@smthrs/control 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/ControlFacts.js

@@ -0,0 +1,324 @@
+/**
+ * Versioned control lifecycle facts and their shared read projection.
+ * @since 1.0.0
+ */
+import { Journal, JournalEvent } from "@smthrs/journal";
+import { Effect, Schema } from "effect";
+import * as ControlSchema from "./ControlSchema.js";
+/** This is the control producer contract, independent of the harness journal format.
+ * @category facts
+ * @since 1.0.0
+ */
+export const version = 1;
+/** A committed control snapshot. A baseline claims no history before its sequence.
+ * @category facts
+ * @since 1.0.0
+ */
+export const RunFact = Schema.Struct({
+    factVersion: Schema.Literal(version),
+    baseline: Schema.Literals(["created", "legacy"]),
+    run: ControlSchema.RunSummary
+});
+/** Capture the exact result of a fenced write, inside its journal transaction.
+ * @category facts
+ * @since 1.0.0
+ */
+export const runFact = (run, baseline = "legacy") => {
+    if (run.executionObservation !== undefined || run.executionView !== undefined) {
+        throw new Error("A control fact cannot persist an executor observation");
+    }
+    return Schema.decodeUnknownSync(RunFact)({ factVersion: version, baseline, run: structuredClone(run) });
+};
+/** The exact facts of the guard that parked a run, frozen when it tripped.
+ *
+ * `Runaway` is a run spending past an approved ceiling (`tokens`, `usd`,
+ * `latency`). `Stuck` is one operation that ran past its time limit
+ * (`model-call`, `tool-call`, `cell`). Every number is in the source's unit,
+ * tokens, dollars, or milliseconds: `used`, `reserved`, `max`, and `next` are
+ * a budget's spend, held forecast, ceiling, and refused call; `max` is a
+ * timeout's limit.
+ * `allowance` is what Continue authorizes: the raised ceiling for a budget,
+ * one more run of `max` for a timeout. `subject` names the operation a
+ * timeout interrupted.
+ * @category facts
+ * @since 1.0.0
+ */
+export const GuardIncident = Schema.Struct({
+    classification: Schema.Literals(["Runaway", "Stuck"]),
+    source: Schema.Literals(["tokens", "usd", "latency", "model-call", "tool-call", "cell"]),
+    message: Schema.String,
+    used: Schema.optional(Schema.Number),
+    reserved: Schema.optional(Schema.Number),
+    max: Schema.optional(Schema.Number),
+    next: Schema.optional(Schema.Number),
+    allowance: Schema.optional(Schema.Number),
+    subject: Schema.optional(Schema.String)
+});
+/** The identity-bearing request admitted with its approval token.
+ *
+ * `incident` is present on a request a guard made, so a restarted host reads
+ * the facts the park was made on rather than measuring them again.
+ * @category facts
+ * @since 1.0.0
+ */
+export const ApprovalRequestFact = Schema.Struct({
+    factVersion: Schema.Literal(version),
+    runId: Schema.String,
+    requestId: Schema.String,
+    question: Schema.String,
+    payload: ControlSchema.ApprovalPayload,
+    incident: Schema.optional(GuardIncident)
+});
+/** The exact target a committed decision resolves; old target-tag fields remain readable.
+ * @category facts
+ * @since 1.0.0
+ */
+export const ApprovalDecisionFact = Schema.Struct({
+    factVersion: Schema.Literal(version),
+    tokenId: Schema.String,
+    approvalTarget: ControlSchema.ApprovalTarget
+});
+/** Capture and validate the target the decision writer has actually resolved.
+ * @category facts
+ * @since 1.0.0
+ */
+export const approvalDecisionFact = (tokenId, approvalTarget) => Schema.decodeUnknownSync(ApprovalDecisionFact)({
+    factVersion: version,
+    tokenId,
+    approvalTarget: structuredClone(approvalTarget)
+});
+/** Commit a fenced control write and the exact resulting lifecycle fact together.
+ * @category facts
+ * @since 1.0.0
+ */
+export const commitRun = (journal, change, sourceId, eventType, detail = {}, baseline = "legacy") => journal.transact(Effect.gen(function* () {
+    const run = yield* change;
+    yield* journal.emitDurableUnfenced(new JournalEvent.Input({
+        runId: JournalEvent.RunId.make(run.runId),
+        sourceId: JournalEvent.SourceId.make(sourceId),
+        eventType,
+        payload: JSON.parse(JSON.stringify({ ...detail, runId: run.runId, status: run.status, ...runFact(run, baseline) }))
+    }));
+    return run;
+}));
+/** The token and submit-ready request have one durable admission boundary.
+ * @category facts
+ * @since 1.0.0
+ */
+export const commitApprovalRequest = (journal, runtime, input, sourceId) => Effect.suspend(() => {
+    const fact = Schema.decodeUnknownSync(ApprovalRequestFact)({ ...structuredClone(input), factVersion: version });
+    const target = fact.payload.target;
+    if (target._tag !== "Node" || target.runId !== fact.runId || target.requestId !== fact.requestId) {
+        return Effect.fail(new Journal.JournalError({
+            code: "invalid_event",
+            message: "Approval request identity does not match its target"
+        }));
+    }
+    return journal.transact(Effect.gen(function* () {
+        const token = yield* runtime.registerApproval(target);
+        if (token._tag === "Pending") {
+            yield* journal.emitDurableUnfenced(new JournalEvent.Input({
+                runId: JournalEvent.RunId.make(fact.runId),
+                sourceId: JournalEvent.SourceId.make(sourceId),
+                eventType: "control.approval.requested",
+                payload: JSON.parse(JSON.stringify(fact))
+            }));
+        }
+        return token;
+    }));
+});
+/** Honest coverage of the displayed lifecycle; engine rows are a separate authority.
+ * @category facts
+ * @since 1.0.0
+ */
+export const LifecycleProvenance = Schema.Struct({
+    control: Schema.Literals(["events", "legacy-snapshot", "unverified-snapshot"]),
+    execution: Schema.Literals(["control", "engine-observed", "engine-missing"]),
+    baseline: Schema.optional(Schema.Literals(["created", "legacy"])),
+    fromSequence: Schema.optional(Schema.Number),
+    throughSequence: Schema.optional(Schema.Number)
+});
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+const string = (value) => typeof value === "string" ? value : undefined;
+const key = (runId, requestId) => JSON.stringify([runId, requestId]);
+const lifecycleKinds = new Set([
+    "control.run.accepted",
+    "control.run.running",
+    "control.run.pending",
+    "control.run.parked",
+    "control.run.waiting-approval",
+    "control.run.completed",
+    "control.run.failed",
+    "control.run.cancelled",
+    "control.run.resume",
+    "control.run.claimed",
+    "control.steer.woke"
+]);
+const consistentStatus = (kind, run) => {
+    if (kind === "control.run.pending")
+        return run.status === "accepted";
+    if (kind === "control.run.resume" || kind === "control.run.claimed" || kind === "control.steer.woke")
+        return true;
+    return kind === `control.run.${run.status}`;
+};
+const coordinationFields = [
+    "runId",
+    "flowId",
+    "createdAt",
+    "updatedAt",
+    "planId",
+    "planDigest",
+    "ownerId",
+    "parkedBy"
+];
+/**
+ * One fold for gateway snapshots and subscriptions. Current writers are strict;
+ * legacy unnamed decisions may close only a legacy request in the same run.
+ * Observed human waits may seed the approval projection without claiming a
+ * journaled request. They still require an exact named decision, and share the
+ * same digest binding as admitted requests.
+ * Duplicate requests never reopen decisions, and a new-style unknown identity
+ * never consumes another gate. Snapshot fallback is explicitly unverified.
+ * @category facts
+ * @since 1.0.0
+ */
+export const fold = (events, snapshot, observedApprovals = []) => {
+    let latest;
+    let first;
+    let uncovered = false;
+    const requests = new Map();
+    for (const row of observedApprovals) {
+        if (snapshot !== undefined && row.runId !== snapshot.runId)
+            continue;
+        const target = row.payload.target;
+        if (target._tag !== "Node" || target.runId !== row.runId || target.requestId !== row.requestId)
+            continue;
+        requests.set(key(row.runId, row.requestId), { row: { ...row, status: "pending" }, versioned: true });
+    }
+    const decisions = new Map();
+    for (const event of events) {
+        if (snapshot !== undefined && event.runId !== snapshot.runId)
+            continue;
+        const payload = record(event.payload);
+        if (lifecycleKinds.has(event.kind) || payload.factVersion !== undefined && event.kind.startsWith("control.run.")) {
+            if (Schema.is(RunFact)(payload) && payload.run.runId === event.runId &&
+                payload.run.executionObservation === undefined && payload.run.executionView === undefined &&
+                consistentStatus(event.kind, payload.run)) {
+                latest = { fact: payload, sequence: event.sequence };
+                first ??= { baseline: payload.baseline, sequence: event.sequence };
+                // This full snapshot establishes a new baseline after a gap; the
+                // earlier prefix can no longer be claimed as continuously covered.
+                if (uncovered)
+                    first = { baseline: "legacy", sequence: event.sequence };
+                uncovered = false;
+            }
+            else if (payload.factVersion !== undefined || latest !== undefined)
+                uncovered = true;
+        }
+        if (event.kind === "control.approval.requested") {
+            const versioned = payload.factVersion !== undefined;
+            if (versioned && !Schema.is(ApprovalRequestFact)(payload))
+                continue;
+            const runId = string(payload.runId) ?? event.runId;
+            const requestId = string(payload.requestId);
+            if (runId === undefined || requestId === undefined || event.runId !== runId ||
+                payload.payload === undefined)
+                continue;
+            // Historical payloads were open JSON. Preserve their read-only display;
+            // only the versioned contract can establish exact target correspondence.
+            const submitted = payload.payload;
+            if (versioned &&
+                (submitted.target._tag !== "Node" || submitted.target.runId !== runId ||
+                    submitted.target.requestId !== requestId))
+                continue;
+            const identity = key(runId, requestId);
+            if (requests.has(identity))
+                continue;
+            const decision = decisions.get(identity);
+            requests.set(identity, {
+                versioned,
+                row: {
+                    runId,
+                    requestId,
+                    title: string(payload.question) ?? `Approval needed — ${requestId}`,
+                    request: event.payload,
+                    payload: submitted,
+                    requestedAt: typeof payload.at === "number" && Number.isFinite(payload.at) ? payload.at : event.occurredAt,
+                    status: decision !== undefined &&
+                        (decision.digest === undefined || decision.digest === record(record(submitted).target).digest)
+                        ? decision.status :
+                        "pending"
+                }
+            });
+        }
+        if (event.kind === "control.approval.approved" || event.kind === "control.approval.denied") {
+            const status = event.kind === "control.approval.approved" ? "approved" : "denied";
+            let identity;
+            let digest;
+            if (payload.factVersion !== undefined) {
+                if (!Schema.is(ApprovalDecisionFact)(payload) || payload.approvalTarget._tag !== "Node" ||
+                    payload.approvalTarget.runId !== event.runId || payload.tokenId !== payload.approvalTarget.requestId)
+                    continue;
+                identity = key(payload.approvalTarget.runId, payload.approvalTarget.requestId);
+                digest = payload.approvalTarget.digest;
+            }
+            else {
+                const tokenId = string(payload.tokenId) ?? string(payload.requestId);
+                if (tokenId !== undefined && event.runId !== undefined)
+                    identity = key(event.runId, tokenId);
+                else {
+                    identity = [...requests].find(([, request]) => !request.versioned && request.row.status === "pending" &&
+                        request.row.runId === event.runId)?.[0];
+                }
+            }
+            if (identity === undefined || decisions.has(identity))
+                continue;
+            const request = requests.get(identity);
+            if (request !== undefined && digest !== undefined && record(record(request.row.payload).target).digest !== digest)
+                continue;
+            decisions.set(identity, { status, ...(digest === undefined ? {} : { digest }) });
+            if (request !== undefined)
+                requests.set(identity, { ...request, row: { ...request.row, status } });
+        }
+    }
+    const matches = !uncovered && latest !== undefined && (snapshot === undefined ||
+        coordinationFields.every((field) => latest.fact.run[field] === snapshot[field]) &&
+            (snapshot.executionObservation === "observed" || latest.fact.run.status === snapshot.status));
+    const run = snapshot === undefined ? uncovered ? undefined : latest?.fact.run : matches
+        ? {
+            ...snapshot,
+            ...latest.fact.run,
+            ...(snapshot.executionObservation === "observed" ?
+                {
+                    status: snapshot.status,
+                    waitingReason: snapshot.waitingReason,
+                    parentRunId: snapshot.parentRunId,
+                    lineageId: snapshot.lineageId,
+                    roundOrdinal: snapshot.roundOrdinal,
+                    pendingWaits: snapshot.pendingWaits
+                } :
+                {})
+        }
+        : snapshot;
+    return {
+        run,
+        provenance: {
+            control: uncovered
+                ? "unverified-snapshot"
+                : latest === undefined
+                    ? "legacy-snapshot"
+                    : matches
+                        ? "events"
+                        : "unverified-snapshot",
+            execution: snapshot?.executionObservation === "observed" ?
+                "engine-observed"
+                : snapshot?.executionObservation === "missing"
+                    ? "engine-missing"
+                    : "control",
+            ...(first === undefined ? {} : { baseline: first.baseline, fromSequence: first.sequence }),
+            ...(latest === undefined ? {} : { throughSequence: latest.sequence })
+        },
+        approvals: [...requests.values()].map(({ row }) => row)
+    };
+};
+//# sourceMappingURL=ControlFacts.js.map

package/dist/esm/ControlFacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlFacts.js","sourceRoot":"","sources":["../../src/ControlFacts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEvC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAA;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,GAAG,EAAE,aAAa,CAAC,UAAU;CAC9B,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,GAA6B,EAC7B,WAAiC,QAAQ,EACpB,EAAE;IACvB,IAAI,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AACzG,CAAC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACxF,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACxC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,OAAO,EAAE,aAAa,CAAC,eAAe;IACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;CACzC,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,cAAc,EAAE,aAAa,CAAC,cAAc;CAC7C,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAe,EACf,cAA4C,EACV,EAAE,CACpC,MAAM,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IAC7C,WAAW,EAAE,OAAO;IACpB,OAAO;IACP,cAAc,EAAE,eAAe,CAAC,cAAc,CAAC;CAChD,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAwB,EACxB,MAAqD,EACrD,QAAgB,EAChB,SAAiB,EACjB,SAA4C,EAAE,EAC9C,WAAiC,QAAQ,EACzC,EAAE,CACF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IACzB,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAChC,IAAI,YAAY,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9C,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,KAAK,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAC/F;KACF,CAAC,CACH,CAAA;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAC,CAAA;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAwB,EACxB,OAAyD,EACzD,KAA2D,EAC3D,QAAgB,EAChB,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACjG,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,OAAO,CAAC,YAAY,CAAC;YACvB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CACH,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAChC,IAAI,YAAY,CAAC,KAAK,CAAC;gBACrB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1C,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC9C,SAAS,EAAE,4BAA4B;gBACvC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aAC1C,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAC,CAAA;AACL,CAAC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC9E,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CAChD,CAAC,CAAA;AAkBF,MAAM,MAAM,GAAG,CAAC,KAAc,EAA2B,EAAE,CACzD,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9G,MAAM,MAAM,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACpG,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,oBAAoB;IACpB,8BAA8B;IAC9B,uBAAuB;IACvB,oBAAoB;IACpB,uBAAuB;IACvB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;CACrB,CAAC,CAAA;AACF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,GAA6B,EAAW,EAAE;IAChF,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,CAAA;IACpE,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAA;IACjH,OAAO,IAAI,KAAK,eAAe,GAAG,CAAC,MAAM,EAAE,CAAA;AAC7C,CAAC,CAAA;AACD,MAAM,kBAAkB,GAAG;IACzB,OAAO;IACP,QAAQ;IACR,WAAW;IACX,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,UAAU;CACF,CAAA;AAEV;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAiD,EACjD,QAAmC,EACnC,oBAA6C,EAAE,EAK/C,EAAE;IACF,IAAI,MAAqF,CAAA;IACzF,IAAI,KAAyF,CAAA;IAC7F,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmE,CAAA;IAC3F,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAAE,SAAQ;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;QACjC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;YAAE,SAAQ;QACxG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgF,CAAA;IACzG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAAE,SAAQ;QACtE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACjH,IACE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;gBAChE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;gBACzF,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EACzC,CAAC;gBACD,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;gBACpD,KAAK,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,IAAI,SAAS;oBAAE,KAAK,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;gBACvE,SAAS,GAAG,KAAK,CAAA;YACnB,CAAC;iBAAM,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAA;QACxF,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAA;YACnD,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAA;YAClD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC3C,IACE,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;gBACvE,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC7B,SAAQ;YACV,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAwC,CAAA;YAClE,IACE,SAAS;gBACT,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;oBACnE,SAAS,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;gBAC3C,SAAQ;YACV,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACxC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACrB,SAAS;gBACT,GAAG,EAAE;oBACH,KAAK;oBACL,SAAS;oBACT,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,qBAAqB,SAAS,EAAE;oBACnE,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,OAAO,EAAE,SAAS;oBAClB,WAAW,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU;oBAC1G,MAAM,EAAE,QAAQ,KAAK,SAAS;wBAC1B,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;wBAChG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBACnB,SAAS;iBACZ;aACF,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,2BAA2B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAA;YACjF,IAAI,QAA4B,CAAA;YAChC,IAAI,MAA0B,CAAA;YAC9B,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACtC,IACE,CAAC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,KAAK,MAAM;oBACnF,OAAO,CAAC,cAAc,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,cAAc,CAAC,SAAS;oBACpG,SAAQ;gBACV,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;gBAC9E,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAA;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;gBACpE,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;qBACvF,CAAC;oBAAA,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAChD,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;wBACtD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAClC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAAA,CAAC;YACX,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACtC,IACE,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM;gBAC7G,SAAQ;YACV,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;YAChF,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;QACpG,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,SAAS;QAC3E,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7E,CAAC,QAAQ,CAAC,oBAAoB,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO;QACrF,CAAC,CAAC;YACA,GAAG,QAAQ;YACX,GAAG,MAAO,CAAC,IAAI,CAAC,GAAG;YACnB,GAAG,CAAC,QAAQ,CAAC,oBAAoB,KAAK,UAAU,CAAC,CAAC;gBAChD;oBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;iBACpC,CAAC,CAAC;gBACH,EAAE,CAAC;SACN;QACD,CAAC,CAAC,QAAQ,CAAA;IACZ,OAAO;QACL,GAAG;QACH,UAAU,EAAE;YACV,OAAO,EAAE,SAAS;gBAChB,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,MAAM,KAAK,SAAS;oBACtB,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,QAAQ;wBACV,CAAC,CAAC,qBAAqB;YACzB,SAAS,EAAE,QAAQ,EAAE,oBAAoB,KAAK,UAAU,CAAC,CAAC;gBACxD,iBAAiB;gBACjB,CAAC,CAAC,QAAQ,EAAE,oBAAoB,KAAK,SAAS;oBAC9C,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,SAAS;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1F,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;SACtE;QACD,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;KACxD,CAAA;AACH,CAAC,CAAA","sourcesContent":["/**\n * Versioned control lifecycle facts and their shared read projection.\n * @since 1.0.0\n */\n\nimport { Journal, JournalEvent } from \"@smthrs/journal\"\nimport { Effect, Schema } from \"effect\"\nimport type * as ControlRuntime from \"./ControlRuntime.ts\"\nimport * as ControlSchema from \"./ControlSchema.ts\"\n\n/** This is the control producer contract, independent of the harness journal format.\n * @category facts\n * @since 1.0.0\n */\nexport const version = 1\n\n/** A committed control snapshot. A baseline claims no history before its sequence.\n * @category facts\n * @since 1.0.0\n */\nexport const RunFact = Schema.Struct({\n  factVersion: Schema.Literal(version),\n  baseline: Schema.Literals([\"created\", \"legacy\"]),\n  run: ControlSchema.RunSummary\n})\n\n/** Capture the exact result of a fenced write, inside its journal transaction.\n * @category facts\n * @since 1.0.0\n */\nexport const runFact = (\n  run: ControlSchema.RunSummary,\n  baseline: \"created\" | \"legacy\" = \"legacy\"\n): typeof RunFact.Type => {\n  if (run.executionObservation !== undefined || run.executionView !== undefined) {\n    throw new Error(\"A control fact cannot persist an executor observation\")\n  }\n  return Schema.decodeUnknownSync(RunFact)({ factVersion: version, baseline, run: structuredClone(run) })\n}\n\n/** The exact facts of the guard that parked a run, frozen when it tripped.\n *\n * `Runaway` is a run spending past an approved ceiling (`tokens`, `usd`,\n * `latency`). `Stuck` is one operation that ran past its time limit\n * (`model-call`, `tool-call`, `cell`). Every number is in the source's unit,\n * tokens, dollars, or milliseconds: `used`, `reserved`, `max`, and `next` are\n * a budget's spend, held forecast, ceiling, and refused call; `max` is a\n * timeout's limit.\n * `allowance` is what Continue authorizes: the raised ceiling for a budget,\n * one more run of `max` for a timeout. `subject` names the operation a\n * timeout interrupted.\n * @category facts\n * @since 1.0.0\n */\nexport const GuardIncident = Schema.Struct({\n  classification: Schema.Literals([\"Runaway\", \"Stuck\"]),\n  source: Schema.Literals([\"tokens\", \"usd\", \"latency\", \"model-call\", \"tool-call\", \"cell\"]),\n  message: Schema.String,\n  used: Schema.optional(Schema.Number),\n  reserved: Schema.optional(Schema.Number),\n  max: Schema.optional(Schema.Number),\n  next: Schema.optional(Schema.Number),\n  allowance: Schema.optional(Schema.Number),\n  subject: Schema.optional(Schema.String)\n})\n\n/** The identity-bearing request admitted with its approval token.\n *\n * `incident` is present on a request a guard made, so a restarted host reads\n * the facts the park was made on rather than measuring them again.\n * @category facts\n * @since 1.0.0\n */\nexport const ApprovalRequestFact = Schema.Struct({\n  factVersion: Schema.Literal(version),\n  runId: Schema.String,\n  requestId: Schema.String,\n  question: Schema.String,\n  payload: ControlSchema.ApprovalPayload,\n  incident: Schema.optional(GuardIncident)\n})\n\n/** The exact target a committed decision resolves; old target-tag fields remain readable.\n * @category facts\n * @since 1.0.0\n */\nexport const ApprovalDecisionFact = Schema.Struct({\n  factVersion: Schema.Literal(version),\n  tokenId: Schema.String,\n  approvalTarget: ControlSchema.ApprovalTarget\n})\n\n/** Capture and validate the target the decision writer has actually resolved.\n * @category facts\n * @since 1.0.0\n */\nexport const approvalDecisionFact = (\n  tokenId: string,\n  approvalTarget: ControlSchema.ApprovalTarget\n): typeof ApprovalDecisionFact.Type =>\n  Schema.decodeUnknownSync(ApprovalDecisionFact)({\n    factVersion: version,\n    tokenId,\n    approvalTarget: structuredClone(approvalTarget)\n  })\n\n/** Commit a fenced control write and the exact resulting lifecycle fact together.\n * @category facts\n * @since 1.0.0\n */\nexport const commitRun = <E, R>(\n  journal: Journal.Service,\n  change: Effect.Effect<ControlSchema.RunSummary, E, R>,\n  sourceId: string,\n  eventType: string,\n  detail: Readonly<Record<string, unknown>> = {},\n  baseline: \"created\" | \"legacy\" = \"legacy\"\n) =>\n  journal.transact(Effect.gen(function*() {\n    const run = yield* change\n    yield* journal.emitDurableUnfenced(\n      new JournalEvent.Input({\n        runId: JournalEvent.RunId.make(run.runId),\n        sourceId: JournalEvent.SourceId.make(sourceId),\n        eventType,\n        payload: JSON.parse(\n          JSON.stringify({ ...detail, runId: run.runId, status: run.status, ...runFact(run, baseline) })\n        )\n      })\n    )\n    return run\n  }))\n\n/** The token and submit-ready request have one durable admission boundary.\n * @category facts\n * @since 1.0.0\n */\nexport const commitApprovalRequest = (\n  journal: Journal.Service,\n  runtime: Pick<ControlRuntime.Service, \"registerApproval\">,\n  input: Omit<typeof ApprovalRequestFact.Type, \"factVersion\">,\n  sourceId: string\n) =>\n  Effect.suspend(() => {\n    const fact = Schema.decodeUnknownSync(ApprovalRequestFact)({ ...structuredClone(input), factVersion: version })\n    const target = fact.payload.target\n    if (target._tag !== \"Node\" || target.runId !== fact.runId || target.requestId !== fact.requestId) {\n      return Effect.fail(\n        new Journal.JournalError({\n          code: \"invalid_event\",\n          message: \"Approval request identity does not match its target\"\n        })\n      )\n    }\n    return journal.transact(Effect.gen(function*() {\n      const token = yield* runtime.registerApproval(target)\n      if (token._tag === \"Pending\") {\n        yield* journal.emitDurableUnfenced(\n          new JournalEvent.Input({\n            runId: JournalEvent.RunId.make(fact.runId),\n            sourceId: JournalEvent.SourceId.make(sourceId),\n            eventType: \"control.approval.requested\",\n            payload: JSON.parse(JSON.stringify(fact))\n          })\n        )\n      }\n      return token\n    }))\n  })\n\n/** Honest coverage of the displayed lifecycle; engine rows are a separate authority.\n * @category facts\n * @since 1.0.0\n */\nexport const LifecycleProvenance = Schema.Struct({\n  control: Schema.Literals([\"events\", \"legacy-snapshot\", \"unverified-snapshot\"]),\n  execution: Schema.Literals([\"control\", \"engine-observed\", \"engine-missing\"]),\n  baseline: Schema.optional(Schema.Literals([\"created\", \"legacy\"])),\n  fromSequence: Schema.optional(Schema.Number),\n  throughSequence: Schema.optional(Schema.Number)\n})\n\n/** Submit-ready approval state derived solely from admitted facts.\n * @category facts\n * @since 1.0.0\n */\nexport interface Approval {\n  readonly runId: string\n  readonly waitRunId?: string | undefined\n  readonly questionProvenance?: \"events\" | \"legacy-observation\" | \"unverified-observation\" | undefined\n  readonly requestId: string\n  readonly title: string\n  readonly request: ControlSchema.ControlEvent[\"payload\"]\n  readonly payload: ControlSchema.ApprovalPayload\n  readonly requestedAt: number\n  readonly status: \"pending\" | \"approved\" | \"denied\"\n}\n\nconst record = (value: unknown): Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value) ? value as Record<string, unknown> : {}\nconst string = (value: unknown): string | undefined => typeof value === \"string\" ? value : undefined\nconst key = (runId: string, requestId: string): string => JSON.stringify([runId, requestId])\nconst lifecycleKinds = new Set([\n  \"control.run.accepted\",\n  \"control.run.running\",\n  \"control.run.pending\",\n  \"control.run.parked\",\n  \"control.run.waiting-approval\",\n  \"control.run.completed\",\n  \"control.run.failed\",\n  \"control.run.cancelled\",\n  \"control.run.resume\",\n  \"control.run.claimed\",\n  \"control.steer.woke\"\n])\nconst consistentStatus = (kind: string, run: ControlSchema.RunSummary): boolean => {\n  if (kind === \"control.run.pending\") return run.status === \"accepted\"\n  if (kind === \"control.run.resume\" || kind === \"control.run.claimed\" || kind === \"control.steer.woke\") return true\n  return kind === `control.run.${run.status}`\n}\nconst coordinationFields = [\n  \"runId\",\n  \"flowId\",\n  \"createdAt\",\n  \"updatedAt\",\n  \"planId\",\n  \"planDigest\",\n  \"ownerId\",\n  \"parkedBy\"\n] as const\n\n/**\n * One fold for gateway snapshots and subscriptions. Current writers are strict;\n * legacy unnamed decisions may close only a legacy request in the same run.\n * Observed human waits may seed the approval projection without claiming a\n * journaled request. They still require an exact named decision, and share the\n * same digest binding as admitted requests.\n * Duplicate requests never reopen decisions, and a new-style unknown identity\n * never consumes another gate. Snapshot fallback is explicitly unverified.\n * @category facts\n * @since 1.0.0\n */\nexport const fold = (\n  events: ReadonlyArray<ControlSchema.ControlEvent>,\n  snapshot?: ControlSchema.RunSummary,\n  observedApprovals: ReadonlyArray<Approval> = []\n): {\n  readonly run: ControlSchema.RunSummary | undefined\n  readonly provenance: typeof LifecycleProvenance.Type\n  readonly approvals: ReadonlyArray<Approval>\n} => {\n  let latest: { readonly fact: typeof RunFact.Type; readonly sequence: number } | undefined\n  let first: { readonly baseline: \"created\" | \"legacy\"; readonly sequence: number } | undefined\n  let uncovered = false\n  const requests = new Map<string, { readonly row: Approval; readonly versioned: boolean }>()\n  for (const row of observedApprovals) {\n    if (snapshot !== undefined && row.runId !== snapshot.runId) continue\n    const target = row.payload.target\n    if (target._tag !== \"Node\" || target.runId !== row.runId || target.requestId !== row.requestId) continue\n    requests.set(key(row.runId, row.requestId), { row: { ...row, status: \"pending\" }, versioned: true })\n  }\n  const decisions = new Map<string, { readonly status: \"approved\" | \"denied\"; readonly digest?: string }>()\n  for (const event of events) {\n    if (snapshot !== undefined && event.runId !== snapshot.runId) continue\n    const payload = record(event.payload)\n    if (lifecycleKinds.has(event.kind) || payload.factVersion !== undefined && event.kind.startsWith(\"control.run.\")) {\n      if (\n        Schema.is(RunFact)(payload) && payload.run.runId === event.runId &&\n        payload.run.executionObservation === undefined && payload.run.executionView === undefined &&\n        consistentStatus(event.kind, payload.run)\n      ) {\n        latest = { fact: payload, sequence: event.sequence }\n        first ??= { baseline: payload.baseline, sequence: event.sequence }\n        // This full snapshot establishes a new baseline after a gap; the\n        // earlier prefix can no longer be claimed as continuously covered.\n        if (uncovered) first = { baseline: \"legacy\", sequence: event.sequence }\n        uncovered = false\n      } else if (payload.factVersion !== undefined || latest !== undefined) uncovered = true\n    }\n    if (event.kind === \"control.approval.requested\") {\n      const versioned = payload.factVersion !== undefined\n      if (versioned && !Schema.is(ApprovalRequestFact)(payload)) continue\n      const runId = string(payload.runId) ?? event.runId\n      const requestId = string(payload.requestId)\n      if (\n        runId === undefined || requestId === undefined || event.runId !== runId ||\n        payload.payload === undefined\n      ) continue\n      // Historical payloads were open JSON. Preserve their read-only display;\n      // only the versioned contract can establish exact target correspondence.\n      const submitted = payload.payload as ControlSchema.ApprovalPayload\n      if (\n        versioned &&\n        (submitted.target._tag !== \"Node\" || submitted.target.runId !== runId ||\n          submitted.target.requestId !== requestId)\n      ) continue\n      const identity = key(runId, requestId)\n      if (requests.has(identity)) continue\n      const decision = decisions.get(identity)\n      requests.set(identity, {\n        versioned,\n        row: {\n          runId,\n          requestId,\n          title: string(payload.question) ?? `Approval needed — ${requestId}`,\n          request: event.payload,\n          payload: submitted,\n          requestedAt: typeof payload.at === \"number\" && Number.isFinite(payload.at) ? payload.at : event.occurredAt,\n          status: decision !== undefined &&\n              (decision.digest === undefined || decision.digest === record(record(submitted).target).digest)\n            ? decision.status :\n            \"pending\"\n        }\n      })\n    }\n    if (event.kind === \"control.approval.approved\" || event.kind === \"control.approval.denied\") {\n      const status = event.kind === \"control.approval.approved\" ? \"approved\" : \"denied\"\n      let identity: string | undefined\n      let digest: string | undefined\n      if (payload.factVersion !== undefined) {\n        if (\n          !Schema.is(ApprovalDecisionFact)(payload) || payload.approvalTarget._tag !== \"Node\" ||\n          payload.approvalTarget.runId !== event.runId || payload.tokenId !== payload.approvalTarget.requestId\n        ) continue\n        identity = key(payload.approvalTarget.runId, payload.approvalTarget.requestId)\n        digest = payload.approvalTarget.digest\n      } else {\n        const tokenId = string(payload.tokenId) ?? string(payload.requestId)\n        if (tokenId !== undefined && event.runId !== undefined) identity = key(event.runId, tokenId)\n        else {identity = [...requests].find(([, request]) =>\n            !request.versioned && request.row.status === \"pending\" &&\n            request.row.runId === event.runId\n          )?.[0]}\n      }\n      if (identity === undefined || decisions.has(identity)) continue\n      const request = requests.get(identity)\n      if (\n        request !== undefined && digest !== undefined && record(record(request.row.payload).target).digest !== digest\n      ) continue\n      decisions.set(identity, { status, ...(digest === undefined ? {} : { digest }) })\n      if (request !== undefined) requests.set(identity, { ...request, row: { ...request.row, status } })\n    }\n  }\n  const matches = !uncovered && latest !== undefined && (snapshot === undefined ||\n    coordinationFields.every((field) => latest.fact.run[field] === snapshot[field]) &&\n      (snapshot.executionObservation === \"observed\" || latest.fact.run.status === snapshot.status))\n  const run = snapshot === undefined ? uncovered ? undefined : latest?.fact.run : matches\n    ? {\n      ...snapshot,\n      ...latest!.fact.run,\n      ...(snapshot.executionObservation === \"observed\" ?\n        {\n          status: snapshot.status,\n          waitingReason: snapshot.waitingReason,\n          parentRunId: snapshot.parentRunId,\n          lineageId: snapshot.lineageId,\n          roundOrdinal: snapshot.roundOrdinal,\n          pendingWaits: snapshot.pendingWaits\n        } :\n        {})\n    }\n    : snapshot\n  return {\n    run,\n    provenance: {\n      control: uncovered\n        ? \"unverified-snapshot\"\n        : latest === undefined\n        ? \"legacy-snapshot\"\n        : matches\n        ? \"events\"\n        : \"unverified-snapshot\",\n      execution: snapshot?.executionObservation === \"observed\" ?\n        \"engine-observed\"\n        : snapshot?.executionObservation === \"missing\"\n        ? \"engine-missing\"\n        : \"control\",\n      ...(first === undefined ? {} : { baseline: first.baseline, fromSequence: first.sequence }),\n      ...(latest === undefined ? {} : { throughSequence: latest.sequence })\n    },\n    approvals: [...requests.values()].map(({ row }) => row)\n  }\n}\n"]}

package/dist/esm/ControlLive.d.ts

@@ -0,0 +1,23 @@
+/**
+ * In-process Control implementation over `ControlRuntime`, the flow
+ * registry, and the append-only journal.
+ *
+ * @since 0.1.0
+ */
+import { Journal } from "@smthrs/journal";
+import { NotificationQueue } from "@smthrs/notifications";
+import { Registry } from "@smthrs/registry";
+import { Layer } from "effect";
+import { Control } from "./Control.ts";
+import { ControlRuntime } from "./ControlRuntime.ts";
+/**
+ * Live in-process Control layer.
+ *
+ * Writes delegate to `ControlRuntime`; journal events are observational
+ * records. `watch` only replays and follows committed journal entries.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: Layer.Layer<Control, never, ControlRuntime | Journal.Journal | NotificationQueue.NotificationQueue | Registry.Registry>;
+//# sourceMappingURL=ControlLive.d.ts.map

package/dist/esm/ControlLive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlLive.d.ts","sourceRoot":"","sources":["../../src/ControlLive.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,OAAO,EAAgB,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAiC,KAAK,EAAqC,MAAM,QAAQ,CAAA;AAEhG,OAAO,EAEL,OAAO,EAOR,MAAM,cAAc,CAAA;AAoBrB,OAAO,EAAE,cAAc,EAAoE,MAAM,qBAAqB,CAAA;AA6RtH;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAC7B,OAAO,EACP,KAAK,EACL,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,GAAG,QAAQ,CAAC,QAAQ,CAwvD3F,CAAA"}