@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/internal/AttemptProbe.js

@@ -0,0 +1,83 @@
+/**
+ * Survivor discovery for an action key's attempt rows.
+ *
+ * Two implementations answer the same question — the durable state's single
+ * ordered range read (issue #77) and the point-probe walk against
+ * `AttemptStore` for storage that cannot range-scan. They are kept here
+ * together, behind one entry point, because their answers must agree: a run
+ * that resumes under SQL state and under the fallback must restore the same
+ * retry origin and the same attempt counter (issue #96).
+ *
+ * @since 0.1.0
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+/**
+ * How long a pruned leading run of attempt numbers the survivor scan
+ * tolerates before it reports "no attempt row survives".
+ *
+ * A retention/prune job removes attempts oldest-first, so a surviving
+ * sequence is contiguous once its first row is found; the bound caps the
+ * pruned prefix walk (issue #69). It is a *semantic* bound, not merely a
+ * cost bound: the point-probe fallback cannot distinguish "nothing ever ran"
+ * from "the first 33 attempts were pruned" without a range read, so both
+ * paths apply the same tolerance and a key whose earliest survivor sits past
+ * it restarts its expiration budget and attempt numbering on either backend
+ * (issue #96). Restarting is safe — the pruned numbers are gone, so the
+ * fresh counter cannot collide — and, unlike the previous split, it is the
+ * same behaviour on every backend.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const prunedPrefixScanLimit = 32;
+/**
+ * Finds the surviving attempt rows for an action key: the earliest row's
+ * start time — the durable retry origin when attempt 1 itself was pruned
+ * (issue #69) — and the highest attempt number contiguous from it, from
+ * which the engine resumes the attempt counter (issue #59). `Option.none()`
+ * means no attempt row survives within `prunedPrefixScanLimit`.
+ *
+ * When the durable state can range-scan attempts, one ordered SELECT answers
+ * both questions (issue #77); otherwise the point-read scan against
+ * `AttemptStore` answers them, paying up to `prunedPrefixScanLimit`
+ * sequential gets for a key that never ran. Both answers pass through the
+ * same tolerance check, so the two paths cannot diverge (issue #96).
+ *
+ * @since 0.1.0
+ * @category combinators
+ */
+export const probeAttempts = (attemptStore, survivors, runId, stepKeyDigest) => Effect.gen(function* () {
+    if (survivors !== undefined) {
+        const found = yield* survivors(runId, stepKeyDigest);
+        if (Option.isNone(found))
+            return Option.none();
+        return found.value.earliestAttempt > prunedPrefixScanLimit
+            ? Option.none()
+            : found;
+    }
+    let earliest = Option.none();
+    let attempt = 1;
+    for (; attempt <= prunedPrefixScanLimit; attempt++) {
+        const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt }).pipe(Effect.orDie);
+        if (Option.isSome(row)) {
+            earliest = row;
+            break;
+        }
+    }
+    if (Option.isNone(earliest))
+        return Option.none();
+    let latest = attempt;
+    for (let next = attempt + 1;; next++) {
+        const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt: next }).pipe(Effect.orDie);
+        if (Option.isNone(row))
+            break;
+        latest = next;
+    }
+    return Option.some({
+        earliestAttempt: attempt,
+        earliestStartedAtMs: earliest.value.startedAtMs,
+        latest
+    });
+});
+//# sourceMappingURL=AttemptProbe.js.map

package/dist/esm/internal/AttemptProbe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttemptProbe.js","sourceRoot":"","sources":["../../../src/internal/AttemptProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,YAAkC,EAClC,SAAyD,EACzD,KAAa,EACb,aAAqB,EAC8C,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAA;QAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,eAAe,GAAG,qBAAqB;YACxD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YACf,CAAC,CAAC,KAAK,CAAA;IACX,CAAC;IACD,IAAI,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAwB,CAAA;IAClD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,OAAO,OAAO,IAAI,qBAAqB,EAAE,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACzF,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,GAAG,GAAG,CAAA;YACd,MAAK;QACP,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAA;IACjD,IAAI,MAAM,GAAG,OAAO,CAAA;IACpB,KAAK,IAAI,IAAI,GAAG,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/F,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,MAAK;QAC7B,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACjB,eAAe,EAAE,OAAO;QACxB,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QAC/C,MAAM;KACP,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Survivor discovery for an action key's attempt rows.\n *\n * Two implementations answer the same question — the durable state's single\n * ordered range read (issue #77) and the point-probe walk against\n * `AttemptStore` for storage that cannot range-scan. They are kept here\n * together, behind one entry point, because their answers must agree: a run\n * that resumes under SQL state and under the fallback must restore the same\n * retry origin and the same attempt counter (issue #96).\n *\n * @since 0.1.0\n */\n\nimport type { AttemptStore } from \"@smthrs/run-store\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport type * as DurableEngineState from \"../DurableEngineState.ts\"\n\n/**\n * How long a pruned leading run of attempt numbers the survivor scan\n * tolerates before it reports \"no attempt row survives\".\n *\n * A retention/prune job removes attempts oldest-first, so a surviving\n * sequence is contiguous once its first row is found; the bound caps the\n * pruned prefix walk (issue #69). It is a *semantic* bound, not merely a\n * cost bound: the point-probe fallback cannot distinguish \"nothing ever ran\"\n * from \"the first 33 attempts were pruned\" without a range read, so both\n * paths apply the same tolerance and a key whose earliest survivor sits past\n * it restarts its expiration budget and attempt numbering on either backend\n * (issue #96). Restarting is safe — the pruned numbers are gone, so the\n * fresh counter cannot collide — and, unlike the previous split, it is the\n * same behaviour on every backend.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const prunedPrefixScanLimit = 32\n\n/**\n * Finds the surviving attempt rows for an action key: the earliest row's\n * start time — the durable retry origin when attempt 1 itself was pruned\n * (issue #69) — and the highest attempt number contiguous from it, from\n * which the engine resumes the attempt counter (issue #59). `Option.none()`\n * means no attempt row survives within `prunedPrefixScanLimit`.\n *\n * When the durable state can range-scan attempts, one ordered SELECT answers\n * both questions (issue #77); otherwise the point-read scan against\n * `AttemptStore` answers them, paying up to `prunedPrefixScanLimit`\n * sequential gets for a key that never ran. Both answers pass through the\n * same tolerance check, so the two paths cannot diverge (issue #96).\n *\n * @since 0.1.0\n * @category combinators\n */\nexport const probeAttempts = (\n  attemptStore: AttemptStore.Service,\n  survivors: DurableEngineState.Service[\"attemptSurvivors\"],\n  runId: string,\n  stepKeyDigest: string\n): Effect.Effect<Option.Option<DurableEngineState.AttemptSurvivors>> =>\n  Effect.gen(function*() {\n    if (survivors !== undefined) {\n      const found = yield* survivors(runId, stepKeyDigest)\n      if (Option.isNone(found)) return Option.none()\n      return found.value.earliestAttempt > prunedPrefixScanLimit\n        ? Option.none()\n        : found\n    }\n    let earliest = Option.none<AttemptStore.Attempt>()\n    let attempt = 1\n    for (; attempt <= prunedPrefixScanLimit; attempt++) {\n      const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt }).pipe(Effect.orDie)\n      if (Option.isSome(row)) {\n        earliest = row\n        break\n      }\n    }\n    if (Option.isNone(earliest)) return Option.none()\n    let latest = attempt\n    for (let next = attempt + 1;; next++) {\n      const row = yield* attemptStore.get({ runId, stepKeyDigest, attempt: next }).pipe(Effect.orDie)\n      if (Option.isNone(row)) break\n      latest = next\n    }\n    return Option.some({\n      earliestAttempt: attempt,\n      earliestStartedAtMs: earliest.value.startedAtMs,\n      latest\n    })\n  })\n"]}

package/dist/esm/internal/CacheAdmission.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Pure, phase-specific cache evidence admission. Storage decoding, current-read
+ * measurement, TTL history, output replay and publication I/O stay with their owners.
+ * @since 1.0.0-rc.0
+ */
+import type { Action } from "@smthrs/flow";
+import type { FileBoundary } from "@smthrs/flow/FileBoundary";
+import type * as StepBoundary from "../StepBoundary.ts";
+/** Reasons an existing declaration cannot name reusable results.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type DisabledReason = "unsealed" | "missing-boundary" | "expected-boundary" | "unresolved-read-glob";
+/** Declaration eligibility is separate from proof that a result may be reused.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Declaration = {
+    readonly _tag: "Eligible";
+    readonly metadata: FileBoundary;
+} | {
+    readonly _tag: "Disabled";
+    readonly reason: DisabledReason;
+};
+/** The proof-bearing part of already-decoded attempt metadata.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Metadata {
+    readonly tier: Action.Tier;
+    readonly boundary?: StepBoundary.BoundaryEvidence | undefined;
+    readonly readSetVerified?: true | undefined;
+    readonly boundaryQuarantined?: true | undefined;
+}
+/** A refusal is not a failure of an already durable action outcome.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Refused {
+    readonly _tag: "Refused";
+    readonly reason: DisabledReason | "invalid-meta" | "unsealed-meta" | "missing-evidence" | "deviation" | "unverified-writes" | "unverified-hermetic-reads" | "unverified-recorded-reads" | "quarantined-evidence" | "contradictory-evidence";
+}
+/** Necessary historical evidence, not yet a hit: current reads and outputs still need verification.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface CandidateEvidence<M extends Metadata> {
+    readonly _tag: "CandidateEvidence";
+    readonly meta: M;
+    readonly evidence: StepBoundary.BoundaryEvidence;
+}
+/** Shared gate for fresh completion and durable-completion convergence.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface PublishCompletion<M extends Metadata> {
+    readonly _tag: "PublishCompletion";
+    readonly meta: M;
+}
+/** Classifies existing declaration policy without changing keys or measuring the host.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const declaration: (input: {
+    readonly tier: Action.Tier;
+    readonly metadata?: FileBoundary | undefined;
+}) => Declaration;
+/** Candidate reads are remeasured, so do not require a historical readSetVerified flag here.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const candidate: <M extends Metadata>(meta: M | undefined) => CandidateEvidence<M> | Refused;
+/** Publication additionally requires the read proof associated with the completed body.
+ * Both stored quarantine and the caller's current integrity verdict forbid publication.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const completion: <M extends Metadata>(declared: Declaration, meta: M | undefined, quarantined: boolean) => PublishCompletion<M> | Refused;
+//# sourceMappingURL=CacheAdmission.d.ts.map

package/dist/esm/internal/CacheAdmission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAdmission.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheAdmission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,KAAK,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAEvD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,sBAAsB,CAAA;AAE3G;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,gBAAgB,GAAG,SAAS,CAAA;IAC7D,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,EACX,cAAc,GACd,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,WAAW,GACX,mBAAmB,GACnB,2BAA2B,GAC3B,2BAA2B,GAC3B,sBAAsB,GACtB,wBAAwB,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACnD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAChB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,gBAAgB,CAAA;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACnD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;CACjB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,KAClF,WAMF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,KAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,OAsB1F,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,QAAQ,EAC3C,UAAU,WAAW,EACrB,MAAM,CAAC,GAAG,SAAS,EACnB,aAAa,OAAO,KACnB,iBAAiB,CAAC,CAAC,CAAC,GAAG,OAOzB,CAAA"}

package/dist/esm/internal/CacheAdmission.js

@@ -0,0 +1,72 @@
+/**
+ * Pure, phase-specific cache evidence admission. Storage decoding, current-read
+ * measurement, TTL history, output replay and publication I/O stay with their owners.
+ * @since 1.0.0-rc.0
+ */
+import * as FileSet from "@smthrs/plan/FileSet";
+/** Classifies existing declaration policy without changing keys or measuring the host.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export const declaration = (input) => {
+    if (input.tier !== "sealed")
+        return { _tag: "Disabled", reason: "unsealed" };
+    if (input.metadata === undefined)
+        return { _tag: "Disabled", reason: "missing-boundary" };
+    if (input.metadata.boundaryMode !== "hard")
+        return { _tag: "Disabled", reason: "expected-boundary" };
+    if (input.metadata.readSet.some(FileSet.isGlob))
+        return { _tag: "Disabled", reason: "unresolved-read-glob" };
+    return { _tag: "Eligible", metadata: input.metadata };
+};
+/** Candidate reads are remeasured, so do not require a historical readSetVerified flag here.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export const candidate = (meta) => {
+    if (meta === undefined)
+        return { _tag: "Refused", reason: "invalid-meta" };
+    // Legacy flags never override quarantine. Retain the durable outcome and
+    // the original metadata, but refuse to promote contradictory proof to reuse.
+    if (meta.boundaryQuarantined === true) {
+        return {
+            _tag: "Refused",
+            reason: meta.boundary !== undefined || meta.readSetVerified === true
+                ? "contradictory-evidence"
+                : "quarantined-evidence"
+        };
+    }
+    if (meta.readSetVerified === true && meta.boundary === undefined) {
+        return { _tag: "Refused", reason: "contradictory-evidence" };
+    }
+    if (meta.tier !== "sealed")
+        return { _tag: "Refused", reason: "unsealed-meta" };
+    const evidence = meta.boundary;
+    if (evidence === undefined)
+        return { _tag: "Refused", reason: "missing-evidence" };
+    if (evidence.deviation !== undefined)
+        return { _tag: "Refused", reason: "deviation" };
+    if (evidence.wholeTreeWritesVerified !== true)
+        return { _tag: "Refused", reason: "unverified-writes" };
+    if (evidence.hermeticReadsVerified !== true)
+        return { _tag: "Refused", reason: "unverified-hermetic-reads" };
+    return { _tag: "CandidateEvidence", meta, evidence };
+};
+/** Publication additionally requires the read proof associated with the completed body.
+ * Both stored quarantine and the caller's current integrity verdict forbid publication.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export const completion = (declared, meta, quarantined) => {
+    if (quarantined)
+        return { _tag: "Refused", reason: "quarantined-evidence" };
+    if (declared._tag === "Disabled")
+        return { _tag: "Refused", reason: declared.reason };
+    const checked = candidate(meta);
+    if (checked._tag === "Refused")
+        return checked;
+    if (checked.meta.readSetVerified !== true)
+        return { _tag: "Refused", reason: "unverified-recorded-reads" };
+    return { _tag: "PublishCompletion", meta: checked.meta };
+};
+//# sourceMappingURL=CacheAdmission.js.map

package/dist/esm/internal/CacheAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAdmission.js","sourceRoot":"","sources":["../../../src/internal/CacheAdmission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAkE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,KAAmF,EACtE,EAAE;IACf,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC5E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACzF,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACpG,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;IAC5G,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;AACvD,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAqB,IAAmB,EAAkC,EAAE;IACnG,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;gBAClE,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,sBAAsB;SAC3B,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;IAC9B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IAClF,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACrF,IAAI,QAAQ,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtG,IAAI,QAAQ,CAAC,qBAAqB,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;IAC5G,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,QAAqB,EACrB,IAAmB,EACnB,WAAoB,EACY,EAAE;IAClC,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;IAC3E,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IACrF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;IAC1G,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;AAC1D,CAAC,CAAA","sourcesContent":["/**\n * Pure, phase-specific cache evidence admission. Storage decoding, current-read\n * measurement, TTL history, output replay and publication I/O stay with their owners.\n * @since 1.0.0-rc.0\n */\n\nimport type { Action } from \"@smthrs/flow\"\nimport type { FileBoundary } from \"@smthrs/flow/FileBoundary\"\nimport * as FileSet from \"@smthrs/plan/FileSet\"\nimport type * as StepBoundary from \"../StepBoundary.ts\"\n\n/** Reasons an existing declaration cannot name reusable results.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type DisabledReason = \"unsealed\" | \"missing-boundary\" | \"expected-boundary\" | \"unresolved-read-glob\"\n\n/** Declaration eligibility is separate from proof that a result may be reused.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Declaration =\n  | { readonly _tag: \"Eligible\"; readonly metadata: FileBoundary }\n  | { readonly _tag: \"Disabled\"; readonly reason: DisabledReason }\n\n/** The proof-bearing part of already-decoded attempt metadata.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Metadata {\n  readonly tier: Action.Tier\n  readonly boundary?: StepBoundary.BoundaryEvidence | undefined\n  readonly readSetVerified?: true | undefined\n  readonly boundaryQuarantined?: true | undefined\n}\n\n/** A refusal is not a failure of an already durable action outcome.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Refused {\n  readonly _tag: \"Refused\"\n  readonly reason:\n    | DisabledReason\n    | \"invalid-meta\"\n    | \"unsealed-meta\"\n    | \"missing-evidence\"\n    | \"deviation\"\n    | \"unverified-writes\"\n    | \"unverified-hermetic-reads\"\n    | \"unverified-recorded-reads\"\n    | \"quarantined-evidence\"\n    | \"contradictory-evidence\"\n}\n\n/** Necessary historical evidence, not yet a hit: current reads and outputs still need verification.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface CandidateEvidence<M extends Metadata> {\n  readonly _tag: \"CandidateEvidence\"\n  readonly meta: M\n  readonly evidence: StepBoundary.BoundaryEvidence\n}\n\n/** Shared gate for fresh completion and durable-completion convergence.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface PublishCompletion<M extends Metadata> {\n  readonly _tag: \"PublishCompletion\"\n  readonly meta: M\n}\n\n/** Classifies existing declaration policy without changing keys or measuring the host.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const declaration = (\n  input: { readonly tier: Action.Tier; readonly metadata?: FileBoundary | undefined }\n): Declaration => {\n  if (input.tier !== \"sealed\") return { _tag: \"Disabled\", reason: \"unsealed\" }\n  if (input.metadata === undefined) return { _tag: \"Disabled\", reason: \"missing-boundary\" }\n  if (input.metadata.boundaryMode !== \"hard\") return { _tag: \"Disabled\", reason: \"expected-boundary\" }\n  if (input.metadata.readSet.some(FileSet.isGlob)) return { _tag: \"Disabled\", reason: \"unresolved-read-glob\" }\n  return { _tag: \"Eligible\", metadata: input.metadata }\n}\n\n/** Candidate reads are remeasured, so do not require a historical readSetVerified flag here.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const candidate = <M extends Metadata>(meta: M | undefined): CandidateEvidence<M> | Refused => {\n  if (meta === undefined) return { _tag: \"Refused\", reason: \"invalid-meta\" }\n  // Legacy flags never override quarantine. Retain the durable outcome and\n  // the original metadata, but refuse to promote contradictory proof to reuse.\n  if (meta.boundaryQuarantined === true) {\n    return {\n      _tag: \"Refused\",\n      reason: meta.boundary !== undefined || meta.readSetVerified === true\n        ? \"contradictory-evidence\"\n        : \"quarantined-evidence\"\n    }\n  }\n  if (meta.readSetVerified === true && meta.boundary === undefined) {\n    return { _tag: \"Refused\", reason: \"contradictory-evidence\" }\n  }\n  if (meta.tier !== \"sealed\") return { _tag: \"Refused\", reason: \"unsealed-meta\" }\n  const evidence = meta.boundary\n  if (evidence === undefined) return { _tag: \"Refused\", reason: \"missing-evidence\" }\n  if (evidence.deviation !== undefined) return { _tag: \"Refused\", reason: \"deviation\" }\n  if (evidence.wholeTreeWritesVerified !== true) return { _tag: \"Refused\", reason: \"unverified-writes\" }\n  if (evidence.hermeticReadsVerified !== true) return { _tag: \"Refused\", reason: \"unverified-hermetic-reads\" }\n  return { _tag: \"CandidateEvidence\", meta, evidence }\n}\n\n/** Publication additionally requires the read proof associated with the completed body.\n * Both stored quarantine and the caller's current integrity verdict forbid publication.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const completion = <M extends Metadata>(\n  declared: Declaration,\n  meta: M | undefined,\n  quarantined: boolean\n): PublishCompletion<M> | Refused => {\n  if (quarantined) return { _tag: \"Refused\", reason: \"quarantined-evidence\" }\n  if (declared._tag === \"Disabled\") return { _tag: \"Refused\", reason: declared.reason }\n  const checked = candidate(meta)\n  if (checked._tag === \"Refused\") return checked\n  if (checked.meta.readSetVerified !== true) return { _tag: \"Refused\", reason: \"unverified-recorded-reads\" }\n  return { _tag: \"PublishCompletion\", meta: checked.meta }\n}\n"]}

package/dist/esm/internal/CacheAgeHistory.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Read-only validation of copied cache-age decisions. Producer identities and
+ * persisted payloads remain unchanged; ancestry alone is not a reuse proof.
+ * @since 1.0.0-rc.0
+ */
+import type { Journal, JournalEvent } from "@smthrs/journal";
+import type { RunStore } from "@smthrs/run-store";
+import * as Effect from "effect/Effect";
+/**
+ * Paged journal lookup shared with copied-record validation.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export { find } from "./CopiedRecord.ts";
+/** A copied verdict is usable only through an exact, retained fork prefix.
+ * Missing/compacted ancestry and malformed or unrelated history fail closed.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export declare const copiedVerdict: (options: {
+    readonly journal: Journal.Service;
+    readonly runs: RunStore.Service;
+    readonly runId: string;
+    readonly decision: JournalEvent.Input;
+    readonly conflict: Journal.JournalError;
+}) => Effect.Effect<"admitted" | "expired", Journal.JournalError>;
+//# sourceMappingURL=CacheAgeHistory.d.ts.map

package/dist/esm/internal/CacheAgeHistory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAgeHistory.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheAgeHistory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAWxC;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAA;CACxC,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,EAAE,OAAO,CAAC,YAAY,CAkB1D,CAAA"}

package/dist/esm/internal/CacheAgeHistory.js

@@ -0,0 +1,49 @@
+/**
+ * Read-only validation of copied cache-age decisions. Producer identities and
+ * persisted payloads remain unchanged; ancestry alone is not a reuse proof.
+ * @since 1.0.0-rc.0
+ */
+import { FlowEngine } from "@smthrs/engine";
+import * as Effect from "effect/Effect";
+import { find, prove } from "./CopiedRecord.js";
+/**
+ * Paged journal lookup shared with copied-record validation.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export { find } from "./CopiedRecord.js";
+const fieldsEqual = (value, expected) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    if (typeof expected !== "object" || expected === null || Array.isArray(expected))
+        return false;
+    const record = value;
+    const keys = Object.keys(expected);
+    return Object.keys(record).length === keys.length &&
+        keys.every((key) => record[key] === expected[key]);
+};
+/** A copied verdict is usable only through an exact, retained fork prefix.
+ * Missing/compacted ancestry and malformed or unrelated history fail closed.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export const copiedVerdict = (options) => Effect.gen(function* () {
+    const { journal, conflict, decision } = options;
+    const source = (entry) => entry.sourceId === decision.sourceId && entry.sourceSeq === decision.sourceSeq;
+    const entry = yield* find(journal, options.runId, source);
+    if (entry === undefined)
+        return yield* Effect.fail(conflict);
+    const payload = entry.payload;
+    const verdict = payload?.verdict;
+    if (verdict !== "admitted" && verdict !== "expired")
+        return yield* Effect.fail(conflict);
+    const expected = { ...decision.payload, verdict };
+    if (entry.eventType !== decision.eventType || !fieldsEqual(entry.payload, expected)) {
+        return yield* Effect.fail(conflict);
+    }
+    const original = yield* prove({ ...options, entry, same: fieldsEqual });
+    return fieldsEqual(original.record.meta, { lineageId: FlowEngine.Lineage.root(original.ancestor) })
+        ? verdict
+        : yield* Effect.fail(conflict);
+});
+//# sourceMappingURL=CacheAgeHistory.js.map

package/dist/esm/internal/CacheAgeHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAgeHistory.js","sourceRoot":"","sources":["../../../src/internal/CacheAgeHistory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE/C;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAExC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,QAAiB,EAAW,EAAE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9F,MAAM,MAAM,GAAG,KAA0C,CAAA;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC/C,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAM,QAA8C,CAAC,GAAG,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAM7B,EAA+D,EAAE,CAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC/C,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAE,EAAE,CAC3C,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAA;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAgD,CAAA;IACtE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAA;IAChC,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxF,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,OAA4C,EAAE,OAAO,EAAE,CAAA;IACtF,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IACvE,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAClC,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Read-only validation of copied cache-age decisions. Producer identities and\n * persisted payloads remain unchanged; ancestry alone is not a reuse proof.\n * @since 1.0.0-rc.0\n */\n\nimport { FlowEngine } from \"@smthrs/engine\"\nimport type { Journal, JournalEvent } from \"@smthrs/journal\"\nimport type { RunStore } from \"@smthrs/run-store\"\nimport * as Effect from \"effect/Effect\"\nimport { find, prove } from \"./CopiedRecord.ts\"\n\n/**\n * Paged journal lookup shared with copied-record validation.\n * @category accessors\n * @since 1.0.0-rc.0\n */\nexport { find } from \"./CopiedRecord.ts\"\n\nconst fieldsEqual = (value: unknown, expected: unknown): boolean => {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false\n  if (typeof expected !== \"object\" || expected === null || Array.isArray(expected)) return false\n  const record = value as Readonly<Record<string, unknown>>\n  const keys = Object.keys(expected)\n  return Object.keys(record).length === keys.length &&\n    keys.every((key) => record[key] === (expected as Readonly<Record<string, unknown>>)[key])\n}\n\n/** A copied verdict is usable only through an exact, retained fork prefix.\n * Missing/compacted ancestry and malformed or unrelated history fail closed.\n * @category accessors\n * @since 1.0.0-rc.0\n */\nexport const copiedVerdict = (options: {\n  readonly journal: Journal.Service\n  readonly runs: RunStore.Service\n  readonly runId: string\n  readonly decision: JournalEvent.Input\n  readonly conflict: Journal.JournalError\n}): Effect.Effect<\"admitted\" | \"expired\", Journal.JournalError> =>\n  Effect.gen(function*() {\n    const { journal, conflict, decision } = options\n    const source = (entry: JournalEvent.Entry) =>\n      entry.sourceId === decision.sourceId && entry.sourceSeq === decision.sourceSeq\n    const entry = yield* find(journal, options.runId, source)\n    if (entry === undefined) return yield* Effect.fail(conflict)\n    const payload = entry.payload as { readonly verdict?: unknown } | null\n    const verdict = payload?.verdict\n    if (verdict !== \"admitted\" && verdict !== \"expired\") return yield* Effect.fail(conflict)\n    const expected = { ...decision.payload as Readonly<Record<string, unknown>>, verdict }\n    if (entry.eventType !== decision.eventType || !fieldsEqual(entry.payload, expected)) {\n      return yield* Effect.fail(conflict)\n    }\n    const original = yield* prove({ ...options, entry, same: fieldsEqual })\n    return fieldsEqual(original.record.meta, { lineageId: FlowEngine.Lineage.root(original.ancestor) })\n      ? verdict\n      : yield* Effect.fail(conflict)\n  })\n"]}

package/dist/esm/internal/CacheAgeVerdicts.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Incremental evidence for the no-TTL cache guard.
+ * @since 1.0.0-rc.0
+ */
+import { Journal, JournalEvent } from "@smthrs/journal";
+import * as Effect from "effect/Effect";
+/**
+ * Per-executor index of TTL markers in an append-only journal generation.
+ * Refresh before answering, retaining the first record for either its producer
+ * key or payload key so malformed and copied verdicts still refuse removal.
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const make: (runId: string) => (journal: Journal.Service, keyDigest: string) => Effect.Effect<JournalEvent.Entry | undefined, Journal.JournalError>;
+//# sourceMappingURL=CacheAgeVerdicts.d.ts.map

package/dist/esm/internal/CacheAgeVerdicts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAgeVerdicts.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheAgeVerdicts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,MAAM,MAQ9B,SAAS,OAAO,CAAC,OAAO,EACxB,WAAW,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,GAAG,SAAS,EAAE,OAAO,CAAC,YAAY,CAkCtE,CAAA"}

package/dist/esm/internal/CacheAgeVerdicts.js

@@ -0,0 +1,54 @@
+/**
+ * Incremental evidence for the no-TTL cache guard.
+ * @since 1.0.0-rc.0
+ */
+import { Journal, JournalEvent } from "@smthrs/journal";
+import * as Effect from "effect/Effect";
+import * as Semaphore from "effect/Semaphore";
+/**
+ * Per-executor index of TTL markers in an append-only journal generation.
+ * Refresh before answering, retaining the first record for either its producer
+ * key or payload key so malformed and copied verdicts still refuse removal.
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export const make = (runId) => {
+    const gate = Semaphore.makeUnsafe(1);
+    const id = JournalEvent.RunId.make(runId);
+    let source;
+    let generation;
+    let after;
+    const verdicts = new Map();
+    return (journal, keyDigest) => Semaphore.withPermit(gate)(Effect.gen(function* () {
+        const currentGeneration = journal.generation === undefined ? 0 : (yield* journal.generation(id)).generation;
+        if (source !== journal || generation !== currentGeneration) {
+            source = journal;
+            generation = currentGeneration;
+            after = undefined;
+            verdicts.clear();
+        }
+        while (true) {
+            const page = yield* journal.entries({ runId: id, limit: 128, ...after === undefined ? {} : { after } });
+            const next = page.entries.at(-1)?.seq;
+            if ((page.hasMore && next === undefined) ||
+                (next !== undefined && after !== undefined && next <= after)) {
+                return yield* Effect.fail(new Journal.JournalError({ code: "read_failed", message: "cache history cursor did not advance" }));
+            }
+            for (const entry of page.entries) {
+                const producerKey = /^cache:([^:]+):ttl:/.exec(entry.sourceId)?.[1];
+                const payload = entry.payload;
+                if (producerKey !== undefined && !verdicts.has(producerKey))
+                    verdicts.set(producerKey, entry);
+                if (payload?.action === "ttl" && typeof payload.keyDigest === "string" && !verdicts.has(payload.keyDigest)) {
+                    verdicts.set(payload.keyDigest, entry);
+                }
+            }
+            // Publish each fully processed page, including the final one. A read
+            // failure or interruption retries only the unvalidated suffix.
+            after = next ?? after;
+            if (!page.hasMore)
+                return verdicts.get(keyDigest);
+        }
+    }));
+};
+//# sourceMappingURL=CacheAgeVerdicts.js.map

package/dist/esm/internal/CacheAgeVerdicts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheAgeVerdicts.js","sourceRoot":"","sources":["../../../src/internal/CacheAgeVerdicts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACpC,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzC,IAAI,MAAmC,CAAA;IACvC,IAAI,UAA8B,CAAA;IAClC,IAAI,KAAmC,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IACtD,OAAO,CACL,OAAwB,EACxB,SAAiB,EACoD,EAAE,CACvE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7C,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAA;QAC3G,IAAI,MAAM,KAAK,OAAO,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC3D,MAAM,GAAG,OAAO,CAAA;YAChB,UAAU,GAAG,iBAAiB,CAAA;YAC9B,KAAK,GAAG,SAAS,CAAA;YACjB,QAAQ,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;YACvG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;YACrC,IACE,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC;gBACpC,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,IAAI,KAAK,CAAC,EAC5D,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CACnG,CAAA;YACH,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACnE,MAAM,OAAO,GAAG,KAAK,CAAC,OAA2D,CAAA;gBACjF,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBAC7F,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC3G,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;gBACxC,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,+DAA+D;YAC/D,KAAK,GAAG,IAAI,IAAI,KAAK,CAAA;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAC,CAAA;AACP,CAAC,CAAA","sourcesContent":["/**\n * Incremental evidence for the no-TTL cache guard.\n * @since 1.0.0-rc.0\n */\n\nimport { Journal, JournalEvent } from \"@smthrs/journal\"\nimport * as Effect from \"effect/Effect\"\nimport * as Semaphore from \"effect/Semaphore\"\n\n/**\n * Per-executor index of TTL markers in an append-only journal generation.\n * Refresh before answering, retaining the first record for either its producer\n * key or payload key so malformed and copied verdicts still refuse removal.\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const make = (runId: string) => {\n  const gate = Semaphore.makeUnsafe(1)\n  const id = JournalEvent.RunId.make(runId)\n  let source: Journal.Service | undefined\n  let generation: number | undefined\n  let after: JournalEvent.Seq | undefined\n  const verdicts = new Map<string, JournalEvent.Entry>()\n  return (\n    journal: Journal.Service,\n    keyDigest: string\n  ): Effect.Effect<JournalEvent.Entry | undefined, Journal.JournalError> =>\n    Semaphore.withPermit(gate)(Effect.gen(function*() {\n      const currentGeneration = journal.generation === undefined ? 0 : (yield* journal.generation(id)).generation\n      if (source !== journal || generation !== currentGeneration) {\n        source = journal\n        generation = currentGeneration\n        after = undefined\n        verdicts.clear()\n      }\n      while (true) {\n        const page = yield* journal.entries({ runId: id, limit: 128, ...after === undefined ? {} : { after } })\n        const next = page.entries.at(-1)?.seq\n        if (\n          (page.hasMore && next === undefined) ||\n          (next !== undefined && after !== undefined && next <= after)\n        ) {\n          return yield* Effect.fail(\n            new Journal.JournalError({ code: \"read_failed\", message: \"cache history cursor did not advance\" })\n          )\n        }\n        for (const entry of page.entries) {\n          const producerKey = /^cache:([^:]+):ttl:/.exec(entry.sourceId)?.[1]\n          const payload = entry.payload as { action?: unknown; keyDigest?: unknown } | null\n          if (producerKey !== undefined && !verdicts.has(producerKey)) verdicts.set(producerKey, entry)\n          if (payload?.action === \"ttl\" && typeof payload.keyDigest === \"string\" && !verdicts.has(payload.keyDigest)) {\n            verdicts.set(payload.keyDigest, entry)\n          }\n        }\n        // Publish each fully processed page, including the final one. A read\n        // failure or interruption retries only the unvalidated suffix.\n        after = next ?? after\n        if (!page.hasMore) return verdicts.get(keyDigest)\n      }\n    }))\n}\n"]}

package/dist/esm/internal/CacheOutputPolicy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Replay authority comes from the current descriptor, never the recorded paths.
+ * This preflight performs no host I/O; every path is checked before replay can prune.
+ * @since 1.0.0-rc.0
+ */
+import type { FileBoundary } from "@smthrs/flow/FileBoundary";
+import type * as StepBoundary from "../StepBoundary.ts";
+/** A typed refusal leaves both the evidence and the workspace intact.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Decision = {
+    readonly _tag: "ReplayOutputs";
+} | {
+    readonly _tag: "Refused";
+    readonly reason: "output-boundary-mismatch" | "unsupported-output-evidence";
+};
+/** Validate all recorded writes, removals and pruning roots before materialization.
+ * Unknown output formats cannot establish current filesystem authority.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export declare const replay: (descriptor: FileBoundary | undefined, evidence: StepBoundary.BoundaryEvidence) => Decision;
+//# sourceMappingURL=CacheOutputPolicy.d.ts.map

package/dist/esm/internal/CacheOutputPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheOutputPolicy.d.ts","sourceRoot":"","sources":["../../../src/internal/CacheOutputPolicy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAG7D,OAAO,KAAK,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAWvD;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,GAAG,6BAA6B,CAAA;CAAE,CAAA;AAE7G;;;;GAIG;AACH,eAAO,MAAM,MAAM,GACjB,YAAY,YAAY,GAAG,SAAS,EACpC,UAAU,YAAY,CAAC,gBAAgB,KACtC,QA4CF,CAAA"}

package/dist/esm/internal/CacheOutputPolicy.js

@@ -0,0 +1,73 @@
+/**
+ * Replay authority comes from the current descriptor, never the recorded paths.
+ * This preflight performs no host I/O; every path is checked before replay can prune.
+ * @since 1.0.0-rc.0
+ */
+import * as ArtifactStore from "@smthrs/artifacts/ArtifactStore";
+import * as FileSet from "@smthrs/plan/FileSet";
+import * as Schema from "effect/Schema";
+const Outputs = Schema.Struct({
+    outputs: Schema.Array(Schema.Struct({ path: Schema.String, digest: Schema.NullOr(ArtifactStore.Digest) })),
+    trees: Schema.optional(Schema.Array(Schema.Struct({ path: Schema.String, identity: Schema.String })))
+});
+// The existing abstract boundary protocol records its exact declared path set.
+// Validate that format separately; it does not claim a filesystem blob manifest.
+const DeclaredPaths = Schema.Struct({ paths: Schema.Array(FileSet.Entry) });
+const samePaths = Schema.toEquivalence(Schema.Array(FileSet.Entry));
+/** Validate all recorded writes, removals and pruning roots before materialization.
+ * Unknown output formats cannot establish current filesystem authority.
+ * @category classifiers
+ * @since 1.0.0-rc.0
+ */
+export const replay = (descriptor, evidence) => {
+    const mismatch = { _tag: "Refused", reason: "output-boundary-mismatch" };
+    if (descriptor === undefined)
+        return mismatch;
+    const decoded = Schema.decodeUnknownResult(Outputs)(evidence.declaredOutputs);
+    if (decoded._tag === "Failure") {
+        const paths = Schema.decodeUnknownResult(DeclaredPaths)(evidence.declaredOutputs);
+        // Malformed production evidence cannot downgrade itself to the abstract
+        // protocol by also supplying a matching path list.
+        if (paths._tag === "Failure" || Object.hasOwn(evidence.declaredOutputs, "outputs")) {
+            return { _tag: "Refused", reason: "unsupported-output-evidence" };
+        }
+        return (descriptor.removes ?? []).length === 0 && samePaths(paths.success.paths, descriptor.writeSet)
+            ? { _tag: "ReplayOutputs" }
+            : mismatch;
+    }
+    const { outputs, trees = [] } = decoded.success;
+    const paths = [...outputs.map((output) => output.path), ...trees.map((tree) => tree.path)];
+    // Use the exact coordinate spelling that replay passes to the filesystem.
+    if (paths.some((path) => !FileSet.workspaceRelative(path) || FileSet.canonical(path) !== path))
+        return mismatch;
+    if (new Set(outputs.map((output) => output.path)).size !== outputs.length)
+        return mismatch;
+    if (new Set(trees.map((tree) => tree.path)).size !== trees.length)
+        return mismatch;
+    const removes = descriptor.removes ?? [];
+    for (const output of outputs) {
+        if (output.digest === null) {
+            if (!removes.includes(output.path))
+                return mismatch;
+        }
+        else if (removes.includes(output.path) ||
+            !descriptor.writeSet.some((entry) => FileSet.overlaps(entry, output.path)))
+            return mismatch;
+    }
+    // A tree root authorizes pruning its entire subtree. A glob or a narrower
+    // tree is never sufficient authority for a recorded broader pruning root.
+    const declaredTrees = descriptor.writeSet.filter(FileSet.isTreeArtifact);
+    // A declared tree root is a directory, never a replayable file or deletion.
+    if (declaredTrees.some((entry) => outputs.some((output) => output.path === entry.path)))
+        return mismatch;
+    if (trees.some((tree) => !declaredTrees.some((entry) => entry.path === tree.path)))
+        return mismatch;
+    if (declaredTrees.some((entry) => !trees.some((tree) => tree.path === entry.path)))
+        return mismatch;
+    if (removes.some((path) => !outputs.some((output) => output.path === path && output.digest === null)))
+        return mismatch;
+    if (descriptor.writeSet.some((entry) => typeof entry === "string" && !outputs.some((output) => output.path === entry && output.digest !== null)))
+        return mismatch;
+    return { _tag: "ReplayOutputs" };
+};
+//# sourceMappingURL=CacheOutputPolicy.js.map

package/dist/esm/internal/CacheOutputPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheOutputPolicy.js","sourceRoot":"","sources":["../../../src/internal/CacheOutputPolicy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,aAAa,MAAM,iCAAiC,CAAA;AAEhE,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1G,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CACtG,CAAC,CAAA;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;AAUnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,UAAoC,EACpC,QAAuC,EAC7B,EAAE;IACZ,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAW,CAAA;IACjF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;IAC7E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QACjF,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAyB,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;QACnE,CAAC;QACD,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC;YACnG,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE;YAC3B,CAAC,CAAC,QAAQ,CAAA;IACd,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAA;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,0EAA0E;IAC1E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC/G,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAA;IAC1F,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAA;IAClF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,EAAE,CAAA;IACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAA;QACrD,CAAC;aAAM,IACL,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YAC7B,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO,QAAQ,CAAA;IACnB,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACxE,4EAA4E;IAC5E,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACxG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACtH,IACE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACjC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CACxG;QACD,OAAO,QAAQ,CAAA;IACjB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;AAClC,CAAC,CAAA","sourcesContent":["/**\n * Replay authority comes from the current descriptor, never the recorded paths.\n * This preflight performs no host I/O; every path is checked before replay can prune.\n * @since 1.0.0-rc.0\n */\n\nimport * as ArtifactStore from \"@smthrs/artifacts/ArtifactStore\"\nimport type { FileBoundary } from \"@smthrs/flow/FileBoundary\"\nimport * as FileSet from \"@smthrs/plan/FileSet\"\nimport * as Schema from \"effect/Schema\"\nimport type * as StepBoundary from \"../StepBoundary.ts\"\n\nconst Outputs = Schema.Struct({\n  outputs: Schema.Array(Schema.Struct({ path: Schema.String, digest: Schema.NullOr(ArtifactStore.Digest) })),\n  trees: Schema.optional(Schema.Array(Schema.Struct({ path: Schema.String, identity: Schema.String })))\n})\n// The existing abstract boundary protocol records its exact declared path set.\n// Validate that format separately; it does not claim a filesystem blob manifest.\nconst DeclaredPaths = Schema.Struct({ paths: Schema.Array(FileSet.Entry) })\nconst samePaths = Schema.toEquivalence(Schema.Array(FileSet.Entry))\n\n/** A typed refusal leaves both the evidence and the workspace intact.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Decision =\n  | { readonly _tag: \"ReplayOutputs\" }\n  | { readonly _tag: \"Refused\"; readonly reason: \"output-boundary-mismatch\" | \"unsupported-output-evidence\" }\n\n/** Validate all recorded writes, removals and pruning roots before materialization.\n * Unknown output formats cannot establish current filesystem authority.\n * @category classifiers\n * @since 1.0.0-rc.0\n */\nexport const replay = (\n  descriptor: FileBoundary | undefined,\n  evidence: StepBoundary.BoundaryEvidence\n): Decision => {\n  const mismatch = { _tag: \"Refused\", reason: \"output-boundary-mismatch\" } as const\n  if (descriptor === undefined) return mismatch\n  const decoded = Schema.decodeUnknownResult(Outputs)(evidence.declaredOutputs)\n  if (decoded._tag === \"Failure\") {\n    const paths = Schema.decodeUnknownResult(DeclaredPaths)(evidence.declaredOutputs)\n    // Malformed production evidence cannot downgrade itself to the abstract\n    // protocol by also supplying a matching path list.\n    if (paths._tag === \"Failure\" || Object.hasOwn(evidence.declaredOutputs as object, \"outputs\")) {\n      return { _tag: \"Refused\", reason: \"unsupported-output-evidence\" }\n    }\n    return (descriptor.removes ?? []).length === 0 && samePaths(paths.success.paths, descriptor.writeSet)\n      ? { _tag: \"ReplayOutputs\" }\n      : mismatch\n  }\n  const { outputs, trees = [] } = decoded.success\n  const paths = [...outputs.map((output) => output.path), ...trees.map((tree) => tree.path)]\n  // Use the exact coordinate spelling that replay passes to the filesystem.\n  if (paths.some((path) => !FileSet.workspaceRelative(path) || FileSet.canonical(path) !== path)) return mismatch\n  if (new Set(outputs.map((output) => output.path)).size !== outputs.length) return mismatch\n  if (new Set(trees.map((tree) => tree.path)).size !== trees.length) return mismatch\n  const removes = descriptor.removes ?? []\n  for (const output of outputs) {\n    if (output.digest === null) {\n      if (!removes.includes(output.path)) return mismatch\n    } else if (\n      removes.includes(output.path) ||\n      !descriptor.writeSet.some((entry) => FileSet.overlaps(entry, output.path))\n    ) return mismatch\n  }\n  // A tree root authorizes pruning its entire subtree. A glob or a narrower\n  // tree is never sufficient authority for a recorded broader pruning root.\n  const declaredTrees = descriptor.writeSet.filter(FileSet.isTreeArtifact)\n  // A declared tree root is a directory, never a replayable file or deletion.\n  if (declaredTrees.some((entry) => outputs.some((output) => output.path === entry.path))) return mismatch\n  if (trees.some((tree) => !declaredTrees.some((entry) => entry.path === tree.path))) return mismatch\n  if (declaredTrees.some((entry) => !trees.some((tree) => tree.path === entry.path))) return mismatch\n  if (removes.some((path) => !outputs.some((output) => output.path === path && output.digest === null))) return mismatch\n  if (\n    descriptor.writeSet.some((entry) =>\n      typeof entry === \"string\" && !outputs.some((output) => output.path === entry && output.digest !== null)\n    )\n  ) return mismatch\n  return { _tag: \"ReplayOutputs\" }\n}\n"]}