@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/internal/AttemptProbe.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/AttemptProbe.ts"],
+  "sourcesContent": ["/**\n * Survivor discovery for an action key's attempt rows.\n *\n * Two implementations answer the same question \u2014 the durable state's single\n * ordered range read (issue #77) and the point-probe walk against\n * `AttemptStore` for storage that cannot range-scan. They are kept here\n * together, behind one entry point, because their answers must agree: a run\n * that resumes under SQL state and under the fallback must restore the same\n * retry origin and the same attempt counter (issue #96).\n *\n * @since 0.1.0\n */\n\nimport type { AttemptStore } from \"@smthrs/run-store\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport type * as DurableEngineState from \"../DurableEngineState.ts\"\n\n/**\n * How long a pruned leading run of attempt numbers the survivor scan\n * tolerates before it reports \"no attempt row survives\".\n *\n * A retention/prune job removes attempts oldest-first, so a surviving\n * sequence is contiguous once its first row is found; the bound caps the\n * pruned prefix walk (issue #69). It is a *semantic* bound, not merely a\n * cost bound: the point-probe fallback cannot distinguish \"nothing ever ran\"\n * from \"the first 33 attempts were pruned\" without a range read, so both\n * paths apply the same tolerance and a key whose earliest survivor sits past\n * it restarts its expiration budget and attempt numbering on either backend\n * (issue #96). Restarting is safe \u2014 the pruned numbers are gone, so the\n * fresh counter cannot collide \u2014 and, unlike the previous split, it is the\n * same behaviour on every backend.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const prunedPrefixScanLimit = 32\n\n/**\n * Finds the surviving attempt rows for an action key: the earliest row's\n * start time \u2014 the durable retry origin when attempt 1 itself was pruned\n * (issue #69) \u2014 and the highest attempt number contiguous from it, from\n * which the engine resumes the attempt counter (issue #59). `Option.none()`\n * means no attempt row survives within `prunedPrefixScanLimit`.\n *\n * When the durable state can range-scan attempts, one ordered SELECT answers\n * both questions (issue #77); otherwise the point-read scan against\n * `AttemptStore` answers them, paying up to `prunedPrefixScanLimit`\n * sequential gets for a key that never ran. Both answers pass through the\n * same tolerance check, so the two paths cannot diverge (issue #96).\n *\n * @since 0.1.0\n * @category combinators\n */\nexport const probeAttempts = (\n  attemptStore: AttemptStore.Service,\n  survivors: DurableEngineState.Service[\"attemptSurvivors\"],\n  runId: string,\n  stepKeyDigest: string\n): Effect.Effect<Option.Option<DurableEngineState.AttemptSurvivors>> =>\n  Effect.gen(function*() {\n    if (survivors !== undefined) {\n      const found = yield* survivors(runId, stepKeyDigest)\n      if (Option.isNone(found)) return Option.none()\n      return found.value.earliestAttempt > prunedPrefixScanLimit\n        ? Option.none()\n        : found\n    }\n    let earliest = Option.none<AttemptStore.Attempt>()\n    let attempt = 1\n    for (; attempt <= prunedPrefixScanLimit; attempt++) {\n      const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt }).pipe(Effect.orDie)\n      if (Option.isSome(row)) {\n        earliest = row\n        break\n      }\n    }\n    if (Option.isNone(earliest)) return Option.none()\n    let latest = attempt\n    for (let next = attempt + 1;; next++) {\n      const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt: next }).pipe(Effect.orDie)\n      if (Option.isNone(row)) break\n      latest = next\n    }\n    return Option.some({\n      earliestAttempt: attempt,\n      earliestStartedAtMs: earliest.value.startedAtMs,\n      latest\n    })\n  })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,aAAwB;AACxB,aAAwB;AAqBjB,MAAM,wBAAwB;AAkB9B,MAAM,gBAAgB,CAC3B,cACA,WACA,OACA,kBAEA,OAAO,IAAI,aAAY;AACrB,MAAI,cAAc,QAAW;AAC3B,UAAM,QAAQ,OAAO,UAAU,OAAO,aAAa;AACnD,QAAI,OAAO,OAAO,KAAK,EAAG,QAAO,OAAO,KAAK;AAC7C,WAAO,MAAM,MAAM,kBAAkB,wBACjC,OAAO,KAAK,IACZ;AAAA,EACN;AACA,MAAI,WAAW,OAAO,KAA2B;AACjD,MAAI,UAAU;AACd,SAAO,WAAW,uBAAuB,WAAW;AAClD,UAAM,MAAM,OAAO,aAAa,IAAI,EAAE,OAAO,eAAe,QAAQ,CAAC,EAAE,KAAK,OAAO,KAAK;AACxF,QAAI,OAAO,OAAO,GAAG,GAAG;AACtB,iBAAW;AACX;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,OAAO,QAAQ,EAAG,QAAO,OAAO,KAAK;AAChD,MAAI,SAAS;AACb,WAAS,OAAO,UAAU,KAAI,QAAQ;AACpC,UAAM,MAAM,OAAO,aAAa,IAAI,EAAE,OAAO,eAAe,SAAS,KAAK,CAAC,EAAE,KAAK,OAAO,KAAK;AAC9F,QAAI,OAAO,OAAO,GAAG,EAAG;AACxB,aAAS;AAAA,EACX;AACA,SAAO,OAAO,KAAK;AAAA,IACjB,iBAAiB;AAAA,IACjB,qBAAqB,SAAS,MAAM;AAAA,IACpC;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/cjs/internal/CacheAdmission.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Pure, phase-specific cache evidence admission. Storage decoding, current-read
+ * measurement, TTL history, output replay and publication I/O stay with their owners.
+ * @since 1.0.0-rc.0
+ */
+import type { Action } from "@smthrs/flow";
+import type { FileBoundary } from "@smthrs/flow/FileBoundary";
+import type * as StepBoundary from "../StepBoundary.ts";
+/** Reasons an existing declaration cannot name reusable results.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type DisabledReason = "unsealed" | "missing-boundary" | "expected-boundary" | "unresolved-read-glob";
+/** Declaration eligibility is separate from proof that a result may be reused.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Declaration = {
+    readonly _tag: "Eligible";
+    readonly metadata: FileBoundary;
+} | {
+    readonly _tag: "Disabled";
+    readonly reason: DisabledReason;
+};
+/** The proof-bearing part of already-decoded attempt metadata.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Metadata {
+    readonly tier: Action.Tier;
+    readonly boundary?: StepBoundary.BoundaryEvidence | undefined;
+    readonly readSetVerified?: true | undefined;
+    readonly boundaryQuarantined?: true | undefined;
+}
+/** A refusal is not a failure of an already durable action outcome.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Refused {
+    readonly _tag: "Refused";
+    readonly reason: DisabledReason | "invalid-meta" | "unsealed-meta" | "missing-evidence" | "deviation" | "unverified-writes" | "unverified-hermetic-reads" | "unverified-recorded-reads" | "quarantined-evidence" | "contradictory-evidence";
+}
+/** Necessary historical evidence, not yet a hit: current reads and outputs still need verification.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface CandidateEvidence<M extends Metadata> {
+    readonly _tag: "CandidateEvidence";
+    readonly meta: M;
+    readonly evidence: StepBoundary.BoundaryEvidence;
+}
+/** Shared gate for fresh completion and durable-completion convergence.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface PublishCompletion<M extends Metadata> {
+    readonly _tag: "PublishCompletion";
+    readonly meta: M;
+}
+/** Classifies existing declaration policy without changing keys or measuring the host.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const declaration: (input: {
+    readonly tier: Action.Tier;
+    readonly metadata?: FileBoundary | undefined;
+}) => Declaration;
+/** Candidate reads are remeasured, so do not require a historical readSetVerified flag here.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const candidate: <M extends Metadata>(meta: M | undefined) => CandidateEvidence<M> | Refused;
+/** Publication additionally requires the read proof associated with the completed body.
+ * Both stored quarantine and the caller's current integrity verdict forbid publication.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const completion: <M extends Metadata>(declared: Declaration, meta: M | undefined, quarantined: boolean) => PublishCompletion<M> | Refused;
+//# sourceMappingURL=CacheAdmission.d.ts.map

package/dist/cjs/internal/CacheAdmission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAdmission.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheAdmission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,KAAK,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAEvD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,sBAAsB,CAAA;AAE3G;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,gBAAgB,GAAG,SAAS,CAAA;IAC7D,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,EACX,cAAc,GACd,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,WAAW,GACX,mBAAmB,GACnB,2BAA2B,GAC3B,2BAA2B,GAC3B,sBAAsB,GACtB,wBAAwB,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACnD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAChB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,gBAAgB,CAAA;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACnD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;CACjB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,KAClF,WAMF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,KAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,OAsB1F,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,QAAQ,EAC3C,UAAU,WAAW,EACrB,MAAM,CAAC,GAAG,SAAS,EACnB,aAAa,OAAO,KACnB,iBAAiB,CAAC,CAAC,CAAC,GAAG,OAOzB,CAAA"}

package/dist/cjs/internal/CacheAdmission.js

@@ -0,0 +1,71 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var CacheAdmission_exports = {};
+__export(CacheAdmission_exports, {
+  candidate: () => candidate,
+  completion: () => completion,
+  declaration: () => declaration
+});
+module.exports = __toCommonJS(CacheAdmission_exports);
+var FileSet = __toESM(require("@smthrs/plan/FileSet"), 1);
+const declaration = (input) => {
+  if (input.tier !== "sealed") return { _tag: "Disabled", reason: "unsealed" };
+  if (input.metadata === void 0) return { _tag: "Disabled", reason: "missing-boundary" };
+  if (input.metadata.boundaryMode !== "hard") return { _tag: "Disabled", reason: "expected-boundary" };
+  if (input.metadata.readSet.some(FileSet.isGlob)) return { _tag: "Disabled", reason: "unresolved-read-glob" };
+  return { _tag: "Eligible", metadata: input.metadata };
+};
+const candidate = (meta) => {
+  if (meta === void 0) return { _tag: "Refused", reason: "invalid-meta" };
+  if (meta.boundaryQuarantined === true) {
+    return {
+      _tag: "Refused",
+      reason: meta.boundary !== void 0 || meta.readSetVerified === true ? "contradictory-evidence" : "quarantined-evidence"
+    };
+  }
+  if (meta.readSetVerified === true && meta.boundary === void 0) {
+    return { _tag: "Refused", reason: "contradictory-evidence" };
+  }
+  if (meta.tier !== "sealed") return { _tag: "Refused", reason: "unsealed-meta" };
+  const evidence = meta.boundary;
+  if (evidence === void 0) return { _tag: "Refused", reason: "missing-evidence" };
+  if (evidence.deviation !== void 0) return { _tag: "Refused", reason: "deviation" };
+  if (evidence.wholeTreeWritesVerified !== true) return { _tag: "Refused", reason: "unverified-writes" };
+  if (evidence.hermeticReadsVerified !== true) return { _tag: "Refused", reason: "unverified-hermetic-reads" };
+  return { _tag: "CandidateEvidence", meta, evidence };
+};
+const completion = (declared, meta, quarantined) => {
+  if (quarantined) return { _tag: "Refused", reason: "quarantined-evidence" };
+  if (declared._tag === "Disabled") return { _tag: "Refused", reason: declared.reason };
+  const checked = candidate(meta);
+  if (checked._tag === "Refused") return checked;
+  if (checked.meta.readSetVerified !== true) return { _tag: "Refused", reason: "unverified-recorded-reads" };
+  return { _tag: "PublishCompletion", meta: checked.meta };
+};
+//# sourceMappingURL=CacheAdmission.js.map

package/dist/cjs/internal/CacheAdmission.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/CacheAdmission.ts"],
+  "sourcesContent": ["/**\n * Pure, phase-specific cache evidence admission. Storage decoding, current-read\n * measurement, TTL history, output replay and publication I/O stay with their owners.\n * @since 1.0.0-rc.0\n */\n\nimport type { Action } from \"@smthrs/flow\"\nimport type { FileBoundary } from \"@smthrs/flow/FileBoundary\"\nimport * as FileSet from \"@smthrs/plan/FileSet\"\nimport type * as StepBoundary from \"../StepBoundary.ts\"\n\n/** Reasons an existing declaration cannot name reusable results.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type DisabledReason = \"unsealed\" | \"missing-boundary\" | \"expected-boundary\" | \"unresolved-read-glob\"\n\n/** Declaration eligibility is separate from proof that a result may be reused.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Declaration =\n  | { readonly _tag: \"Eligible\"; readonly metadata: FileBoundary }\n  | { readonly _tag: \"Disabled\"; readonly reason: DisabledReason }\n\n/** The proof-bearing part of already-decoded attempt metadata.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Metadata {\n  readonly tier: Action.Tier\n  readonly boundary?: StepBoundary.BoundaryEvidence | undefined\n  readonly readSetVerified?: true | undefined\n  readonly boundaryQuarantined?: true | undefined\n}\n\n/** A refusal is not a failure of an already durable action outcome.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Refused {\n  readonly _tag: \"Refused\"\n  readonly reason:\n    | DisabledReason\n    | \"invalid-meta\"\n    | \"unsealed-meta\"\n    | \"missing-evidence\"\n    | \"deviation\"\n    | \"unverified-writes\"\n    | \"unverified-hermetic-reads\"\n    | \"unverified-recorded-reads\"\n    | \"quarantined-evidence\"\n    | \"contradictory-evidence\"\n}\n\n/** Necessary historical evidence, not yet a hit: current reads and outputs still need verification.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface CandidateEvidence<M extends Metadata> {\n  readonly _tag: \"CandidateEvidence\"\n  readonly meta: M\n  readonly evidence: StepBoundary.BoundaryEvidence\n}\n\n/** Shared gate for fresh completion and durable-completion convergence.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface PublishCompletion<M extends Metadata> {\n  readonly _tag: \"PublishCompletion\"\n  readonly meta: M\n}\n\n/** Classifies existing declaration policy without changing keys or measuring the host.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const declaration = (\n  input: { readonly tier: Action.Tier; readonly metadata?: FileBoundary | undefined }\n): Declaration => {\n  if (input.tier !== \"sealed\") return { _tag: \"Disabled\", reason: \"unsealed\" }\n  if (input.metadata === undefined) return { _tag: \"Disabled\", reason: \"missing-boundary\" }\n  if (input.metadata.boundaryMode !== \"hard\") return { _tag: \"Disabled\", reason: \"expected-boundary\" }\n  if (input.metadata.readSet.some(FileSet.isGlob)) return { _tag: \"Disabled\", reason: \"unresolved-read-glob\" }\n  return { _tag: \"Eligible\", metadata: input.metadata }\n}\n\n/** Candidate reads are remeasured, so do not require a historical readSetVerified flag here.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const candidate = <M extends Metadata>(meta: M | undefined): CandidateEvidence<M> | Refused => {\n  if (meta === undefined) return { _tag: \"Refused\", reason: \"invalid-meta\" }\n  // Legacy flags never override quarantine. Retain the durable outcome and\n  // the original metadata, but refuse to promote contradictory proof to reuse.\n  if (meta.boundaryQuarantined === true) {\n    return {\n      _tag: \"Refused\",\n      reason: meta.boundary !== undefined || meta.readSetVerified === true\n        ? \"contradictory-evidence\"\n        : \"quarantined-evidence\"\n    }\n  }\n  if (meta.readSetVerified === true && meta.boundary === undefined) {\n    return { _tag: \"Refused\", reason: \"contradictory-evidence\" }\n  }\n  if (meta.tier !== \"sealed\") return { _tag: \"Refused\", reason: \"unsealed-meta\" }\n  const evidence = meta.boundary\n  if (evidence === undefined) return { _tag: \"Refused\", reason: \"missing-evidence\" }\n  if (evidence.deviation !== undefined) return { _tag: \"Refused\", reason: \"deviation\" }\n  if (evidence.wholeTreeWritesVerified !== true) return { _tag: \"Refused\", reason: \"unverified-writes\" }\n  if (evidence.hermeticReadsVerified !== true) return { _tag: \"Refused\", reason: \"unverified-hermetic-reads\" }\n  return { _tag: \"CandidateEvidence\", meta, evidence }\n}\n\n/** Publication additionally requires the read proof associated with the completed body.\n * Both stored quarantine and the caller's current integrity verdict forbid publication.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const completion = <M extends Metadata>(\n  declared: Declaration,\n  meta: M | undefined,\n  quarantined: boolean\n): PublishCompletion<M> | Refused => {\n  if (quarantined) return { _tag: \"Refused\", reason: \"quarantined-evidence\" }\n  if (declared._tag === \"Disabled\") return { _tag: \"Refused\", reason: declared.reason }\n  const checked = candidate(meta)\n  if (checked._tag === \"Refused\") return checked\n  if (checked.meta.readSetVerified !== true) return { _tag: \"Refused\", reason: \"unverified-recorded-reads\" }\n  return { _tag: \"PublishCompletion\", meta: checked.meta }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,cAAyB;AAsElB,MAAM,cAAc,CACzB,UACgB;AAChB,MAAI,MAAM,SAAS,SAAU,QAAO,EAAE,MAAM,YAAY,QAAQ,WAAW;AAC3E,MAAI,MAAM,aAAa,OAAW,QAAO,EAAE,MAAM,YAAY,QAAQ,mBAAmB;AACxF,MAAI,MAAM,SAAS,iBAAiB,OAAQ,QAAO,EAAE,MAAM,YAAY,QAAQ,oBAAoB;AACnG,MAAI,MAAM,SAAS,QAAQ,KAAK,QAAQ,MAAM,EAAG,QAAO,EAAE,MAAM,YAAY,QAAQ,uBAAuB;AAC3G,SAAO,EAAE,MAAM,YAAY,UAAU,MAAM,SAAS;AACtD;AAMO,MAAM,YAAY,CAAqB,SAAwD;AACpG,MAAI,SAAS,OAAW,QAAO,EAAE,MAAM,WAAW,QAAQ,eAAe;AAGzE,MAAI,KAAK,wBAAwB,MAAM;AACrC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,KAAK,aAAa,UAAa,KAAK,oBAAoB,OAC5D,2BACA;AAAA,IACN;AAAA,EACF;AACA,MAAI,KAAK,oBAAoB,QAAQ,KAAK,aAAa,QAAW;AAChE,WAAO,EAAE,MAAM,WAAW,QAAQ,yBAAyB;AAAA,EAC7D;AACA,MAAI,KAAK,SAAS,SAAU,QAAO,EAAE,MAAM,WAAW,QAAQ,gBAAgB;AAC9E,QAAM,WAAW,KAAK;AACtB,MAAI,aAAa,OAAW,QAAO,EAAE,MAAM,WAAW,QAAQ,mBAAmB;AACjF,MAAI,SAAS,cAAc,OAAW,QAAO,EAAE,MAAM,WAAW,QAAQ,YAAY;AACpF,MAAI,SAAS,4BAA4B,KAAM,QAAO,EAAE,MAAM,WAAW,QAAQ,oBAAoB;AACrG,MAAI,SAAS,0BAA0B,KAAM,QAAO,EAAE,MAAM,WAAW,QAAQ,4BAA4B;AAC3G,SAAO,EAAE,MAAM,qBAAqB,MAAM,SAAS;AACrD;AAOO,MAAM,aAAa,CACxB,UACA,MACA,gBACmC;AACnC,MAAI,YAAa,QAAO,EAAE,MAAM,WAAW,QAAQ,uBAAuB;AAC1E,MAAI,SAAS,SAAS,WAAY,QAAO,EAAE,MAAM,WAAW,QAAQ,SAAS,OAAO;AACpF,QAAM,UAAU,UAAU,IAAI;AAC9B,MAAI,QAAQ,SAAS,UAAW,QAAO;AACvC,MAAI,QAAQ,KAAK,oBAAoB,KAAM,QAAO,EAAE,MAAM,WAAW,QAAQ,4BAA4B;AACzG,SAAO,EAAE,MAAM,qBAAqB,MAAM,QAAQ,KAAK;AACzD;",
+  "names": []
+}

package/dist/cjs/internal/CacheAgeHistory.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Read-only validation of copied cache-age decisions. Producer identities and
+ * persisted payloads remain unchanged; ancestry alone is not a reuse proof.
+ * @since 1.0.0-rc.0
+ */
+import type { Journal, JournalEvent } from "@smthrs/journal";
+import type { RunStore } from "@smthrs/run-store";
+import * as Effect from "effect/Effect";
+/**
+ * Paged journal lookup shared with copied-record validation.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export { find } from "./CopiedRecord.ts";
+/** A copied verdict is usable only through an exact, retained fork prefix.
+ * Missing/compacted ancestry and malformed or unrelated history fail closed.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export declare const copiedVerdict: (options: {
+    readonly journal: Journal.Service;
+    readonly runs: RunStore.Service;
+    readonly runId: string;
+    readonly decision: JournalEvent.Input;
+    readonly conflict: Journal.JournalError;
+}) => Effect.Effect<"admitted" | "expired", Journal.JournalError>;
+//# sourceMappingURL=CacheAgeHistory.d.ts.map

package/dist/cjs/internal/CacheAgeHistory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAgeHistory.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheAgeHistory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAWxC;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAA;CACxC,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,EAAE,OAAO,CAAC,YAAY,CAkB1D,CAAA"}

package/dist/cjs/internal/CacheAgeHistory.js

@@ -0,0 +1,61 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var CacheAgeHistory_exports = {};
+__export(CacheAgeHistory_exports, {
+  copiedVerdict: () => copiedVerdict,
+  find: () => import_CopiedRecord2.find
+});
+module.exports = __toCommonJS(CacheAgeHistory_exports);
+var import_engine = require("@smthrs/engine");
+var Effect = __toESM(require("effect/Effect"), 1);
+var import_CopiedRecord = require("./CopiedRecord.js");
+var import_CopiedRecord2 = require("./CopiedRecord.js");
+const fieldsEqual = (value, expected) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  if (typeof expected !== "object" || expected === null || Array.isArray(expected)) return false;
+  const record = value;
+  const keys = Object.keys(expected);
+  return Object.keys(record).length === keys.length && keys.every((key) => record[key] === expected[key]);
+};
+const copiedVerdict = (options) => Effect.gen(function* () {
+  const { journal, conflict, decision } = options;
+  const source = (entry2) => entry2.sourceId === decision.sourceId && entry2.sourceSeq === decision.sourceSeq;
+  const entry = yield* (0, import_CopiedRecord.find)(journal, options.runId, source);
+  if (entry === void 0) return yield* Effect.fail(conflict);
+  const payload = entry.payload;
+  const verdict = payload?.verdict;
+  if (verdict !== "admitted" && verdict !== "expired") return yield* Effect.fail(conflict);
+  const expected = { ...decision.payload, verdict };
+  if (entry.eventType !== decision.eventType || !fieldsEqual(entry.payload, expected)) {
+    return yield* Effect.fail(conflict);
+  }
+  const original = yield* (0, import_CopiedRecord.prove)({ ...options, entry, same: fieldsEqual });
+  return fieldsEqual(original.record.meta, { lineageId: import_engine.FlowEngine.Lineage.root(original.ancestor) }) ? verdict : yield* Effect.fail(conflict);
+});
+//# sourceMappingURL=CacheAgeHistory.js.map

package/dist/cjs/internal/CacheAgeHistory.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/CacheAgeHistory.ts"],
+  "sourcesContent": ["/**\n * Read-only validation of copied cache-age decisions. Producer identities and\n * persisted payloads remain unchanged; ancestry alone is not a reuse proof.\n * @since 1.0.0-rc.0\n */\n\nimport { FlowEngine } from \"@smthrs/engine\"\nimport type { Journal, JournalEvent } from \"@smthrs/journal\"\nimport type { RunStore } from \"@smthrs/run-store\"\nimport * as Effect from \"effect/Effect\"\nimport { find, prove } from \"./CopiedRecord.ts\"\n\n/**\n * Paged journal lookup shared with copied-record validation.\n * @category accessors\n * @since 1.0.0-rc.0\n */\nexport { find } from \"./CopiedRecord.ts\"\n\nconst fieldsEqual = (value: unknown, expected: unknown): boolean => {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false\n  if (typeof expected !== \"object\" || expected === null || Array.isArray(expected)) return false\n  const record = value as Readonly<Record<string, unknown>>\n  const keys = Object.keys(expected)\n  return Object.keys(record).length === keys.length &&\n    keys.every((key) => record[key] === (expected as Readonly<Record<string, unknown>>)[key])\n}\n\n/** A copied verdict is usable only through an exact, retained fork prefix.\n * Missing/compacted ancestry and malformed or unrelated history fail closed.\n * @category accessors\n * @since 1.0.0-rc.0\n */\nexport const copiedVerdict = (options: {\n  readonly journal: Journal.Service\n  readonly runs: RunStore.Service\n  readonly runId: string\n  readonly decision: JournalEvent.Input\n  readonly conflict: Journal.JournalError\n}): Effect.Effect<\"admitted\" | \"expired\", Journal.JournalError> =>\n  Effect.gen(function*() {\n    const { journal, conflict, decision } = options\n    const source = (entry: JournalEvent.Entry) =>\n      entry.sourceId === decision.sourceId && entry.sourceSeq === decision.sourceSeq\n    const entry = yield* find(journal, options.runId, source)\n    if (entry === undefined) return yield* Effect.fail(conflict)\n    const payload = entry.payload as { readonly verdict?: unknown } | null\n    const verdict = payload?.verdict\n    if (verdict !== \"admitted\" && verdict !== \"expired\") return yield* Effect.fail(conflict)\n    const expected = { ...decision.payload as Readonly<Record<string, unknown>>, verdict }\n    if (entry.eventType !== decision.eventType || !fieldsEqual(entry.payload, expected)) {\n      return yield* Effect.fail(conflict)\n    }\n    const original = yield* prove({ ...options, entry, same: fieldsEqual })\n    return fieldsEqual(original.record.meta, { lineageId: FlowEngine.Lineage.root(original.ancestor) })\n      ? verdict\n      : yield* Effect.fail(conflict)\n  })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,oBAA2B;AAG3B,aAAwB;AACxB,0BAA4B;AAO5B,IAAAA,uBAAqB;AAErB,MAAM,cAAc,CAAC,OAAgB,aAA+B;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,MAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACzF,QAAM,SAAS;AACf,QAAM,OAAO,OAAO,KAAK,QAAQ;AACjC,SAAO,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,UACzC,KAAK,MAAM,CAAC,QAAQ,OAAO,GAAG,MAAO,SAA+C,GAAG,CAAC;AAC5F;AAOO,MAAM,gBAAgB,CAAC,YAO5B,OAAO,IAAI,aAAY;AACrB,QAAM,EAAE,SAAS,UAAU,SAAS,IAAI;AACxC,QAAM,SAAS,CAACC,WACdA,OAAM,aAAa,SAAS,YAAYA,OAAM,cAAc,SAAS;AACvE,QAAM,QAAQ,WAAO,0BAAK,SAAS,QAAQ,OAAO,MAAM;AACxD,MAAI,UAAU,OAAW,QAAO,OAAO,OAAO,KAAK,QAAQ;AAC3D,QAAM,UAAU,MAAM;AACtB,QAAM,UAAU,SAAS;AACzB,MAAI,YAAY,cAAc,YAAY,UAAW,QAAO,OAAO,OAAO,KAAK,QAAQ;AACvF,QAAM,WAAW,EAAE,GAAG,SAAS,SAA8C,QAAQ;AACrF,MAAI,MAAM,cAAc,SAAS,aAAa,CAAC,YAAY,MAAM,SAAS,QAAQ,GAAG;AACnF,WAAO,OAAO,OAAO,KAAK,QAAQ;AAAA,EACpC;AACA,QAAM,WAAW,WAAO,2BAAM,EAAE,GAAG,SAAS,OAAO,MAAM,YAAY,CAAC;AACtE,SAAO,YAAY,SAAS,OAAO,MAAM,EAAE,WAAW,yBAAW,QAAQ,KAAK,SAAS,QAAQ,EAAE,CAAC,IAC9F,UACA,OAAO,OAAO,KAAK,QAAQ;AACjC,CAAC;",
+  "names": ["import_CopiedRecord", "entry"]
+}

package/dist/cjs/internal/CacheAgeVerdicts.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Incremental evidence for the no-TTL cache guard.
+ * @since 1.0.0-rc.0
+ */
+import { Journal, JournalEvent } from "@smthrs/journal";
+import * as Effect from "effect/Effect";
+/**
+ * Per-executor index of TTL markers in an append-only journal generation.
+ * Refresh before answering, retaining the first record for either its producer
+ * key or payload key so malformed and copied verdicts still refuse removal.
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const make: (runId: string) => (journal: Journal.Service, keyDigest: string) => Effect.Effect<JournalEvent.Entry | undefined, Journal.JournalError>;
+//# sourceMappingURL=CacheAgeVerdicts.d.ts.map

package/dist/cjs/internal/CacheAgeVerdicts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAgeVerdicts.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheAgeVerdicts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,MAAM,MAQ9B,SAAS,OAAO,CAAC,OAAO,EACxB,WAAW,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,GAAG,SAAS,EAAE,OAAO,CAAC,YAAY,CAkCtE,CAAA"}

package/dist/cjs/internal/CacheAgeVerdicts.js

@@ -0,0 +1,73 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var CacheAgeVerdicts_exports = {};
+__export(CacheAgeVerdicts_exports, {
+  make: () => make
+});
+module.exports = __toCommonJS(CacheAgeVerdicts_exports);
+var import_journal = require("@smthrs/journal");
+var Effect = __toESM(require("effect/Effect"), 1);
+var Semaphore = __toESM(require("effect/Semaphore"), 1);
+const make = (runId) => {
+  const gate = Semaphore.makeUnsafe(1);
+  const id = import_journal.JournalEvent.RunId.make(runId);
+  let source;
+  let generation;
+  let after;
+  const verdicts = /* @__PURE__ */ new Map();
+  return (journal, keyDigest) => Semaphore.withPermit(gate)(Effect.gen(function* () {
+    const currentGeneration = journal.generation === void 0 ? 0 : (yield* journal.generation(id)).generation;
+    if (source !== journal || generation !== currentGeneration) {
+      source = journal;
+      generation = currentGeneration;
+      after = void 0;
+      verdicts.clear();
+    }
+    while (true) {
+      const page = yield* journal.entries({ runId: id, limit: 128, ...after === void 0 ? {} : { after } });
+      const next = page.entries.at(-1)?.seq;
+      if (page.hasMore && next === void 0 || next !== void 0 && after !== void 0 && next <= after) {
+        return yield* Effect.fail(
+          new import_journal.Journal.JournalError({ code: "read_failed", message: "cache history cursor did not advance" })
+        );
+      }
+      for (const entry of page.entries) {
+        const producerKey = /^cache:([^:]+):ttl:/.exec(entry.sourceId)?.[1];
+        const payload = entry.payload;
+        if (producerKey !== void 0 && !verdicts.has(producerKey)) verdicts.set(producerKey, entry);
+        if (payload?.action === "ttl" && typeof payload.keyDigest === "string" && !verdicts.has(payload.keyDigest)) {
+          verdicts.set(payload.keyDigest, entry);
+        }
+      }
+      after = next ?? after;
+      if (!page.hasMore) return verdicts.get(keyDigest);
+    }
+  }));
+};
+//# sourceMappingURL=CacheAgeVerdicts.js.map

package/dist/cjs/internal/CacheAgeVerdicts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/CacheAgeVerdicts.ts"],
+  "sourcesContent": ["/**\n * Incremental evidence for the no-TTL cache guard.\n * @since 1.0.0-rc.0\n */\n\nimport { Journal, JournalEvent } from \"@smthrs/journal\"\nimport * as Effect from \"effect/Effect\"\nimport * as Semaphore from \"effect/Semaphore\"\n\n/**\n * Per-executor index of TTL markers in an append-only journal generation.\n * Refresh before answering, retaining the first record for either its producer\n * key or payload key so malformed and copied verdicts still refuse removal.\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const make = (runId: string) => {\n  const gate = Semaphore.makeUnsafe(1)\n  const id = JournalEvent.RunId.make(runId)\n  let source: Journal.Service | undefined\n  let generation: number | undefined\n  let after: JournalEvent.Seq | undefined\n  const verdicts = new Map<string, JournalEvent.Entry>()\n  return (\n    journal: Journal.Service,\n    keyDigest: string\n  ): Effect.Effect<JournalEvent.Entry | undefined, Journal.JournalError> =>\n    Semaphore.withPermit(gate)(Effect.gen(function*() {\n      const currentGeneration = journal.generation === undefined ? 0 : (yield* journal.generation(id)).generation\n      if (source !== journal || generation !== currentGeneration) {\n        source = journal\n        generation = currentGeneration\n        after = undefined\n        verdicts.clear()\n      }\n      while (true) {\n        const page = yield* journal.entries({ runId: id, limit: 128, ...after === undefined ? {} : { after } })\n        const next = page.entries.at(-1)?.seq\n        if (\n          (page.hasMore && next === undefined) ||\n          (next !== undefined && after !== undefined && next <= after)\n        ) {\n          return yield* Effect.fail(\n            new Journal.JournalError({ code: \"read_failed\", message: \"cache history cursor did not advance\" })\n          )\n        }\n        for (const entry of page.entries) {\n          const producerKey = /^cache:([^:]+):ttl:/.exec(entry.sourceId)?.[1]\n          const payload = entry.payload as { action?: unknown; keyDigest?: unknown } | null\n          if (producerKey !== undefined && !verdicts.has(producerKey)) verdicts.set(producerKey, entry)\n          if (payload?.action === \"ttl\" && typeof payload.keyDigest === \"string\" && !verdicts.has(payload.keyDigest)) {\n            verdicts.set(payload.keyDigest, entry)\n          }\n        }\n        // Publish each fully processed page, including the final one. A read\n        // failure or interruption retries only the unvalidated suffix.\n        after = next ?? after\n        if (!page.hasMore) return verdicts.get(keyDigest)\n      }\n    }))\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,qBAAsC;AACtC,aAAwB;AACxB,gBAA2B;AASpB,MAAM,OAAO,CAAC,UAAkB;AACrC,QAAM,OAAO,UAAU,WAAW,CAAC;AACnC,QAAM,KAAK,4BAAa,MAAM,KAAK,KAAK;AACxC,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,QAAM,WAAW,oBAAI,IAAgC;AACrD,SAAO,CACL,SACA,cAEA,UAAU,WAAW,IAAI,EAAE,OAAO,IAAI,aAAY;AAChD,UAAM,oBAAoB,QAAQ,eAAe,SAAY,KAAK,OAAO,QAAQ,WAAW,EAAE,GAAG;AACjG,QAAI,WAAW,WAAW,eAAe,mBAAmB;AAC1D,eAAS;AACT,mBAAa;AACb,cAAQ;AACR,eAAS,MAAM;AAAA,IACjB;AACA,WAAO,MAAM;AACX,YAAM,OAAO,OAAO,QAAQ,QAAQ,EAAE,OAAO,IAAI,OAAO,KAAK,GAAG,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AACtG,YAAM,OAAO,KAAK,QAAQ,GAAG,EAAE,GAAG;AAClC,UACG,KAAK,WAAW,SAAS,UACzB,SAAS,UAAa,UAAU,UAAa,QAAQ,OACtD;AACA,eAAO,OAAO,OAAO;AAAA,UACnB,IAAI,uBAAQ,aAAa,EAAE,MAAM,eAAe,SAAS,uCAAuC,CAAC;AAAA,QACnG;AAAA,MACF;AACA,iBAAW,SAAS,KAAK,SAAS;AAChC,cAAM,cAAc,sBAAsB,KAAK,MAAM,QAAQ,IAAI,CAAC;AAClE,cAAM,UAAU,MAAM;AACtB,YAAI,gBAAgB,UAAa,CAAC,SAAS,IAAI,WAAW,EAAG,UAAS,IAAI,aAAa,KAAK;AAC5F,YAAI,SAAS,WAAW,SAAS,OAAO,QAAQ,cAAc,YAAY,CAAC,SAAS,IAAI,QAAQ,SAAS,GAAG;AAC1G,mBAAS,IAAI,QAAQ,WAAW,KAAK;AAAA,QACvC;AAAA,MACF;AAGA,cAAQ,QAAQ;AAChB,UAAI,CAAC,KAAK,QAAS,QAAO,SAAS,IAAI,SAAS;AAAA,IAClD;AAAA,EACF,CAAC,CAAC;AACN;",
+  "names": []
+}

package/dist/cjs/internal/CacheOutputPolicy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Replay authority comes from the current descriptor, never the recorded paths.
+ * This preflight performs no host I/O; every path is checked before replay can prune.
+ * @since 1.0.0-rc.0
+ */
+import type { FileBoundary } from "@smthrs/flow/FileBoundary";
+import type * as StepBoundary from "../StepBoundary.ts";
+/** A typed refusal leaves both the evidence and the workspace intact.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Decision = {
+    readonly _tag: "ReplayOutputs";
+} | {
+    readonly _tag: "Refused";
+    readonly reason: "output-boundary-mismatch" | "unsupported-output-evidence";
+};
+/** Validate all recorded writes, removals and pruning roots before materialization.
+ * Unknown output formats cannot establish current filesystem authority.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const replay: (descriptor: FileBoundary | undefined, evidence: StepBoundary.BoundaryEvidence) => Decision;
+//# sourceMappingURL=CacheOutputPolicy.d.ts.map

package/dist/cjs/internal/CacheOutputPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheOutputPolicy.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheOutputPolicy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAG7D,OAAO,KAAK,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAWvD;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,GAAG,6BAA6B,CAAA;CAAE,CAAA;AAE7G;;;;GAIG;AACH,eAAO,MAAM,MAAM,GACjB,YAAY,YAAY,GAAG,SAAS,EACpC,UAAU,YAAY,CAAC,gBAAgB,KACtC,QA4CF,CAAA"}

package/dist/cjs/internal/CacheOutputPolicy.js

@@ -0,0 +1,75 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var CacheOutputPolicy_exports = {};
+__export(CacheOutputPolicy_exports, {
+  replay: () => replay
+});
+module.exports = __toCommonJS(CacheOutputPolicy_exports);
+var ArtifactStore = __toESM(require("@smthrs/artifacts/ArtifactStore"), 1);
+var FileSet = __toESM(require("@smthrs/plan/FileSet"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+const Outputs = Schema.Struct({
+  outputs: Schema.Array(Schema.Struct({ path: Schema.String, digest: Schema.NullOr(ArtifactStore.Digest) })),
+  trees: Schema.optional(Schema.Array(Schema.Struct({ path: Schema.String, identity: Schema.String })))
+});
+const DeclaredPaths = Schema.Struct({ paths: Schema.Array(FileSet.Entry) });
+const samePaths = Schema.toEquivalence(Schema.Array(FileSet.Entry));
+const replay = (descriptor, evidence) => {
+  const mismatch = { _tag: "Refused", reason: "output-boundary-mismatch" };
+  if (descriptor === void 0) return mismatch;
+  const decoded = Schema.decodeUnknownResult(Outputs)(evidence.declaredOutputs);
+  if (decoded._tag === "Failure") {
+    const paths2 = Schema.decodeUnknownResult(DeclaredPaths)(evidence.declaredOutputs);
+    if (paths2._tag === "Failure" || Object.hasOwn(evidence.declaredOutputs, "outputs")) {
+      return { _tag: "Refused", reason: "unsupported-output-evidence" };
+    }
+    return (descriptor.removes ?? []).length === 0 && samePaths(paths2.success.paths, descriptor.writeSet) ? { _tag: "ReplayOutputs" } : mismatch;
+  }
+  const { outputs, trees = [] } = decoded.success;
+  const paths = [...outputs.map((output) => output.path), ...trees.map((tree) => tree.path)];
+  if (paths.some((path) => !FileSet.workspaceRelative(path) || FileSet.canonical(path) !== path)) return mismatch;
+  if (new Set(outputs.map((output) => output.path)).size !== outputs.length) return mismatch;
+  if (new Set(trees.map((tree) => tree.path)).size !== trees.length) return mismatch;
+  const removes = descriptor.removes ?? [];
+  for (const output of outputs) {
+    if (output.digest === null) {
+      if (!removes.includes(output.path)) return mismatch;
+    } else if (removes.includes(output.path) || !descriptor.writeSet.some((entry) => FileSet.overlaps(entry, output.path))) return mismatch;
+  }
+  const declaredTrees = descriptor.writeSet.filter(FileSet.isTreeArtifact);
+  if (declaredTrees.some((entry) => outputs.some((output) => output.path === entry.path))) return mismatch;
+  if (trees.some((tree) => !declaredTrees.some((entry) => entry.path === tree.path))) return mismatch;
+  if (declaredTrees.some((entry) => !trees.some((tree) => tree.path === entry.path))) return mismatch;
+  if (removes.some((path) => !outputs.some((output) => output.path === path && output.digest === null))) return mismatch;
+  if (descriptor.writeSet.some(
+    (entry) => typeof entry === "string" && !outputs.some((output) => output.path === entry && output.digest !== null)
+  )) return mismatch;
+  return { _tag: "ReplayOutputs" };
+};
+//# sourceMappingURL=CacheOutputPolicy.js.map

package/dist/cjs/internal/CacheOutputPolicy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/CacheOutputPolicy.ts"],
+  "sourcesContent": ["/**\n * Replay authority comes from the current descriptor, never the recorded paths.\n * This preflight performs no host I/O; every path is checked before replay can prune.\n * @since 1.0.0-rc.0\n */\n\nimport * as ArtifactStore from \"@smthrs/artifacts/ArtifactStore\"\nimport type { FileBoundary } from \"@smthrs/flow/FileBoundary\"\nimport * as FileSet from \"@smthrs/plan/FileSet\"\nimport * as Schema from \"effect/Schema\"\nimport type * as StepBoundary from \"../StepBoundary.ts\"\n\nconst Outputs = Schema.Struct({\n  outputs: Schema.Array(Schema.Struct({ path: Schema.String, digest: Schema.NullOr(ArtifactStore.Digest) })),\n  trees: Schema.optional(Schema.Array(Schema.Struct({ path: Schema.String, identity: Schema.String })))\n})\n// The existing abstract boundary protocol records its exact declared path set.\n// Validate that format separately; it does not claim a filesystem blob manifest.\nconst DeclaredPaths = Schema.Struct({ paths: Schema.Array(FileSet.Entry) })\nconst samePaths = Schema.toEquivalence(Schema.Array(FileSet.Entry))\n\n/** A typed refusal leaves both the evidence and the workspace intact.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Decision =\n  | { readonly _tag: \"ReplayOutputs\" }\n  | { readonly _tag: \"Refused\"; readonly reason: \"output-boundary-mismatch\" | \"unsupported-output-evidence\" }\n\n/** Validate all recorded writes, removals and pruning roots before materialization.\n * Unknown output formats cannot establish current filesystem authority.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const replay = (\n  descriptor: FileBoundary | undefined,\n  evidence: StepBoundary.BoundaryEvidence\n): Decision => {\n  const mismatch = { _tag: \"Refused\", reason: \"output-boundary-mismatch\" } as const\n  if (descriptor === undefined) return mismatch\n  const decoded = Schema.decodeUnknownResult(Outputs)(evidence.declaredOutputs)\n  if (decoded._tag === \"Failure\") {\n    const paths = Schema.decodeUnknownResult(DeclaredPaths)(evidence.declaredOutputs)\n    // Malformed production evidence cannot downgrade itself to the abstract\n    // protocol by also supplying a matching path list.\n    if (paths._tag === \"Failure\" || Object.hasOwn(evidence.declaredOutputs as object, \"outputs\")) {\n      return { _tag: \"Refused\", reason: \"unsupported-output-evidence\" }\n    }\n    return (descriptor.removes ?? []).length === 0 && samePaths(paths.success.paths, descriptor.writeSet)\n      ? { _tag: \"ReplayOutputs\" }\n      : mismatch\n  }\n  const { outputs, trees = [] } = decoded.success\n  const paths = [...outputs.map((output) => output.path), ...trees.map((tree) => tree.path)]\n  // Use the exact coordinate spelling that replay passes to the filesystem.\n  if (paths.some((path) => !FileSet.workspaceRelative(path) || FileSet.canonical(path) !== path)) return mismatch\n  if (new Set(outputs.map((output) => output.path)).size !== outputs.length) return mismatch\n  if (new Set(trees.map((tree) => tree.path)).size !== trees.length) return mismatch\n  const removes = descriptor.removes ?? []\n  for (const output of outputs) {\n    if (output.digest === null) {\n      if (!removes.includes(output.path)) return mismatch\n    } else if (\n      removes.includes(output.path) ||\n      !descriptor.writeSet.some((entry) => FileSet.overlaps(entry, output.path))\n    ) return mismatch\n  }\n  // A tree root authorizes pruning its entire subtree. A glob or a narrower\n  // tree is never sufficient authority for a recorded broader pruning root.\n  const declaredTrees = descriptor.writeSet.filter(FileSet.isTreeArtifact)\n  // A declared tree root is a directory, never a replayable file or deletion.\n  if (declaredTrees.some((entry) => outputs.some((output) => output.path === entry.path))) return mismatch\n  if (trees.some((tree) => !declaredTrees.some((entry) => entry.path === tree.path))) return mismatch\n  if (declaredTrees.some((entry) => !trees.some((tree) => tree.path === entry.path))) return mismatch\n  if (removes.some((path) => !outputs.some((output) => output.path === path && output.digest === null))) return mismatch\n  if (\n    descriptor.writeSet.some((entry) =>\n      typeof entry === \"string\" && !outputs.some((output) => output.path === entry && output.digest !== null)\n    )\n  ) return mismatch\n  return { _tag: \"ReplayOutputs\" }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,oBAA+B;AAE/B,cAAyB;AACzB,aAAwB;AAGxB,MAAM,UAAU,OAAO,OAAO;AAAA,EAC5B,SAAS,OAAO,MAAM,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,QAAQ,OAAO,OAAO,cAAc,MAAM,EAAE,CAAC,CAAC;AAAA,EACzG,OAAO,OAAO,SAAS,OAAO,MAAM,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,UAAU,OAAO,OAAO,CAAC,CAAC,CAAC;AACtG,CAAC;AAGD,MAAM,gBAAgB,OAAO,OAAO,EAAE,OAAO,OAAO,MAAM,QAAQ,KAAK,EAAE,CAAC;AAC1E,MAAM,YAAY,OAAO,cAAc,OAAO,MAAM,QAAQ,KAAK,CAAC;AAe3D,MAAM,SAAS,CACpB,YACA,aACa;AACb,QAAM,WAAW,EAAE,MAAM,WAAW,QAAQ,2BAA2B;AACvE,MAAI,eAAe,OAAW,QAAO;AACrC,QAAM,UAAU,OAAO,oBAAoB,OAAO,EAAE,SAAS,eAAe;AAC5E,MAAI,QAAQ,SAAS,WAAW;AAC9B,UAAMA,SAAQ,OAAO,oBAAoB,aAAa,EAAE,SAAS,eAAe;AAGhF,QAAIA,OAAM,SAAS,aAAa,OAAO,OAAO,SAAS,iBAA2B,SAAS,GAAG;AAC5F,aAAO,EAAE,MAAM,WAAW,QAAQ,8BAA8B;AAAA,IAClE;AACA,YAAQ,WAAW,WAAW,CAAC,GAAG,WAAW,KAAK,UAAUA,OAAM,QAAQ,OAAO,WAAW,QAAQ,IAChG,EAAE,MAAM,gBAAgB,IACxB;AAAA,EACN;AACA,QAAM,EAAE,SAAS,QAAQ,CAAC,EAAE,IAAI,QAAQ;AACxC,QAAM,QAAQ,CAAC,GAAG,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAEzF,MAAI,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,kBAAkB,IAAI,KAAK,QAAQ,UAAU,IAAI,MAAM,IAAI,EAAG,QAAO;AACvG,MAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,EAAE,SAAS,QAAQ,OAAQ,QAAO;AAClF,MAAI,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,SAAS,MAAM,OAAQ,QAAO;AAC1E,QAAM,UAAU,WAAW,WAAW,CAAC;AACvC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,MAAM;AAC1B,UAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAAA,IAC7C,WACE,QAAQ,SAAS,OAAO,IAAI,KAC5B,CAAC,WAAW,SAAS,KAAK,CAAC,UAAU,QAAQ,SAAS,OAAO,OAAO,IAAI,CAAC,EACzE,QAAO;AAAA,EACX;AAGA,QAAM,gBAAgB,WAAW,SAAS,OAAO,QAAQ,cAAc;AAEvE,MAAI,cAAc,KAAK,CAAC,UAAU,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,MAAM,IAAI,CAAC,EAAG,QAAO;AAChG,MAAI,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,KAAK,IAAI,CAAC,EAAG,QAAO;AAC3F,MAAI,cAAc,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM,IAAI,CAAC,EAAG,QAAO;AAC3F,MAAI,QAAQ,KAAK,CAAC,SAAS,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,QAAQ,OAAO,WAAW,IAAI,CAAC,EAAG,QAAO;AAC9G,MACE,WAAW,SAAS;AAAA,IAAK,CAAC,UACxB,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,SAAS,OAAO,WAAW,IAAI;AAAA,EACxG,EACA,QAAO;AACT,SAAO,EAAE,MAAM,gBAAgB;AACjC;",
+  "names": ["paths"]
+}