@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/internal/PlanInputs.js

@@ -0,0 +1,57 @@
+/**
+ * Cross-check stored or newly measured observations against a verified plan.
+ * @since 1.0.0
+ */
+import { FileSet } from "@smthrs/plan";
+import { Effect, Schema } from "effect";
+import * as PlanInputStore from "../PlanInputStore.js";
+/**
+ * Validates without publishing or mutating either the old pins or observations.
+ * @since 1.0.0
+ * @category validation
+ */
+export const validate = (snapshot, nodes, pinned, writerScopesBefore) => Effect.gen(function* () {
+    const corrupt = (message) => Effect.fail(new PlanInputStore.PlanInputError({ code: "corrupt_state", message }));
+    if (snapshot.nodes.length !== nodes.length)
+        return yield* corrupt("source observation node count changed");
+    const nextPins = new Map(pinned);
+    const newPins = new Set();
+    for (const pin of snapshot.pins) {
+        if (nextPins.has(pin.path))
+            return yield* corrupt("a later generation replaced an existing source pin");
+        nextPins.set(pin.path, pin.digest);
+        newPins.add(pin.path);
+    }
+    for (let index = 0; index < nodes.length; index++) {
+        const node = nodes[index];
+        const recorded = snapshot.nodes[index];
+        const reads = FileSet.expandReads(node.effects.reads);
+        const writerScopes = reads.length === 0 ? [] : writerScopesBefore(node);
+        if (recorded.id !== node.id || recorded.key !== node.key || recorded.reads.length !== reads.length) {
+            return yield* corrupt("source observation does not match its plan node");
+        }
+        for (let readIndex = 0; readIndex < reads.length; readIndex++) {
+            const expected = Schema.decodeUnknownSync(FileSet.ReadEntry)(reads[readIndex]);
+            const read = recorded.reads[readIndex];
+            if (JSON.stringify(read.entry) !== JSON.stringify(expected)) {
+                return yield* corrupt("source observation declaration changed");
+            }
+            if (typeof expected === "string") {
+                const source = !writerScopes.some((scope) => FileSet.overlaps(scope, expected));
+                if (read.sourcePaths.length !== (source ? 1 : 0)) {
+                    return yield* corrupt("source observation selects the wrong file version");
+                }
+            }
+            for (const path of read.sourcePaths) {
+                if (!nextPins.has(path) || writerScopes.some((scope) => FileSet.overlaps(scope, path))) {
+                    return yield* corrupt("source observation has a missing pin or preceding writer");
+                }
+                newPins.delete(path);
+            }
+        }
+    }
+    if (newPins.size > 0)
+        return yield* corrupt("source observation contains unreferenced pins");
+    return nextPins;
+});
+//# sourceMappingURL=PlanInputs.js.map

package/dist/esm/internal/PlanInputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanInputs.js","sourceRoot":"","sources":["../../../src/internal/PlanInputs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAa,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AAEtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,QAAiC,EACjC,KAAmC,EACnC,MAAmC,EACnC,kBAAyE,EACN,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAClC,MAAM,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACpF,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAA;IAC1G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAA;QACvG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAA;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAE,CAAA;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACrD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACvE,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACnG,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAA;QAC1E,CAAC;QACD,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,CAAA;YAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAE,CAAA;YACvC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAA;YACjE,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAC/E,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAA;gBAC5E,CAAC;YACH,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;oBACvF,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;gBACnF,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAA;IAC5F,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Cross-check stored or newly measured observations against a verified plan.\n * @since 1.0.0\n */\n\nimport { FileSet, type Plan } from \"@smthrs/plan\"\nimport { Effect, Schema } from \"effect\"\nimport * as PlanInputStore from \"../PlanInputStore.ts\"\n\n/**\n * Validates without publishing or mutating either the old pins or observations.\n * @since 1.0.0\n * @category validation\n */\nexport const validate = (\n  snapshot: PlanInputStore.Snapshot,\n  nodes: ReadonlyArray<Plan.PlanNode>,\n  pinned: ReadonlyMap<string, string>,\n  writerScopesBefore: (node: Plan.PlanNode) => ReadonlyArray<FileSet.Entry>\n): Effect.Effect<Map<string, string>, PlanInputStore.PlanInputError> =>\n  Effect.gen(function*() {\n    const corrupt = (message: string) =>\n      Effect.fail(new PlanInputStore.PlanInputError({ code: \"corrupt_state\", message }))\n    if (snapshot.nodes.length !== nodes.length) return yield* corrupt(\"source observation node count changed\")\n    const nextPins = new Map(pinned)\n    const newPins = new Set<string>()\n    for (const pin of snapshot.pins) {\n      if (nextPins.has(pin.path)) return yield* corrupt(\"a later generation replaced an existing source pin\")\n      nextPins.set(pin.path, pin.digest)\n      newPins.add(pin.path)\n    }\n    for (let index = 0; index < nodes.length; index++) {\n      const node = nodes[index]!\n      const recorded = snapshot.nodes[index]!\n      const reads = FileSet.expandReads(node.effects.reads)\n      const writerScopes = reads.length === 0 ? [] : writerScopesBefore(node)\n      if (recorded.id !== node.id || recorded.key !== node.key || recorded.reads.length !== reads.length) {\n        return yield* corrupt(\"source observation does not match its plan node\")\n      }\n      for (let readIndex = 0; readIndex < reads.length; readIndex++) {\n        const expected = Schema.decodeUnknownSync(FileSet.ReadEntry)(reads[readIndex]!)\n        const read = recorded.reads[readIndex]!\n        if (JSON.stringify(read.entry) !== JSON.stringify(expected)) {\n          return yield* corrupt(\"source observation declaration changed\")\n        }\n        if (typeof expected === \"string\") {\n          const source = !writerScopes.some((scope) => FileSet.overlaps(scope, expected))\n          if (read.sourcePaths.length !== (source ? 1 : 0)) {\n            return yield* corrupt(\"source observation selects the wrong file version\")\n          }\n        }\n        for (const path of read.sourcePaths) {\n          if (!nextPins.has(path) || writerScopes.some((scope) => FileSet.overlaps(scope, path))) {\n            return yield* corrupt(\"source observation has a missing pin or preceding writer\")\n          }\n          newPins.delete(path)\n        }\n      }\n    }\n    if (newPins.size > 0) return yield* corrupt(\"source observation contains unreferenced pins\")\n    return nextPins\n  })\n"]}

package/dist/esm/internal/PlanMerges.d.ts

@@ -0,0 +1,178 @@
+/** Durable merge recovery and generated identity, independent of dispatch.
+ * @since 1.0.0
+ */
+import { Plan } from "@smthrs/plan";
+import { Effect } from "effect";
+import * as PlanMergeStore from "../PlanMergeStore.ts";
+/** Chooses a free display ID; ownership comes from the durable decision, not this spelling.
+ * @since 1.0.0
+ * @category identity
+ */
+export declare const allocateId: (plan: Plan.Plan, nodeId: string) => string;
+/** The single declaration used both when appending and when recovering an extension.
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const draft: (node: Plan.PlanNode, mergeId: string, winners: ReadonlyArray<string>) => Plan.NodeDraft;
+/** Checks that an intent names a permissible stopped node and its actual conflict peers.
+ * @since 1.0.0
+ * @category validation
+ */
+export declare const validateIntent: (plan: Plan.Plan, intent: PlanMergeStore.Intent) => Effect.Effect<{
+    readonly id: string;
+    readonly kind: "step" | "agent" | "merge";
+    readonly key: string & import("effect/Brand").Brand<"@smthrs/keys/Key">;
+    readonly material: {
+        readonly kind: "sealed" | "compensable" | "irreversible";
+        readonly body: unknown;
+        readonly version: "flows/key-material/v2";
+        readonly layers: readonly string[];
+        readonly capabilities: readonly string[];
+        readonly inputs: readonly ({
+            readonly _tag: "Literal";
+            readonly value: unknown;
+        } | {
+            readonly _tag: "Ref";
+            readonly from: string;
+            readonly path: readonly string[];
+        } | {
+            readonly _tag: "Pending";
+            readonly from: string;
+        })[];
+        readonly effects?: unknown;
+        readonly nondeterministic?: true | undefined;
+        readonly placement?: unknown;
+    };
+    readonly effects: {
+        readonly boundaryMode: "expected" | "hard";
+        readonly reads: readonly (string | {
+            readonly _tag: "Glob";
+            readonly include: readonly [string, ...string[]];
+            readonly exclude?: readonly string[] | undefined;
+        } | {
+            readonly _tag: "Filegroup";
+            readonly name: string;
+            readonly entries: readonly (string | {
+                readonly _tag: "Glob";
+                readonly include: readonly [string, ...string[]];
+                readonly exclude?: readonly string[] | undefined;
+            })[];
+        })[];
+        readonly writes: readonly (string | {
+            readonly _tag: "Glob";
+            readonly include: readonly [string, ...string[]];
+            readonly exclude?: readonly string[] | undefined;
+        } | {
+            readonly _tag: "TreeArtifact";
+            readonly path: string;
+        } | {
+            readonly _tag: "Filegroup";
+            readonly name: string;
+            readonly entries: readonly (string | {
+                readonly _tag: "Glob";
+                readonly include: readonly [string, ...string[]];
+                readonly exclude?: readonly string[] | undefined;
+            } | {
+                readonly _tag: "TreeArtifact";
+                readonly path: string;
+            })[];
+        })[];
+        readonly removes?: readonly string[] | undefined;
+    };
+    readonly dependsOn: readonly string[];
+    readonly conflicts: readonly {
+        readonly with: string;
+        readonly paths: readonly string[];
+        readonly strategy: "serialize" | "lane" | "fail";
+        readonly runtime: "delay-rebase" | "stop-merge";
+    }[];
+    readonly strategy: "serialize" | "lane" | "fail";
+    readonly runtime: "delay-rebase" | "stop-merge";
+    readonly priority: number;
+    readonly generation: number;
+}, PlanMergeStore.PlanMergeError, never>;
+/** Recovers only recorded merge extensions, never unrelated/unapproved appended work.
+ * @since 1.0.0
+ * @category recovery
+ */
+export declare const recover: (candidate: Plan.Plan, decisions: ReadonlyArray<PlanMergeStore.Decision>) => Effect.Effect<{
+    readonly planId: string;
+    readonly flow: string;
+    readonly generation: number;
+    readonly baseDigest: string & import("effect/Brand").Brand<"@smthrs/keys/Key">;
+    readonly digest: string & import("effect/Brand").Brand<"@smthrs/keys/Key">;
+    readonly nodes: readonly {
+        readonly id: string;
+        readonly kind: "step" | "agent" | "merge";
+        readonly key: string & import("effect/Brand").Brand<"@smthrs/keys/Key">;
+        readonly material: {
+            readonly kind: "sealed" | "compensable" | "irreversible";
+            readonly body: unknown;
+            readonly version: "flows/key-material/v2";
+            readonly layers: readonly string[];
+            readonly capabilities: readonly string[];
+            readonly inputs: readonly ({
+                readonly _tag: "Literal";
+                readonly value: unknown;
+            } | {
+                readonly _tag: "Ref";
+                readonly from: string;
+                readonly path: readonly string[];
+            } | {
+                readonly _tag: "Pending";
+                readonly from: string;
+            })[];
+            readonly effects?: unknown;
+            readonly nondeterministic?: true | undefined;
+            readonly placement?: unknown;
+        };
+        readonly effects: {
+            readonly boundaryMode: "expected" | "hard";
+            readonly reads: readonly (string | {
+                readonly _tag: "Glob";
+                readonly include: readonly [string, ...string[]];
+                readonly exclude?: readonly string[] | undefined;
+            } | {
+                readonly _tag: "Filegroup";
+                readonly name: string;
+                readonly entries: readonly (string | {
+                    readonly _tag: "Glob";
+                    readonly include: readonly [string, ...string[]];
+                    readonly exclude?: readonly string[] | undefined;
+                })[];
+            })[];
+            readonly writes: readonly (string | {
+                readonly _tag: "Glob";
+                readonly include: readonly [string, ...string[]];
+                readonly exclude?: readonly string[] | undefined;
+            } | {
+                readonly _tag: "TreeArtifact";
+                readonly path: string;
+            } | {
+                readonly _tag: "Filegroup";
+                readonly name: string;
+                readonly entries: readonly (string | {
+                    readonly _tag: "Glob";
+                    readonly include: readonly [string, ...string[]];
+                    readonly exclude?: readonly string[] | undefined;
+                } | {
+                    readonly _tag: "TreeArtifact";
+                    readonly path: string;
+                })[];
+            })[];
+            readonly removes?: readonly string[] | undefined;
+        };
+        readonly dependsOn: readonly string[];
+        readonly conflicts: readonly {
+            readonly with: string;
+            readonly paths: readonly string[];
+            readonly strategy: "serialize" | "lane" | "fail";
+            readonly runtime: "delay-rebase" | "stop-merge";
+        }[];
+        readonly strategy: "serialize" | "lane" | "fail";
+        readonly runtime: "delay-rebase" | "stop-merge";
+        readonly priority: number;
+        readonly generation: number;
+    }[];
+}, PlanMergeStore.PlanMergeError, import("effect/Crypto").Crypto>;
+//# sourceMappingURL=PlanMerges.d.ts.map

package/dist/esm/internal/PlanMerges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanMerges.d.ts","sourceRoot":"","sources":["../../../src/internal/PlanMerges.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAe,IAAI,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AAQtD;;;GAGG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,MAAM,KAAG,MAM5D,CAAA;AACD;;;GAGG;AACH,eAAO,MAAM,KAAK,GAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,SAAS,aAAa,CAAC,MAAM,CAAC,KAAG,IAAI,CAAC,SAYhG,CAAA;AACF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,cAAc,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAWzE,CAAA;AACJ;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,WAAW,IAAI,CAAC,IAAI,EAAE,WAAW,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEA4D3F,CAAA"}

package/dist/esm/internal/PlanMerges.js

@@ -0,0 +1,113 @@
+/** Durable merge recovery and generated identity, independent of dispatch.
+ * @since 1.0.0
+ */
+import { KeyMaterial, Plan } from "@smthrs/plan";
+import { Effect } from "effect";
+import * as PlanMergeStore from "../PlanMergeStore.js";
+const invalid = (message, cause) => new PlanMergeStore.PlanMergeError({
+    code: "corrupt_state",
+    message,
+    ...(cause === undefined ? {} : { cause })
+});
+/** Chooses a free display ID; ownership comes from the durable decision, not this spelling.
+ * @since 1.0.0
+ * @category identity
+ */
+export const allocateId = (plan, nodeId) => {
+    const occupied = new Set(plan.nodes.map((node) => node.id));
+    const base = `${nodeId}+merge`;
+    let candidate = base;
+    for (let suffix = 1; occupied.has(candidate); suffix++)
+        candidate = `${base}#${suffix}`;
+    return candidate;
+};
+/** The single declaration used both when appending and when recovering an extension.
+ * @since 1.0.0
+ * @category constructors
+ */
+export const draft = (node, mergeId, winners) => ({
+    id: mergeId,
+    kind: "merge",
+    material: {
+        version: KeyMaterial.version,
+        kind: node.material.kind,
+        body: { merge: { stopped: node.id, winners } },
+        inputs: winners.map((id) => ({ _tag: "Pending", from: id })),
+        layers: [],
+        capabilities: []
+    },
+    effects: node.effects
+});
+/** Checks that an intent names a permissible stopped node and its actual conflict peers.
+ * @since 1.0.0
+ * @category validation
+ */
+export const validateIntent = (plan, intent) => Effect.gen(function* () {
+    const node = plan.nodes.find((candidate) => candidate.id === intent.nodeId);
+    if (node === undefined || node.key !== intent.nodeKey || node.material.kind === "irreversible" ||
+        (node.runtime !== "stop-merge" && !node.conflicts.some((conflict) => conflict.runtime === "stop-merge")) ||
+        intent.peers.some((id) => !node.conflicts.some((conflict) => conflict.with === id))) {
+        return yield* Effect.fail(invalid("merge intent does not match its approved stopped node"));
+    }
+    return node;
+});
+/** Recovers only recorded merge extensions, never unrelated/unapproved appended work.
+ * @since 1.0.0
+ * @category recovery
+ */
+export const recover = (candidate, decisions) => Effect.gen(function* () {
+    const byGeneration = new Map(decisions.flatMap((decision) => decision.completion === undefined ? [] : [[decision.completion.generation, decision]]));
+    let plan = candidate;
+    if (byGeneration.size > 0) {
+        // Rebuild each prefix once. Re-verifying every complete prefix separately
+        // would multiply the compiler's overlap work across a long merge history.
+        plan = yield* Plan.verify({
+            ...candidate,
+            generation: 0,
+            digest: candidate.baseDigest,
+            nodes: candidate.nodes.filter((node) => node.generation === 0)
+        })
+            .pipe(Effect.mapError((cause) => invalid("merge recovery has an invalid approved base", cause)));
+        const last = Math.max(candidate.generation, ...byGeneration.keys());
+        if (last > Plan.maximumPlanNodes)
+            return yield* Effect.fail(invalid("merge generation exceeds the plan limit"));
+        for (let generation = 1; generation <= last; generation++) {
+            const decision = byGeneration.get(generation);
+            let drafts;
+            if (decision?.completion !== undefined) {
+                const stopped = yield* validateIntent(plan, decision.intent);
+                if (decision.completion.parentDigest !== plan.digest) {
+                    return yield* Effect.fail(invalid("merge parent digest changed"));
+                }
+                drafts = [draft(stopped, decision.completion.mergeId, decision.completion.winners)];
+            }
+            else {
+                drafts = candidate.nodes.filter((node) => node.generation === generation).map((node) => ({
+                    id: node.id,
+                    kind: node.kind,
+                    material: node.material,
+                    effects: node.effects,
+                    priority: node.priority,
+                    conflictStrategy: node.strategy,
+                    runtimeStrategy: node.runtime
+                }));
+                if (drafts.length === 0) {
+                    return yield* Effect.fail(invalid("merge recovery requires the approved intervening plan generations"));
+                }
+            }
+            plan = yield* Plan.append(plan, drafts).pipe(Effect.mapError((cause) => invalid("stored merge extension cannot be reconstructed", cause)));
+            if (decision?.completion !== undefined &&
+                (plan.digest !== decision.completion.planDigest ||
+                    Plan.generationNodes(plan)[0].key !== decision.completion.mergeKey)) {
+                return yield* Effect.fail(invalid("merge decision does not identify its generated node"));
+            }
+            if (generation === candidate.generation && plan.digest !== candidate.digest) {
+                return yield* Effect.fail(invalid("merge decisions disagree with the supplied plan"));
+            }
+        }
+    }
+    for (const decision of decisions)
+        yield* validateIntent(plan, decision.intent);
+    return plan;
+});
+//# sourceMappingURL=PlanMerges.js.map

package/dist/esm/internal/PlanMerges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanMerges.js","sourceRoot":"","sources":["../../../src/internal/PlanMerges.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AAEtD,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,KAAe,EAAE,EAAE,CACnD,IAAI,cAAc,CAAC,cAAc,CAAC;IAChC,IAAI,EAAE,eAAe;IACrB,OAAO;IACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;CAC1C,CAAC,CAAA;AACJ;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAe,EAAE,MAAc,EAAU,EAAE;IACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,GAAG,MAAM,QAAQ,CAAA;IAC9B,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE;QAAE,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAA;IACvF,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AACD;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAE,OAAe,EAAE,OAA8B,EAAkB,EAAE,CAAC,CAAC;IAC9G,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE;QACR,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE;QAC9C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,EAAE,EAAE;QACV,YAAY,EAAE,EAAE;KACjB;IACD,OAAO,EAAE,IAAI,CAAC,OAAO;CACtB,CAAC,CAAA;AACF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAe,EAAE,MAA6B,EAAE,EAAE,CAC/E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3E,IACE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,cAAc;QAC1F,CAAC,IAAI,CAAC,OAAO,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC;QACxG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,EACnF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AACJ;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,SAAoB,EAAE,SAAiD,EAAE,EAAE,CACjG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7B,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC,CAC/F,CACF,CAAA;IACD,IAAI,IAAI,GAAG,SAAS,CAAA;IACpB,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YACxB,GAAG,SAAS;YACZ,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,SAAS,CAAC,UAAU;YAC5B,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC;SAC/D,CAAC;aACC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;QAClG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;QACnE,IAAI,IAAI,GAAG,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,CAAA;QAC/G,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,MAAqC,CAAA;YACzC,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAC5D,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAA;gBACnE,CAAC;gBACD,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;YACrF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACvF,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,gBAAgB,EAAE,IAAI,CAAC,QAAQ;oBAC/B,eAAe,EAAE,IAAI,CAAC,OAAO;iBAC9B,CAAC,CAAC,CAAA;gBACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,mEAAmE,CAAC,CAAC,CAAA;gBACzG,CAAC;YACH,CAAC;YACD,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC,CAC7F,CAAA;YACD,IACE,QAAQ,EAAE,UAAU,KAAK,SAAS;gBAClC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,UAAU;oBAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EACtE,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,CAAA;YAC3F,CAAC;YACD,IAAI,UAAU,KAAK,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;gBAC5E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9E,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA","sourcesContent":["/** Durable merge recovery and generated identity, independent of dispatch.\n * @since 1.0.0\n */\n\nimport { KeyMaterial, Plan } from \"@smthrs/plan\"\nimport { Effect } from \"effect\"\nimport * as PlanMergeStore from \"../PlanMergeStore.ts\"\n\nconst invalid = (message: string, cause?: unknown) =>\n  new PlanMergeStore.PlanMergeError({\n    code: \"corrupt_state\",\n    message,\n    ...(cause === undefined ? {} : { cause })\n  })\n/** Chooses a free display ID; ownership comes from the durable decision, not this spelling.\n * @since 1.0.0\n * @category identity\n */\nexport const allocateId = (plan: Plan.Plan, nodeId: string): string => {\n  const occupied = new Set(plan.nodes.map((node) => node.id))\n  const base = `${nodeId}+merge`\n  let candidate = base\n  for (let suffix = 1; occupied.has(candidate); suffix++) candidate = `${base}#${suffix}`\n  return candidate\n}\n/** The single declaration used both when appending and when recovering an extension.\n * @since 1.0.0\n * @category constructors\n */\nexport const draft = (node: Plan.PlanNode, mergeId: string, winners: ReadonlyArray<string>): Plan.NodeDraft => ({\n  id: mergeId,\n  kind: \"merge\",\n  material: {\n    version: KeyMaterial.version,\n    kind: node.material.kind,\n    body: { merge: { stopped: node.id, winners } },\n    inputs: winners.map((id) => ({ _tag: \"Pending\", from: id })),\n    layers: [],\n    capabilities: []\n  },\n  effects: node.effects\n})\n/** Checks that an intent names a permissible stopped node and its actual conflict peers.\n * @since 1.0.0\n * @category validation\n */\nexport const validateIntent = (plan: Plan.Plan, intent: PlanMergeStore.Intent) =>\n  Effect.gen(function*() {\n    const node = plan.nodes.find((candidate) => candidate.id === intent.nodeId)\n    if (\n      node === undefined || node.key !== intent.nodeKey || node.material.kind === \"irreversible\" ||\n      (node.runtime !== \"stop-merge\" && !node.conflicts.some((conflict) => conflict.runtime === \"stop-merge\")) ||\n      intent.peers.some((id) => !node.conflicts.some((conflict) => conflict.with === id))\n    ) {\n      return yield* Effect.fail(invalid(\"merge intent does not match its approved stopped node\"))\n    }\n    return node\n  })\n/** Recovers only recorded merge extensions, never unrelated/unapproved appended work.\n * @since 1.0.0\n * @category recovery\n */\nexport const recover = (candidate: Plan.Plan, decisions: ReadonlyArray<PlanMergeStore.Decision>) =>\n  Effect.gen(function*() {\n    const byGeneration = new Map(\n      decisions.flatMap((decision) =>\n        decision.completion === undefined ? [] : [[decision.completion.generation, decision] as const]\n      )\n    )\n    let plan = candidate\n    if (byGeneration.size > 0) {\n      // Rebuild each prefix once. Re-verifying every complete prefix separately\n      // would multiply the compiler's overlap work across a long merge history.\n      plan = yield* Plan.verify({\n        ...candidate,\n        generation: 0,\n        digest: candidate.baseDigest,\n        nodes: candidate.nodes.filter((node) => node.generation === 0)\n      })\n        .pipe(Effect.mapError((cause) => invalid(\"merge recovery has an invalid approved base\", cause)))\n      const last = Math.max(candidate.generation, ...byGeneration.keys())\n      if (last > Plan.maximumPlanNodes) return yield* Effect.fail(invalid(\"merge generation exceeds the plan limit\"))\n      for (let generation = 1; generation <= last; generation++) {\n        const decision = byGeneration.get(generation)\n        let drafts: ReadonlyArray<Plan.NodeDraft>\n        if (decision?.completion !== undefined) {\n          const stopped = yield* validateIntent(plan, decision.intent)\n          if (decision.completion.parentDigest !== plan.digest) {\n            return yield* Effect.fail(invalid(\"merge parent digest changed\"))\n          }\n          drafts = [draft(stopped, decision.completion.mergeId, decision.completion.winners)]\n        } else {\n          drafts = candidate.nodes.filter((node) => node.generation === generation).map((node) => ({\n            id: node.id,\n            kind: node.kind,\n            material: node.material,\n            effects: node.effects,\n            priority: node.priority,\n            conflictStrategy: node.strategy,\n            runtimeStrategy: node.runtime\n          }))\n          if (drafts.length === 0) {\n            return yield* Effect.fail(invalid(\"merge recovery requires the approved intervening plan generations\"))\n          }\n        }\n        plan = yield* Plan.append(plan, drafts).pipe(\n          Effect.mapError((cause) => invalid(\"stored merge extension cannot be reconstructed\", cause))\n        )\n        if (\n          decision?.completion !== undefined &&\n          (plan.digest !== decision.completion.planDigest ||\n            Plan.generationNodes(plan)[0]!.key !== decision.completion.mergeKey)\n        ) {\n          return yield* Effect.fail(invalid(\"merge decision does not identify its generated node\"))\n        }\n        if (generation === candidate.generation && plan.digest !== candidate.digest) {\n          return yield* Effect.fail(invalid(\"merge decisions disagree with the supplied plan\"))\n        }\n      }\n    }\n    for (const decision of decisions) yield* validateIntent(plan, decision.intent)\n    return plan\n  })\n"]}

package/dist/esm/internal/ProvenanceSlot.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Read-only validation of the cache-provenance record occupying a producer
+ * slot this run re-emits into.
+ *
+ * A provenance producer identity (`cache:<digest>:<action>[:<run>:<seq>]`,
+ * `sourceSeq` 0) names ONE fact about one cache row — this key expired, this
+ * row was served, this replay failed — so a re-emission after a resume or in
+ * a fork child records the same fact with fresh measurements (`ageMs`, the
+ * clock, a later `reason`) and collapses onto the row already there. That
+ * collapse is legitimate only while the occupying record IS that fact: the
+ * same event type, the same key, the same action, and the same recorded row
+ * when the record names one. Anything else in the slot is the conflict the
+ * journal reported.
+ * @since 1.0.0-rc.0
+ */
+import type { Journal, JournalEvent } from "@smthrs/journal";
+import * as Effect from "effect/Effect";
+/**
+ * Accepts the occupying record only when it states the same provenance fact
+ * as `record`; otherwise fails with `conflict`.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export declare const accept: (options: {
+    readonly journal: Journal.Service;
+    readonly runId: string;
+    readonly record: JournalEvent.Input;
+    readonly conflict: Journal.JournalError;
+}) => Effect.Effect<void, Journal.JournalError>;
+//# sourceMappingURL=ProvenanceSlot.d.ts.map

package/dist/esm/internal/ProvenanceSlot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProvenanceSlot.d.ts","sourceRoot":"","sources":["../../../src/internal/ProvenanceSlot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAQvC;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,SAAS;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAA;CACxC,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAexC,CAAA"}

package/dist/esm/internal/ProvenanceSlot.js

@@ -0,0 +1,39 @@
+/**
+ * Read-only validation of the cache-provenance record occupying a producer
+ * slot this run re-emits into.
+ *
+ * A provenance producer identity (`cache:<digest>:<action>[:<run>:<seq>]`,
+ * `sourceSeq` 0) names ONE fact about one cache row — this key expired, this
+ * row was served, this replay failed — so a re-emission after a resume or in
+ * a fork child records the same fact with fresh measurements (`ageMs`, the
+ * clock, a later `reason`) and collapses onto the row already there. That
+ * collapse is legitimate only while the occupying record IS that fact: the
+ * same event type, the same key, the same action, and the same recorded row
+ * when the record names one. Anything else in the slot is the conflict the
+ * journal reported.
+ * @since 1.0.0-rc.0
+ */
+import * as Effect from "effect/Effect";
+import * as CacheAgeHistory from "./CacheAgeHistory.js";
+const identity = ["keyDigest", "action", "recordedRunId", "recordedEventSeq"];
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * Accepts the occupying record only when it states the same provenance fact
+ * as `record`; otherwise fails with `conflict`.
+ * @category accessors
+ * @since 1.0.0-rc.0
+ */
+export const accept = (options) => Effect.gen(function* () {
+    const { conflict, journal, record } = options;
+    const sourceSeq = record.sourceSeq ?? 0;
+    const entry = yield* CacheAgeHistory.find(journal, options.runId, (candidate) => candidate.sourceId === record.sourceId && Number(candidate.sourceSeq) === Number(sourceSeq));
+    if (entry === undefined || entry.eventType !== record.eventType)
+        return yield* Effect.fail(conflict);
+    const attempted = record.payload;
+    const occupying = entry.payload;
+    if (!isRecord(attempted) || !isRecord(occupying))
+        return yield* Effect.fail(conflict);
+    const same = identity.every((field) => !(field in attempted) || attempted[field] === occupying[field]);
+    return same ? undefined : yield* Effect.fail(conflict);
+});
+//# sourceMappingURL=ProvenanceSlot.js.map

package/dist/esm/internal/ProvenanceSlot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProvenanceSlot.js","sourceRoot":"","sources":["../../../src/internal/ProvenanceSlot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AAEvD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,CAAU,CAAA;AAEtF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAA8C,EAAE,CAC9E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAKtB,EAA6C,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CACvC,OAAO,EACP,OAAO,CAAC,KAAK,EACb,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,CAC3G,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpG,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAA;IAChC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAA;IAC/B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACtG,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACxD,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Read-only validation of the cache-provenance record occupying a producer\n * slot this run re-emits into.\n *\n * A provenance producer identity (`cache:<digest>:<action>[:<run>:<seq>]`,\n * `sourceSeq` 0) names ONE fact about one cache row — this key expired, this\n * row was served, this replay failed — so a re-emission after a resume or in\n * a fork child records the same fact with fresh measurements (`ageMs`, the\n * clock, a later `reason`) and collapses onto the row already there. That\n * collapse is legitimate only while the occupying record IS that fact: the\n * same event type, the same key, the same action, and the same recorded row\n * when the record names one. Anything else in the slot is the conflict the\n * journal reported.\n * @since 1.0.0-rc.0\n */\n\nimport type { Journal, JournalEvent } from \"@smthrs/journal\"\nimport * as Effect from \"effect/Effect\"\nimport * as CacheAgeHistory from \"./CacheAgeHistory.ts\"\n\nconst identity = [\"keyDigest\", \"action\", \"recordedRunId\", \"recordedEventSeq\"] as const\n\nconst isRecord = (value: unknown): value is Readonly<Record<string, unknown>> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value)\n\n/**\n * Accepts the occupying record only when it states the same provenance fact\n * as `record`; otherwise fails with `conflict`.\n * @category accessors\n * @since 1.0.0-rc.0\n */\nexport const accept = (options: {\n  readonly journal: Journal.Service\n  readonly runId: string\n  readonly record: JournalEvent.Input\n  readonly conflict: Journal.JournalError\n}): Effect.Effect<void, Journal.JournalError> =>\n  Effect.gen(function*() {\n    const { conflict, journal, record } = options\n    const sourceSeq = record.sourceSeq ?? 0\n    const entry = yield* CacheAgeHistory.find(\n      journal,\n      options.runId,\n      (candidate) => candidate.sourceId === record.sourceId && Number(candidate.sourceSeq) === Number(sourceSeq)\n    )\n    if (entry === undefined || entry.eventType !== record.eventType) return yield* Effect.fail(conflict)\n    const attempted = record.payload\n    const occupying = entry.payload\n    if (!isRecord(attempted) || !isRecord(occupying)) return yield* Effect.fail(conflict)\n    const same = identity.every((field) => !(field in attempted) || attempted[field] === occupying[field])\n    return same ? undefined : yield* Effect.fail(conflict)\n  })\n"]}

package/dist/esm/internal/ResultEnvelope.d.ts

@@ -0,0 +1,88 @@
+/**
+ * A typed JSON settlement at the engine persistence boundary. The existing
+ * terminal fallback remains the encoder, so a rejected class cannot leave a
+ * run live. This module does not change existing result bytes or writers.
+ *
+ * @since 1.0.0
+ */
+import type { Flow } from "@smthrs/flow";
+import * as EngineEvent from "@smthrs/journal/EngineEvent";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+/**
+ * Encoded success or a classified failure.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export declare const ResultEnvelope: Schema.Union<readonly [Schema.TaggedStruct<"Success", {
+    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>, Schema.TaggedStruct<"Failure", {
+    readonly reason: Schema.Literals<readonly ["error", "defect", "interrupted", "encoding"]>;
+    readonly detail: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>]>;
+/**
+ * Encoded success or a classified failure.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export type ResultEnvelope = EngineEvent.ResultEnvelope;
+/**
+ * Validate untrusted encoded state without dropping contradictory fields.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export declare const decode: (input: unknown) => Effect.Effect<{
+    readonly _tag: "Success";
+    readonly value: Schema.Json;
+} | {
+    readonly _tag: "Failure";
+    readonly reason: "error" | "encoding" | "defect" | "interrupted";
+    readonly detail: Schema.Json;
+}, EngineEvent.EventError, never>;
+/**
+ * The encoded settlement and whether the existing encoder required terminal
+ * fallback. Encoded domain failure is still an Encoded settlement; callers
+ * read its exit, never infer domain success from this discriminant.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export declare const Settlement: Schema.Union<readonly [Schema.TaggedStruct<"Encoded", {
+    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>, Schema.TaggedStruct<"EncodingFailure", {
+    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    readonly note: Schema.String;
+}>]>;
+/**
+ * Encoded terminal settlement and its encoding-failure status.
+ *
+ * @category models
+ * @since 1.0.0
+ */
+export type Settlement = typeof Settlement.Type;
+/**
+ * Admit an encoded settlement without introducing an error channel on the
+ * terminal write path. A corrupt codec output becomes a terminal failure.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export declare const fromEncoded: (encoded: unknown, note?: string) => Effect.Effect<Settlement>;
+/**
+ * Wrap the established no-fail terminal encoder without changing its bytes.
+ *
+ * @category conversions
+ * @since 1.0.0
+ */
+export declare const encode: (flow: Flow.Any, result: Flow.Result<unknown, unknown>) => Effect.Effect<{
+    readonly _tag: "Encoded";
+    readonly value: Schema.Json;
+} | {
+    readonly _tag: "EncodingFailure";
+    readonly value: Schema.Json;
+    readonly note: string;
+}, never, never>;
+//# sourceMappingURL=ResultEnvelope.d.ts.map

package/dist/esm/internal/ResultEnvelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResultEnvelope.d.ts","sourceRoot":"","sources":["../../../src/internal/ResultEnvelope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,6BAA6B,CAAA;AAE1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;IAA6B,CAAA;AACxD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,CAAA;AACvD;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO;;;;;;;iCAWlC,CAAA;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU;;;;;IAGrB,CAAA;AACF;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAA;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,OAAO,EAAE,OAAO,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CA+BnF,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;;;;;;;gBAGzE,CAAA"}

package/dist/esm/internal/ResultEnvelope.js

@@ -0,0 +1,83 @@
+/**
+ * A typed JSON settlement at the engine persistence boundary. The existing
+ * terminal fallback remains the encoder, so a rejected class cannot leave a
+ * run live. This module does not change existing result bytes or writers.
+ *
+ * @since 1.0.0
+ */
+import * as EngineEvent from "@smthrs/journal/EngineEvent";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as ExitEncoding from "./ExitEncoding.js";
+/**
+ * Encoded success or a classified failure.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const ResultEnvelope = EngineEvent.ResultEnvelope;
+/**
+ * Validate untrusted encoded state without dropping contradictory fields.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const decode = (input) => Effect.suspend(() => Schema.decodeUnknownEffect(ResultEnvelope, { onExcessProperty: "error" })(input)).pipe(Effect.catchCause((cause) => Effect.fail(new EngineEvent.EventError({
+    code: "malformed",
+    message: "invalid result envelope",
+    cause: Cause.squash(cause)
+}))));
+/**
+ * The encoded settlement and whether the existing encoder required terminal
+ * fallback. Encoded domain failure is still an Encoded settlement; callers
+ * read its exit, never infer domain success from this discriminant.
+ *
+ * @category schemas
+ * @since 1.0.0
+ */
+export const Settlement = Schema.Union([
+    Schema.TaggedStruct("Encoded", { value: Schema.Json }),
+    Schema.TaggedStruct("EncodingFailure", { value: Schema.Json, note: Schema.String })
+]);
+/**
+ * Admit an encoded settlement without introducing an error channel on the
+ * terminal write path. A corrupt codec output becomes a terminal failure.
+ *
+ * @category decoders
+ * @since 1.0.0
+ */
+export const fromEncoded = (encoded, note) => Effect.suspend(() => Schema.decodeUnknownEffect(Schema.Json)(encoded)).pipe(Effect.map((value) => note === undefined ? { _tag: "Encoded", value } : { _tag: "EncodingFailure", value, note }), Effect.catchCause((_cause) => {
+    const note = "the encoded settlement was not JSON";
+    // This is the same terminal-only policy as ExitEncoding.encode: record
+    // a failed settlement even when pure codec validation defects. No I/O
+    // or authority decision is retried by recovering this validation cause.
+    return Effect.as(Effect.logWarning(`${note}; preserving a terminal failure`), {
+        _tag: "EncodingFailure",
+        note,
+        value: {
+            _tag: "Complete",
+            exit: {
+                _tag: "Failure",
+                cause: [{
+                        _tag: "Die",
+                        defect: {
+                            _tag: ExitEncoding.projectionTag,
+                            result: "Complete",
+                            note,
+                            reasons: [],
+                            value: null
+                        }
+                    }]
+            }
+        }
+    });
+}));
+/**
+ * Wrap the established no-fail terminal encoder without changing its bytes.
+ *
+ * @category conversions
+ * @since 1.0.0
+ */
+export const encode = (flow, result) => ExitEncoding.encode(flow, result).pipe(Effect.flatMap(({ encoded, note }) => fromEncoded(encoded, note)));
+//# sourceMappingURL=ResultEnvelope.js.map