@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/Inconsistency.js

@@ -0,0 +1,135 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Inconsistency_exports = {};
+__export(Inconsistency_exports, {
+  Inconsistency: () => Inconsistency,
+  layerNoop: () => layerNoop,
+  layerStrict: () => layerStrict,
+  layerTolerant: () => layerTolerant,
+  make: () => make,
+  makeNoop: () => makeNoop
+});
+module.exports = __toCommonJS(Inconsistency_exports);
+var import_engine = require("@smthrs/engine");
+var import_journal = require("@smthrs/journal");
+var Context = __toESM(require("effect/Context"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var JournalRecords = __toESM(require("./internal/JournalRecords.js"), 1);
+class Inconsistency extends Context.Service()("@smthrs/engine-store/Inconsistency") {
+}
+const make = (options) => ({
+  note: Effect.fn("Inconsistency.note")(
+    (event) => Effect.as(
+      options.journal.emitDurable(
+        JournalRecords.cacheConflict(
+          {
+            runId: event.attempted.recordedRunId,
+            sourceId: "flows/engine-store/inconsistency",
+            lineageId: import_engine.FlowEngine.Lineage.root(event.attempted.recordedRunId)
+          },
+          {
+            // `@smthrs/journal` redacts the credential word `key`. A durable
+            // content identity must use the specific, non-credential name.
+            cacheKey: event.key,
+            verdict: options.verdict,
+            existing: event.existing === void 0 ? null : {
+              recordedRunId: event.existing.recordedRunId,
+              recordedEventSeq: event.existing.recordedEventSeq,
+              createdAtMs: event.existing.createdAtMs
+            },
+            attempted: {
+              recordedRunId: event.attempted.recordedRunId,
+              recordedEventSeq: event.attempted.recordedEventSeq,
+              createdAtMs: event.attempted.createdAtMs
+            }
+          }
+        ),
+        options.owner
+      ),
+      options.verdict
+    )
+  ),
+  noteCorruption: Effect.fn("Inconsistency.noteCorruption")(
+    (event) => Effect.as(
+      options.journal.emitDurable(
+        JournalRecords.cacheCorruption(
+          {
+            runId: event.runId,
+            lineageId: import_engine.FlowEngine.Lineage.root(event.runId),
+            // The producer identity is the corruption evidence plus the
+            // recorded row generation (issues #156, #172): a caller
+            // re-observing the same corrupt row re-emits an exact producer
+            // duplicate the journal collapses, while an identically corrupt
+            // row recorded after eviction and healing has new provenance and
+            // lands as a distinct incident. Attempt-row evidence has no cache
+            // provenance, so its explicit local markers retain same-row
+            // convergence. A record already landed by another lineage under
+            // this identity surfaces as an idempotency conflict; either way
+            // evidence for that row generation exists exactly once.
+            sourceId: `flows/engine-store/inconsistency:corruption:${event.keyDigest}:${event.path}:${event.recordedDigest}:${event.measuredDigest}:${event.recordedRunId ?? "local"}:${event.recordedEventSeq ?? "local"}`,
+            sourceSeq: 0
+          },
+          {
+            keyDigest: event.keyDigest,
+            verdict: options.verdict,
+            path: event.path,
+            recordedDigest: event.recordedDigest,
+            measuredDigest: event.measuredDigest,
+            recordedRunId: event.recordedRunId ?? null,
+            recordedEventSeq: event.recordedEventSeq ?? null
+          }
+        ),
+        options.owner
+      ).pipe(
+        Effect.catch((error) => error.code === "idempotency_conflict" ? Effect.succeed(void 0) : Effect.fail(error))
+      ),
+      options.verdict
+    )
+  )
+});
+const makeNoop = (overrides = {}) => ({
+  note: Effect.fn("Inconsistency.note")(() => Effect.succeed("tolerate")),
+  noteCorruption: Effect.fn("Inconsistency.noteCorruption")(() => Effect.succeed("tolerate")),
+  ...overrides
+});
+const layerNoop = (overrides = {}) => Layer.succeed(Inconsistency)(makeNoop(overrides));
+const layerStrict = (owner) => Layer.effect(Inconsistency)(
+  Effect.gen(function* () {
+    const journal = yield* import_journal.Journal.Journal;
+    return make({ journal, verdict: "fail", owner });
+  })
+);
+const layerTolerant = (owner) => Layer.effect(Inconsistency)(
+  Effect.gen(function* () {
+    const journal = yield* import_journal.Journal.Journal;
+    return make({ journal, verdict: "tolerate", owner });
+  })
+);
+//# sourceMappingURL=Inconsistency.js.map

package/dist/cjs/Inconsistency.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Inconsistency.ts"],
+  "sourcesContent": ["/**\n * Receiver for detected engine inconsistencies.\n *\n * Modeled on Skyframe's `GraphInconsistencyReceiver`: the store layer detects\n * an invariant violation \u2014 today, a content-addressed cache key that produced\n * a different result than the recorded row \u2014 and this service decides whether\n * the run fails or tolerates it. Either way the conflict is journaled, so the\n * detector is never wired to /dev/null.\n *\n * The `note` signature deliberately matches the plugin spec's\n * `cacheInconsistency` hook (`(event) => Effect<InconsistencyVerdict>`); the\n * strict layer is the future default plugin.\n *\n * The core default is strict so an invariant violation cannot pass silently.\n *\n * Governing designs: `docs/concepts/attempts-and-replay.md` and\n * `apps/site/src/content/docs/docs/concepts/flows-actions-plans.mdx`.\n *\n * @since 0.1.0\n */\n\nimport { FlowEngine } from \"@smthrs/engine\"\nimport { Journal } from \"@smthrs/journal\"\nimport type { Ownership } from \"@smthrs/run-store\"\nimport type { CacheStore } from \"@smthrs/step-cache\"\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as JournalRecords from \"./internal/JournalRecords.ts\"\n\n/**\n * Decision returned by an inconsistency receiver.\n *\n * @category models\n * @since 0.1.0\n */\nexport type InconsistencyVerdict = \"fail\" | \"tolerate\"\n\n/**\n * A content-addressed cache key that produced a result different from the\n * recorded row \u2014 a hermeticity/determinism violation.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface CacheConflict {\n  readonly key: string\n  readonly existing: CacheStore.CacheEntry | undefined\n  readonly attempted: CacheStore.CacheEntry\n}\n\n/**\n * Recorded boundary evidence whose blob no longer hashes to its recorded\n * digest \u2014 on-disk corruption of the content-addressed store, detected while\n * replaying a verified cache hit or a succeeded attempt (issue #150).\n * Distinct from a transient host failure, which merely refuses the replay\n * and stays retryable.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface BlobCorruption {\n  /** The run that observed the corruption; the journaling target. */\n  readonly runId: string\n  readonly keyDigest: string\n  readonly path: string\n  readonly recordedDigest: string\n  readonly measuredDigest: string\n  /**\n   * Provenance of the corrupt evidence when it came from a shared cache row;\n   * absent when it came from this run's own succeeded attempt row.\n   */\n  readonly recordedRunId?: string | undefined\n  readonly recordedEventSeq?: number | undefined\n}\n\n/**\n * Inconsistency receiver operations.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Service {\n  readonly note: (event: CacheConflict) => Effect.Effect<InconsistencyVerdict, Journal.JournalError>\n  /**\n   * Observes on-disk corruption of recorded boundary evidence (issue #150).\n   * `\"fail\"` fails the dispatch; `\"tolerate\"` lets it fall back to a real\n   * execution (which re-captures and heals the corrupt address).\n   */\n  readonly noteCorruption: (event: BlobCorruption) => Effect.Effect<InconsistencyVerdict, Journal.JournalError>\n}\n\n/**\n * Service tag for the engine inconsistency receiver.\n *\n * @category services\n * @since 0.1.0\n */\nexport class Inconsistency extends Context.Service<Inconsistency, Service>()(\"@smthrs/engine-store/Inconsistency\") {}\n\n/**\n * Options for constructing a journaling inconsistency receiver.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface MakeOptions {\n  readonly journal: Journal.Service\n  readonly verdict: InconsistencyVerdict\n  /**\n   * The owner the conflict record is fenced to: a reclaimed run cannot append\n   * hermeticity evidence it no longer owns. Required \u2014 every composer of this\n   * receiver is a run's owner.\n   */\n  readonly owner: Ownership.OwnerId\n}\n\n/**\n * Builds a receiver that journals every conflict under the run that attempted\n * the write and returns a fixed verdict.\n *\n * The record goes through the journal's durable channel: a cache conflict is\n * hermeticity evidence, and a `tolerate` verdict that silently dropped its\n * only record would wire the detector to /dev/null (issue #10).\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (options: MakeOptions): Service => ({\n  note: Effect.fn(\"Inconsistency.note\")((event) =>\n    Effect.as(\n      options.journal.emitDurable(\n        JournalRecords.cacheConflict(\n          {\n            runId: event.attempted.recordedRunId,\n            sourceId: \"flows/engine-store/inconsistency\",\n            lineageId: FlowEngine.Lineage.root(event.attempted.recordedRunId)\n          },\n          {\n            // `@smthrs/journal` redacts the credential word `key`. A durable\n            // content identity must use the specific, non-credential name.\n            cacheKey: event.key,\n            verdict: options.verdict,\n            existing: event.existing === undefined ? null : {\n              recordedRunId: event.existing.recordedRunId,\n              recordedEventSeq: event.existing.recordedEventSeq,\n              createdAtMs: event.existing.createdAtMs\n            },\n            attempted: {\n              recordedRunId: event.attempted.recordedRunId,\n              recordedEventSeq: event.attempted.recordedEventSeq,\n              createdAtMs: event.attempted.createdAtMs\n            }\n          }\n        ),\n        options.owner\n      ),\n      options.verdict\n    )\n  ),\n  noteCorruption: Effect.fn(\"Inconsistency.noteCorruption\")((event) =>\n    Effect.as(\n      options.journal.emitDurable(\n        JournalRecords.cacheCorruption(\n          {\n            runId: event.runId,\n            lineageId: FlowEngine.Lineage.root(event.runId),\n            // The producer identity is the corruption evidence plus the\n            // recorded row generation (issues #156, #172): a caller\n            // re-observing the same corrupt row re-emits an exact producer\n            // duplicate the journal collapses, while an identically corrupt\n            // row recorded after eviction and healing has new provenance and\n            // lands as a distinct incident. Attempt-row evidence has no cache\n            // provenance, so its explicit local markers retain same-row\n            // convergence. A record already landed by another lineage under\n            // this identity surfaces as an idempotency conflict; either way\n            // evidence for that row generation exists exactly once.\n            sourceId:\n              `flows/engine-store/inconsistency:corruption:${event.keyDigest}:${event.path}:${event.recordedDigest}:${event.measuredDigest}:${\n                event.recordedRunId ?? \"local\"\n              }:${event.recordedEventSeq ?? \"local\"}`,\n            sourceSeq: 0\n          },\n          {\n            keyDigest: event.keyDigest,\n            verdict: options.verdict,\n            path: event.path,\n            recordedDigest: event.recordedDigest,\n            measuredDigest: event.measuredDigest,\n            recordedRunId: event.recordedRunId ?? null,\n            recordedEventSeq: event.recordedEventSeq ?? null\n          }\n        ),\n        options.owner\n      ).pipe(\n        Effect.catch((error) => error.code === \"idempotency_conflict\" ? Effect.succeed(undefined) : Effect.fail(error))\n      ),\n      options.verdict\n    )\n  )\n})\n\n/**\n * Builds a receiver from overrides. The default notes nothing and tolerates.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeNoop = (overrides: Partial<Service> = {}): Service => ({\n  note: Effect.fn(\"Inconsistency.note\")(() => Effect.succeed(\"tolerate\" as const)),\n  noteCorruption: Effect.fn(\"Inconsistency.noteCorruption\")(() => Effect.succeed(\"tolerate\" as const)),\n  ...overrides\n})\n\n/**\n * Provides a receiver that never journals and always tolerates.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoop = (overrides: Partial<Service> = {}): Layer.Layer<Inconsistency> =>\n  Layer.succeed(Inconsistency)(makeNoop(overrides))\n\n/**\n * Journals every cache conflict and fails the run. This is the default\n * receiver for engine wiring: a non-hermetic sealed hard-boundary action is\n * a defect, not a condition to paper over.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerStrict = (owner: Ownership.OwnerId): Layer.Layer<Inconsistency, never, Journal.Journal> =>\n  Layer.effect(Inconsistency)(\n    Effect.gen(function*() {\n      const journal = yield* Journal.Journal\n      return make({ journal, verdict: \"fail\", owner })\n    })\n  )\n\n/**\n * Journals every cache conflict and continues, preserving the first-recorded\n * row (Skyframe's tolerant production configuration).\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerTolerant = (owner: Ownership.OwnerId): Layer.Layer<Inconsistency, never, Journal.Journal> =>\n  Layer.effect(Inconsistency)(\n    Effect.gen(function*() {\n      const journal = yield* Journal.Journal\n      return make({ journal, verdict: \"tolerate\", owner })\n    })\n  )\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBA,oBAA2B;AAC3B,qBAAwB;AAGxB,cAAyB;AACzB,aAAwB;AACxB,YAAuB;AACvB,qBAAgC;AAsEzB,MAAM,sBAAsB,QAAQ,QAAgC,EAAE,oCAAoC,EAAE;AAAC;AA8B7G,MAAM,OAAO,CAAC,aAAmC;AAAA,EACtD,MAAM,OAAO,GAAG,oBAAoB;AAAA,IAAE,CAAC,UACrC,OAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,QACd,eAAe;AAAA,UACb;AAAA,YACE,OAAO,MAAM,UAAU;AAAA,YACvB,UAAU;AAAA,YACV,WAAW,yBAAW,QAAQ,KAAK,MAAM,UAAU,aAAa;AAAA,UAClE;AAAA,UACA;AAAA;AAAA;AAAA,YAGE,UAAU,MAAM;AAAA,YAChB,SAAS,QAAQ;AAAA,YACjB,UAAU,MAAM,aAAa,SAAY,OAAO;AAAA,cAC9C,eAAe,MAAM,SAAS;AAAA,cAC9B,kBAAkB,MAAM,SAAS;AAAA,cACjC,aAAa,MAAM,SAAS;AAAA,YAC9B;AAAA,YACA,WAAW;AAAA,cACT,eAAe,MAAM,UAAU;AAAA,cAC/B,kBAAkB,MAAM,UAAU;AAAA,cAClC,aAAa,MAAM,UAAU;AAAA,YAC/B;AAAA,UACF;AAAA,QACF;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,gBAAgB,OAAO,GAAG,8BAA8B;AAAA,IAAE,CAAC,UACzD,OAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,QACd,eAAe;AAAA,UACb;AAAA,YACE,OAAO,MAAM;AAAA,YACb,WAAW,yBAAW,QAAQ,KAAK,MAAM,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAW9C,UACE,+CAA+C,MAAM,SAAS,IAAI,MAAM,IAAI,IAAI,MAAM,cAAc,IAAI,MAAM,cAAc,IAC1H,MAAM,iBAAiB,OACzB,IAAI,MAAM,oBAAoB,OAAO;AAAA,YACvC,WAAW;AAAA,UACb;AAAA,UACA;AAAA,YACE,WAAW,MAAM;AAAA,YACjB,SAAS,QAAQ;AAAA,YACjB,MAAM,MAAM;AAAA,YACZ,gBAAgB,MAAM;AAAA,YACtB,gBAAgB,MAAM;AAAA,YACtB,eAAe,MAAM,iBAAiB;AAAA,YACtC,kBAAkB,MAAM,oBAAoB;AAAA,UAC9C;AAAA,QACF;AAAA,QACA,QAAQ;AAAA,MACV,EAAE;AAAA,QACA,OAAO,MAAM,CAAC,UAAU,MAAM,SAAS,yBAAyB,OAAO,QAAQ,MAAS,IAAI,OAAO,KAAK,KAAK,CAAC;AAAA,MAChH;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAQO,MAAM,WAAW,CAAC,YAA8B,CAAC,OAAgB;AAAA,EACtE,MAAM,OAAO,GAAG,oBAAoB,EAAE,MAAM,OAAO,QAAQ,UAAmB,CAAC;AAAA,EAC/E,gBAAgB,OAAO,GAAG,8BAA8B,EAAE,MAAM,OAAO,QAAQ,UAAmB,CAAC;AAAA,EACnG,GAAG;AACL;AAQO,MAAM,YAAY,CAAC,YAA8B,CAAC,MACvD,MAAM,QAAQ,aAAa,EAAE,SAAS,SAAS,CAAC;AAU3C,MAAM,cAAc,CAAC,UAC1B,MAAM,OAAO,aAAa;AAAA,EACxB,OAAO,IAAI,aAAY;AACrB,UAAM,UAAU,OAAO,uBAAQ;AAC/B,WAAO,KAAK,EAAE,SAAS,SAAS,QAAQ,MAAM,CAAC;AAAA,EACjD,CAAC;AACH;AASK,MAAM,gBAAgB,CAAC,UAC5B,MAAM,OAAO,aAAa;AAAA,EACxB,OAAO,IAAI,aAAY;AACrB,UAAM,UAAU,OAAO,uBAAQ;AAC/B,WAAO,KAAK,EAAE,SAAS,SAAS,YAAY,MAAM,CAAC;AAAA,EACrD,CAAC;AACH;",
+  "names": []
+}

package/dist/cjs/Migrations.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Durable engine schema migrations.
+ *
+ * Engine-store owns persisted deferred/clock state, execution selections,
+ * and append-only plan-input observations. These are authoritative execution
+ * records, distinct from journal projections and evictable step-cache rows.
+ * It reserves migration id block `3000`.
+ *
+ * Because engine-store composes the journal, the run store, and the step
+ * cache, {@link sets} is also the full durable schema an engine needs, and
+ * {@link layer} installs it in dependency order.
+ *
+ * Derived contracts: `docs/api.md` ("Migrations") and
+ * `packages/smithers/flows/journal/docs/api.md`.
+ *
+ * @since 0.1.0
+ */
+import * as DatabaseMigrations from "@smthrs/database/Migrations";
+import * as Layer from "effect/Layer";
+/**
+ * Engine-store's own namespaced migration set.
+ *
+ * @category migrations
+ * @since 0.1.0
+ */
+export declare const set: DatabaseMigrations.MigrationSet;
+/**
+ * Every migration set a durable engine needs, in dependency order: journal
+ * events, run and attempt state, the step cache, the engine's own deferred and
+ * clock, selection, and input tables, then the persisted plan.
+ *
+ * The plan set has the highest id block (`4000`). The database loader applies
+ * forward additions within already installed blocks transactionally before
+ * the ordinary migration pass (for example, engine-store `3003` after plan
+ * `4003`). Earlier holes and entirely new lower blocks remain refusals.
+ *
+ * @category migrations
+ * @since 0.1.0
+ */
+export declare const sets: ReadonlyArray<DatabaseMigrations.MigrationSet>;
+/**
+ * Creates the complete durable engine schema.
+ *
+ * @category migrations
+ * @since 0.1.0
+ */
+export declare const run: import("effect/Effect").Effect<readonly (readonly [id: number, name: string])[], import("effect/unstable/sql/SqlError").SqlError | import("effect/unstable/sql/Migrator").MigrationError, import("effect/unstable/sql/SqlClient").SqlClient>;
+/**
+ * Layer that installs the complete durable engine schema before exposing the
+ * database to any durable service.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: Layer.Layer<never, import("effect/unstable/sql/SqlError").SqlError | import("effect/unstable/sql/Migrator").MigrationError, import("effect/unstable/sql/SqlClient").SqlClient>;
+//# sourceMappingURL=Migrations.d.ts.map

package/dist/cjs/Migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migrations.d.ts","sourceRoot":"","sources":["../../src/Migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,kBAAkB,MAAM,6BAA6B,CAAA;AAKjE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAYrC;;;;;GAKG;AACH,eAAO,MAAM,GAAG,EAAE,kBAAkB,CAAC,YAepC,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,IAAI,EAAE,aAAa,CAAC,kBAAkB,CAAC,YAAY,CAM/D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,GAAG,8OAA+B,CAAA;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,gLAA2B,CAAA"}

package/dist/cjs/Migrations.js

@@ -0,0 +1,78 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Migrations_exports = {};
+__export(Migrations_exports, {
+  layer: () => layer,
+  run: () => run,
+  set: () => set,
+  sets: () => sets
+});
+module.exports = __toCommonJS(Migrations_exports);
+var DatabaseMigrations = __toESM(require("@smthrs/database/Migrations"), 1);
+var JournalMigrations = __toESM(require("@smthrs/journal/Migrations"), 1);
+var PlanMigrations = __toESM(require("@smthrs/plan-store/Migrations"), 1);
+var RunStoreMigrations = __toESM(require("@smthrs/run-store/Migrations"), 1);
+var StepCacheMigrations = __toESM(require("@smthrs/step-cache/Migrations"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var import_initial = require("./migrations/0001_initial.js");
+var import_selection_store = require("./migrations/0002_selection_store.js");
+var import_plan_inputs = require("./migrations/0003_plan_inputs.js");
+var import_plan_environment = require("./migrations/0004_plan_environment.js");
+var import_plan_merges = require("./migrations/0005_plan_merges.js");
+var import_execution_listing = require("./migrations/0006_execution_listing.js");
+var import_run_parent_sequence = require("./migrations/0007_run_parent_sequence.js");
+var import_deferred_consumption = require("./migrations/0008_deferred_consumption.js");
+var import_deferred_clock_facts = require("./migrations/0009_deferred_clock_facts.js");
+var import_pending_cancellation = require("./migrations/0010_pending_cancellation.js");
+const set = {
+  namespace: "engine-store",
+  idOffset: DatabaseMigrations.idBlock * 3,
+  migrations: {
+    "0001_initial": import_initial.initial,
+    "0002_selection_store": import_selection_store.selectionStore,
+    "0003_plan_inputs": import_plan_inputs.planInputs,
+    "0004_plan_environment": import_plan_environment.planEnvironment,
+    "0005_plan_merges": import_plan_merges.planMerges,
+    "0006_execution_listing": import_execution_listing.executionListing,
+    "0007_run_parent_sequence": import_run_parent_sequence.runParentSequence,
+    "0008_deferred_consumption": import_deferred_consumption.deferredConsumption,
+    "0009_deferred_clock_facts": import_deferred_clock_facts.deferredClockFacts,
+    "0010_pending_cancellation": import_pending_cancellation.pendingCancellation
+  }
+};
+const sets = [
+  JournalMigrations.set,
+  RunStoreMigrations.set,
+  StepCacheMigrations.set,
+  set,
+  PlanMigrations.set
+];
+const run = DatabaseMigrations.run(sets);
+const layer = Layer.effectDiscard(run);
+//# sourceMappingURL=Migrations.js.map

package/dist/cjs/Migrations.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Migrations.ts"],
+  "sourcesContent": ["/**\n * Durable engine schema migrations.\n *\n * Engine-store owns persisted deferred/clock state, execution selections,\n * and append-only plan-input observations. These are authoritative execution\n * records, distinct from journal projections and evictable step-cache rows.\n * It reserves migration id block `3000`.\n *\n * Because engine-store composes the journal, the run store, and the step\n * cache, {@link sets} is also the full durable schema an engine needs, and\n * {@link layer} installs it in dependency order.\n *\n * Derived contracts: `docs/api.md` (\"Migrations\") and\n * `packages/smithers/flows/journal/docs/api.md`.\n *\n * @since 0.1.0\n */\n\nimport * as DatabaseMigrations from \"@smthrs/database/Migrations\"\nimport * as JournalMigrations from \"@smthrs/journal/Migrations\"\nimport * as PlanMigrations from \"@smthrs/plan-store/Migrations\"\nimport * as RunStoreMigrations from \"@smthrs/run-store/Migrations\"\nimport * as StepCacheMigrations from \"@smthrs/step-cache/Migrations\"\nimport * as Layer from \"effect/Layer\"\nimport { initial } from \"./migrations/0001_initial.ts\"\nimport { selectionStore } from \"./migrations/0002_selection_store.ts\"\nimport { planInputs } from \"./migrations/0003_plan_inputs.ts\"\nimport { planEnvironment } from \"./migrations/0004_plan_environment.ts\"\nimport { planMerges } from \"./migrations/0005_plan_merges.ts\"\nimport { executionListing } from \"./migrations/0006_execution_listing.ts\"\nimport { runParentSequence } from \"./migrations/0007_run_parent_sequence.ts\"\nimport { deferredConsumption } from \"./migrations/0008_deferred_consumption.ts\"\nimport { deferredClockFacts } from \"./migrations/0009_deferred_clock_facts.ts\"\nimport { pendingCancellation } from \"./migrations/0010_pending_cancellation.ts\"\n\n/**\n * Engine-store's own namespaced migration set.\n *\n * @category migrations\n * @since 0.1.0\n */\nexport const set: DatabaseMigrations.MigrationSet = {\n  namespace: \"engine-store\",\n  idOffset: DatabaseMigrations.idBlock * 3,\n  migrations: {\n    \"0001_initial\": initial,\n    \"0002_selection_store\": selectionStore,\n    \"0003_plan_inputs\": planInputs,\n    \"0004_plan_environment\": planEnvironment,\n    \"0005_plan_merges\": planMerges,\n    \"0006_execution_listing\": executionListing,\n    \"0007_run_parent_sequence\": runParentSequence,\n    \"0008_deferred_consumption\": deferredConsumption,\n    \"0009_deferred_clock_facts\": deferredClockFacts,\n    \"0010_pending_cancellation\": pendingCancellation\n  }\n}\n\n/**\n * Every migration set a durable engine needs, in dependency order: journal\n * events, run and attempt state, the step cache, the engine's own deferred and\n * clock, selection, and input tables, then the persisted plan.\n *\n * The plan set has the highest id block (`4000`). The database loader applies\n * forward additions within already installed blocks transactionally before\n * the ordinary migration pass (for example, engine-store `3003` after plan\n * `4003`). Earlier holes and entirely new lower blocks remain refusals.\n *\n * @category migrations\n * @since 0.1.0\n */\nexport const sets: ReadonlyArray<DatabaseMigrations.MigrationSet> = [\n  JournalMigrations.set,\n  RunStoreMigrations.set,\n  StepCacheMigrations.set,\n  set,\n  PlanMigrations.set\n]\n\n/**\n * Creates the complete durable engine schema.\n *\n * @category migrations\n * @since 0.1.0\n */\nexport const run = DatabaseMigrations.run(sets)\n\n/**\n * Layer that installs the complete durable engine schema before exposing the\n * database to any durable service.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer = Layer.effectDiscard(run)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,yBAAoC;AACpC,wBAAmC;AACnC,qBAAgC;AAChC,yBAAoC;AACpC,0BAAqC;AACrC,YAAuB;AACvB,qBAAwB;AACxB,6BAA+B;AAC/B,yBAA2B;AAC3B,8BAAgC;AAChC,yBAA2B;AAC3B,+BAAiC;AACjC,iCAAkC;AAClC,kCAAoC;AACpC,kCAAmC;AACnC,kCAAoC;AAQ7B,MAAM,MAAuC;AAAA,EAClD,WAAW;AAAA,EACX,UAAU,mBAAmB,UAAU;AAAA,EACvC,YAAY;AAAA,IACV,gBAAgB;AAAA,IAChB,wBAAwB;AAAA,IACxB,oBAAoB;AAAA,IACpB,yBAAyB;AAAA,IACzB,oBAAoB;AAAA,IACpB,0BAA0B;AAAA,IAC1B,4BAA4B;AAAA,IAC5B,6BAA6B;AAAA,IAC7B,6BAA6B;AAAA,IAC7B,6BAA6B;AAAA,EAC/B;AACF;AAeO,MAAM,OAAuD;AAAA,EAClE,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB;AAAA,EACA,eAAe;AACjB;AAQO,MAAM,MAAM,mBAAmB,IAAI,IAAI;AASvC,MAAM,QAAQ,MAAM,cAAc,GAAG;",
+  "names": []
+}

package/dist/cjs/OwnerIdentity.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The source of the fencing identity a store incarnation runs under.
+ *
+ * Minting an {@link OwnerId} is an act of nondeterminism against the host: it
+ * reads a process identifier and draws a fresh nonce. Both belong behind a
+ * port rather than in the composition itself — the closed-host doctrine in
+ * `@smthrs/kernel`'s `HostServices` admits no ambient `process` and no static
+ * `node:crypto` import, and browser support is a hard requirement, so a store
+ * that reached for either directly could not be composed in a tab at all.
+ *
+ * Governing design: `docs/concepts/ownership-and-fencing.md`.
+ *
+ * @since 0.1.0
+ */
+import type { OwnerId } from "@smthrs/journal/OwnerId";
+import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+/**
+ * Owner identity operations.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Service {
+    /**
+     * Mints the identity this incarnation fences its durable writes with. The
+     * host supplies the incarnation; the caller supplies the host id, because
+     * which host a store speaks for is a composition decision, not a host fact.
+     */
+    readonly ownerId: (hostId: string) => Effect.Effect<OwnerId>;
+}
+declare const OwnerIdentity_base: Context.ServiceClass<OwnerIdentity, "@smthrs/engine-store/OwnerIdentity", Service>;
+/**
+ * Service tag for the owner identity source.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export declare class OwnerIdentity extends OwnerIdentity_base {
+}
+/**
+ * Constructs an owner identity source from an implementation.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const make: (service: Service) => Service;
+/**
+ * Builds the standard identity source over an explicitly supplied process id
+ * and the injected `Crypto` service.
+ *
+ * On node and bun `pid` is the real process id, so the minted token is exactly
+ * what the store produced before this service existed. A browser tab has no
+ * process, and no stable per-tab integer that means the same thing, so
+ * `undefined` draws an incarnation number instead: the component's only job is
+ * to distinguish concurrent incarnations on one host, and `Random` is the
+ * sanctioned port for drawing one. Effect's own cluster storage does the same
+ * where a backend exposes no connection pid (`reference/effect`
+ * `unstable/cluster/SqlRunnerStorage.ts`).
+ *
+ * The nonce is a UUIDv4 drawn from the injected `effect/Crypto` service — the
+ * closed-host seam every composition already provides for digesting — so no
+ * ambient `crypto` global is reached from a hot path. A host whose crypto
+ * cannot mint a UUID cannot fence anything, so that refusal is a defect.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const makeIncarnation: (pid: number | undefined, crypto: Crypto.Crypto) => Service;
+/**
+ * Provides {@link makeIncarnation} over whatever process id the running
+ * platform reports and the composition's `Crypto` service. This is what
+ * engine composition supplies unless a host has a better answer.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: Layer.Layer<OwnerIdentity, never, Crypto.Crypto>;
+/**
+ * Provides a fixed identity. A test — or a host that derives ownership from
+ * something outside this process, such as a lease it already holds — pins the
+ * whole token instead of letting the default draw one.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerConstant: (owner: OwnerId) => Layer.Layer<OwnerIdentity>;
+export {};
+//# sourceMappingURL=OwnerIdentity.d.ts.map

package/dist/cjs/OwnerIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OwnerIdentity.d.ts","sourceRoot":"","sources":["../../src/OwnerIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;CAC7D;;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,kBAA+E;CAAG;AAErH;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,SAAS,OAAO,KAAG,OAAoC,CAAA;AAc5E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,QAAQ,MAAM,CAAC,MAAM,KAAG,OAchF,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAGlE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CACM,CAAA"}

package/dist/cjs/OwnerIdentity.js

@@ -0,0 +1,65 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var OwnerIdentity_exports = {};
+__export(OwnerIdentity_exports, {
+  OwnerIdentity: () => OwnerIdentity,
+  layer: () => layer,
+  layerConstant: () => layerConstant,
+  make: () => make,
+  makeIncarnation: () => makeIncarnation
+});
+module.exports = __toCommonJS(OwnerIdentity_exports);
+var Context = __toESM(require("effect/Context"), 1);
+var Crypto = __toESM(require("effect/Crypto"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var Random = __toESM(require("effect/Random"), 1);
+class OwnerIdentity extends Context.Service()("@smthrs/engine-store/OwnerIdentity") {
+}
+const make = (service) => OwnerIdentity.of(service);
+const hostProcessId = () => globalThis.process?.pid;
+const makeIncarnation = (pid, crypto) => {
+  const incarnationId = pid === void 0 ? Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER, { halfOpen: true }) : Effect.succeed(pid);
+  return make({
+    ownerId: Effect.fn("OwnerIdentity.ownerId")(function* (hostId) {
+      yield* Effect.annotateCurrentSpan({ hostId });
+      return {
+        hostId,
+        pid: yield* incarnationId,
+        nonce: yield* crypto.randomUUIDv4.pipe(Effect.orDie)
+      };
+    })
+  });
+};
+const layer = Layer.effect(
+  OwnerIdentity,
+  Effect.map(Crypto.Crypto, (crypto) => makeIncarnation(hostProcessId(), crypto))
+);
+const layerConstant = (owner) => Layer.succeed(OwnerIdentity)(make({ ownerId: () => Effect.succeed(owner) }));
+//# sourceMappingURL=OwnerIdentity.js.map

package/dist/cjs/OwnerIdentity.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/OwnerIdentity.ts"],
+  "sourcesContent": ["/**\n * The source of the fencing identity a store incarnation runs under.\n *\n * Minting an {@link OwnerId} is an act of nondeterminism against the host: it\n * reads a process identifier and draws a fresh nonce. Both belong behind a\n * port rather than in the composition itself \u2014 the closed-host doctrine in\n * `@smthrs/kernel`'s `HostServices` admits no ambient `process` and no static\n * `node:crypto` import, and browser support is a hard requirement, so a store\n * that reached for either directly could not be composed in a tab at all.\n *\n * Governing design: `docs/concepts/ownership-and-fencing.md`.\n *\n * @since 0.1.0\n */\n\nimport type { OwnerId } from \"@smthrs/journal/OwnerId\"\nimport * as Context from \"effect/Context\"\nimport * as Crypto from \"effect/Crypto\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Random from \"effect/Random\"\n\n/**\n * Owner identity operations.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Service {\n  /**\n   * Mints the identity this incarnation fences its durable writes with. The\n   * host supplies the incarnation; the caller supplies the host id, because\n   * which host a store speaks for is a composition decision, not a host fact.\n   */\n  readonly ownerId: (hostId: string) => Effect.Effect<OwnerId>\n}\n\n/**\n * Service tag for the owner identity source.\n *\n * @category services\n * @since 0.1.0\n */\nexport class OwnerIdentity extends Context.Service<OwnerIdentity, Service>()(\"@smthrs/engine-store/OwnerIdentity\") {}\n\n/**\n * Constructs an owner identity source from an implementation.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (service: Service): Service => OwnerIdentity.of(service)\n\n/**\n * The host's process identifier, when the platform has one.\n *\n * Read off `globalThis` rather than through a bare `process` reference so the\n * module carries no Node binding at all: a browser bundle sees `undefined`\n * here and falls through to a drawn incarnation number instead. The read\n * happens at layer construction \u2014 {@link layer} \u2014 so importing the module\n * touches nothing.\n */\nconst hostProcessId = (): number | undefined =>\n  (globalThis as { readonly process?: { readonly pid?: number } }).process?.pid\n\n/**\n * Builds the standard identity source over an explicitly supplied process id\n * and the injected `Crypto` service.\n *\n * On node and bun `pid` is the real process id, so the minted token is exactly\n * what the store produced before this service existed. A browser tab has no\n * process, and no stable per-tab integer that means the same thing, so\n * `undefined` draws an incarnation number instead: the component's only job is\n * to distinguish concurrent incarnations on one host, and `Random` is the\n * sanctioned port for drawing one. Effect's own cluster storage does the same\n * where a backend exposes no connection pid (`reference/effect`\n * `unstable/cluster/SqlRunnerStorage.ts`).\n *\n * The nonce is a UUIDv4 drawn from the injected `effect/Crypto` service \u2014 the\n * closed-host seam every composition already provides for digesting \u2014 so no\n * ambient `crypto` global is reached from a hot path. A host whose crypto\n * cannot mint a UUID cannot fence anything, so that refusal is a defect.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeIncarnation = (pid: number | undefined, crypto: Crypto.Crypto): Service => {\n  const incarnationId: Effect.Effect<number> = pid === undefined\n    ? Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER, { halfOpen: true })\n    : Effect.succeed(pid)\n  return make({\n    ownerId: Effect.fn(\"OwnerIdentity.ownerId\")(function*(hostId) {\n      yield* Effect.annotateCurrentSpan({ hostId })\n      return {\n        hostId,\n        pid: yield* incarnationId,\n        nonce: yield* crypto.randomUUIDv4.pipe(Effect.orDie)\n      } satisfies OwnerId\n    })\n  })\n}\n\n/**\n * Provides {@link makeIncarnation} over whatever process id the running\n * platform reports and the composition's `Crypto` service. This is what\n * engine composition supplies unless a host has a better answer.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer: Layer.Layer<OwnerIdentity, never, Crypto.Crypto> = Layer.effect(\n  OwnerIdentity,\n  Effect.map(Crypto.Crypto, (crypto) => makeIncarnation(hostProcessId(), crypto))\n)\n\n/**\n * Provides a fixed identity. A test \u2014 or a host that derives ownership from\n * something outside this process, such as a lease it already holds \u2014 pins the\n * whole token instead of letting the default draw one.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerConstant = (owner: OwnerId): Layer.Layer<OwnerIdentity> =>\n  Layer.succeed(OwnerIdentity)(make({ ownerId: () => Effect.succeed(owner) }))\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBA,cAAyB;AACzB,aAAwB;AACxB,aAAwB;AACxB,YAAuB;AACvB,aAAwB;AAuBjB,MAAM,sBAAsB,QAAQ,QAAgC,EAAE,oCAAoC,EAAE;AAAC;AAQ7G,MAAM,OAAO,CAAC,YAA8B,cAAc,GAAG,OAAO;AAW3E,MAAM,gBAAgB,MACnB,WAAgE,SAAS;AAuBrE,MAAM,kBAAkB,CAAC,KAAyB,WAAmC;AAC1F,QAAM,gBAAuC,QAAQ,SACjD,OAAO,eAAe,GAAG,OAAO,kBAAkB,EAAE,UAAU,KAAK,CAAC,IACpE,OAAO,QAAQ,GAAG;AACtB,SAAO,KAAK;AAAA,IACV,SAAS,OAAO,GAAG,uBAAuB,EAAE,WAAU,QAAQ;AAC5D,aAAO,OAAO,oBAAoB,EAAE,OAAO,CAAC;AAC5C,aAAO;AAAA,QACL;AAAA,QACA,KAAK,OAAO;AAAA,QACZ,OAAO,OAAO,OAAO,aAAa,KAAK,OAAO,KAAK;AAAA,MACrD;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAUO,MAAM,QAA0D,MAAM;AAAA,EAC3E;AAAA,EACA,OAAO,IAAI,OAAO,QAAQ,CAAC,WAAW,gBAAgB,cAAc,GAAG,MAAM,CAAC;AAChF;AAUO,MAAM,gBAAgB,CAAC,UAC5B,MAAM,QAAQ,aAAa,EAAE,KAAK,EAAE,SAAS,MAAM,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC;",
+  "names": []
+}

package/dist/cjs/PlanInputStore.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Authoritative source observations for one durable plan execution. These are
+ * replay state, not approval data, journal projections, or evictable cache rows.
+ * @since 1.0.0
+ */
+import { DurableWriter } from "@smthrs/database/DurableWriter";
+import { OwnerId } from "@smthrs/run-store/Ownership";
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import type * as Crypto from "effect/Crypto";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+/**
+ * Address of an append-only observation generation. `environmentDigest` comes
+ * from `StepKey.environmentIdentity` and binds every generation of the run.
+ * @since 1.0.0
+ * @category schemas
+ */
+export declare const Address: Schema.Struct<{
+    readonly runId: Schema.NonEmptyString;
+    readonly planId: Schema.NonEmptyString;
+    readonly baseDigest: Schema.NonEmptyString;
+    readonly environmentDigest: Schema.NonEmptyString;
+    readonly generation: Schema.Int;
+}>;
+/**
+ * Address of an append-only observation generation.
+ * @since 1.0.0
+ * @category models
+ */
+export type Address = typeof Address.Type;
+/**
+ * Maximum encoded snapshot size, in JavaScript string code units.
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const maximumSnapshotCharacters: number;
+/**
+ * Frozen membership and newly pinned source digests for one generation.
+ * @since 1.0.0
+ * @category schemas
+ */
+export declare const Snapshot: Schema.Struct<{
+    readonly version: Schema.Literal<1>;
+    readonly generation: Schema.Int;
+    readonly nodes: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.NonEmptyString;
+        readonly key: Schema.NonEmptyString;
+        readonly reads: Schema.$Array<Schema.Struct<{
+            readonly entry: Schema.Union<readonly [Schema.NonEmptyString, Schema.TaggedStruct<"Glob", {
+                readonly include: Schema.NonEmptyArray<Schema.NonEmptyString>;
+                readonly exclude: Schema.optional<Schema.$Array<Schema.NonEmptyString>>;
+            }>]>;
+            readonly sourcePaths: Schema.$Array<Schema.NonEmptyString>;
+        }>>;
+    }>>;
+    readonly pins: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.NonEmptyString;
+        readonly digest: Schema.NonEmptyString;
+    }>>;
+}>;
+/**
+ * Frozen membership and newly pinned source digests for one generation.
+ * @since 1.0.0
+ * @category models
+ */
+export type Snapshot = typeof Snapshot.Type;
+declare const PlanInputError_base: Schema.Class<PlanInputError, Schema.TaggedStruct<"@smthrs/engine-store/PlanInputError", {
+    readonly code: Schema.Literals<readonly ["invalid_input", "corrupt_state", "incompatible_state", "fence_lost", "transaction_open", "persistence_failed"]>;
+    readonly message: Schema.String;
+    readonly cause: Schema.optional<Schema.Unknown>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A durable observation cannot be read or safely admitted.
+ * @since 1.0.0
+ * @category errors
+ */
+export declare class PlanInputError extends PlanInputError_base {
+}
+/**
+ * `get` is a committed-state admission gate and refuses an enclosing SQL
+ * transaction. `record` is first-writer-wins and may join a write transaction;
+ * callers must wait for its outer commit before executing affected actions.
+ * @since 1.0.0
+ * @category models
+ */
+export interface Service {
+    readonly get: (address: Address, owner: OwnerId) => Effect.Effect<Option.Option<Snapshot>, PlanInputError>;
+    readonly record: (address: Address, snapshot: Snapshot, owner: OwnerId) => Effect.Effect<Snapshot, PlanInputError>;
+}
+declare const PlanInputStore_base: Context.ServiceClass<PlanInputStore, "@smthrs/engine-store/PlanInputStore", Service>;
+/**
+ * Durable plan-input service.
+ * @since 1.0.0
+ * @category services
+ */
+export declare class PlanInputStore extends PlanInputStore_base {
+}
+/**
+ * Builds the SQL-backed, owner-fenced store.
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const make: Effect.Effect<Service, never, SqlClient.SqlClient | DurableWriter | Crypto.Crypto>;
+/**
+ * Provides the SQL-backed input store over the same database as the run/attempt stores.
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layer: Layer.Layer<PlanInputStore, never, SqlClient.SqlClient | DurableWriter | Crypto.Crypto>;
+export {};
+//# sourceMappingURL=PlanInputStore.d.ts.map

package/dist/cjs/PlanInputStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanInputStore.d.ts","sourceRoot":"","sources":["../../src/PlanInputStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/D,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAA;AAI1D;;;;;GAKG;AACH,eAAO,MAAM,OAAO;;;;;;EAMlB,CAAA;AACF;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAA;AAEzC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAmB,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;EAYnB,CAAA;AACF;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;;;;;;AAE3C;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,mBAWlC;CAAG;AAEL;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAA;IAC1G,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;CACnH;;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,mBAAiF;CAAG;AAsCxH;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,GAAG,aAAa,GAAG,MAAM,CAAC,MAAM,CAuInG,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,GAAG,aAAa,GAAG,MAAM,CAAC,MAAM,CAGjG,CAAA"}