@smthrs/triggers 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/CatchUp.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Pure catch-up policy decisions.
+ *
+ * @since 0.1.0
+ */
+import * as Effect from "effect/Effect";
+import type { Cron } from "./Cron.ts";
+import type { CatchUp as Policy } from "./Schedule.ts";
+import { TriggerError } from "./TriggerError.ts";
+/**
+ * The occurrences a trigger owes since it last fired, bounded by
+ * `maxCatchUp` and by the policy named in `Schedule.CatchUp`: `none` owes
+ * nothing, `one` owes only the most recent, and `all` owes every missed tick.
+ *
+ * Every policy answers to `maxCatchUp`, `one` included: a bound of zero says
+ * no occurrence may be caught up, so a missed occurrence under `one` is
+ * `catch_up_bound_exceeded` exactly as three missed occurrences under `all`
+ * are. The bound is validated before any policy branch, so an unusable bound
+ * is refused even where the policy owes nothing.
+ *
+ * @category computation
+ * @since 0.1.0
+ */
+export declare const occurrences: (policy: Policy, maxCatchUp: number, lastFiredAt: Date | undefined, now: Date, cron: Cron) => Effect.Effect<ReadonlyArray<Date>, TriggerError>;
+//# sourceMappingURL=CatchUp.d.ts.map

package/dist/esm/CatchUp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CatchUp.d.ts","sourceRoot":"","sources":["../../src/CatchUp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC,OAAO,KAAK,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,GACtB,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,aAAa,IAAI,GAAG,SAAS,EAC7B,KAAK,IAAI,EACT,MAAM,IAAI,KACT,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,YAAY,CAwCjD,CAAA"}

package/dist/esm/CatchUp.js

@@ -0,0 +1,52 @@
+/**
+ * Pure catch-up policy decisions.
+ *
+ * @since 0.1.0
+ */
+import * as Effect from "effect/Effect";
+import * as CronSchedule from "./Cron.js";
+import { TriggerError } from "./TriggerError.js";
+/**
+ * The occurrences a trigger owes since it last fired, bounded by
+ * `maxCatchUp` and by the policy named in `Schedule.CatchUp`: `none` owes
+ * nothing, `one` owes only the most recent, and `all` owes every missed tick.
+ *
+ * Every policy answers to `maxCatchUp`, `one` included: a bound of zero says
+ * no occurrence may be caught up, so a missed occurrence under `one` is
+ * `catch_up_bound_exceeded` exactly as three missed occurrences under `all`
+ * are. The bound is validated before any policy branch, so an unusable bound
+ * is refused even where the policy owes nothing.
+ *
+ * @category computation
+ * @since 0.1.0
+ */
+export const occurrences = (policy, maxCatchUp, lastFiredAt, now, cron) => {
+    if (!Number.isSafeInteger(maxCatchUp) || maxCatchUp < 0) {
+        return Effect.fail(new TriggerError({
+            code: "catch_up_bound_exceeded",
+            message: `maxCatchUp must be a non-negative safe integer, received ${maxCatchUp}`,
+            path: "maxCatchUp"
+        }));
+    }
+    if (lastFiredAt === undefined)
+        return Effect.succeed([]);
+    if (policy === "none")
+        return Effect.succeed([]);
+    if (policy === "one") {
+        return CronSchedule.previousAtOrBefore(cron, now).pipe(Effect.flatMap((latest) => latest.getTime() <= lastFiredAt.getTime()
+            ? Effect.succeed([])
+            : maxCatchUp < 1
+                ? Effect.fail(new TriggerError({
+                    code: "catch_up_bound_exceeded",
+                    message: `missed 1 occurrence; maxCatchUp is ${maxCatchUp}`
+                }))
+                : Effect.succeed([latest])));
+    }
+    return CronSchedule.occurrencesBetween(cron, lastFiredAt, now, maxCatchUp + 1).pipe(Effect.flatMap((missed) => missed.length > maxCatchUp
+        ? Effect.fail(new TriggerError({
+            code: "catch_up_bound_exceeded",
+            message: `missed ${missed.length} occurrences; maxCatchUp is ${maxCatchUp}`
+        }))
+        : Effect.succeed(missed)));
+};
+//# sourceMappingURL=CatchUp.js.map

package/dist/esm/CatchUp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CatchUp.js","sourceRoot":"","sources":["../../src/CatchUp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,YAAY,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,MAAc,EACd,UAAkB,EAClB,WAA6B,EAC7B,GAAS,EACT,IAAU,EACwC,EAAE;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,YAAY,CAAC;YACf,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,4DAA4D,UAAU,EAAE;YACjF,IAAI,EAAE,YAAY;SACnB,CAAC,CACH,CAAA;IACH,CAAC;IACD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,OAAO,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE;YACvC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAsB,EAAE,CAAC;YACzC,CAAC,CAAC,UAAU,GAAG,CAAC;gBAChB,CAAC,CAAC,MAAM,CAAC,IAAI,CACX,IAAI,YAAY,CAAC;oBACf,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,sCAAsC,UAAU,EAAE;iBAC5D,CAAC,CACH;gBACD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAsB,CAAC,MAAM,CAAC,CAAC,CAClD,CACF,CAAA;IACH,CAAC;IACD,OAAO,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,CACjF,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,MAAM,GAAG,UAAU;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CACX,IAAI,YAAY,CAAC;YACf,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,UAAU,MAAM,CAAC,MAAM,+BAA+B,UAAU,EAAE;SAC5E,CAAC,CACH;QACD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAC3B,CACF,CAAA;AACH,CAAC,CAAA","sourcesContent":["/**\n * Pure catch-up policy decisions.\n *\n * @since 0.1.0\n */\n\nimport * as Effect from \"effect/Effect\"\nimport type { Cron } from \"./Cron.ts\"\nimport * as CronSchedule from \"./Cron.ts\"\nimport type { CatchUp as Policy } from \"./Schedule.ts\"\nimport { TriggerError } from \"./TriggerError.ts\"\n\n/**\n * The occurrences a trigger owes since it last fired, bounded by\n * `maxCatchUp` and by the policy named in `Schedule.CatchUp`: `none` owes\n * nothing, `one` owes only the most recent, and `all` owes every missed tick.\n *\n * Every policy answers to `maxCatchUp`, `one` included: a bound of zero says\n * no occurrence may be caught up, so a missed occurrence under `one` is\n * `catch_up_bound_exceeded` exactly as three missed occurrences under `all`\n * are. The bound is validated before any policy branch, so an unusable bound\n * is refused even where the policy owes nothing.\n *\n * @category computation\n * @since 0.1.0\n */\nexport const occurrences = (\n  policy: Policy,\n  maxCatchUp: number,\n  lastFiredAt: Date | undefined,\n  now: Date,\n  cron: Cron\n): Effect.Effect<ReadonlyArray<Date>, TriggerError> => {\n  if (!Number.isSafeInteger(maxCatchUp) || maxCatchUp < 0) {\n    return Effect.fail(\n      new TriggerError({\n        code: \"catch_up_bound_exceeded\",\n        message: `maxCatchUp must be a non-negative safe integer, received ${maxCatchUp}`,\n        path: \"maxCatchUp\"\n      })\n    )\n  }\n  if (lastFiredAt === undefined) return Effect.succeed([])\n  if (policy === \"none\") return Effect.succeed([])\n  if (policy === \"one\") {\n    return CronSchedule.previousAtOrBefore(cron, now).pipe(\n      Effect.flatMap((latest) =>\n        latest.getTime() <= lastFiredAt.getTime()\n          ? Effect.succeed<ReadonlyArray<Date>>([])\n          : maxCatchUp < 1\n          ? Effect.fail(\n            new TriggerError({\n              code: \"catch_up_bound_exceeded\",\n              message: `missed 1 occurrence; maxCatchUp is ${maxCatchUp}`\n            })\n          )\n          : Effect.succeed<ReadonlyArray<Date>>([latest])\n      )\n    )\n  }\n  return CronSchedule.occurrencesBetween(cron, lastFiredAt, now, maxCatchUp + 1).pipe(\n    Effect.flatMap((missed) =>\n      missed.length > maxCatchUp\n        ? Effect.fail(\n          new TriggerError({\n            code: \"catch_up_bound_exceeded\",\n            message: `missed ${missed.length} occurrences; maxCatchUp is ${maxCatchUp}`\n          })\n        )\n        : Effect.succeed(missed)\n    )\n  )\n}\n"]}

package/dist/esm/Channel.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Authority-free channel declarations.
+ *
+ * A channel authenticates opaque transport input, maps verified payloads to
+ * control-plane starts or signals, and may project run state outbound. It
+ * carries no execution authority: the target flow's envelope and permission
+ * checks apply unchanged.
+ *
+ * @see packages/smithers/agent/triggers/docs/api.md
+ * @since 0.1.0
+ */
+import type { IdempotencyKey } from "@smthrs/control/ControlSchema";
+import type { CredentialRef } from "@smthrs/control/Credential";
+import type * as Effect from "effect/Effect";
+import type * as Redacted from "effect/Redacted";
+import type * as Schema from "effect/Schema";
+import type { TriggerError } from "./TriggerError.ts";
+/**
+ * Opaque inbound transport data. Verification must inspect this value before
+ * any payload decoding occurs.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface RawInbound {
+    readonly body: Uint8Array;
+    readonly headers: Readonly<Record<string, string | undefined>>;
+    readonly idempotencyKey: IdempotencyKey;
+}
+/**
+ * A verified request that starts a flow.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Start {
+    readonly start: {
+        readonly flowId: string;
+        readonly input: unknown;
+    };
+}
+/**
+ * A verified request that resolves a waiting flow step.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Signal {
+    readonly signal: {
+        readonly runId: string;
+        readonly stepId: string;
+        readonly value: unknown;
+    };
+}
+/**
+ * The only operations an inbound channel may request.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type Inbound = Start | Signal;
+/**
+ * Authenticates raw request bytes and headers against a credential reference.
+ *
+ * The credential arrives as a redacted reference rather than a secret, and it
+ * arrives per request rather than at declaration time: a verifier resolves it
+ * through the host's resolver when it needs the bytes. Dropping this parameter
+ * left a verifier no way to reach a secret except by closing over it in plain
+ * memory at declaration time, which is the shape the reference exists to
+ * prevent. `packages/smithers/control/src/WebhookChannel.ts` states the same contract
+ * for the control-plane side of the boundary.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type Verify = (raw: RawInbound, credential: Redacted.Redacted<CredentialRef>) => Effect.Effect<void, TriggerError>;
+/**
+ * An authority-free bidirectional channel declaration.
+ *
+ * `inbound` only describes a control-plane start or signal. It cannot supply
+ * capabilities, grants, or an alternate execution envelope.
+ *
+ * @category declarations
+ * @since 0.1.0
+ */
+export interface Channel<Payload, Run = never, Outbound = never> {
+    readonly name: string;
+    readonly verify: Verify;
+    readonly inbound: (payload: Payload) => Inbound;
+    readonly outbound?: ((run: Run) => Outbound) | undefined;
+}
+/**
+ * Configuration for a schema-declared channel.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Config<Payload, Run = never, Outbound = never> extends Channel<Payload, Run, Outbound> {
+    readonly schema: Schema.Schema<Payload>;
+}
+/**
+ * Declares a channel without adding authority or execution behavior.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const make: <Payload, Run = never, Outbound = never>(config: Channel<Payload, Run, Outbound>) => Channel<Payload, Run, Outbound>;
+//# sourceMappingURL=Channel.d.ts.map

package/dist/esm/Channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Channel.d.ts","sourceRoot":"","sources":["../../src/Channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KACxB,CAAA;CACF;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KACxB,CAAA;CACF;AAED;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,MAAM,GAAG,CACnB,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;AAEtC;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,GAAG,SAAS,CAAA;CACzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAE,SAAQ,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC;IACrG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,EAAE,GAAG,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,EACzD,QAAQ,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,KACtC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAW,CAAA"}

package/dist/esm/Channel.js

@@ -0,0 +1,19 @@
+/**
+ * Authority-free channel declarations.
+ *
+ * A channel authenticates opaque transport input, maps verified payloads to
+ * control-plane starts or signals, and may project run state outbound. It
+ * carries no execution authority: the target flow's envelope and permission
+ * checks apply unchanged.
+ *
+ * @see packages/smithers/agent/triggers/docs/api.md
+ * @since 0.1.0
+ */
+/**
+ * Declares a channel without adding authority or execution behavior.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const make = (config) => config;
+//# sourceMappingURL=Channel.js.map

package/dist/esm/Channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Channel.js","sourceRoot":"","sources":["../../src/Channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAsGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAuC,EACN,EAAE,CAAC,MAAM,CAAA","sourcesContent":["/**\n * Authority-free channel declarations.\n *\n * A channel authenticates opaque transport input, maps verified payloads to\n * control-plane starts or signals, and may project run state outbound. It\n * carries no execution authority: the target flow's envelope and permission\n * checks apply unchanged.\n *\n * @see packages/smithers/agent/triggers/docs/api.md\n * @since 0.1.0\n */\n\nimport type { IdempotencyKey } from \"@smthrs/control/ControlSchema\"\nimport type { CredentialRef } from \"@smthrs/control/Credential\"\nimport type * as Effect from \"effect/Effect\"\nimport type * as Redacted from \"effect/Redacted\"\nimport type * as Schema from \"effect/Schema\"\nimport type { TriggerError } from \"./TriggerError.ts\"\n\n/**\n * Opaque inbound transport data. Verification must inspect this value before\n * any payload decoding occurs.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface RawInbound {\n  readonly body: Uint8Array\n  readonly headers: Readonly<Record<string, string | undefined>>\n  readonly idempotencyKey: IdempotencyKey\n}\n\n/**\n * A verified request that starts a flow.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Start {\n  readonly start: {\n    readonly flowId: string\n    readonly input: unknown\n  }\n}\n\n/**\n * A verified request that resolves a waiting flow step.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Signal {\n  readonly signal: {\n    readonly runId: string\n    readonly stepId: string\n    readonly value: unknown\n  }\n}\n\n/**\n * The only operations an inbound channel may request.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Inbound = Start | Signal\n\n/**\n * Authenticates raw request bytes and headers against a credential reference.\n *\n * The credential arrives as a redacted reference rather than a secret, and it\n * arrives per request rather than at declaration time: a verifier resolves it\n * through the host's resolver when it needs the bytes. Dropping this parameter\n * left a verifier no way to reach a secret except by closing over it in plain\n * memory at declaration time, which is the shape the reference exists to\n * prevent. `packages/smithers/control/src/WebhookChannel.ts` states the same contract\n * for the control-plane side of the boundary.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Verify = (\n  raw: RawInbound,\n  credential: Redacted.Redacted<CredentialRef>\n) => Effect.Effect<void, TriggerError>\n\n/**\n * An authority-free bidirectional channel declaration.\n *\n * `inbound` only describes a control-plane start or signal. It cannot supply\n * capabilities, grants, or an alternate execution envelope.\n *\n * @category declarations\n * @since 0.1.0\n */\nexport interface Channel<Payload, Run = never, Outbound = never> {\n  readonly name: string\n  readonly verify: Verify\n  readonly inbound: (payload: Payload) => Inbound\n  readonly outbound?: ((run: Run) => Outbound) | undefined\n}\n\n/**\n * Configuration for a schema-declared channel.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Config<Payload, Run = never, Outbound = never> extends Channel<Payload, Run, Outbound> {\n  readonly schema: Schema.Schema<Payload>\n}\n\n/**\n * Declares a channel without adding authority or execution behavior.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = <Payload, Run = never, Outbound = never>(\n  config: Channel<Payload, Run, Outbound>\n): Channel<Payload, Run, Outbound> => config\n"]}

package/dist/esm/ClaimDecision.d.ts

@@ -0,0 +1,183 @@
+/**
+ * The one claim decision both trigger stores apply.
+ *
+ * A claim is a pure function of the rows it reads: the trigger declaration,
+ * the fire row at the occurrence being claimed, and the fire row the active
+ * reservation holds. Each store gathers that snapshot in its own storage,
+ * calls {@link decide}, and applies the writes it answers. Writing the fences,
+ * the expired-reservation reclaim, and the supersede predecessor substitution
+ * once is what keeps `SqlTriggerStore` and the published in-memory store from
+ * drifting apart.
+ *
+ * @since 1.0.0-rc.0
+ */
+import type { Overlap as Policy } from "./Trigger.ts";
+import { TriggerError } from "./TriggerError.ts";
+import { type Claim, type ClaimFire, type Outcome } from "./TriggerStore.ts";
+/**
+ * A fire row as the decision reads it. `outcome` is `null` for a claimed but
+ * unsettled occurrence, matching the nullable column.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Fire {
+    readonly outcome: Outcome | null;
+    readonly runId?: string | undefined;
+}
+/**
+ * Everything the decision reads, gathered by the store before it runs.
+ *
+ * `existingFire` is absent when this claim is what created the row.
+ * `activeFire` is the row at `reservationOccurrence(activeRunId)`, read after
+ * that insert, and is needed only while `activeRunId` is a reservation.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Snapshot {
+    readonly revision: number;
+    readonly enabled: boolean;
+    readonly overlap: Policy;
+    readonly activeRunId?: string | undefined;
+    readonly activeClaimedAt?: number | undefined;
+    readonly pending?: number | undefined;
+    readonly existingFire?: Fire | undefined;
+    readonly activeFire?: Fire | undefined;
+}
+/**
+ * One durable edit a claim owes, in the order the store must apply them.
+ *
+ * `SetOutcome` with `whileOpen` may only settle a fire that is still `null` or
+ * `buffered`; the SQL store spells that as a `WHERE` clause.
+ * `ReleaseReservation` may only land while `expected` still owns the trigger.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Write = {
+    readonly _tag: "SetOutcome";
+    readonly occurrence: number;
+    readonly outcome: Outcome;
+    readonly whileOpen: boolean;
+} | {
+    readonly _tag: "SetRunId";
+    readonly occurrence: number;
+    readonly runId: string;
+} | {
+    readonly _tag: "ReleaseReservation";
+    readonly expected: string;
+    readonly activeRunId?: string | undefined;
+    readonly pending?: number | undefined;
+} | {
+    readonly _tag: "AdvanceCursor";
+    readonly occurrence: number;
+} | {
+    readonly _tag: "SetPending";
+    readonly occurrence: number;
+} | {
+    readonly _tag: "Reserve";
+    readonly reservationId: string;
+    readonly claimedAt: number;
+};
+/**
+ * What a claim decided: a refusal the store fails with, or a claim outcome and
+ * the writes that make it durable. An unclaimed occurrence answers
+ * `{ claimed: false }` with no writes.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Decision = {
+    readonly _tag: "Refused";
+    readonly error: TriggerError;
+} | {
+    readonly _tag: "Decided";
+    readonly claim: Claim;
+    readonly writes: ReadonlyArray<Write>;
+};
+/**
+ * The claim request, the rows it reads, the reservation id the store minted
+ * for it, and the store clock reading it was claimed at.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Input {
+    readonly fire: ClaimFire;
+    readonly snapshot: Snapshot;
+    readonly reservationId: string;
+    readonly claimedAt: number;
+}
+type AdmittedDecision = Extract<Decision, {
+    readonly _tag: "Decided";
+}>;
+/**
+ * What a reader finds behind a trigger's active owner: nothing, a live owner,
+ * or an expired reservation to release.
+ *
+ * `expected` is the reservation the release must still find in place.
+ * `recovered` is the launched predecessor the release hands back, and
+ * `pending` is the occurrence it re-arms; both are absent when the reservation
+ * covered no unsettled fire.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Lease = {
+    readonly _tag: "Idle";
+} | {
+    readonly _tag: "Held";
+    readonly runId: string;
+} | {
+    readonly _tag: "Expired";
+    readonly expected: string;
+    readonly recovered?: string | undefined;
+    readonly pending?: number | undefined;
+};
+/**
+ * Applies the reservation lease to a trigger's active owner.
+ *
+ * `unfinished` is the fire row at `reservationOccurrence(activeRunId)` while
+ * that row is still `null` or `buffered`, and is absent otherwise. A process
+ * that died after claiming an occurrence but before launching it left the
+ * reservation; the expired lease releases it and re-arms both ordinary and
+ * buffered work.
+ *
+ * @category decision
+ * @since 1.0.0-rc.0
+ */
+export declare const lease: (input: {
+    readonly activeRunId?: string | undefined;
+    readonly activeClaimedAt?: number | undefined;
+    readonly pending?: number | undefined;
+    readonly now: number;
+    readonly unfinished?: Fire | undefined;
+}) => Lease;
+/**
+ * The refusals a claim owes before it reads any fire row, in the order the
+ * stores apply them. A store checks these first so a refused claim leaves the
+ * ledger untouched; {@link decide} re-applies them so a store that only calls
+ * it is still fenced.
+ *
+ * @category decision
+ * @since 1.0.0-rc.0
+ */
+export declare const refuse: (snapshot: Pick<Snapshot, "enabled" | "revision">, fire: ClaimFire) => TriggerError | undefined;
+/**
+ * Applies the claim protocol to a snapshot.
+ *
+ * @category decision
+ * @since 1.0.0-rc.0
+ */
+export declare const decide: (input: Input) => Decision;
+/**
+ * Decides over a snapshot already admitted by {@link refuse} in the same
+ * transaction. This avoids checking the same immutable revision twice.
+ * @category decision
+ * @since 1.0.0-rc.0
+ * @private
+ */
+export declare const decideFenced: ({ claimedAt, fire, reservationId, snapshot }: Input) => AdmittedDecision;
+export {};
+//# sourceMappingURL=ClaimDecision.d.ts.map

package/dist/esm/ClaimDecision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimDecision.d.ts","sourceRoot":"","sources":["../../src/ClaimDecision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EACL,KAAK,KAAK,EACV,KAAK,SAAS,EAEd,KAAK,OAAO,EAGb,MAAM,mBAAmB,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,KAAK,GACb;IACA,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B,GACC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClF;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC,GACC;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5F;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;CAAE,CAAA;AAE9F;;;;;;GAMG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,KAAK,gBAAgB,GAAG,OAAO,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAA;AAIvE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjD;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC,CAAA;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAAI,OAAO;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;CACvC,KAAG,KAeH,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,GACjB,UAAU,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,UAAU,CAAC,EAChD,MAAM,SAAS,KACd,YAAY,GAAG,SAWjB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,KAAK,KAAG,QAGrC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GAAI,8CAA8C,KAAK,KAAG,gBAqFlF,CAAA"}

package/dist/esm/ClaimDecision.js

@@ -0,0 +1,172 @@
+/**
+ * The one claim decision both trigger stores apply.
+ *
+ * A claim is a pure function of the rows it reads: the trigger declaration,
+ * the fire row at the occurrence being claimed, and the fire row the active
+ * reservation holds. Each store gathers that snapshot in its own storage,
+ * calls {@link decide}, and applies the writes it answers. Writing the fences,
+ * the expired-reservation reclaim, and the supersede predecessor substitution
+ * once is what keeps `SqlTriggerStore` and the published in-memory store from
+ * drifting apart.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Overlap from "./Overlap.js";
+import { TriggerError } from "./TriggerError.js";
+import { isReservation, reservationLeaseMs, reservationOccurrence } from "./TriggerStore.js";
+const decided = (claim, writes) => ({ _tag: "Decided", claim, writes });
+/**
+ * Applies the reservation lease to a trigger's active owner.
+ *
+ * `unfinished` is the fire row at `reservationOccurrence(activeRunId)` while
+ * that row is still `null` or `buffered`, and is absent otherwise. A process
+ * that died after claiming an occurrence but before launching it left the
+ * reservation; the expired lease releases it and re-arms both ordinary and
+ * buffered work.
+ *
+ * @category decision
+ * @since 1.0.0-rc.0
+ */
+export const lease = (input) => {
+    const { activeClaimedAt, activeRunId, now, pending, unfinished } = input;
+    if (activeRunId === undefined)
+        return { _tag: "Idle" };
+    if (!isReservation(activeRunId) || (activeClaimedAt !== undefined && activeClaimedAt > now - reservationLeaseMs)) {
+        return { _tag: "Held", runId: activeRunId };
+    }
+    const occurrence = reservationOccurrence(activeRunId);
+    if (occurrence === undefined || unfinished === undefined)
+        return { _tag: "Expired", expected: activeRunId };
+    const predecessor = unfinished.runId;
+    return {
+        _tag: "Expired",
+        expected: activeRunId,
+        pending: Overlap.pendingAfter({ running: false, pending, due: occurrence }),
+        ...(predecessor !== undefined && !isReservation(predecessor) ? { recovered: predecessor } : {})
+    };
+};
+/**
+ * The refusals a claim owes before it reads any fire row, in the order the
+ * stores apply them. A store checks these first so a refused claim leaves the
+ * ledger untouched; {@link decide} re-applies them so a store that only calls
+ * it is still fenced.
+ *
+ * @category decision
+ * @since 1.0.0-rc.0
+ */
+export const refuse = (snapshot, fire) => {
+    if (snapshot.revision !== fire.expectedRevision) {
+        return new TriggerError({
+            code: "revision_mismatch",
+            message: `trigger ${fire.triggerId} is at revision ${snapshot.revision}, not the claimed ${fire.expectedRevision}`
+        });
+    }
+    if (!snapshot.enabled) {
+        return new TriggerError({ code: "trigger_disabled", message: `trigger ${fire.triggerId} is disabled` });
+    }
+    return undefined;
+};
+/**
+ * Applies the claim protocol to a snapshot.
+ *
+ * @category decision
+ * @since 1.0.0-rc.0
+ */
+export const decide = (input) => {
+    const refusal = refuse(input.snapshot, input.fire);
+    return refusal === undefined ? decideFenced(input) : { _tag: "Refused", error: refusal };
+};
+/**
+ * Decides over a snapshot already admitted by {@link refuse} in the same
+ * transaction. This avoids checking the same immutable revision twice.
+ * @category decision
+ * @since 1.0.0-rc.0
+ * @private
+ */
+export const decideFenced = ({ claimedAt, fire, reservationId, snapshot }) => {
+    let activeRunId = snapshot.activeRunId;
+    let pending = snapshot.pending;
+    // A reservation with no claim timestamp predates the lease column. Nothing
+    // writes that shape now, so treating it as expired is the only way such a
+    // row is ever reclaimed.
+    const expiredReservation = activeRunId !== undefined && isReservation(activeRunId) &&
+        (snapshot.activeClaimedAt === undefined || snapshot.activeClaimedAt <= claimedAt - reservationLeaseMs)
+        ? activeRunId
+        : undefined;
+    const existing = snapshot.existingFire;
+    if (existing !== undefined) {
+        const resumableBuffer = fire.resumeBuffered === true && existing.outcome === "buffered";
+        const resumableReservation = existing.outcome === null &&
+            (activeRunId === undefined ||
+                (reservationOccurrence(activeRunId) === fire.occurrence && expiredReservation !== undefined));
+        const resumableSupersede = fire.resumeBuffered === true && existing.outcome === null &&
+            snapshot.overlap === "supersede" && activeRunId !== undefined && existing.runId === activeRunId;
+        if (!resumableBuffer && !resumableReservation && !resumableSupersede)
+            return decided({ claimed: false }, []);
+    }
+    const writes = [];
+    if (expiredReservation !== undefined) {
+        const expiredOccurrence = reservationOccurrence(expiredReservation);
+        const expiredFire = expiredOccurrence === undefined ? undefined : snapshot.activeFire;
+        if (expiredOccurrence !== undefined && expiredFire !== undefined &&
+            (expiredFire.outcome === null || expiredFire.outcome === "buffered")) {
+            if (snapshot.overlap === "supersede") {
+                const predecessor = expiredFire.runId;
+                activeRunId = predecessor !== undefined && !isReservation(predecessor) ? predecessor : undefined;
+                if (expiredOccurrence !== fire.occurrence) {
+                    writes.push({ _tag: "SetOutcome", occurrence: expiredOccurrence, outcome: "superseded", whileOpen: false });
+                }
+            }
+            else {
+                activeRunId = undefined;
+                if (expiredOccurrence !== fire.occurrence) {
+                    pending = Overlap.pendingAfter({ running: false, pending, due: expiredOccurrence });
+                }
+            }
+        }
+        else {
+            activeRunId = undefined;
+        }
+        writes.push({ _tag: "ReleaseReservation", expected: expiredReservation, activeRunId, pending });
+    }
+    const state = { running: activeRunId !== undefined, pending, due: fire.occurrence };
+    const action = Overlap.decide(snapshot.overlap, state);
+    // A skip or buffer is complete inside the claim transaction. A fire or
+    // supersede is only reserved here; its cursor advances when `recordResult`
+    // makes the launched run durable.
+    if (action === "skip" || action === "buffer") {
+        writes.push({
+            _tag: "SetOutcome",
+            occurrence: fire.occurrence,
+            outcome: action === "skip" ? "skipped" : "buffered",
+            whileOpen: false
+        });
+        writes.push({ _tag: "AdvanceCursor", occurrence: fire.occurrence });
+        if (action === "buffer")
+            writes.push({ _tag: "SetPending", occurrence: Overlap.pendingAfter(state) });
+        return decided({ claimed: true, action }, writes);
+    }
+    let supersededRunId = activeRunId;
+    if (action === "supersede" && activeRunId !== undefined) {
+        if (isReservation(activeRunId)) {
+            const activeOccurrence = reservationOccurrence(activeRunId);
+            if (activeOccurrence !== undefined) {
+                const predecessor = snapshot.activeFire?.runId;
+                if (predecessor !== undefined && !isReservation(predecessor))
+                    supersededRunId = predecessor;
+                writes.push({ _tag: "SetOutcome", occurrence: activeOccurrence, outcome: "superseded", whileOpen: true });
+            }
+        }
+        if (supersededRunId !== undefined && !isReservation(supersededRunId)) {
+            writes.push({ _tag: "SetRunId", occurrence: fire.occurrence, runId: supersededRunId });
+        }
+    }
+    writes.push({ _tag: "Reserve", reservationId, claimedAt });
+    return decided({
+        claimed: true,
+        action,
+        reservationId,
+        ...(supersededRunId === undefined ? {} : { activeRunId: supersededRunId })
+    }, writes);
+};
+//# sourceMappingURL=ClaimDecision.js.map

package/dist/esm/ClaimDecision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimDecision.js","sourceRoot":"","sources":["../../src/ClaimDecision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAGL,aAAa,EAEb,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,mBAAmB,CAAA;AA2F1B,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,MAA4B,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAwBtH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAMrB,EAAS,EAAE;IACV,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IACxE,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACtD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,eAAe,GAAG,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACrD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;IAC3G,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAA;IACpC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,QAAgD,EAChD,IAAe,EACW,EAAE;IAC5B,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,OAAO,IAAI,YAAY,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,WAAW,IAAI,CAAC,SAAS,mBAAmB,QAAQ,CAAC,QAAQ,qBAAqB,IAAI,CAAC,gBAAgB,EAAE;SACnH,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC,SAAS,cAAc,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAY,EAAY,EAAE;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC1F,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAS,EAAoB,EAAE;IACpG,IAAI,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAA;IACtC,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;IAC9B,2EAA2E;IAC3E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,kBAAkB,GAAG,WAAW,KAAK,SAAS,IAAI,aAAa,CAAC,WAAW,CAAC;QAC9E,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,SAAS,GAAG,kBAAkB,CAAC;QACxG,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAA;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAA;QACvF,MAAM,oBAAoB,GAAG,QAAQ,CAAC,OAAO,KAAK,IAAI;YACpD,CAAC,WAAW,KAAK,SAAS;gBACxB,CAAC,qBAAqB,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAA;QACjG,MAAM,kBAAkB,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI;YAClF,QAAQ,CAAC,OAAO,KAAK,WAAW,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,CAAA;QACjG,IAAI,CAAC,eAAe,IAAI,CAAC,oBAAoB,IAAI,CAAC,kBAAkB;YAAE,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAC9G,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAA;QACrF,IACE,iBAAiB,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;YAC5D,CAAC,WAAW,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,OAAO,KAAK,UAAU,CAAC,EACpE,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;gBACrC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAA;gBACrC,WAAW,GAAG,WAAW,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;gBAChG,IAAI,iBAAiB,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC7G,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,SAAS,CAAA;gBACvB,IAAI,iBAAiB,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1C,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,SAAS,CAAA;QACzB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,WAAW,KAAK,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;IAClG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACtD,uEAAuE;IACvE,2EAA2E;IAC3E,kCAAkC;IAClC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACrG,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,eAAe,GAAG,WAAW,CAAA;IACjC,IAAI,MAAM,KAAK,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACxD,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;YAC3D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;gBAC9C,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;oBAAE,eAAe,GAAG,WAAW,CAAA;gBAC3F,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3G,CAAC;QACH,CAAC;QACD,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1D,OAAO,OAAO,CACZ;QACE,OAAO,EAAE,IAAI;QACb,MAAM;QACN,aAAa;QACb,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;KAC3E,EACD,MAAM,CACP,CAAA;AACH,CAAC,CAAA","sourcesContent":["/**\n * The one claim decision both trigger stores apply.\n *\n * A claim is a pure function of the rows it reads: the trigger declaration,\n * the fire row at the occurrence being claimed, and the fire row the active\n * reservation holds. Each store gathers that snapshot in its own storage,\n * calls {@link decide}, and applies the writes it answers. Writing the fences,\n * the expired-reservation reclaim, and the supersede predecessor substitution\n * once is what keeps `SqlTriggerStore` and the published in-memory store from\n * drifting apart.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Overlap from \"./Overlap.ts\"\nimport type { Overlap as Policy } from \"./Trigger.ts\"\nimport { TriggerError } from \"./TriggerError.ts\"\nimport {\n  type Claim,\n  type ClaimFire,\n  isReservation,\n  type Outcome,\n  reservationLeaseMs,\n  reservationOccurrence\n} from \"./TriggerStore.ts\"\n\n/**\n * A fire row as the decision reads it. `outcome` is `null` for a claimed but\n * unsettled occurrence, matching the nullable column.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Fire {\n  readonly outcome: Outcome | null\n  readonly runId?: string | undefined\n}\n\n/**\n * Everything the decision reads, gathered by the store before it runs.\n *\n * `existingFire` is absent when this claim is what created the row.\n * `activeFire` is the row at `reservationOccurrence(activeRunId)`, read after\n * that insert, and is needed only while `activeRunId` is a reservation.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Snapshot {\n  readonly revision: number\n  readonly enabled: boolean\n  readonly overlap: Policy\n  readonly activeRunId?: string | undefined\n  readonly activeClaimedAt?: number | undefined\n  readonly pending?: number | undefined\n  readonly existingFire?: Fire | undefined\n  readonly activeFire?: Fire | undefined\n}\n\n/**\n * One durable edit a claim owes, in the order the store must apply them.\n *\n * `SetOutcome` with `whileOpen` may only settle a fire that is still `null` or\n * `buffered`; the SQL store spells that as a `WHERE` clause.\n * `ReleaseReservation` may only land while `expected` still owns the trigger.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Write =\n  | {\n    readonly _tag: \"SetOutcome\"\n    readonly occurrence: number\n    readonly outcome: Outcome\n    readonly whileOpen: boolean\n  }\n  | { readonly _tag: \"SetRunId\"; readonly occurrence: number; readonly runId: string }\n  | {\n    readonly _tag: \"ReleaseReservation\"\n    readonly expected: string\n    readonly activeRunId?: string | undefined\n    readonly pending?: number | undefined\n  }\n  | { readonly _tag: \"AdvanceCursor\"; readonly occurrence: number }\n  | { readonly _tag: \"SetPending\"; readonly occurrence: number }\n  | { readonly _tag: \"Reserve\"; readonly reservationId: string; readonly claimedAt: number }\n\n/**\n * What a claim decided: a refusal the store fails with, or a claim outcome and\n * the writes that make it durable. An unclaimed occurrence answers\n * `{ claimed: false }` with no writes.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Decision =\n  | { readonly _tag: \"Refused\"; readonly error: TriggerError }\n  | { readonly _tag: \"Decided\"; readonly claim: Claim; readonly writes: ReadonlyArray<Write> }\n\n/**\n * The claim request, the rows it reads, the reservation id the store minted\n * for it, and the store clock reading it was claimed at.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Input {\n  readonly fire: ClaimFire\n  readonly snapshot: Snapshot\n  readonly reservationId: string\n  readonly claimedAt: number\n}\n\ntype AdmittedDecision = Extract<Decision, { readonly _tag: \"Decided\" }>\n\nconst decided = (claim: Claim, writes: ReadonlyArray<Write>): AdmittedDecision => ({ _tag: \"Decided\", claim, writes })\n\n/**\n * What a reader finds behind a trigger's active owner: nothing, a live owner,\n * or an expired reservation to release.\n *\n * `expected` is the reservation the release must still find in place.\n * `recovered` is the launched predecessor the release hands back, and\n * `pending` is the occurrence it re-arms; both are absent when the reservation\n * covered no unsettled fire.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Lease =\n  | { readonly _tag: \"Idle\" }\n  | { readonly _tag: \"Held\"; readonly runId: string }\n  | {\n    readonly _tag: \"Expired\"\n    readonly expected: string\n    readonly recovered?: string | undefined\n    readonly pending?: number | undefined\n  }\n\n/**\n * Applies the reservation lease to a trigger's active owner.\n *\n * `unfinished` is the fire row at `reservationOccurrence(activeRunId)` while\n * that row is still `null` or `buffered`, and is absent otherwise. A process\n * that died after claiming an occurrence but before launching it left the\n * reservation; the expired lease releases it and re-arms both ordinary and\n * buffered work.\n *\n * @category decision\n * @since 1.0.0-rc.0\n */\nexport const lease = (input: {\n  readonly activeRunId?: string | undefined\n  readonly activeClaimedAt?: number | undefined\n  readonly pending?: number | undefined\n  readonly now: number\n  readonly unfinished?: Fire | undefined\n}): Lease => {\n  const { activeClaimedAt, activeRunId, now, pending, unfinished } = input\n  if (activeRunId === undefined) return { _tag: \"Idle\" }\n  if (!isReservation(activeRunId) || (activeClaimedAt !== undefined && activeClaimedAt > now - reservationLeaseMs)) {\n    return { _tag: \"Held\", runId: activeRunId }\n  }\n  const occurrence = reservationOccurrence(activeRunId)\n  if (occurrence === undefined || unfinished === undefined) return { _tag: \"Expired\", expected: activeRunId }\n  const predecessor = unfinished.runId\n  return {\n    _tag: \"Expired\",\n    expected: activeRunId,\n    pending: Overlap.pendingAfter({ running: false, pending, due: occurrence }),\n    ...(predecessor !== undefined && !isReservation(predecessor) ? { recovered: predecessor } : {})\n  }\n}\n\n/**\n * The refusals a claim owes before it reads any fire row, in the order the\n * stores apply them. A store checks these first so a refused claim leaves the\n * ledger untouched; {@link decide} re-applies them so a store that only calls\n * it is still fenced.\n *\n * @category decision\n * @since 1.0.0-rc.0\n */\nexport const refuse = (\n  snapshot: Pick<Snapshot, \"enabled\" | \"revision\">,\n  fire: ClaimFire\n): TriggerError | undefined => {\n  if (snapshot.revision !== fire.expectedRevision) {\n    return new TriggerError({\n      code: \"revision_mismatch\",\n      message: `trigger ${fire.triggerId} is at revision ${snapshot.revision}, not the claimed ${fire.expectedRevision}`\n    })\n  }\n  if (!snapshot.enabled) {\n    return new TriggerError({ code: \"trigger_disabled\", message: `trigger ${fire.triggerId} is disabled` })\n  }\n  return undefined\n}\n\n/**\n * Applies the claim protocol to a snapshot.\n *\n * @category decision\n * @since 1.0.0-rc.0\n */\nexport const decide = (input: Input): Decision => {\n  const refusal = refuse(input.snapshot, input.fire)\n  return refusal === undefined ? decideFenced(input) : { _tag: \"Refused\", error: refusal }\n}\n\n/**\n * Decides over a snapshot already admitted by {@link refuse} in the same\n * transaction. This avoids checking the same immutable revision twice.\n * @category decision\n * @since 1.0.0-rc.0\n * @private\n */\nexport const decideFenced = ({ claimedAt, fire, reservationId, snapshot }: Input): AdmittedDecision => {\n  let activeRunId = snapshot.activeRunId\n  let pending = snapshot.pending\n  // A reservation with no claim timestamp predates the lease column. Nothing\n  // writes that shape now, so treating it as expired is the only way such a\n  // row is ever reclaimed.\n  const expiredReservation = activeRunId !== undefined && isReservation(activeRunId) &&\n      (snapshot.activeClaimedAt === undefined || snapshot.activeClaimedAt <= claimedAt - reservationLeaseMs)\n    ? activeRunId\n    : undefined\n  const existing = snapshot.existingFire\n  if (existing !== undefined) {\n    const resumableBuffer = fire.resumeBuffered === true && existing.outcome === \"buffered\"\n    const resumableReservation = existing.outcome === null &&\n      (activeRunId === undefined ||\n        (reservationOccurrence(activeRunId) === fire.occurrence && expiredReservation !== undefined))\n    const resumableSupersede = fire.resumeBuffered === true && existing.outcome === null &&\n      snapshot.overlap === \"supersede\" && activeRunId !== undefined && existing.runId === activeRunId\n    if (!resumableBuffer && !resumableReservation && !resumableSupersede) return decided({ claimed: false }, [])\n  }\n  const writes: Array<Write> = []\n  if (expiredReservation !== undefined) {\n    const expiredOccurrence = reservationOccurrence(expiredReservation)\n    const expiredFire = expiredOccurrence === undefined ? undefined : snapshot.activeFire\n    if (\n      expiredOccurrence !== undefined && expiredFire !== undefined &&\n      (expiredFire.outcome === null || expiredFire.outcome === \"buffered\")\n    ) {\n      if (snapshot.overlap === \"supersede\") {\n        const predecessor = expiredFire.runId\n        activeRunId = predecessor !== undefined && !isReservation(predecessor) ? predecessor : undefined\n        if (expiredOccurrence !== fire.occurrence) {\n          writes.push({ _tag: \"SetOutcome\", occurrence: expiredOccurrence, outcome: \"superseded\", whileOpen: false })\n        }\n      } else {\n        activeRunId = undefined\n        if (expiredOccurrence !== fire.occurrence) {\n          pending = Overlap.pendingAfter({ running: false, pending, due: expiredOccurrence })\n        }\n      }\n    } else {\n      activeRunId = undefined\n    }\n    writes.push({ _tag: \"ReleaseReservation\", expected: expiredReservation, activeRunId, pending })\n  }\n  const state: Overlap.State = { running: activeRunId !== undefined, pending, due: fire.occurrence }\n  const action = Overlap.decide(snapshot.overlap, state)\n  // A skip or buffer is complete inside the claim transaction. A fire or\n  // supersede is only reserved here; its cursor advances when `recordResult`\n  // makes the launched run durable.\n  if (action === \"skip\" || action === \"buffer\") {\n    writes.push({\n      _tag: \"SetOutcome\",\n      occurrence: fire.occurrence,\n      outcome: action === \"skip\" ? \"skipped\" : \"buffered\",\n      whileOpen: false\n    })\n    writes.push({ _tag: \"AdvanceCursor\", occurrence: fire.occurrence })\n    if (action === \"buffer\") writes.push({ _tag: \"SetPending\", occurrence: Overlap.pendingAfter(state) })\n    return decided({ claimed: true, action }, writes)\n  }\n  let supersededRunId = activeRunId\n  if (action === \"supersede\" && activeRunId !== undefined) {\n    if (isReservation(activeRunId)) {\n      const activeOccurrence = reservationOccurrence(activeRunId)\n      if (activeOccurrence !== undefined) {\n        const predecessor = snapshot.activeFire?.runId\n        if (predecessor !== undefined && !isReservation(predecessor)) supersededRunId = predecessor\n        writes.push({ _tag: \"SetOutcome\", occurrence: activeOccurrence, outcome: \"superseded\", whileOpen: true })\n      }\n    }\n    if (supersededRunId !== undefined && !isReservation(supersededRunId)) {\n      writes.push({ _tag: \"SetRunId\", occurrence: fire.occurrence, runId: supersededRunId })\n    }\n  }\n  writes.push({ _tag: \"Reserve\", reservationId, claimedAt })\n  return decided(\n    {\n      claimed: true,\n      action,\n      reservationId,\n      ...(supersededRunId === undefined ? {} : { activeRunId: supersededRunId })\n    },\n    writes\n  )\n}\n"]}