@smthrs/control 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/migrations/0005_signal_principals.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Record who admitted each signal command.
+ * @since 1.0.0
+ */
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+/**
+ * Adds the admitting principal to the signal inbox.
+ *
+ * NULL is intentional for existing rows: a command admitted before this column
+ * has no recorded identity, so it cannot answer a human wait, which requires
+ * `ApprovalAuthority` to authorize the admitting principal.
+ *
+ * @category migrations
+ * @since 1.0.0
+ */
+export declare const signalPrincipals: Effect.Effect<void, import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+//# sourceMappingURL=0005_signal_principals.d.ts.map

package/dist/cjs/migrations/0005_signal_principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0005_signal_principals.d.ts","sourceRoot":"","sources":["../../../src/migrations/0005_signal_principals.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,2FAO3B,CAAA"}

package/dist/cjs/migrations/0005_signal_principals.js

@@ -0,0 +1,45 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var signal_principals_exports = {};
+__export(signal_principals_exports, {
+  signalPrincipals: () => signalPrincipals
+});
+module.exports = __toCommonJS(signal_principals_exports);
+var Dialect = __toESM(require("@smthrs/database/Dialect"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var SqlClient = __toESM(require("effect/unstable/sql/SqlClient"), 1);
+const signalPrincipals = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql.withTransaction(Effect.gen(function* () {
+    const columns = yield* Dialect.columns(sql, "control_signal_commands");
+    if (columns.some((column) => column.name === "principal_json")) return;
+    yield* sql`ALTER TABLE control_signal_commands ADD COLUMN principal_json TEXT`;
+  }));
+});
+//# sourceMappingURL=0005_signal_principals.js.map

package/dist/cjs/migrations/0005_signal_principals.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/migrations/0005_signal_principals.ts"],
+  "sourcesContent": ["/**\n * Record who admitted each signal command.\n * @since 1.0.0\n */\n\nimport * as Dialect from \"@smthrs/database/Dialect\"\nimport * as Effect from \"effect/Effect\"\nimport * as SqlClient from \"effect/unstable/sql/SqlClient\"\n\n/**\n * Adds the admitting principal to the signal inbox.\n *\n * NULL is intentional for existing rows: a command admitted before this column\n * has no recorded identity, so it cannot answer a human wait, which requires\n * `ApprovalAuthority` to authorize the admitting principal.\n *\n * @category migrations\n * @since 1.0.0\n */\nexport const signalPrincipals = Effect.gen(function*() {\n  const sql = yield* SqlClient.SqlClient\n  yield* sql.withTransaction(Effect.gen(function*() {\n    const columns = yield* Dialect.columns(sql, \"control_signal_commands\")\n    if (columns.some((column) => column.name === \"principal_json\")) return\n    yield* sql`ALTER TABLE control_signal_commands ADD COLUMN principal_json TEXT`\n  }))\n})\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,cAAyB;AACzB,aAAwB;AACxB,gBAA2B;AAYpB,MAAM,mBAAmB,OAAO,IAAI,aAAY;AACrD,QAAM,MAAM,OAAO,UAAU;AAC7B,SAAO,IAAI,gBAAgB,OAAO,IAAI,aAAY;AAChD,UAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK,yBAAyB;AACrE,QAAI,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,gBAAgB,EAAG;AAChE,WAAO;AAAA,EACT,CAAC,CAAC;AACJ,CAAC;",
+  "names": []
+}

package/dist/cjs/migrations/0006_run_principals.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Record who launched each run.
+ * @since 1.0.0
+ */
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+/**
+ * Adds the launching principal to the launch index.
+ *
+ * NULL is intentional for existing rows: a run launched before these columns
+ * has no recorded launcher, so only a reader that sees every run lists or
+ * watches it.
+ *
+ * @category migrations
+ * @since 1.0.0
+ */
+export declare const runPrincipals: Effect.Effect<void, import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+//# sourceMappingURL=0006_run_principals.d.ts.map

package/dist/cjs/migrations/0006_run_principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0006_run_principals.d.ts","sourceRoot":"","sources":["../../../src/migrations/0006_run_principals.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,2FAWxB,CAAA"}

package/dist/cjs/migrations/0006_run_principals.js

@@ -0,0 +1,49 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var run_principals_exports = {};
+__export(run_principals_exports, {
+  runPrincipals: () => runPrincipals
+});
+module.exports = __toCommonJS(run_principals_exports);
+var Dialect = __toESM(require("@smthrs/database/Dialect"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var SqlClient = __toESM(require("effect/unstable/sql/SqlClient"), 1);
+const runPrincipals = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql.withTransaction(Effect.gen(function* () {
+    const columns = yield* Dialect.columns(sql, "control_runs");
+    if (!columns.some((column) => column.name === "principal_id")) {
+      yield* sql`ALTER TABLE control_runs ADD COLUMN principal_id TEXT`;
+    }
+    if (!columns.some((column) => column.name === "principal_kind")) {
+      yield* sql`ALTER TABLE control_runs ADD COLUMN principal_kind TEXT`;
+    }
+  }));
+});
+//# sourceMappingURL=0006_run_principals.js.map

package/dist/cjs/migrations/0006_run_principals.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/migrations/0006_run_principals.ts"],
+  "sourcesContent": ["/**\n * Record who launched each run.\n * @since 1.0.0\n */\n\nimport * as Dialect from \"@smthrs/database/Dialect\"\nimport * as Effect from \"effect/Effect\"\nimport * as SqlClient from \"effect/unstable/sql/SqlClient\"\n\n/**\n * Adds the launching principal to the launch index.\n *\n * NULL is intentional for existing rows: a run launched before these columns\n * has no recorded launcher, so only a reader that sees every run lists or\n * watches it.\n *\n * @category migrations\n * @since 1.0.0\n */\nexport const runPrincipals = Effect.gen(function*() {\n  const sql = yield* SqlClient.SqlClient\n  yield* sql.withTransaction(Effect.gen(function*() {\n    const columns = yield* Dialect.columns(sql, \"control_runs\")\n    if (!columns.some((column) => column.name === \"principal_id\")) {\n      yield* sql`ALTER TABLE control_runs ADD COLUMN principal_id TEXT`\n    }\n    if (!columns.some((column) => column.name === \"principal_kind\")) {\n      yield* sql`ALTER TABLE control_runs ADD COLUMN principal_kind TEXT`\n    }\n  }))\n})\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,cAAyB;AACzB,aAAwB;AACxB,gBAA2B;AAYpB,MAAM,gBAAgB,OAAO,IAAI,aAAY;AAClD,QAAM,MAAM,OAAO,UAAU;AAC7B,SAAO,IAAI,gBAAgB,OAAO,IAAI,aAAY;AAChD,UAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK,cAAc;AAC1D,QAAI,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,cAAc,GAAG;AAC7D,aAAO;AAAA,IACT;AACA,QAAI,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,gBAAgB,GAAG;AAC/D,aAAO;AAAA,IACT;AAAA,EACF,CAAC,CAAC;AACJ,CAAC;",
+  "names": []
+}

package/dist/cjs/migrations/0007_resume_consent.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Record the operator consent a resume delegation carries.
+ * @since 1.0.0
+ */
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+/**
+ * Adds the journal sequence of an operator's explicit resume to the pending
+ * resume delegations.
+ *
+ * NULL is intentional for existing rows: a delegation recorded before this
+ * column is an approval or a wake, which is background intent.
+ *
+ * @category migrations
+ * @since 1.0.0
+ */
+export declare const resumeConsent: Effect.Effect<void, import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+//# sourceMappingURL=0007_resume_consent.d.ts.map

package/dist/cjs/migrations/0007_resume_consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0007_resume_consent.d.ts","sourceRoot":"","sources":["../../../src/migrations/0007_resume_consent.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,2FAQxB,CAAA"}

package/dist/cjs/migrations/0007_resume_consent.js

@@ -0,0 +1,46 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resume_consent_exports = {};
+__export(resume_consent_exports, {
+  resumeConsent: () => resumeConsent
+});
+module.exports = __toCommonJS(resume_consent_exports);
+var Dialect = __toESM(require("@smthrs/database/Dialect"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var SqlClient = __toESM(require("effect/unstable/sql/SqlClient"), 1);
+const resumeConsent = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql.withTransaction(Effect.gen(function* () {
+    const columns = yield* Dialect.columns(sql, "control_run_resumes");
+    if (!columns.some((column) => column.name === "consent_seq")) {
+      yield* sql`ALTER TABLE control_run_resumes ADD COLUMN consent_seq ${Dialect.integer(sql)}`;
+    }
+  }));
+});
+//# sourceMappingURL=0007_resume_consent.js.map

package/dist/cjs/migrations/0007_resume_consent.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/migrations/0007_resume_consent.ts"],
+  "sourcesContent": ["/**\n * Record the operator consent a resume delegation carries.\n * @since 1.0.0\n */\n\nimport * as Dialect from \"@smthrs/database/Dialect\"\nimport * as Effect from \"effect/Effect\"\nimport * as SqlClient from \"effect/unstable/sql/SqlClient\"\n\n/**\n * Adds the journal sequence of an operator's explicit resume to the pending\n * resume delegations.\n *\n * NULL is intentional for existing rows: a delegation recorded before this\n * column is an approval or a wake, which is background intent.\n *\n * @category migrations\n * @since 1.0.0\n */\nexport const resumeConsent = Effect.gen(function*() {\n  const sql = yield* SqlClient.SqlClient\n  yield* sql.withTransaction(Effect.gen(function*() {\n    const columns = yield* Dialect.columns(sql, \"control_run_resumes\")\n    if (!columns.some((column) => column.name === \"consent_seq\")) {\n      yield* sql`ALTER TABLE control_run_resumes ADD COLUMN consent_seq ${Dialect.integer(sql)}`\n    }\n  }))\n})\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,cAAyB;AACzB,aAAwB;AACxB,gBAA2B;AAYpB,MAAM,gBAAgB,OAAO,IAAI,aAAY;AAClD,QAAM,MAAM,OAAO,UAAU;AAC7B,SAAO,IAAI,gBAAgB,OAAO,IAAI,aAAY;AAChD,UAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK,qBAAqB;AACjE,QAAI,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,aAAa,GAAG;AAC5D,aAAO,6DAA6D,QAAQ,QAAQ,GAAG,CAAC;AAAA,IAC1F;AAAA,EACF,CAAC,CAAC;AACJ,CAAC;",
+  "names": []
+}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/test/TestControl.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Deterministic in-memory Control stack for package and consumer tests.
+ *
+ * @since 0.1.0
+ */
+import { NotificationQueue } from "@smthrs/notifications";
+import { Registry } from "@smthrs/registry";
+import { Layer } from "effect";
+import * as ControlExecutor from "../ControlExecutor.ts";
+import * as ControlRuntime from "../ControlRuntime.ts";
+/**
+ * Provides Control, ControlRuntime, the in-memory journal bundle, and an empty
+ * registry. Runtime flow metadata falls back to the reserved system catalog.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: (options?: ControlRuntime.MemoryOptions, executor?: ControlExecutor.Service) => Layer.Layer<import("@smthrs/journal/Journal").Journal | NotificationQueue.NotificationQueue | import("../Control.ts").Control | ControlRuntime.ControlRuntime | ControlExecutor.ControlExecutor | Registry.Registry, import("effect/unstable/sql/SqlError").SqlError | import("@smthrs/journal/Journal").JournalError | import("effect/unstable/sql/Migrator").MigrationError, never>;
+//# sourceMappingURL=TestControl.d.ts.map

package/dist/cjs/test/TestControl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TestControl.d.ts","sourceRoot":"","sources":["../../../src/test/TestControl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAkB,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AActD;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,GAChB,UAAU,cAAc,CAAC,aAAa,EACtC,WAAU,eAAe,CAAC,OAAoC,0XAW/D,CAAA"}

package/dist/cjs/test/TestControl.js

@@ -0,0 +1,62 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var TestControl_exports = {};
+__export(TestControl_exports, {
+  layer: () => layer
+});
+module.exports = __toCommonJS(TestControl_exports);
+var TestJournal = __toESM(require("@smthrs/journal/test/TestJournal"), 1);
+var import_notifications = require("@smthrs/notifications");
+var import_registry = require("@smthrs/registry");
+var import_effect = require("effect");
+var ControlExecutor = __toESM(require("../ControlExecutor.js"), 1);
+var ControlLive = __toESM(require("../ControlLive.js"), 1);
+var ControlRuntime = __toESM(require("../ControlRuntime.js"), 1);
+const browserCrypto = import_effect.Layer.succeed(
+  import_effect.Crypto.Crypto,
+  import_effect.Crypto.make({
+    /* v8 ignore next -- `Crypto.make` requires a random-byte primitive, and the deterministic runtime this bundle composes derives every identifier from a counter, so only `digest` is ever called here */
+    randomBytes: (size) => globalThis.crypto.getRandomValues(new Uint8Array(size)),
+    digest: (algorithm, data) => import_effect.Effect.promise(() => globalThis.crypto.subtle.digest(algorithm, data.slice().buffer)).pipe(
+      import_effect.Effect.map((buffer) => new Uint8Array(buffer))
+    )
+  })
+);
+const layer = (options, executor = ControlExecutor.makeNoop()) => {
+  const journal = TestJournal.layer();
+  const dependencies = import_effect.Layer.mergeAll(
+    ControlRuntime.layerMemory(options).pipe(import_effect.Layer.provide(browserCrypto)),
+    journal,
+    import_notifications.NotificationQueue.layer.pipe(import_effect.Layer.provide(journal)),
+    ControlExecutor.layer(executor),
+    import_registry.Registry.layerNoop()
+  );
+  return import_effect.Layer.provideMerge(ControlLive.layer, dependencies);
+};
+//# sourceMappingURL=TestControl.js.map

package/dist/cjs/test/TestControl.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/test/TestControl.ts"],
+  "sourcesContent": ["/**\n * Deterministic in-memory Control stack for package and consumer tests.\n *\n * @since 0.1.0\n */\n\nimport * as TestJournal from \"@smthrs/journal/test/TestJournal\"\nimport { NotificationQueue } from \"@smthrs/notifications\"\nimport { Registry } from \"@smthrs/registry\"\nimport { Crypto, Effect, Layer } from \"effect\"\nimport * as ControlExecutor from \"../ControlExecutor.ts\"\nimport * as ControlLive from \"../ControlLive.ts\"\nimport * as ControlRuntime from \"../ControlRuntime.ts\"\n\nconst browserCrypto = Layer.succeed(\n  Crypto.Crypto,\n  Crypto.make({\n    /* v8 ignore next -- `Crypto.make` requires a random-byte primitive, and the deterministic runtime this bundle composes derives every identifier from a counter, so only `digest` is ever called here */\n    randomBytes: (size) => globalThis.crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.promise(() => globalThis.crypto.subtle.digest(algorithm, data.slice().buffer)).pipe(\n        Effect.map((buffer) => new Uint8Array(buffer))\n      )\n  })\n)\n\n/**\n * Provides Control, ControlRuntime, the in-memory journal bundle, and an empty\n * registry. Runtime flow metadata falls back to the reserved system catalog.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer = (\n  options?: ControlRuntime.MemoryOptions,\n  executor: ControlExecutor.Service = ControlExecutor.makeNoop()\n) => {\n  const journal = TestJournal.layer()\n  const dependencies = Layer.mergeAll(\n    ControlRuntime.layerMemory(options).pipe(Layer.provide(browserCrypto)),\n    journal,\n    NotificationQueue.layer.pipe(Layer.provide(journal)),\n    ControlExecutor.layer(executor),\n    Registry.layerNoop()\n  )\n  return Layer.provideMerge(ControlLive.layer, dependencies)\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,kBAA6B;AAC7B,2BAAkC;AAClC,sBAAyB;AACzB,oBAAsC;AACtC,sBAAiC;AACjC,kBAA6B;AAC7B,qBAAgC;AAEhC,MAAM,gBAAgB,oBAAM;AAAA,EAC1B,qBAAO;AAAA,EACP,qBAAO,KAAK;AAAA;AAAA,IAEV,aAAa,CAAC,SAAS,WAAW,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;AAAA,IAC7E,QAAQ,CAAC,WAAW,SAClB,qBAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,KAAK,MAAM,EAAE,MAAM,CAAC,EAAE;AAAA,MACpF,qBAAO,IAAI,CAAC,WAAW,IAAI,WAAW,MAAM,CAAC;AAAA,IAC/C;AAAA,EACJ,CAAC;AACH;AASO,MAAM,QAAQ,CACnB,SACA,WAAoC,gBAAgB,SAAS,MAC1D;AACH,QAAM,UAAU,YAAY,MAAM;AAClC,QAAM,eAAe,oBAAM;AAAA,IACzB,eAAe,YAAY,OAAO,EAAE,KAAK,oBAAM,QAAQ,aAAa,CAAC;AAAA,IACrE;AAAA,IACA,uCAAkB,MAAM,KAAK,oBAAM,QAAQ,OAAO,CAAC;AAAA,IACnD,gBAAgB,MAAM,QAAQ;AAAA,IAC9B,yBAAS,UAAU;AAAA,EACrB;AACA,SAAO,oBAAM,aAAa,YAAY,OAAO,YAAY;AAC3D;",
+  "names": []
+}

package/dist/esm/ApprovalAuthority.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Host-owned approval authority, separate from principal attribution and from
+ * the permissions a workflow receives after approval.
+ *
+ * @since 1.0.0
+ */
+import { Effect, Schema } from "effect";
+import { InvalidInput, type PersistenceError, Unauthorized } from "./ControlError.ts";
+import { type ApprovalTarget, GrantScope, type Principal } from "./ControlSchema.ts";
+/**
+ * An approval decision whose caller has already been authenticated by its host.
+ * @category models
+ * @since 1.0.0
+ */
+export interface Request {
+    readonly principal: Principal;
+    readonly target: ApprovalTarget;
+    readonly decision: "approved" | "denied";
+    readonly scope: GrantScope;
+}
+/**
+ * A trusted host policy. Both refusals and unavailable policy storage fail
+ * closed. Implementations must be bounded and safe inside a write transaction;
+ * they must not recursively invoke Control or perform the gated work.
+ * @category services
+ * @since 1.0.0
+ */
+export interface Service {
+    readonly authorize: (request: Request) => Effect.Effect<void, Unauthorized | PersistenceError>;
+}
+/**
+ * An explicit delegation to one authenticated identity, not everyone whose
+ * kind resembles a role. Scopes are exact, not implicitly hierarchical. A
+ * delegation may approve only its listed scopes and may deny either target
+ * kind it names (denial installs no grant).
+ * Delegation is reusable: `scopes: ["once"]` permits once-scoped grants, not
+ * one lifetime decision. Use a host policy for expiry or one-use delegation.
+ * @category schemas
+ * @since 1.0.0
+ */
+export declare const Delegation: Schema.Struct<{
+    readonly principal: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly kind: Schema.String;
+    }>;
+    readonly scopes: Schema.$Array<Schema.Literals<readonly ["once", "run", "remembered"]>>;
+    readonly targets: Schema.$Array<Schema.Literals<readonly ["Plan", "Node"]>>;
+}>;
+/**
+ * One explicit host-owned approval delegation.
+ * @category models
+ * @since 1.0.0
+ */
+export type Delegation = typeof Delegation.Type;
+/**
+ * Builds an immutable policy from explicit host configuration. Invalid
+ * configuration is refused without including its contents in the error.
+ * The caller's arrays and objects are not retained after acquisition.
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const make: (delegations: ReadonlyArray<Delegation>) => Effect.Effect<Service, InvalidInput>;
+/**
+ * Default trusted-local policy. Only the local operator identity is an
+ * approver. A custom actor, gateway identity, or agent needs explicit host
+ * delegation; setting Principal.kind is not itself an authorization. The
+ * in-memory test adapter's `memory`/`test` identity is delegated only by that
+ * adapter's own default policy, never here.
+ * @category policies
+ * @since 1.0.0
+ */
+export declare const local: Service;
+//# sourceMappingURL=ApprovalAuthority.d.ts.map

package/dist/esm/ApprovalAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApprovalAuthority.d.ts","sourceRoot":"","sources":["../../src/ApprovalAuthority.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,EAAE,KAAK,cAAc,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEpF;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAA;IACxC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,gBAAgB,CAAC,CAAA;CAC/F;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU;;;;;;;EAIrB,CAAA;AAEF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAA;AA4B/C;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GACf,aAAa,aAAa,CAAC,UAAU,CAAC,KACrC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAMnC,CAAA;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,EAAE,OAElB,CAAA"}

package/dist/esm/ApprovalAuthority.js

@@ -0,0 +1,72 @@
+/**
+ * Host-owned approval authority, separate from principal attribution and from
+ * the permissions a workflow receives after approval.
+ *
+ * @since 1.0.0
+ */
+import { Effect, Schema } from "effect";
+import { InvalidInput, Unauthorized } from "./ControlError.js";
+import { GrantScope } from "./ControlSchema.js";
+const IdentityPart = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(1024));
+/**
+ * An explicit delegation to one authenticated identity, not everyone whose
+ * kind resembles a role. Scopes are exact, not implicitly hierarchical. A
+ * delegation may approve only its listed scopes and may deny either target
+ * kind it names (denial installs no grant).
+ * Delegation is reusable: `scopes: ["once"]` permits once-scoped grants, not
+ * one lifetime decision. Use a host policy for expiry or one-use delegation.
+ * @category schemas
+ * @since 1.0.0
+ */
+export const Delegation = Schema.Struct({
+    principal: Schema.Struct({ id: IdentityPart, kind: IdentityPart }),
+    scopes: Schema.Array(GrantScope).check(Schema.isMinLength(1), Schema.isMaxLength(3)),
+    targets: Schema.Array(Schema.Literals(["Plan", "Node"])).check(Schema.isMinLength(1), Schema.isMaxLength(2))
+});
+const identity = (principal) => JSON.stringify([principal.id, principal.kind]);
+const compile = (delegations) => {
+    // Separate target keys preserve each delegation's target/scope pairing;
+    // unioning both dimensions independently would grant a cross product.
+    const permissions = new Map();
+    for (const delegation of delegations) {
+        for (const target of delegation.targets) {
+            const key = JSON.stringify([identity(delegation.principal), target]);
+            const scopes = permissions.get(key) ?? new Set();
+            for (const scope of delegation.scopes)
+                scopes.add(scope);
+            permissions.set(key, scopes);
+        }
+    }
+    return Object.freeze({
+        authorize: (request) => Effect.suspend(() => {
+            const scopes = permissions.get(JSON.stringify([identity(request.principal), request.target._tag]));
+            return scopes !== undefined &&
+                (request.decision === "denied" || (request.decision === "approved" && scopes.has(request.scope)))
+                ? Effect.void
+                : Effect.fail(new Unauthorized({ message: "This caller has no authority to make this approval decision" }));
+        })
+    });
+};
+/**
+ * Builds an immutable policy from explicit host configuration. Invalid
+ * configuration is refused without including its contents in the error.
+ * The caller's arrays and objects are not retained after acquisition.
+ * @category constructors
+ * @since 1.0.0
+ */
+export const make = (delegations) => Schema.decodeUnknownEffect(Schema.Array(Delegation).check(Schema.isMaxLength(1024)))(delegations, {
+    onExcessProperty: "error"
+}).pipe(Effect.mapError(() => new InvalidInput({ issue: "Invalid approval-authority delegation configuration" })), Effect.map(compile));
+/**
+ * Default trusted-local policy. Only the local operator identity is an
+ * approver. A custom actor, gateway identity, or agent needs explicit host
+ * delegation; setting Principal.kind is not itself an authorization. The
+ * in-memory test adapter's `memory`/`test` identity is delegated only by that
+ * adapter's own default policy, never here.
+ * @category policies
+ * @since 1.0.0
+ */
+export const local = compile([
+    { principal: { id: "local", kind: "operator" }, scopes: ["once", "run", "remembered"], targets: ["Plan", "Node"] }
+]);
+//# sourceMappingURL=ApprovalAuthority.js.map

package/dist/esm/ApprovalAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApprovalAuthority.js","sourceRoot":"","sources":["../../src/ApprovalAuthority.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,YAAY,EAAyB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,EAAuB,UAAU,EAAkB,MAAM,oBAAoB,CAAA;AAyBpF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AAEzF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAClE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CAC7G,CAAC,CAAA;AASF,MAAM,QAAQ,GAAG,CAAC,SAAyC,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAEtH,MAAM,OAAO,GAAG,CAAC,WAAsC,EAAW,EAAE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAA;IACtD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;YACpE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAc,CAAA;YAC5D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACxD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;YAClB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAClG,OAAO,MAAM,KAAK,SAAS;gBACvB,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACnG,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC,CAAC,CAAA;QAC/G,CAAC,CAAC;KACL,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,WAAsC,EACA,EAAE,CACxC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;IAChG,gBAAgB,EAAE,OAAO;CAC1B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC,CAAC,EACzG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CACpB,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,KAAK,GAAY,OAAO,CAAC;IACpC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;CACnH,CAAC,CAAA","sourcesContent":["/**\n * Host-owned approval authority, separate from principal attribution and from\n * the permissions a workflow receives after approval.\n *\n * @since 1.0.0\n */\n\nimport { Effect, Schema } from \"effect\"\nimport { InvalidInput, type PersistenceError, Unauthorized } from \"./ControlError.ts\"\nimport { type ApprovalTarget, GrantScope, type Principal } from \"./ControlSchema.ts\"\n\n/**\n * An approval decision whose caller has already been authenticated by its host.\n * @category models\n * @since 1.0.0\n */\nexport interface Request {\n  readonly principal: Principal\n  readonly target: ApprovalTarget\n  readonly decision: \"approved\" | \"denied\"\n  readonly scope: GrantScope\n}\n\n/**\n * A trusted host policy. Both refusals and unavailable policy storage fail\n * closed. Implementations must be bounded and safe inside a write transaction;\n * they must not recursively invoke Control or perform the gated work.\n * @category services\n * @since 1.0.0\n */\nexport interface Service {\n  readonly authorize: (request: Request) => Effect.Effect<void, Unauthorized | PersistenceError>\n}\n\nconst IdentityPart = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(1024))\n\n/**\n * An explicit delegation to one authenticated identity, not everyone whose\n * kind resembles a role. Scopes are exact, not implicitly hierarchical. A\n * delegation may approve only its listed scopes and may deny either target\n * kind it names (denial installs no grant).\n * Delegation is reusable: `scopes: [\"once\"]` permits once-scoped grants, not\n * one lifetime decision. Use a host policy for expiry or one-use delegation.\n * @category schemas\n * @since 1.0.0\n */\nexport const Delegation = Schema.Struct({\n  principal: Schema.Struct({ id: IdentityPart, kind: IdentityPart }),\n  scopes: Schema.Array(GrantScope).check(Schema.isMinLength(1), Schema.isMaxLength(3)),\n  targets: Schema.Array(Schema.Literals([\"Plan\", \"Node\"])).check(Schema.isMinLength(1), Schema.isMaxLength(2))\n})\n\n/**\n * One explicit host-owned approval delegation.\n * @category models\n * @since 1.0.0\n */\nexport type Delegation = typeof Delegation.Type\n\nconst identity = (principal: Pick<Principal, \"id\" | \"kind\">): string => JSON.stringify([principal.id, principal.kind])\n\nconst compile = (delegations: ReadonlyArray<Delegation>): Service => {\n  // Separate target keys preserve each delegation's target/scope pairing;\n  // unioning both dimensions independently would grant a cross product.\n  const permissions = new Map<string, Set<GrantScope>>()\n  for (const delegation of delegations) {\n    for (const target of delegation.targets) {\n      const key = JSON.stringify([identity(delegation.principal), target])\n      const scopes = permissions.get(key) ?? new Set<GrantScope>()\n      for (const scope of delegation.scopes) scopes.add(scope)\n      permissions.set(key, scopes)\n    }\n  }\n  return Object.freeze({\n    authorize: (request: Request) =>\n      Effect.suspend(() => {\n        const scopes = permissions.get(JSON.stringify([identity(request.principal), request.target._tag]))\n        return scopes !== undefined &&\n            (request.decision === \"denied\" || (request.decision === \"approved\" && scopes.has(request.scope)))\n          ? Effect.void\n          : Effect.fail(new Unauthorized({ message: \"This caller has no authority to make this approval decision\" }))\n      })\n  })\n}\n\n/**\n * Builds an immutable policy from explicit host configuration. Invalid\n * configuration is refused without including its contents in the error.\n * The caller's arrays and objects are not retained after acquisition.\n * @category constructors\n * @since 1.0.0\n */\nexport const make = (\n  delegations: ReadonlyArray<Delegation>\n): Effect.Effect<Service, InvalidInput> =>\n  Schema.decodeUnknownEffect(Schema.Array(Delegation).check(Schema.isMaxLength(1024)))(delegations, {\n    onExcessProperty: \"error\"\n  }).pipe(\n    Effect.mapError(() => new InvalidInput({ issue: \"Invalid approval-authority delegation configuration\" })),\n    Effect.map(compile)\n  )\n\n/**\n * Default trusted-local policy. Only the local operator identity is an\n * approver. A custom actor, gateway identity, or agent needs explicit host\n * delegation; setting Principal.kind is not itself an authorization. The\n * in-memory test adapter's `memory`/`test` identity is delegated only by that\n * adapter's own default policy, never here.\n * @category policies\n * @since 1.0.0\n */\nexport const local: Service = compile([\n  { principal: { id: \"local\", kind: \"operator\" }, scopes: [\"once\", \"run\", \"remembered\"], targets: [\"Plan\", \"Node\"] }\n])\n"]}

package/dist/esm/Cancellation.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Cancellation attribution as the control plane reads it back.
+ *
+ * A cancellation is durable but anonymous. `flows_runs.cancel_requested_at_ms`
+ * records that somebody asked, and nothing in the row records who, why, or
+ * whether the run was asked at all rather than swept up in an ancestor's
+ * cascade. Three journals hold the missing halves: the control plane's own
+ * `control.run.cancel-requested`, the engine's `flows.engine.interrupted`, and
+ * the ancestry the run store already keeps. This module folds them into one
+ * answer per run.
+ *
+ * The fold is pure and scope-independent: it reads whatever evidence it is
+ * handed and never issues a query, so the caller chooses how much to read.
+ * `SqlControlRuntime` uses two scopes. A listing folds the whole database,
+ * because every row is going to be answered for anyway. A single-run read
+ * folds only that run and its ancestor chain, which is the smallest scope that
+ * can still answer the question: cascade is a fact about a run's ancestors, so
+ * it cannot be decided one row at a time — a child's cancellation is
+ * attributed to whoever asked for its nearest cancelled ancestor's, however
+ * many rounds up that is.
+ *
+ * The two foreign event types are named as strings rather than imported,
+ * exactly as in {@link Lineage}: a control plane reads journals, not engines.
+ *
+ * @since 0.1.0
+ */
+import type { Cancellation, Principal } from "./ControlSchema.ts";
+/**
+ * The journal event type the control plane records an attributed cancel under.
+ *
+ * @category constants
+ * @since 0.1.0
+ */
+export declare const requestedEventType = "control.run.cancel-requested";
+/**
+ * The journal event type the engine records an interruption under.
+ *
+ * @category constants
+ * @since 0.1.0
+ */
+export declare const interruptedEventType = "flows.engine.interrupted";
+/**
+ * One attributed cancel request, as the control plane journaled it.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Request {
+    readonly requestedAt: number;
+    readonly principal?: Principal | undefined;
+    readonly reason?: string | undefined;
+}
+/**
+ * What one run row discloses about its own cancellation.
+ *
+ * `cancelRequestedAt` is the run store's unfenced request column, and
+ * `cancelledAt` is the moment the engine journaled the interruption. Either
+ * one alone is evidence that this run was cancelled, and so is an attributed
+ * request naming the run: a control plane that cancels a run it owns
+ * interrupts the fiber rather than asking the column, and the journal entry it
+ * wrote is the whole record.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Evidence {
+    readonly runId: string;
+    readonly parentRunId?: string | undefined;
+    readonly cancelRequestedAt?: number | undefined;
+    readonly cancelledAt?: number | undefined;
+}
+/**
+ * Everything the fold reads.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Input {
+    readonly runs: ReadonlyArray<Evidence>;
+    /** Attributed requests the control plane journaled, by run id. */
+    readonly requests: ReadonlyMap<string, Request>;
+}
+/**
+ * Attributes every cancelled run in one pass.
+ *
+ * Three sources, in the order a run's own evidence outranks its ancestors':
+ *
+ * 1. A `control.run.cancel-requested` entry names this run. Somebody asked for
+ *    this run by name, and the entry says who and why.
+ * 2. A cancelled ancestor exists. The run was swept up in that cancellation,
+ *    so it reports `cascade`, names the ancestor whose request started it, and
+ *    inherits that request's principal and reason — the honest answer to "who
+ *    cancelled this child" is the operator who cancelled its parent.
+ * 3. Neither. The engine cancelled the run on its own account: a lease
+ *    expiry, a budget, a supervisor. There is no principal to report, and
+ *    inventing one would be worse than saying nothing.
+ *
+ * The ancestor walk carries a visited set. A cyclic parent chain is not
+ * reachable through the engine's cycle detection, but a projection that hung
+ * on corrupt ancestry would take the control plane down with it.
+ *
+ * @param input the run evidence and the attributed requests
+ * @category projections
+ * @since 0.1.0
+ */
+export declare const attribute: (input: Input) => ReadonlyMap<string, Cancellation>;
+//# sourceMappingURL=Cancellation.d.ts.map

package/dist/esm/Cancellation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cancellation.d.ts","sourceRoot":"","sources":["../../src/Cancellation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,iCAAiC,CAAA;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACrC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IACtC,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChD;AAwBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,KAAK,KAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAqCxE,CAAA"}