly run: (input: RunInput) => Effect.Effect<Receipt, RunNotFound | PlanNotFound | PlanDenied | PlanDigestMismatch | EnvelopeMismatch | ClaimLost | CodeDrift | InvalidInput | LaunchFailed | PersistenceError | Unavailable | TransportError | Unauthorized>;
+    readonly approve: (input: ApprovalInput) => Effect.Effect<Receipt, PlanDigestMismatch | EnvelopeMismatch | AlreadyResolved | PlanNotFound | RunNotFound | CodeDrift | InvalidInput | Unauthorized | PersistenceError | Unavailable | TransportError>;
+    readonly deny: (input: ApprovalInput) => Effect.Effect<Receipt, PlanDigestMismatch | EnvelopeMismatch | AlreadyResolved | PlanNotFound | RunNotFound | CodeDrift | InvalidInput | Unauthorized | PersistenceError | Unavailable | TransportError>;
+    readonly steer: (input: SteerInput) => Effect.Effect<Receipt, RunNotFound | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized | NotificationError>;
+    readonly signal: (input: SignalInput) => Effect.Effect<Receipt, RunNotFound | NoMatchingWait | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized>;
+    readonly cancel: (input: RunMutationInput) => Effect.Effect<Receipt, RunNotFound | ClaimLost | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized>;
+    readonly resume: (input: RunMutationInput) => Effect.Effect<Receipt, RunNotFound | ClaimLost | CodeDrift | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized>;
+    readonly list: (input: ListInput) => Effect.Effect<ListResponse, ControlError>;
+    /** Checkpoint `event.cursor` after processing each event and resume with `afterCursor`. */
+    readonly watch: (filter: WatchInput) => Stream.Stream<ControlEvent, ControlError>;
+}
+declare const Control_base: Context.ServiceClass<Control, "/control/Control", Service>;
+/**
+ * Service key for the authoritative control-plane vtable.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class Control extends Control_base {
+}
+/**
+ * Constructs a control service from an implementation record.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const make: (implementation: Service) => Service;
+/**
+ * Provides an unavailable control implementation for optional integrations.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerNoop: Layer.Layer<Control>;
+//# sourceMappingURL=Control.d.ts.map

package/dist/cjs/Control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Control.d.ts","sourceRoot":"","sources":["../../src/Control.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvD,OAAO,KAAK,EACV,eAAe,EACf,SAAS,EACT,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,cAAc,EACd,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,OAAO,EACP,KAAK,EACL,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IACpD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAA;CACjD;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,cAAc,CAAC,IAAI,GAAG;IAClD,sFAAsF;IACtF,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAC3C,CAAA;AAED;;;GAGG;AACH,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACxC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACxC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAC3C;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,gBAAgB,CAAC,IAAI,GAAG;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACxC,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,iBAAiB,CAAC,IAAI,GAAG;IACxD,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACxC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,SAAS,KACb,MAAM,CAAC,MAAM,CAChB,QAAQ,EACR,YAAY,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,CAC7F,CAAA;IACD,QAAQ,CAAC,GAAG,EAAE,CACZ,KAAK,EAAE,QAAQ,KACZ,MAAM,CAAC,MAAM,CAChB,OAAO,EACL,WAAW,GACX,YAAY,GACZ,UAAU,GACV,kBAAkB,GAClB,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,cAAc,GACd,YAAY,CACf,CAAA;IACD,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAChB,OAAO,EACL,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,cAAc,CACjB,CAAA;IACD,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,aAAa,KACjB,MAAM,CAAC,MAAM,CAChB,OAAO,EACL,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,cAAc,CACjB,CAAA;IACD,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,UAAU,KACd,MAAM,CAAC,MAAM,CAChB,OAAO,EACP,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,iBAAiB,CAChH,CAAA;IACD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,WAAW,KACf,MAAM,CAAC,MAAM,CAChB,OAAO,EACP,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,CAC7G,CAAA;IACD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,gBAAgB,KACpB,MAAM,CAAC,MAAM,CAChB,OAAO,EACP,WAAW,GAAG,SAAS,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,CACxG,CAAA;IACD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,gBAAgB,KACpB,MAAM,CAAC,MAAM,CAChB,OAAO,EACP,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,CACpH,CAAA;IACD,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IAC9E,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;CAClF;;AAED;;;;;GAKG;AACH,qBAAa,OAAQ,SAAQ,YAAuD;CAAG;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,gBAAgB,OAAO,KAAG,OAAqC,CAAA;AAKpF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAc1C,CAAA"}

package/dist/cjs/Control.js

@@ -0,0 +1,47 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Control_exports = {};
+__export(Control_exports, {
+  Control: () => Control,
+  layerNoop: () => layerNoop,
+  make: () => make
+});
+module.exports = __toCommonJS(Control_exports);
+var import_effect = require("effect");
+var import_ControlError = require("./ControlError.js");
+class Control extends import_effect.Context.Service()("/control/Control") {
+}
+const make = (implementation) => Control.of(implementation);
+const unavailable = (feature) => new import_ControlError.Unavailable({ feature, ticket: "control-runtime-engine-integration" });
+const layerNoop = import_effect.Layer.succeed(
+  Control,
+  make({
+    plan: import_effect.Effect.fn("Control.plan")(() => import_effect.Effect.fail(unavailable("plan"))),
+    run: import_effect.Effect.fn("Control.run")(() => import_effect.Effect.fail(unavailable("run"))),
+    approve: import_effect.Effect.fn("Control.approve")(() => import_effect.Effect.fail(unavailable("approve"))),
+    deny: import_effect.Effect.fn("Control.deny")(() => import_effect.Effect.fail(unavailable("deny"))),
+    steer: import_effect.Effect.fn("Control.steer")(() => import_effect.Effect.fail(unavailable("steer"))),
+    signal: import_effect.Effect.fn("Control.signal")(() => import_effect.Effect.fail(unavailable("signal"))),
+    cancel: import_effect.Effect.fn("Control.cancel")(() => import_effect.Effect.fail(unavailable("cancel"))),
+    resume: import_effect.Effect.fn("Control.resume")(() => import_effect.Effect.fail(unavailable("resume"))),
+    list: import_effect.Effect.fn("Control.list")(() => import_effect.Effect.fail(unavailable("list"))),
+    watch: () => import_effect.Stream.fail(unavailable("watch"))
+  })
+);
+//# sourceMappingURL=Control.js.map

package/dist/cjs/Control.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Control.ts"],
+  "sourcesContent": ["/**\n * Transport-independent control-plane vtable.\n *\n * @since 0.1.0\n */\n\nimport type { NotificationError } from \"@smthrs/notifications/NotificationQueue\"\nimport { Context, Effect, Layer, Stream } from \"effect\"\nimport type {\n  AlreadyResolved,\n  ClaimLost,\n  CodeDrift,\n  ControlError,\n  EnvelopeMismatch,\n  FlowNotFound,\n  InvalidInput,\n  LaunchFailed,\n  NoMatchingWait,\n  PersistenceError,\n  PlanDenied,\n  PlanDigestMismatch,\n  PlanNotFound,\n  RunNotFound,\n  TransportError,\n  Unauthorized,\n  Unavailable\n} from \"./ControlError.ts\"\nimport { Unavailable as UnavailableError } from \"./ControlError.ts\"\nimport type {\n  ApprovalPayload,\n  ControlEvent,\n  Envelope,\n  FlowId,\n  IdempotencyKey,\n  ListRequest,\n  ListResponse,\n  PlanCard,\n  Principal,\n  Receipt,\n  RunId,\n  RunInputSchema,\n  SignalInputSchema,\n  SteerInputSchema,\n  WatchFilter\n} from \"./ControlSchema.ts\"\n\n/**\n * Raw input submitted to planning. Decoding is owned by `ControlRuntime`.\n *\n * This local contract accepts `unknown` so the selected flow can decode its\n * own input. `ControlSchema.PlanInputSchema` is the narrower JSON wire\n * contract used by RPC clients.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface PlanInput {\n  readonly flowId: FlowId\n  readonly input: unknown\n  readonly idempotencyKey?: IdempotencyKey | undefined\n  /** Budget fields that replace the flow's declared ones on this plan's envelope. */\n  readonly budget?: Envelope[\"budget\"] | undefined\n}\n\n/**\n * Starts an approved plan or joins/resumes an existing run.\n *\n * @category models\n * @since 0.1.0\n */\nexport type RunInput = typeof RunInputSchema.Type & {\n  /** Trusted runtime caller reserves the execution identity; absent from public RPC. */\n  readonly reservedRunId?: RunId | undefined\n  /** Authenticated actor used only to scope durable idempotency. */\n  readonly principal?: Principal | undefined\n}\n\n/**\n * @category models\n * @since 0.1.0\n */\nexport type { ApprovalTarget } from \"./ControlSchema.ts\"\n\n/**\n * A listing request, restricted to one reader's runs when `reader` is set.\n *\n * The server sets `reader` to the authenticated principal unless its\n * `RunVisibility` lets that principal see every run; `ControlSchema.ListRequest`\n * excludes it from the wire, so a remote client cannot widen or borrow a view.\n * A restricted reader sees only the runs its principal launched, and the fires\n * that started them; an in-process caller that names no reader sees every run.\n *\n * @category models\n * @since 1.0.0\n */\nexport type ListInput = ListRequest & {\n  readonly reader?: Principal | undefined\n}\n\n/**\n * A watch filter, restricted to one reader's runs when `reader` is set.\n *\n * A restricted reader receives the events of the runs its principal launched\n * and nothing from a plan or from a run it did not launch. See {@link ListInput}.\n *\n * @category models\n * @since 1.0.0\n */\nexport type WatchInput = WatchFilter & {\n  readonly reader?: Principal | undefined\n}\n\n/**\n * Full approval decision submitted to the authenticated server boundary.\n *\n * The local service may receive a runtime-stamped principal.\n * `ControlSchema.ApprovalInputSchema` excludes it from the wire so a remote\n * client cannot claim another identity.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface ApprovalInput extends ApprovalPayload {\n  readonly principal?: Principal | undefined\n}\n\n/**\n * Steering mutation arguments.\n *\n * @category models\n * @since 0.1.0\n */\nexport type SteerInput = typeof SteerInputSchema.Type & {\n  /**\n   * Set by the server to the authenticated principal unless its\n   * `RunVisibility` lets that principal see every run. A run the reader may\n   * not see fails `RunNotFound`, exactly as a missing run does. Not on the\n   * wire; an in-process caller that names no reader mutates any run.\n   */\n  readonly reader?: Principal | undefined\n}\n\n/**\n * Signal mutation arguments.\n *\n * @category models\n * @since 0.1.0\n */\nexport type SignalInput = typeof SignalInputSchema.Type & {\n  /** Authenticated actor used only to scope durable idempotency. */\n  readonly principal?: Principal | undefined\n  /**\n   * Set by the server to the authenticated principal unless its\n   * `RunVisibility` lets that principal see every run. A run the reader may\n   * not see fails `RunNotFound`, exactly as a missing run does. Not on the\n   * wire; an in-process caller that names no reader mutates any run.\n   */\n  readonly reader?: Principal | undefined\n}\n\n/**\n * Run lifecycle mutation arguments.\n *\n * The local contract includes the runtime-stamped principal.\n * `ControlSchema.ReasonedMutationInputSchema` carries only the caller's reason\n * over RPC.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface RunMutationInput {\n  readonly runId: RunId\n  readonly idempotencyKey: IdempotencyKey\n  /**\n   * Why the run is being cancelled or resumed.\n   *\n   * Free text, recorded on the journal entry the mutation writes and projected\n   * back onto `RunSummary.cancellation`. An operator reading a cancelled run a\n   * week later asks \"why\", and a control plane that never carried the answer\n   * cannot produce one afterwards.\n   */\n  readonly reason?: string | undefined\n  /**\n   * Who is asking. Stamped by the runtime, which supplies its own principal\n   * when the caller names none.\n   */\n  readonly principal?: Principal | undefined\n  /**\n   * Resume only: run the flow's current code even when its execution digest\n   * differs from the one the run started with. Without it such a resume fails\n   * `CodeDrift` and leaves the run where it was.\n   */\n  readonly allowCodeDrift?: boolean | undefined\n  /**\n   * Set by the server to the authenticated principal unless its\n   * `RunVisibility` lets that principal see every run. A run the reader may\n   * not see fails `RunNotFound`, exactly as a missing run does. Not on the\n   * wire; an in-process caller that names no reader mutates any run.\n   */\n  readonly reader?: Principal | undefined\n}\n\n/**\n * Transport-independent control operations.\n *\n * Every operation admits transport and authentication failures so the same\n * service key can be provided by either a local implementation or an RPC client.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Service {\n  readonly plan: (\n    input: PlanInput\n  ) => Effect.Effect<\n    PlanCard,\n    FlowNotFound | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized\n  >\n  readonly run: (\n    input: RunInput\n  ) => Effect.Effect<\n    Receipt,\n    | RunNotFound\n    | PlanNotFound\n    | PlanDenied\n    | PlanDigestMismatch\n    | EnvelopeMismatch\n    | ClaimLost\n    | CodeDrift\n    | InvalidInput\n    | LaunchFailed\n    | PersistenceError\n    | Unavailable\n    | TransportError\n    | Unauthorized\n  >\n  readonly approve: (\n    input: ApprovalInput\n  ) => Effect.Effect<\n    Receipt,\n    | PlanDigestMismatch\n    | EnvelopeMismatch\n    | AlreadyResolved\n    | PlanNotFound\n    | RunNotFound\n    | CodeDrift\n    | InvalidInput\n    | Unauthorized\n    | PersistenceError\n    | Unavailable\n    | TransportError\n  >\n  readonly deny: (\n    input: ApprovalInput\n  ) => Effect.Effect<\n    Receipt,\n    | PlanDigestMismatch\n    | EnvelopeMismatch\n    | AlreadyResolved\n    | PlanNotFound\n    | RunNotFound\n    | CodeDrift\n    | InvalidInput\n    | Unauthorized\n    | PersistenceError\n    | Unavailable\n    | TransportError\n  >\n  readonly steer: (\n    input: SteerInput\n  ) => Effect.Effect<\n    Receipt,\n    RunNotFound | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized | NotificationError\n  >\n  readonly signal: (\n    input: SignalInput\n  ) => Effect.Effect<\n    Receipt,\n    RunNotFound | NoMatchingWait | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized\n  >\n  readonly cancel: (\n    input: RunMutationInput\n  ) => Effect.Effect<\n    Receipt,\n    RunNotFound | ClaimLost | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized\n  >\n  readonly resume: (\n    input: RunMutationInput\n  ) => Effect.Effect<\n    Receipt,\n    RunNotFound | ClaimLost | CodeDrift | InvalidInput | PersistenceError | Unavailable | TransportError | Unauthorized\n  >\n  readonly list: (input: ListInput) => Effect.Effect<ListResponse, ControlError>\n  /** Checkpoint `event.cursor` after processing each event and resume with `afterCursor`. */\n  readonly watch: (filter: WatchInput) => Stream.Stream<ControlEvent, ControlError>\n}\n\n/**\n * Service key for the authoritative control-plane vtable.\n *\n * @category services\n * @since 0.1.0\n */\nexport class Control extends Context.Service<Control, Service>()(\"/control/Control\") {}\n\n/**\n * Constructs a control service from an implementation record.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (implementation: Service): Service => Control.of(implementation)\n\nconst unavailable = (feature: string): Unavailable =>\n  new UnavailableError({ feature, ticket: \"control-runtime-engine-integration\" })\n\n/**\n * Provides an unavailable control implementation for optional integrations.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoop: Layer.Layer<Control> = Layer.succeed(\n  Control,\n  make({\n    plan: Effect.fn(\"Control.plan\")(() => Effect.fail(unavailable(\"plan\"))),\n    run: Effect.fn(\"Control.run\")(() => Effect.fail(unavailable(\"run\"))),\n    approve: Effect.fn(\"Control.approve\")(() => Effect.fail(unavailable(\"approve\"))),\n    deny: Effect.fn(\"Control.deny\")(() => Effect.fail(unavailable(\"deny\"))),\n    steer: Effect.fn(\"Control.steer\")(() => Effect.fail(unavailable(\"steer\"))),\n    signal: Effect.fn(\"Control.signal\")(() => Effect.fail(unavailable(\"signal\"))),\n    cancel: Effect.fn(\"Control.cancel\")(() => Effect.fail(unavailable(\"cancel\"))),\n    resume: Effect.fn(\"Control.resume\")(() => Effect.fail(unavailable(\"resume\"))),\n    list: Effect.fn(\"Control.list\")(() => Effect.fail(unavailable(\"list\"))),\n    watch: () => Stream.fail(unavailable(\"watch\"))\n  })\n)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,oBAA+C;AAoB/C,0BAAgD;AAoRzC,MAAM,gBAAgB,sBAAQ,QAA0B,EAAE,kBAAkB,EAAE;AAAC;AAQ/E,MAAM,OAAO,CAAC,mBAAqC,QAAQ,GAAG,cAAc;AAEnF,MAAM,cAAc,CAAC,YACnB,IAAI,oBAAAA,YAAiB,EAAE,SAAS,QAAQ,qCAAqC,CAAC;AAQzE,MAAM,YAAkC,oBAAM;AAAA,EACnD;AAAA,EACA,KAAK;AAAA,IACH,MAAM,qBAAO,GAAG,cAAc,EAAE,MAAM,qBAAO,KAAK,YAAY,MAAM,CAAC,CAAC;AAAA,IACtE,KAAK,qBAAO,GAAG,aAAa,EAAE,MAAM,qBAAO,KAAK,YAAY,KAAK,CAAC,CAAC;AAAA,IACnE,SAAS,qBAAO,GAAG,iBAAiB,EAAE,MAAM,qBAAO,KAAK,YAAY,SAAS,CAAC,CAAC;AAAA,IAC/E,MAAM,qBAAO,GAAG,cAAc,EAAE,MAAM,qBAAO,KAAK,YAAY,MAAM,CAAC,CAAC;AAAA,IACtE,OAAO,qBAAO,GAAG,eAAe,EAAE,MAAM,qBAAO,KAAK,YAAY,OAAO,CAAC,CAAC;AAAA,IACzE,QAAQ,qBAAO,GAAG,gBAAgB,EAAE,MAAM,qBAAO,KAAK,YAAY,QAAQ,CAAC,CAAC;AAAA,IAC5E,QAAQ,qBAAO,GAAG,gBAAgB,EAAE,MAAM,qBAAO,KAAK,YAAY,QAAQ,CAAC,CAAC;AAAA,IAC5E,QAAQ,qBAAO,GAAG,gBAAgB,EAAE,MAAM,qBAAO,KAAK,YAAY,QAAQ,CAAC,CAAC;AAAA,IAC5E,MAAM,qBAAO,GAAG,cAAc,EAAE,MAAM,qBAAO,KAAK,YAAY,MAAM,CAAC,CAAC;AAAA,IACtE,OAAO,MAAM,qBAAO,KAAK,YAAY,OAAO,CAAC;AAAA,EAC/C,CAAC;AACH;",
+  "names": ["UnavailableError"]
+}

package/dist/cjs/ControlClient.d.ts

@@ -0,0 +1,52 @@
+/**
+ * RPC client layer projected back into the control service interface.
+ *
+ * @since 0.1.0
+ */
+import { Layer } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import { Control } from "./Control.ts";
+import { TransportError, Unauthorized } from "./ControlError.ts";
+/**
+ * Whether a value is one of the control plane's declared failures, as opposed
+ * to a defect that escaped some other layer.
+ *
+ * Derived from `ControlError.ControlErrorSchema` rather than restated, so a new
+ * error class cannot be a member of the union and a stranger to the client.
+ *
+ * @category refinements
+ * @since 0.1.0
+ */
+export declare const isControlError: <I>(input: I) => input is I & (import("@smthrs/notifications/NotificationQueue").NotificationError | import("./ControlError.ts").RunNotFound | import("./ControlError.ts").PlanNotFound | import("./ControlError.ts").PlanDenied | import("./ControlError.ts").FlowNotFound | import("./ControlError.ts").PlanDigestMismatch | import("./ControlError.ts").EnvelopeMismatch | import("./ControlError.ts").ClaimLost | import("./ControlError.ts").CodeDrift | import("./ControlError.ts").AlreadyResolved | import("./ControlError.ts").InvalidInput | Unauthorized | import("./ControlError.ts").Unavailable | TransportError | import("./ControlError.ts").PersistenceError | import("./ControlError.ts").LaunchFailed | import("./ControlError.ts").NoMatchingWait | import("./ControlError.ts").CredentialConflict);
+/**
+ * Client transport configuration. Unary procedures use HTTP at this URL;
+ * `watch` uses the abstract WebSocket supplied by the platform layer.
+ *
+ * `credential` reaches the HTTP protocol only. It is attached as a bearer
+ * token on each HTTP RPC request; the `watch` stream rides a WebSocket whose
+ * upgrade request a browser cannot add headers to, so the socket carries no
+ * credential at all in a browser deployment. A deployment that authenticates
+ * control traffic must therefore front the socket (terminate auth at a proxy
+ * that injects the credential on the upgrade) or serve `watch` over the HTTP
+ * protocol instead.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface ClientConfig {
+    readonly url: string;
+    /**
+     * Bearer token attached to every HTTP RPC request when present.
+     *
+     * Not sent on the `watch` WebSocket: see {@link ClientConfig}.
+     */
+    readonly credential?: string | undefined;
+}
+/**
+ * Provides `Control` through an RPC client while preserving the local vtable.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: (config: ClientConfig) => Layer.Layer<Control, never, import("effect/unstable/rpc/RpcSerialization").RpcSerialization | HttpClient.HttpClient | import("effect/unstable/socket/Socket").Socket>;
+//# sourceMappingURL=ControlClient.d.ts.map

package/dist/cjs/ControlClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlClient.d.ts","sourceRoot":"","sources":["../../src/ControlClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,KAAK,EAA0B,MAAM,QAAQ,CAAA;AACrE,OAAO,EAAE,UAAU,EAAqB,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,OAAO,EAAQ,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAyC,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAcvG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,yxBAAgC,CAAA;AAiM3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACzC;AAED;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAAI,QAAQ,YAAY,0KA4DzC,CAAA"}

package/dist/cjs/ControlClient.js

@@ -0,0 +1,191 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ControlClient_exports = {};
+__export(ControlClient_exports, {
+  isControlError: () => isControlError,
+  layer: () => layer
+});
+module.exports = __toCommonJS(ControlClient_exports);
+var import_effect = require("effect");
+var import_http = require("effect/unstable/http");
+var import_rpc = require("effect/unstable/rpc");
+var import_Control = require("./Control.js");
+var import_ControlError = require("./ControlError.js");
+var import_ControlRpcs = require("./ControlRpcs.js");
+var import_ControlSchema = require("./ControlSchema.js");
+const isControlError = import_effect.Schema.is(import_ControlError.ControlErrorSchema);
+const requestEncoding = {
+  message: "The control request could not be encoded.",
+  retryable: false
+};
+const responseDecoding = {
+  message: "The control response could not be decoded.",
+  retryable: false
+};
+const connectionFailure = {
+  message: "The control server could not be reached.",
+  retryable: true
+};
+const clientHttpFailure = {
+  message: "The control server rejected the HTTP request.",
+  retryable: false
+};
+const serverHttpFailure = {
+  message: "The control server failed while handling the HTTP request.",
+  retryable: true
+};
+const invalidClientUrl = {
+  message: "The control server URL is invalid.",
+  retryable: false
+};
+const unknownClientFailure = {
+  message: "The control RPC client failed.",
+  retryable: false
+};
+const transportError = (cause, classification) => new import_ControlError.TransportError({
+  ...classification,
+  cause
+});
+const statusFrom = (cause) => {
+  if (typeof cause !== "object" || cause === null || !("response" in cause)) return void 0;
+  const response = cause.response;
+  if (typeof response !== "object" || response === null || !("status" in response)) return void 0;
+  return typeof response.status === "number" ? response.status : void 0;
+};
+const httpClassification = {
+  TransportError: connectionFailure,
+  EncodeError: requestEncoding,
+  InvalidUrlError: invalidClientUrl,
+  DecodeError: responseDecoding,
+  EmptyBodyError: responseDecoding
+};
+const reasonClassification = {
+  RpcClientDefect: responseDecoding,
+  SocketReadError: connectionFailure,
+  SocketWriteError: connectionFailure,
+  SocketOpenError: connectionFailure,
+  // The socket cannot perform a requested protocol upgrade; retries of the
+  // same unsupported operation cannot change that host capability.
+  SocketUpgradeError: unknownClientFailure,
+  SocketCloseError: connectionFailure,
+  // A worker transport is not composable with this client, which speaks HTTP
+  // and WebSocket. The entries exist so the table stays exhaustive.
+  WorkerSpawnError: unknownClientFailure,
+  WorkerSendError: unknownClientFailure,
+  WorkerReceiveError: unknownClientFailure,
+  WorkerUnknownError: unknownClientFailure
+};
+const classifyRpcClientError = (error) => {
+  const reason = error.reason;
+  if (reason._tag !== "HttpError") return reasonClassification[reason._tag];
+  if (reason.kind !== "StatusCodeError") return httpClassification[reason.kind];
+  const status = statusFrom(reason.cause);
+  return status !== void 0 && status >= 500 && status <= 599 ? serverHttpFailure : clientHttpFailure;
+};
+const isRpcClientError = import_effect.Schema.is(import_rpc.RpcClientError.RpcClientError);
+const classify = (error) => {
+  if (import_effect.Schema.isSchemaError(error)) return responseDecoding;
+  if (isRpcClientError(error)) return classifyRpcClientError(error);
+  return unknownClientFailure;
+};
+const normalizedFailure = (cause) => {
+  const failure = import_effect.Cause.findError(cause);
+  if (import_effect.Result.isSuccess(failure)) {
+    return import_effect.Effect.fail(
+      isControlError(failure.success) ? failure.success : transportError(failure.success, classify(failure.success))
+    );
+  }
+  const defect = import_effect.Cause.findDefect(cause);
+  return import_effect.Result.isSuccess(defect) ? import_effect.Effect.fail(transportError(defect.success, classify(defect.success))) : import_effect.Effect.failCause(cause);
+};
+const normalize = (effect) => import_effect.Effect.catchCause(effect, normalizedFailure);
+const encoder = (schema) => (
+  // Every request schema in this module is service-free. `Schema.Top` erases
+  // that fact to `unknown`, so restore it at this one construction boundary.
+  import_effect.Schema.encodeUnknownEffect(import_effect.Schema.toCodecJson(schema))
+);
+const planEncoder = encoder(import_ControlSchema.PlanInputSchema);
+const runEncoder = encoder(import_ControlSchema.RunInputSchema);
+const approvalEncoder = encoder(import_ControlSchema.ApprovalInputSchema);
+const steerEncoder = encoder(import_ControlSchema.SteerInputSchema);
+const signalEncoder = encoder(import_ControlSchema.SignalInputSchema);
+const cancelEncoder = encoder(import_ControlSchema.CancelInputSchema);
+const resumeEncoder = encoder(import_ControlSchema.ResumeInputSchema);
+const listEncoder = encoder(import_ControlSchema.ListRequest);
+const watchEncoder = encoder(import_ControlSchema.WatchFilter);
+const normalizeRequest = (encode, input, request) => encode(input).pipe(
+  import_effect.Effect.mapError((cause) => transportError(cause, requestEncoding)),
+  import_effect.Effect.andThen(import_effect.Effect.suspend(() => normalize(request())))
+);
+const normalizeStream = (stream) => import_effect.Stream.catchCause(stream, (cause) => import_effect.Stream.fromEffect(normalizedFailure(cause)));
+const normalizeStreamRequest = (encode, input, request) => import_effect.Stream.unwrap(
+  encode(input).pipe(
+    import_effect.Effect.mapError((cause) => transportError(cause, requestEncoding)),
+    import_effect.Effect.map(() => normalizeStream(request()))
+  )
+);
+const layer = (config) => {
+  const http = import_rpc.RpcClient.layerProtocolHttp({
+    url: config.url,
+    transformClient: (client) => {
+      const checked = import_http.HttpClient.filterStatusOk(client);
+      return config.credential === void 0 ? checked : import_http.HttpClient.mapRequest(checked, import_http.HttpClientRequest.bearerToken(config.credential));
+    }
+  });
+  const websocket = import_rpc.RpcClient.layerProtocolSocket();
+  return import_effect.Layer.effect(
+    import_Control.Control,
+    import_effect.Effect.gen(function* () {
+      const httpServices = yield* import_effect.Layer.build(http);
+      const websocketServices = yield* import_effect.Layer.build(websocket);
+      const unary = yield* import_rpc.RpcClient.make(import_ControlRpcs.ControlRpcs).pipe(import_effect.Effect.provide(httpServices));
+      const streaming = yield* import_rpc.RpcClient.make(import_ControlRpcs.ControlRpcs).pipe(import_effect.Effect.provide(websocketServices));
+      return (0, import_Control.make)({
+        plan: import_effect.Effect.fn("Control.plan")((input) => normalizeRequest(planEncoder, input, () => unary.Plan(input))),
+        run: import_effect.Effect.fn("Control.run")((input) => normalizeRequest(runEncoder, input, () => unary.Run(input))),
+        // RPC authenticates with this client's credential and does not carry
+        // local attribution. Refuse here before an agent becomes that operator.
+        approve: import_effect.Effect.fn("Control.approve")(
+          (input) => normalizeRequest(approvalEncoder, input, () => input.principal?.kind === "agent" ? import_effect.Effect.fail(new import_ControlError.Unauthorized({ message: "Approval decisions are operator-only" })) : unary.Approve(input))
+        ),
+        deny: import_effect.Effect.fn("Control.deny")(
+          (input) => normalizeRequest(approvalEncoder, input, () => input.principal?.kind === "agent" ? import_effect.Effect.fail(new import_ControlError.Unauthorized({ message: "Approval decisions are operator-only" })) : unary.Deny(input))
+        ),
+        steer: import_effect.Effect.fn("Control.steer")((input) => normalizeRequest(steerEncoder, input, () => unary.Steer(input))),
+        signal: import_effect.Effect.fn("Control.signal")(
+          (input) => normalizeRequest(signalEncoder, input, () => unary.Signal(input))
+        ),
+        cancel: import_effect.Effect.fn("Control.cancel")(
+          (input) => normalizeRequest(cancelEncoder, input, () => unary.Cancel(input))
+        ),
+        resume: import_effect.Effect.fn("Control.resume")(
+          (input) => normalizeRequest(resumeEncoder, input, () => unary.Resume(input))
+        ),
+        list: import_effect.Effect.fn("Control.list")((input) => normalizeRequest(listEncoder, input, () => unary.List(input))),
+        // `watch` is the only procedure on the socket protocol, and the
+        // socket is why `credential` cannot protect it: a browser's WebSocket
+        // upgrade takes no headers, so the bearer token that authenticates
+        // every unary call above never reaches this stream. Credentialed
+        // deployments front the socket or use the HTTP protocol for watch.
+        watch: (input) => normalizeStreamRequest(watchEncoder, input, () => streaming.Watch(input))
+      });
+    })
+  );
+};
+//# sourceMappingURL=ControlClient.js.map