@vercel/factory 0.0.14 → 0.0.15

package/dist/store/task-messages.mjs

@@ -0,0 +1,475 @@
+import { taskIdSchema } from "../schema/id.mjs";
+import "../schema/common.mjs";
+import { taskAttemptRefSchema } from "../schema/execution.mjs";
+import { RecordExistsError, VersionConflictError } from "./driver.mjs";
+import { sendTaskMessageInputSchema, taskInboxSchema, taskMessageClaimSchema, taskMessageDiscardSchema, taskMessageIdSchema, taskMessagePrincipalSchema, taskMessageProcessingSchema, taskMessageReservationSchema, taskMessageSchema } from "../schema/task-message.mjs";
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { isDeepStrictEqual } from "node:util";
+//#region src/store/task-messages.ts
+/** Base error for Task message admission, authorization, and processing failures. */
+var TaskMessageError = class extends Error {};
+/** Error raised when an idempotency key is reused with different message intent. */
+var TaskMessageConflictError = class extends TaskMessageError {};
+/** Error raised when a configured Task message policy does not grant an operation. */
+var TaskMessageAuthorizationError = class extends TaskMessageError {};
+/** Error raised when a Task inbox claim is expired, replaced, or otherwise invalid. */
+var TaskMessageLeaseError = class extends TaskMessageError {};
+/** Error raised when an inbox head belongs to a stale or cancelled source attempt. */
+var TaskMessageSourceFenceError = class extends TaskMessageError {
+	messageId;
+	source;
+	currentAttempt;
+	sourceState;
+	constructor(messageId, source, currentAttempt, sourceState) {
+		super(`Inbox blocked by message ${messageId}: source ${source.taskId} attempt ${source.attempt}, current attempt ${currentAttempt}, state ${sourceState}. Message remains pending; an explicitly authorized discard is required to unblock this inbox.`);
+		this.messageId = messageId;
+		this.source = source;
+		this.currentAttempt = currentAttempt;
+		this.sourceState = sourceState;
+		this.name = "TaskMessageSourceFenceError";
+	}
+};
+/**
+* Authorizes recipient-local operations and direct parent-child sends for a trusted
+* Task-bound principal while denying result delivery and discard.
+*/
+const taskBoundMessagePolicy = ({ principal, action, fromTask, toTask }) => {
+	if (action === "discard" || action === "send_result") return false;
+	if (action !== "send") return principal.taskId === toTask.id;
+	if (!fromTask || !principal.taskId) return false;
+	return principal.taskId === fromTask.id && (fromTask.parentTaskId === toTask.id || toTask.parentTaskId === fromTask.id);
+};
+const claimOptionsSchema = z.strictObject({
+	leaseMs: z.number().int().min(1).max(3e5).describe("Processing lease duration, at most five minutes."),
+	recoverCompleted: z.boolean().default(false).describe("Trusted recovery of an exact existing decision on a succeeded/failed recipient at the same attempt; not permission for new effects or cancelled Tasks.")
+});
+const acknowledgmentSchema = z.strictObject({ effectsCommitted: z.literal(true).describe("Effects committed before this acknowledgment.") });
+const hash = (parts) => createHash("sha256").update(JSON.stringify(parts)).digest("hex");
+const messageIdFor = (source, operation) => taskMessageIdSchema.parse(`msg_${hash([source, operation])}`);
+const messageContent = ({ createdAt: _createdAt, ...content }) => content;
+const retryable = (error) => error instanceof VersionConflictError || error instanceof RecordExistsError;
+/** Creates the trusted, CAS-backed Task message and recipient-inbox store. */
+function createTaskMessageStore(options) {
+	const { driver, now, getTask, protocols, authorize } = options;
+	if (typeof authorize !== "function") throw new TaskMessageAuthorizationError("Task messages require an explicit authorize callback; no access is granted by default");
+	async function task(id) {
+		const value = await getTask(taskIdSchema.parse(id));
+		if (!value || value.id !== id) throw new TaskMessageError(`Missing Task ${id}`);
+		taskIdSchema.parse(value.rootTaskId);
+		return value;
+	}
+	async function scope(principal, action, toTaskId, fromTaskId) {
+		const toTask = await task(toTaskId);
+		const fromTask = fromTaskId === void 0 ? void 0 : await task(fromTaskId);
+		if (fromTask && fromTask.rootTaskId !== toTask.rootTaskId) throw new TaskMessageAuthorizationError("Cross-root Task messages are not permitted");
+		if ((action === "send" || action === "send_result") && principal.taskId !== void 0 && principal.taskId !== fromTaskId) throw new TaskMessageAuthorizationError("Task-bound sender must equal fromTaskId");
+		if (await authorize(structuredClone({
+			principal,
+			action,
+			fromTask,
+			toTask
+		})) !== true) throw new TaskMessageAuthorizationError(`Task message ${action} denied for ${principal.id}`);
+		return {
+			fromTask,
+			toTask
+		};
+	}
+	function matchingAttempt(value, expected) {
+		if (value.attempt !== expected) throw new TaskMessageError(`Task ${value.id} requires current attempt ${value.attempt}; received ${expected}`);
+	}
+	function activeAttempt(value, expected) {
+		if (value.attempt !== expected || ![
+			"queued",
+			"running",
+			"needs_human"
+		].includes(value.state)) throw new TaskMessageError(`Task ${value.id} requires current attempt ${value.attempt} and queued, running, or needs_human state`);
+	}
+	function resultAttempt(value, expected) {
+		matchingAttempt(value, expected);
+		if (![
+			"succeeded",
+			"failed",
+			"cancelled"
+		].includes(value.state)) throw new TaskMessageError(`Task ${value.id} requires a persisted succeeded, failed, or cancelled outcome for result delivery`);
+	}
+	function claimableAttempt(value, expected, recoverCompleted) {
+		if (recoverCompleted && (value.state === "succeeded" || value.state === "failed")) matchingAttempt(value, expected);
+		else activeAttempt(value, expected);
+	}
+	function parseMessage(value) {
+		const { causationId, delivery, ...message } = taskMessageSchema.parse(value);
+		if (message.id !== messageIdFor(message.fromTaskId, message.operationId)) throw new TaskMessageConflictError("Stored message ID does not match its source and operation");
+		return {
+			...message,
+			...causationId === void 0 ? {} : { causationId },
+			...delivery === void 0 ? {} : { delivery },
+			payload: protocols.validateStored(message.type, message.payload)
+		};
+	}
+	function correlateMessage(message, type) {
+		if (message.type.id !== type.id || message.type.version !== type.version) throw new TaskMessageConflictError("Message protocol differs from its send intent");
+		const payload = protocols.validateStored(type, message.payload);
+		return structuredClone({
+			...message,
+			payload
+		});
+	}
+	async function deliveredMessage(intent) {
+		const stored = await driver.get("taskMessages", intent.id);
+		if (!stored) return null;
+		const delivered = parseMessage(stored.value);
+		if (!isDeepStrictEqual(messageContent(delivered), messageContent(intent))) throw new TaskMessageConflictError(`Operation ${intent.operationId} was reused with different content or attempt`);
+		return delivered;
+	}
+	async function immutable(collection, id, value, parse) {
+		const validated = parse(value);
+		try {
+			await driver.insert({
+				collection,
+				id,
+				value: validated
+			});
+		} catch (error) {
+			if (!(error instanceof RecordExistsError)) throw error;
+			const stored = await driver.get(collection, id);
+			if (!stored || !isDeepStrictEqual(parse(stored.value), validated)) throw new TaskMessageConflictError(`Immutable record ${id} has different content`);
+		}
+		return validated;
+	}
+	async function inbox(toTaskId) {
+		const stored = await driver.get("taskInboxes", toTaskId);
+		const value = stored ? taskInboxSchema.parse(stored.value) : taskInboxSchema.parse({
+			schemaVersion: 1,
+			toTaskId,
+			generation: 0,
+			pending: []
+		});
+		if (value.toTaskId !== toTaskId) throw new TaskMessageError("Stored inbox recipient mismatch");
+		value.pending = value.pending.map(parseMessage);
+		return {
+			value,
+			version: stored?.version
+		};
+	}
+	async function saveInbox(value, version) {
+		const validated = taskInboxSchema.parse(value);
+		try {
+			if (version === void 0) await driver.insert({
+				collection: "taskInboxes",
+				id: value.toTaskId,
+				value: validated
+			});
+			else await driver.update({
+				collection: "taskInboxes",
+				id: value.toTaskId,
+				value: validated,
+				expectedVersion: version
+			});
+			return true;
+		} catch (error) {
+			if (retryable(error)) return false;
+			throw error;
+		}
+	}
+	async function repair(principal, toTaskId, action, targetId) {
+		for (;;) {
+			await scope(principal, action, toTaskId);
+			const current = await inbox(toTaskId);
+			for (const message of current.value.pending) {
+				if (targetId !== void 0 && message.id !== targetId) continue;
+				await immutable("taskMessages", message.id, message, parseMessage);
+			}
+			const { completion, rejection } = current.value;
+			const resolved = completion ?? rejection;
+			if (!resolved || targetId !== void 0 && resolved.messageId !== targetId) return current;
+			if (completion) await immutable("taskMessageProcessing", completion.messageId, completion, (value) => taskMessageProcessingSchema.parse(value));
+			if (rejection) await immutable("taskMessageDiscards", rejection.messageId, rejection, (value) => taskMessageDiscardSchema.parse(value));
+			if (await saveInbox({
+				...current.value,
+				pending: current.value.pending.filter((message) => message.id !== resolved.messageId),
+				lease: void 0,
+				completion: void 0,
+				rejection: void 0
+			}, current.version)) continue;
+		}
+	}
+	async function reserve(message, expectAttempt) {
+		const key = `reservation_${message.id}`;
+		const reservation = taskMessageReservationSchema.parse({
+			schemaVersion: 1,
+			message,
+			expectAttempt
+		});
+		try {
+			await driver.insert({
+				collection: "taskMessageProcessing",
+				id: key,
+				value: reservation
+			});
+			return message;
+		} catch (error) {
+			if (!(error instanceof RecordExistsError)) throw error;
+			const stored = await driver.get("taskMessageProcessing", key);
+			if (!stored) throw new TaskMessageConflictError(`Missing operation reservation ${message.id}`);
+			const existing = taskMessageReservationSchema.parse(stored.value);
+			const original = parseMessage(existing.message);
+			if (existing.expectAttempt !== expectAttempt || !isDeepStrictEqual(messageContent(original), messageContent(message))) throw new TaskMessageConflictError(`Operation ${message.operationId} was reused with different content or attempt`);
+			return original;
+		}
+	}
+	async function readMessage(principal, toTaskId, messageId, action) {
+		taskMessageIdSchema.parse(messageId);
+		await scope(principal, action, toTaskId);
+		await repair(principal, toTaskId, action, messageId);
+		const stored = await driver.get("taskMessages", messageId);
+		if (!stored) return null;
+		const message = parseMessage(stored.value);
+		if (message.id !== messageId || message.toTaskId !== toTaskId) throw new TaskMessageAuthorizationError("Message does not belong to this recipient");
+		await scope(principal, action, toTaskId, message.fromTaskId);
+		return message;
+	}
+	async function processingRecord(messageId) {
+		const stored = await driver.get("taskMessageProcessing", messageId);
+		if (!stored) return null;
+		const record = taskMessageProcessingSchema.parse(stored.value);
+		if (record.messageId !== messageId) throw new TaskMessageError("Processing record identity mismatch");
+		return record;
+	}
+	async function discardRecord(messageId) {
+		const stored = await driver.get("taskMessageDiscards", messageId);
+		if (!stored) return null;
+		const record = taskMessageDiscardSchema.parse(stored.value);
+		if (record.messageId !== messageId) throw new TaskMessageError("Discard record identity mismatch");
+		return record;
+	}
+	async function requireLiveClaim(principal, claim, current) {
+		if (principal.id !== claim.principalId) throw new TaskMessageAuthorizationError("Only the claiming principal may validate this lease");
+		matchingAttempt(await task(claim.toTaskId), claim.attempt);
+		const time = now();
+		if (current.completion || current.rejection || current.generation !== claim.generation || !isDeepStrictEqual(current.lease, claim) || Date.parse(claim.expiresAt) <= time.getTime()) throw new TaskMessageLeaseError("Lease expired, resolved, or was replaced; claim again before processing");
+		return time;
+	}
+	function requireClaim(record, claim) {
+		const { schemaVersion: _schemaVersion, completedAt: _completedAt, effectsCommitted: _effectsCommitted, ...accepted } = record;
+		if (!isDeepStrictEqual(accepted, claim)) throw new TaskMessageLeaseError("Processing acknowledgment belongs to a different lease generation");
+		return record;
+	}
+	async function send(context, input, delivery) {
+		const principal = taskMessagePrincipalSchema.parse(context);
+		const parsed = sendTaskMessageInputSchema.parse(input);
+		const payload = protocols.validate(input.type, parsed.payload);
+		const { expectAttempt } = parsed;
+		const action = delivery === "result" ? "send_result" : "send";
+		await scope(principal, action, parsed.toTaskId, parsed.fromTaskId);
+		const intent = correlateMessage(parseMessage({
+			...parsed,
+			payload,
+			delivery,
+			schemaVersion: 1,
+			id: messageIdFor(parsed.fromTaskId, parsed.operationId),
+			createdAt: now().toISOString()
+		}), input.type);
+		const delivered = await deliveredMessage(intent);
+		if (delivery === "result") resultAttempt(await task(parsed.fromTaskId), expectAttempt);
+		if (delivered) return correlateMessage(delivered, input.type);
+		if (delivery !== "result") activeAttempt(await task(parsed.fromTaskId), expectAttempt);
+		const recipient = await task(parsed.toTaskId);
+		activeAttempt(recipient, recipient.attempt);
+		if (parsed.causationId) {
+			const stored = await driver.get("taskMessages", parsed.causationId);
+			if (!stored) throw new TaskMessageError("Causation message must already be durably delivered");
+			const cause = parseMessage(stored.value);
+			await scope(principal, "read", cause.toTaskId, cause.fromTaskId);
+			if ((await task(cause.toTaskId)).rootTaskId !== recipient.rootTaskId) throw new TaskMessageAuthorizationError("Causation must stay within the Task root");
+		}
+		const message = correlateMessage(await reserve(intent, expectAttempt), input.type);
+		for (;;) {
+			await scope(principal, action, message.toTaskId, message.fromTaskId);
+			const current = await inbox(message.toTaskId);
+			const delivered = await deliveredMessage(message);
+			if (delivery === "result") resultAttempt(await task(message.fromTaskId), expectAttempt);
+			if (delivered) return correlateMessage(delivered, input.type);
+			if (delivery !== "result") activeAttempt(await task(message.fromTaskId), expectAttempt);
+			const recipient = await task(message.toTaskId);
+			activeAttempt(recipient, recipient.attempt);
+			const pending = current.value.pending.find((entry) => entry.id === message.id);
+			if (pending) {
+				if (!isDeepStrictEqual(pending, message)) throw new TaskMessageConflictError("Inbox message differs from reserved intent");
+			} else {
+				if (current.value.pending.length >= 256) throw new TaskMessageError(`Recipient inbox is full; maximum 256 pending messages`);
+				if (!await saveInbox({
+					...current.value,
+					pending: [...current.value.pending, message]
+				}, current.version)) continue;
+			}
+			return correlateMessage(await immutable("taskMessages", message.id, message, parseMessage), input.type);
+		}
+	}
+	async function sendAndNotify(principal, input, delivery) {
+		const message = await send(principal, input, delivery);
+		if (options.notify) {
+			const recipient = await task(message.toTaskId);
+			await options.notify({
+				rootTaskId: recipient.rootTaskId,
+				key: `message:${message.id}`
+			});
+		}
+		return message;
+	}
+	return {
+		send: ({ principal, message }) => sendAndNotify(principal, message),
+		sendResult: ({ principal, message }) => sendAndNotify(principal, message, "result"),
+		async get({ principal: context, toTaskId, messageId }) {
+			return readMessage(taskMessagePrincipalSchema.parse(context), toTaskId, messageId, "read");
+		},
+		async pending({ principal: context, toTaskId }) {
+			const principal = taskMessagePrincipalSchema.parse(context);
+			const current = await repair(principal, toTaskId, "read");
+			for (const message of current.value.pending) await scope(principal, "read", toTaskId, message.fromTaskId);
+			return current.value.pending;
+		},
+		async claim({ principal: context, task: inputTask, ...input }) {
+			const principal = taskMessagePrincipalSchema.parse(context);
+			const { taskId: toTaskId, attempt } = taskAttemptRefSchema.parse(inputTask);
+			const { leaseMs, recoverCompleted } = claimOptionsSchema.parse(input);
+			for (;;) {
+				const current = await repair(principal, toTaskId, "claim");
+				const message = current.value.pending[0];
+				if (message) await scope(principal, "claim", toTaskId, message.fromTaskId);
+				const recipient = await task(toTaskId);
+				claimableAttempt(recipient, attempt, recoverCompleted);
+				if (current.value.lease && current.value.lease.attempt === recipient.attempt && Date.parse(current.value.lease.expiresAt) > now().getTime()) return null;
+				if (!message) return null;
+				const source = await task(message.fromTaskId);
+				if (protocols.sourceFence(message.type) === "attempt" && source.attempt !== message.expectAttempt || source.state === "cancelled" && message.delivery !== "result") throw new TaskMessageSourceFenceError(message.id, {
+					taskId: source.id,
+					attempt: message.expectAttempt
+				}, source.attempt, source.state);
+				claimableAttempt(await task(toTaskId), attempt, recoverCompleted);
+				const time = now();
+				const claim = taskMessageClaimSchema.parse({
+					messageId: message.id,
+					toTaskId,
+					generation: current.value.generation + 1,
+					principalId: principal.id,
+					attempt,
+					expiresAt: new Date(time.getTime() + leaseMs).toISOString()
+				});
+				if (await saveInbox({
+					...current.value,
+					generation: claim.generation,
+					lease: claim
+				}, current.version)) return {
+					claim,
+					message
+				};
+			}
+		},
+		async complete({ principal: context, claim: input, effectsCommitted }) {
+			const principal = taskMessagePrincipalSchema.parse(context);
+			const claim = taskMessageClaimSchema.parse(input);
+			acknowledgmentSchema.parse({ effectsCommitted });
+			if (principal.id !== claim.principalId) throw new TaskMessageAuthorizationError("Only the claiming principal may acknowledge processing");
+			const message = await readMessage(principal, claim.toTaskId, claim.messageId, "complete");
+			if (!message) throw new TaskMessageLeaseError("Claimed message does not exist");
+			for (;;) {
+				await scope(principal, "complete", claim.toTaskId, message.fromTaskId);
+				const current = await inbox(claim.toTaskId);
+				const completed = await processingRecord(claim.messageId);
+				if (completed) return requireClaim(completed, claim);
+				if (current.value.completion) {
+					requireClaim(current.value.completion, claim);
+					await repair(principal, claim.toTaskId, "complete", claim.messageId);
+					continue;
+				}
+				const time = await requireLiveClaim(principal, claim, current.value);
+				const completion = taskMessageProcessingSchema.parse({
+					...claim,
+					schemaVersion: 1,
+					effectsCommitted: true,
+					completedAt: time.toISOString()
+				});
+				if (!await saveInbox({
+					...current.value,
+					completion
+				}, current.version)) continue;
+				await repair(principal, claim.toTaskId, "complete", claim.messageId);
+				return completion;
+			}
+		},
+		async assertClaim({ principal: context, claim: input }) {
+			const principal = taskMessagePrincipalSchema.parse(context);
+			const claim = taskMessageClaimSchema.parse(input);
+			if (principal.id !== claim.principalId) throw new TaskMessageAuthorizationError("Only the claiming principal may validate this lease");
+			await scope(principal, "claim", claim.toTaskId);
+			const stored = await driver.get("taskMessages", claim.messageId);
+			if (!stored) throw new TaskMessageLeaseError("Claimed message does not exist");
+			const message = parseMessage(stored.value);
+			if (message.id !== claim.messageId || message.toTaskId !== claim.toTaskId) throw new TaskMessageAuthorizationError("Claim does not belong to this recipient");
+			await scope(principal, "claim", claim.toTaskId, message.fromTaskId);
+			await scope(principal, "complete", claim.toTaskId, message.fromTaskId);
+			const completed = await processingRecord(claim.messageId);
+			if (completed) {
+				requireClaim(completed, claim);
+				throw new TaskMessageLeaseError("Message processing is already complete; the claim is no longer active");
+			}
+			await requireLiveClaim(principal, claim, (await inbox(claim.toTaskId)).value);
+		},
+		async discard({ principal: context, toTaskId, messageId, reason: inputReason }) {
+			const principal = taskMessagePrincipalSchema.parse(context);
+			const reason = taskMessageDiscardSchema.shape.reason.parse(inputReason);
+			const message = await readMessage(principal, toTaskId, messageId, "discard");
+			if (!message) throw new TaskMessageError("Cannot discard a missing message");
+			for (;;) {
+				await scope(principal, "discard", toTaskId, message.fromTaskId);
+				const current = await repair(principal, toTaskId, "discard", messageId);
+				const discarded = await discardRecord(messageId);
+				if (discarded) {
+					if (discarded.toTaskId !== toTaskId || discarded.reason !== reason || !isDeepStrictEqual(discarded.by, principal)) throw new TaskMessageConflictError("Message already has a different discard decision");
+					return;
+				}
+				if (await processingRecord(messageId)) throw new TaskMessageConflictError("Processed messages cannot be discarded");
+				if (current.value.pending[0]?.id !== messageId) throw new TaskMessageError("Only the pending inbox head may be discarded");
+				const time = now();
+				if (current.value.lease && Date.parse(current.value.lease.expiresAt) > time.getTime()) throw new TaskMessageLeaseError("Cannot discard while the recipient has an unexpired lease, including a prior Task attempt");
+				const rejection = taskMessageDiscardSchema.parse({
+					schemaVersion: 1,
+					messageId,
+					toTaskId,
+					reason,
+					by: principal,
+					discardedAt: time.toISOString()
+				});
+				if (!await saveInbox({
+					...current.value,
+					lease: void 0,
+					rejection
+				}, current.version)) continue;
+				await repair(principal, toTaskId, "discard", messageId);
+				return;
+			}
+		},
+		async discarded({ principal: context, toTaskId, messageId }) {
+			if (!await readMessage(taskMessagePrincipalSchema.parse(context), toTaskId, messageId, "read")) return null;
+			const record = await discardRecord(messageId);
+			if (record && record.toTaskId !== toTaskId) throw new TaskMessageError("Discard record recipient mismatch");
+			return record;
+		},
+		async processing({ principal: context, toTaskId, messageId }) {
+			if (!await readMessage(taskMessagePrincipalSchema.parse(context), toTaskId, messageId, "read")) return null;
+			const record = await processingRecord(messageId);
+			if (record && record.toTaskId !== toTaskId) throw new TaskMessageError("Processing record recipient mismatch");
+			return record;
+		},
+		effectKey({ messageId, operation }) {
+			taskMessageIdSchema.parse(messageId);
+			z.string().min(1).max(256).parse(operation);
+			return `effect_${hash([messageId, operation])}`;
+		}
+	};
+}
+//#endregion
+export { TaskMessageAuthorizationError, TaskMessageConflictError, TaskMessageError, TaskMessageLeaseError, TaskMessageSourceFenceError, createTaskMessageStore, taskBoundMessagePolicy };
+
+//# sourceMappingURL=task-messages.mjs.map

package/dist/store/task-messages.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-messages.mjs","names":[],"sources":["../../src/store/task-messages.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { WorkNotification } from \"./work-notifications\";\nimport type { DateClock } from \"../schema/common\";\nimport { taskAttemptRefSchema, type TaskAttemptRef } from \"../schema/execution\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport { z } from \"zod\";\nimport { SCHEMA_VERSION } from \"../schema/common\";\nimport { taskIdSchema, type TaskId } from \"../schema/id\";\nimport type { Task } from \"../schema/task\";\nimport {\n  MAX_TASK_INBOX_PENDING,\n  sendTaskMessageInputSchema,\n  taskInboxSchema,\n  taskMessageIdSchema,\n  taskMessageClaimSchema,\n  taskMessagePrincipalSchema,\n  taskMessageProcessingSchema,\n  taskMessageReservationSchema,\n  taskMessageSchema,\n  taskMessageDiscardSchema,\n  type SendTaskMessageInput,\n  type TaskInbox,\n  type TaskMessage,\n  type TaskMessageClaim,\n  type TaskMessageDiscard,\n  type TaskMessageId,\n  type TaskMessagePrincipal,\n  type TaskMessageProcessing,\n  type TaskMessageProtocolBinding,\n  type TaskMessageProtocols,\n} from \"../schema/task-message\";\nimport {\n  RecordExistsError,\n  VersionConflictError,\n  type CollectionName,\n  type StoreDriver,\n} from \"./driver\";\n\n/** Operation categories evaluated by the Task message authorization boundary. */\nexport type TaskMessageAction = \"send\" | \"send_result\" | \"read\" | \"claim\" | \"complete\" | \"discard\";\n/** Principal, requested action, and validated Task scope for one authorization decision. */\nexport interface TaskMessageAuthorizationInput {\n  readonly principal: TaskMessagePrincipal;\n  readonly action: TaskMessageAction;\n  readonly fromTask?: Task;\n  readonly toTask: Task;\n}\n/** Trusted application authorization, NOT HTTP authentication. Only literal true grants access. */\nexport type TaskMessageAuthorize = (\n  input: TaskMessageAuthorizationInput,\n) => boolean | Promise<boolean>;\n/** Engine-owned dependencies and deny-by-default policy used to create a Task message store. */\nexport interface CreateTaskMessageStoreOptions {\n  readonly driver: StoreDriver;\n  readonly now: DateClock;\n  /**\n   * Main engine supplies schema-validated snapshots. Task reads and inbox CAS are separate:\n   * cancellation/retry can race send, claim, and caller effects. The envelope retains expectAttempt;\n   * consumers must fence effects at their application boundary, not assume atomic cancellation here.\n   */\n  readonly getTask: (id: TaskId) => Promise<Task | null>;\n  readonly protocols: TaskMessageProtocols;\n  readonly authorize: TaskMessageAuthorize;\n  readonly notify?: (event: WorkNotification) => Promise<void>;\n}\n\n/** Authenticated principal and immutable message intent used for one send operation. */\nexport interface TaskMessageSendInput<\n  Type extends TaskMessageProtocolBinding = TaskMessageProtocolBinding,\n> {\n  readonly principal: TaskMessagePrincipal;\n  readonly message: SendTaskMessageInput<Type>;\n}\n\n/** Authenticated principal and recipient identifying one Task inbox. */\nexport interface TaskMessageRecipientInput {\n  readonly principal: TaskMessagePrincipal;\n  readonly toTaskId: TaskId;\n}\n\n/** Authenticated principal, recipient, and immutable message identifying one inbox record. */\nexport interface TaskMessageLookupInput extends TaskMessageRecipientInput {\n  readonly messageId: TaskMessageId;\n}\n\n/** Recipient attempt and bounded lease requested when claiming one Task message. */\nexport interface ClaimTaskMessageInput extends Pick<TaskMessageRecipientInput, \"principal\"> {\n  readonly task: TaskAttemptRef;\n  readonly leaseMs: number;\n  readonly recoverCompleted?: boolean;\n}\n\n/** Authenticated lease and committed-effects attestation used to acknowledge one message. */\nexport interface CompleteTaskMessageInput {\n  readonly principal: TaskMessagePrincipal;\n  readonly claim: TaskMessageClaim;\n  readonly effectsCommitted: true;\n}\n\n/** Authenticated lease whose current validity must be checked before an external effect. */\nexport interface AssertTaskMessageClaimInput {\n  readonly principal: TaskMessagePrincipal;\n  readonly claim: TaskMessageClaim;\n}\n\n/** Authorized reason for discarding one exact pending inbox head. */\nexport interface DiscardTaskMessageInput extends TaskMessageLookupInput {\n  readonly reason: string;\n}\n\n/** Message identity and stable operation name used to derive an external-effect key. */\nexport interface TaskMessageEffectKeyInput {\n  readonly messageId: TaskMessageId;\n  readonly operation: string;\n}\n\n/** Message and lease returned when one pending inbox head is claimed. */\nexport interface ClaimTaskMessageResult {\n  readonly claim: TaskMessageClaim;\n  readonly message: TaskMessage;\n}\n\n/** Trusted API for immutable Task messages, recipient inboxes, leases, and acknowledgments. */\nexport interface TaskMessageStore {\n  send<const Type extends TaskMessageProtocolBinding>(\n    input: TaskMessageSendInput<Type>,\n  ): Promise<TaskMessage<Type>>;\n  /** Trusted workflow delivery after the source outcome is persisted; requires separate send_result authorization. */\n  sendResult<const Type extends TaskMessageProtocolBinding>(\n    input: TaskMessageSendInput<Type>,\n  ): Promise<TaskMessage<Type>>;\n  get(input: TaskMessageLookupInput): Promise<TaskMessage | null>;\n  pending(input: TaskMessageRecipientInput): Promise<readonly TaskMessage[]>;\n  /**\n   * A stale attempt-fenced source or cancelled ordinary source raises TaskMessageSourceFenceError\n   * and leaves the head pending. Protocols default to attempt fencing; explicitly task-scoped\n   * protocols let workflow triggers survive source retries. Authorized discard can unblock the inbox.\n   * Source completion alone does not invalidate previously admitted messages from the same attempt.\n   * recoverCompleted defaults to false. It is a trusted application recovery capability for a\n   * succeeded/failed recipient: the caller must first validate an exact persisted decision for\n   * the pending message, then verify the claimed message matches it. It authorizes no new effects,\n   * never permits cancellation recovery, and does not bypass the authorization callback.\n   */\n  claim(input: ClaimTaskMessageInput): Promise<ClaimTaskMessageResult | null>;\n  /**\n   * Call only after effects commit. A matching recipient attempt may acknowledge in any state,\n   * including cancellation; acknowledgment authorizes no new effects. Leases are not exactly-once.\n   */\n  complete(input: CompleteTaskMessageInput): Promise<TaskMessageProcessing>;\n  /** Read-only claim/complete-authorized lease snapshot check, not a lease extension or external effect fence. Completed claims are invalid. */\n  assertClaim(input: AssertTaskMessageClaimInput): Promise<void>;\n  /** Discard only the pending head with no unexpired recipient lease, under explicit discard authorization. */\n  discard(input: DiscardTaskMessageInput): Promise<void>;\n  discarded(input: TaskMessageLookupInput): Promise<TaskMessageDiscard | null>;\n  processing(input: TaskMessageLookupInput): Promise<TaskMessageProcessing | null>;\n  /** Pure key derivation, not a read or an authorization capability. */\n  effectKey(input: TaskMessageEffectKeyInput): string;\n}\n/** Base error for Task message admission, authorization, and processing failures. */\nexport class TaskMessageError extends Error {}\n/** Error raised when an idempotency key is reused with different message intent. */\nexport class TaskMessageConflictError extends TaskMessageError {}\n/** Error raised when a configured Task message policy does not grant an operation. */\nexport class TaskMessageAuthorizationError extends TaskMessageError {}\n/** Error raised when a Task inbox claim is expired, replaced, or otherwise invalid. */\nexport class TaskMessageLeaseError extends TaskMessageError {}\n/** Error raised when an inbox head belongs to a stale or cancelled source attempt. */\nexport class TaskMessageSourceFenceError extends TaskMessageError {\n  constructor(\n    readonly messageId: TaskMessageId,\n    readonly source: TaskAttemptRef,\n    readonly currentAttempt: number,\n    readonly sourceState: Task[\"state\"],\n  ) {\n    super(\n      `Inbox blocked by message ${messageId}: source ${source.taskId} attempt ${source.attempt}, current attempt ${currentAttempt}, state ${sourceState}. Message remains pending; an explicitly authorized discard is required to unblock this inbox.`,\n    );\n    this.name = \"TaskMessageSourceFenceError\";\n  }\n}\n\n/**\n * Authorizes recipient-local operations and direct parent-child sends for a trusted\n * Task-bound principal while denying result delivery and discard.\n */\nexport const taskBoundMessagePolicy: TaskMessageAuthorize = ({\n  principal,\n  action,\n  fromTask,\n  toTask,\n}) => {\n  if (action === \"discard\" || action === \"send_result\") return false;\n  if (action !== \"send\") return principal.taskId === toTask.id;\n  if (!fromTask || !principal.taskId) return false;\n  return (\n    principal.taskId === fromTask.id &&\n    (fromTask.parentTaskId === toTask.id || toTask.parentTaskId === fromTask.id)\n  );\n};\nconst claimOptionsSchema = z.strictObject({\n  leaseMs: z\n    .number()\n    .int()\n    .min(1)\n    .max(300_000)\n    .describe(\"Processing lease duration, at most five minutes.\"),\n  recoverCompleted: z\n    .boolean()\n    .default(false)\n    .describe(\n      \"Trusted recovery of an exact existing decision on a succeeded/failed recipient at the same attempt; not permission for new effects or cancelled Tasks.\",\n    ),\n});\nconst acknowledgmentSchema = z.strictObject({\n  effectsCommitted: z.literal(true).describe(\"Effects committed before this acknowledgment.\"),\n});\nconst hash = (parts: readonly string[]): string =>\n  createHash(\"sha256\").update(JSON.stringify(parts)).digest(\"hex\");\nconst messageIdFor = (source: TaskId, operation: string): TaskMessageId =>\n  taskMessageIdSchema.parse(`msg_${hash([source, operation])}`);\nconst messageContent = ({ createdAt: _createdAt, ...content }: TaskMessage) => content;\nconst retryable = (error: unknown): boolean =>\n  error instanceof VersionConflictError || error instanceof RecordExistsError;\n\n/** Creates the trusted, CAS-backed Task message and recipient-inbox store. */\nexport function createTaskMessageStore(options: CreateTaskMessageStoreOptions): TaskMessageStore {\n  const { driver, now, getTask, protocols, authorize } = options;\n  if (typeof authorize !== \"function\")\n    throw new TaskMessageAuthorizationError(\n      \"Task messages require an explicit authorize callback; no access is granted by default\",\n    );\n\n  async function task(id: TaskId): Promise<Task> {\n    const value = await getTask(taskIdSchema.parse(id));\n    if (!value || value.id !== id) throw new TaskMessageError(`Missing Task ${id}`);\n    taskIdSchema.parse(value.rootTaskId);\n    return value;\n  }\n  async function scope(\n    principal: TaskMessagePrincipal,\n    action: TaskMessageAction,\n    toTaskId: TaskId,\n    fromTaskId?: TaskId,\n  ) {\n    const toTask = await task(toTaskId);\n    const fromTask = fromTaskId === undefined ? undefined : await task(fromTaskId);\n    if (fromTask && fromTask.rootTaskId !== toTask.rootTaskId)\n      throw new TaskMessageAuthorizationError(\"Cross-root Task messages are not permitted\");\n    if (\n      (action === \"send\" || action === \"send_result\") &&\n      principal.taskId !== undefined &&\n      principal.taskId !== fromTaskId\n    ) {\n      throw new TaskMessageAuthorizationError(\"Task-bound sender must equal fromTaskId\");\n    }\n    if ((await authorize(structuredClone({ principal, action, fromTask, toTask }))) !== true) {\n      throw new TaskMessageAuthorizationError(`Task message ${action} denied for ${principal.id}`);\n    }\n    return { fromTask, toTask };\n  }\n  function matchingAttempt(value: Task, expected: number): void {\n    if (value.attempt !== expected)\n      throw new TaskMessageError(\n        `Task ${value.id} requires current attempt ${value.attempt}; received ${expected}`,\n      );\n  }\n  function activeAttempt(value: Task, expected: number): void {\n    if (value.attempt !== expected || ![\"queued\", \"running\", \"needs_human\"].includes(value.state)) {\n      throw new TaskMessageError(\n        `Task ${value.id} requires current attempt ${value.attempt} and queued, running, or needs_human state`,\n      );\n    }\n  }\n  function resultAttempt(value: Task, expected: number): void {\n    matchingAttempt(value, expected);\n    if (![\"succeeded\", \"failed\", \"cancelled\"].includes(value.state)) {\n      throw new TaskMessageError(\n        `Task ${value.id} requires a persisted succeeded, failed, or cancelled outcome for result delivery`,\n      );\n    }\n  }\n  function claimableAttempt(value: Task, expected: number, recoverCompleted: boolean): void {\n    if (recoverCompleted && (value.state === \"succeeded\" || value.state === \"failed\"))\n      matchingAttempt(value, expected);\n    else activeAttempt(value, expected);\n  }\n  function parseMessage(value: unknown): TaskMessage {\n    // Zod retains explicit undefined, but JSON drivers omit it from immutable envelopes.\n    const { causationId, delivery, ...message } = taskMessageSchema.parse(value);\n    if (message.id !== messageIdFor(message.fromTaskId, message.operationId))\n      throw new TaskMessageConflictError(\n        \"Stored message ID does not match its source and operation\",\n      );\n    return {\n      ...message,\n      ...(causationId === undefined ? {} : { causationId }),\n      ...(delivery === undefined ? {} : { delivery }),\n      payload: protocols.validateStored(message.type, message.payload),\n    };\n  }\n  function correlateMessage<const Type extends TaskMessageProtocolBinding>(\n    message: TaskMessage,\n    type: Type,\n  ): TaskMessage<Type> {\n    if (message.type.id !== type.id || message.type.version !== type.version)\n      throw new TaskMessageConflictError(\"Message protocol differs from its send intent\");\n    const payload = protocols.validateStored(type, message.payload);\n    return structuredClone({ ...message, payload }) as TaskMessage<Type>;\n  }\n  async function deliveredMessage(intent: TaskMessage): Promise<TaskMessage | null> {\n    const stored = await driver.get(\"taskMessages\", intent.id);\n    if (!stored) return null;\n    const delivered = parseMessage(stored.value);\n    if (!isDeepStrictEqual(messageContent(delivered), messageContent(intent))) {\n      throw new TaskMessageConflictError(\n        `Operation ${intent.operationId} was reused with different content or attempt`,\n      );\n    }\n    return delivered;\n  }\n  async function immutable<T>(\n    collection: CollectionName,\n    id: string,\n    value: T,\n    parse: (value: unknown) => T,\n  ): Promise<T> {\n    const validated = parse(value);\n    try {\n      await driver.insert({ collection, id, value: validated });\n    } catch (error) {\n      if (!(error instanceof RecordExistsError)) throw error;\n      const stored = await driver.get(collection, id);\n      if (!stored || !isDeepStrictEqual(parse(stored.value), validated))\n        throw new TaskMessageConflictError(`Immutable record ${id} has different content`);\n    }\n    return validated;\n  }\n  async function inbox(toTaskId: TaskId) {\n    const stored = await driver.get(\"taskInboxes\", toTaskId);\n    const value = stored\n      ? taskInboxSchema.parse(stored.value)\n      : taskInboxSchema.parse({\n          schemaVersion: SCHEMA_VERSION,\n          toTaskId,\n          generation: 0,\n          pending: [],\n        });\n    if (value.toTaskId !== toTaskId) throw new TaskMessageError(\"Stored inbox recipient mismatch\");\n    value.pending = value.pending.map(parseMessage);\n    return { value, version: stored?.version };\n  }\n  async function saveInbox(value: TaskInbox, version: number | undefined): Promise<boolean> {\n    const validated = taskInboxSchema.parse(value);\n    try {\n      if (version === undefined)\n        await driver.insert({ collection: \"taskInboxes\", id: value.toTaskId, value: validated });\n      else\n        await driver.update({\n          collection: \"taskInboxes\",\n          id: value.toTaskId,\n          value: validated,\n          expectedVersion: version,\n        });\n      return true;\n    } catch (error) {\n      if (retryable(error)) return false;\n      throw error;\n    }\n  }\n  async function repair(\n    principal: TaskMessagePrincipal,\n    toTaskId: TaskId,\n    action: TaskMessageAction,\n    targetId?: TaskMessageId,\n  ) {\n    for (;;) {\n      await scope(principal, action, toTaskId);\n      const current = await inbox(toTaskId);\n      // Repair only projects validated, previously admitted intents and CAS-accepted resolutions.\n      // Callers must authorize each message they return or act on, not unrelated repair records.\n      for (const message of current.value.pending) {\n        if (targetId !== undefined && message.id !== targetId) continue;\n        await immutable(\"taskMessages\", message.id, message, parseMessage);\n      }\n      const { completion, rejection } = current.value;\n      const resolved = completion ?? rejection;\n      if (!resolved || (targetId !== undefined && resolved.messageId !== targetId)) return current;\n      if (completion)\n        await immutable(\"taskMessageProcessing\", completion.messageId, completion, (value) =>\n          taskMessageProcessingSchema.parse(value),\n        );\n      if (rejection)\n        await immutable(\"taskMessageDiscards\", rejection.messageId, rejection, (value) =>\n          taskMessageDiscardSchema.parse(value),\n        );\n      const next = {\n        ...current.value,\n        pending: current.value.pending.filter((message) => message.id !== resolved.messageId),\n        lease: undefined,\n        completion: undefined,\n        rejection: undefined,\n      };\n      if (await saveInbox(next, current.version)) continue;\n    }\n  }\n  async function reserve(message: TaskMessage, expectAttempt: number): Promise<TaskMessage> {\n    const key = `reservation_${message.id}`;\n    const reservation = taskMessageReservationSchema.parse({\n      schemaVersion: SCHEMA_VERSION,\n      message,\n      expectAttempt,\n    });\n    try {\n      await driver.insert({ collection: \"taskMessageProcessing\", id: key, value: reservation });\n      return message;\n    } catch (error) {\n      if (!(error instanceof RecordExistsError)) throw error;\n      const stored = await driver.get(\"taskMessageProcessing\", key);\n      if (!stored)\n        throw new TaskMessageConflictError(`Missing operation reservation ${message.id}`);\n      const existing = taskMessageReservationSchema.parse(stored.value);\n      const original = parseMessage(existing.message);\n      if (\n        existing.expectAttempt !== expectAttempt ||\n        !isDeepStrictEqual(messageContent(original), messageContent(message))\n      ) {\n        throw new TaskMessageConflictError(\n          `Operation ${message.operationId} was reused with different content or attempt`,\n        );\n      }\n      return original;\n    }\n  }\n  async function readMessage(\n    principal: TaskMessagePrincipal,\n    toTaskId: TaskId,\n    messageId: TaskMessageId,\n    action: TaskMessageAction,\n  ): Promise<TaskMessage | null> {\n    taskMessageIdSchema.parse(messageId);\n    await scope(principal, action, toTaskId);\n    await repair(principal, toTaskId, action, messageId);\n    const stored = await driver.get(\"taskMessages\", messageId);\n    if (!stored) return null;\n    const message = parseMessage(stored.value);\n    if (message.id !== messageId || message.toTaskId !== toTaskId)\n      throw new TaskMessageAuthorizationError(\"Message does not belong to this recipient\");\n    await scope(principal, action, toTaskId, message.fromTaskId);\n    return message;\n  }\n  async function processingRecord(messageId: TaskMessageId): Promise<TaskMessageProcessing | null> {\n    const stored = await driver.get(\"taskMessageProcessing\", messageId);\n    if (!stored) return null;\n    const record = taskMessageProcessingSchema.parse(stored.value);\n    if (record.messageId !== messageId)\n      throw new TaskMessageError(\"Processing record identity mismatch\");\n    return record;\n  }\n  async function discardRecord(messageId: TaskMessageId): Promise<TaskMessageDiscard | null> {\n    const stored = await driver.get(\"taskMessageDiscards\", messageId);\n    if (!stored) return null;\n    const record = taskMessageDiscardSchema.parse(stored.value);\n    if (record.messageId !== messageId)\n      throw new TaskMessageError(\"Discard record identity mismatch\");\n    return record;\n  }\n  async function requireLiveClaim(\n    principal: TaskMessagePrincipal,\n    claim: TaskMessageClaim,\n    current: TaskInbox,\n  ): Promise<Date> {\n    if (principal.id !== claim.principalId)\n      throw new TaskMessageAuthorizationError(\n        \"Only the claiming principal may validate this lease\",\n      );\n    matchingAttempt(await task(claim.toTaskId), claim.attempt);\n    const time = now();\n    if (\n      current.completion ||\n      current.rejection ||\n      current.generation !== claim.generation ||\n      !isDeepStrictEqual(current.lease, claim) ||\n      Date.parse(claim.expiresAt) <= time.getTime()\n    ) {\n      throw new TaskMessageLeaseError(\n        \"Lease expired, resolved, or was replaced; claim again before processing\",\n      );\n    }\n    return time;\n  }\n  function requireClaim(\n    record: TaskMessageProcessing,\n    claim: TaskMessageClaim,\n  ): TaskMessageProcessing {\n    const {\n      schemaVersion: _schemaVersion,\n      completedAt: _completedAt,\n      effectsCommitted: _effectsCommitted,\n      ...accepted\n    } = record;\n    if (!isDeepStrictEqual(accepted, claim))\n      throw new TaskMessageLeaseError(\n        \"Processing acknowledgment belongs to a different lease generation\",\n      );\n    return record;\n  }\n\n  async function send<const Type extends TaskMessageProtocolBinding>(\n    context: TaskMessagePrincipal,\n    input: SendTaskMessageInput<Type>,\n    delivery?: \"result\",\n  ): Promise<TaskMessage<Type>> {\n    const principal = taskMessagePrincipalSchema.parse(context);\n    const parsed = sendTaskMessageInputSchema.parse(input);\n    const payload = protocols.validate(input.type, parsed.payload);\n    const { expectAttempt } = parsed;\n    const action = delivery === \"result\" ? \"send_result\" : \"send\";\n    await scope(principal, action, parsed.toTaskId, parsed.fromTaskId);\n    const intent = correlateMessage(\n      parseMessage({\n        ...parsed,\n        payload,\n        delivery,\n        schemaVersion: SCHEMA_VERSION,\n        id: messageIdFor(parsed.fromTaskId, parsed.operationId),\n        createdAt: now().toISOString(),\n      }),\n      input.type,\n    );\n    const delivered = await deliveredMessage(intent);\n    if (delivery === \"result\") resultAttempt(await task(parsed.fromTaskId), expectAttempt);\n    if (delivered) return correlateMessage(delivered, input.type);\n    if (delivery !== \"result\") activeAttempt(await task(parsed.fromTaskId), expectAttempt);\n    const recipient = await task(parsed.toTaskId);\n    activeAttempt(recipient, recipient.attempt);\n    if (parsed.causationId) {\n      const stored = await driver.get(\"taskMessages\", parsed.causationId);\n      if (!stored)\n        throw new TaskMessageError(\"Causation message must already be durably delivered\");\n      const cause = parseMessage(stored.value);\n      await scope(principal, \"read\", cause.toTaskId, cause.fromTaskId);\n      if ((await task(cause.toTaskId)).rootTaskId !== recipient.rootTaskId)\n        throw new TaskMessageAuthorizationError(\"Causation must stay within the Task root\");\n    }\n    const message = correlateMessage(await reserve(intent, expectAttempt), input.type);\n    for (;;) {\n      await scope(principal, action, message.toTaskId, message.fromTaskId);\n      const current = await inbox(message.toTaskId);\n      const delivered = await deliveredMessage(message);\n      if (delivery === \"result\") resultAttempt(await task(message.fromTaskId), expectAttempt);\n      if (delivered) return correlateMessage(delivered, input.type);\n      if (delivery !== \"result\") activeAttempt(await task(message.fromTaskId), expectAttempt);\n      const recipient = await task(message.toTaskId);\n      activeAttempt(recipient, recipient.attempt);\n      const pending = current.value.pending.find((entry) => entry.id === message.id);\n      if (pending) {\n        if (!isDeepStrictEqual(pending, message))\n          throw new TaskMessageConflictError(\"Inbox message differs from reserved intent\");\n      } else {\n        if (current.value.pending.length >= MAX_TASK_INBOX_PENDING)\n          throw new TaskMessageError(\n            `Recipient inbox is full; maximum ${MAX_TASK_INBOX_PENDING} pending messages`,\n          );\n        if (\n          !(await saveInbox(\n            { ...current.value, pending: [...current.value.pending, message] },\n            current.version,\n          ))\n        )\n          continue;\n      }\n      return correlateMessage(\n        await immutable(\"taskMessages\", message.id, message, parseMessage),\n        input.type,\n      );\n    }\n  }\n\n  async function sendAndNotify<const Type extends TaskMessageProtocolBinding>(\n    principal: TaskMessagePrincipal,\n    input: SendTaskMessageInput<Type>,\n    delivery?: \"result\",\n  ): Promise<TaskMessage<Type>> {\n    const message = await send(principal, input, delivery);\n    if (options.notify) {\n      const recipient = await task(message.toTaskId);\n      await options.notify({ rootTaskId: recipient.rootTaskId, key: `message:${message.id}` });\n    }\n    return message;\n  }\n\n  return {\n    send: ({ principal, message }) => sendAndNotify(principal, message),\n    sendResult: ({ principal, message }) => sendAndNotify(principal, message, \"result\"),\n    async get({ principal: context, toTaskId, messageId }) {\n      return readMessage(taskMessagePrincipalSchema.parse(context), toTaskId, messageId, \"read\");\n    },\n    async pending({ principal: context, toTaskId }) {\n      const principal = taskMessagePrincipalSchema.parse(context);\n      const current = await repair(principal, toTaskId, \"read\");\n      for (const message of current.value.pending)\n        await scope(principal, \"read\", toTaskId, message.fromTaskId);\n      return current.value.pending;\n    },\n    async claim({ principal: context, task: inputTask, ...input }) {\n      const principal = taskMessagePrincipalSchema.parse(context);\n      const { taskId: toTaskId, attempt } = taskAttemptRefSchema.parse(inputTask);\n      const { leaseMs, recoverCompleted } = claimOptionsSchema.parse(input);\n      for (;;) {\n        const current = await repair(principal, toTaskId, \"claim\");\n        const message = current.value.pending[0];\n        if (message) await scope(principal, \"claim\", toTaskId, message.fromTaskId);\n        const recipient = await task(toTaskId);\n        claimableAttempt(recipient, attempt, recoverCompleted);\n        if (\n          current.value.lease &&\n          current.value.lease.attempt === recipient.attempt &&\n          Date.parse(current.value.lease.expiresAt) > now().getTime()\n        )\n          return null;\n        if (!message) return null;\n        const source = await task(message.fromTaskId);\n        const attemptFenced = protocols.sourceFence(message.type) === \"attempt\";\n        if (\n          (attemptFenced && source.attempt !== message.expectAttempt) ||\n          (source.state === \"cancelled\" && message.delivery !== \"result\")\n        ) {\n          throw new TaskMessageSourceFenceError(\n            message.id,\n            { taskId: source.id, attempt: message.expectAttempt },\n            source.attempt,\n            source.state,\n          );\n        }\n        claimableAttempt(await task(toTaskId), attempt, recoverCompleted);\n        const time = now();\n        const claim = taskMessageClaimSchema.parse({\n          messageId: message.id,\n          toTaskId,\n          generation: current.value.generation + 1,\n          principalId: principal.id,\n          attempt,\n          expiresAt: new Date(time.getTime() + leaseMs).toISOString(),\n        });\n        if (\n          await saveInbox(\n            { ...current.value, generation: claim.generation, lease: claim },\n            current.version,\n          )\n        )\n          return { claim, message };\n      }\n    },\n    async complete({ principal: context, claim: input, effectsCommitted }) {\n      const principal = taskMessagePrincipalSchema.parse(context);\n      const claim = taskMessageClaimSchema.parse(input);\n      acknowledgmentSchema.parse({ effectsCommitted });\n      if (principal.id !== claim.principalId)\n        throw new TaskMessageAuthorizationError(\n          \"Only the claiming principal may acknowledge processing\",\n        );\n      const message = await readMessage(principal, claim.toTaskId, claim.messageId, \"complete\");\n      if (!message) throw new TaskMessageLeaseError(\"Claimed message does not exist\");\n      for (;;) {\n        await scope(principal, \"complete\", claim.toTaskId, message.fromTaskId);\n        const current = await inbox(claim.toTaskId);\n        const completed = await processingRecord(claim.messageId);\n        if (completed) return requireClaim(completed, claim);\n        if (current.value.completion) {\n          requireClaim(current.value.completion, claim);\n          await repair(principal, claim.toTaskId, \"complete\", claim.messageId);\n          continue;\n        }\n        const time = await requireLiveClaim(principal, claim, current.value);\n        const completion = taskMessageProcessingSchema.parse({\n          ...claim,\n          schemaVersion: SCHEMA_VERSION,\n          effectsCommitted: true,\n          completedAt: time.toISOString(),\n        });\n        // The inbox CAS accepts the acknowledgment before its immutable record is written.\n        // A replaced generation cannot commit here, even if its earlier read was valid.\n        if (!(await saveInbox({ ...current.value, completion }, current.version))) continue;\n        await repair(principal, claim.toTaskId, \"complete\", claim.messageId);\n        return completion;\n      }\n    },\n    async assertClaim({ principal: context, claim: input }) {\n      const principal = taskMessagePrincipalSchema.parse(context);\n      const claim = taskMessageClaimSchema.parse(input);\n      if (principal.id !== claim.principalId)\n        throw new TaskMessageAuthorizationError(\n          \"Only the claiming principal may validate this lease\",\n        );\n      await scope(principal, \"claim\", claim.toTaskId);\n      const stored = await driver.get(\"taskMessages\", claim.messageId);\n      if (!stored) throw new TaskMessageLeaseError(\"Claimed message does not exist\");\n      const message = parseMessage(stored.value);\n      if (message.id !== claim.messageId || message.toTaskId !== claim.toTaskId)\n        throw new TaskMessageAuthorizationError(\"Claim does not belong to this recipient\");\n      await scope(principal, \"claim\", claim.toTaskId, message.fromTaskId);\n      await scope(principal, \"complete\", claim.toTaskId, message.fromTaskId);\n      const completed = await processingRecord(claim.messageId);\n      if (completed) {\n        requireClaim(completed, claim);\n        throw new TaskMessageLeaseError(\n          \"Message processing is already complete; the claim is no longer active\",\n        );\n      }\n      await requireLiveClaim(principal, claim, (await inbox(claim.toTaskId)).value);\n    },\n    async discard({ principal: context, toTaskId, messageId, reason: inputReason }) {\n      const principal = taskMessagePrincipalSchema.parse(context);\n      const reason = taskMessageDiscardSchema.shape.reason.parse(inputReason);\n      const message = await readMessage(principal, toTaskId, messageId, \"discard\");\n      if (!message) throw new TaskMessageError(\"Cannot discard a missing message\");\n      for (;;) {\n        await scope(principal, \"discard\", toTaskId, message.fromTaskId);\n        const current = await repair(principal, toTaskId, \"discard\", messageId);\n        const discarded = await discardRecord(messageId);\n        if (discarded) {\n          if (\n            discarded.toTaskId !== toTaskId ||\n            discarded.reason !== reason ||\n            !isDeepStrictEqual(discarded.by, principal)\n          )\n            throw new TaskMessageConflictError(\"Message already has a different discard decision\");\n          return;\n        }\n        if (await processingRecord(messageId))\n          throw new TaskMessageConflictError(\"Processed messages cannot be discarded\");\n        if (current.value.pending[0]?.id !== messageId)\n          throw new TaskMessageError(\"Only the pending inbox head may be discarded\");\n        const time = now();\n        if (current.value.lease && Date.parse(current.value.lease.expiresAt) > time.getTime())\n          throw new TaskMessageLeaseError(\n            \"Cannot discard while the recipient has an unexpired lease, including a prior Task attempt\",\n          );\n        const rejection = taskMessageDiscardSchema.parse({\n          schemaVersion: SCHEMA_VERSION,\n          messageId,\n          toTaskId,\n          reason,\n          by: principal,\n          discardedAt: time.toISOString(),\n        });\n        if (!(await saveInbox({ ...current.value, lease: undefined, rejection }, current.version)))\n          continue;\n        await repair(principal, toTaskId, \"discard\", messageId);\n        return;\n      }\n    },\n    async discarded({ principal: context, toTaskId, messageId }) {\n      const principal = taskMessagePrincipalSchema.parse(context);\n      if (!(await readMessage(principal, toTaskId, messageId, \"read\"))) return null;\n      const record = await discardRecord(messageId);\n      if (record && record.toTaskId !== toTaskId)\n        throw new TaskMessageError(\"Discard record recipient mismatch\");\n      return record;\n    },\n    async processing({ principal: context, toTaskId, messageId }) {\n      const principal = taskMessagePrincipalSchema.parse(context);\n      if (!(await readMessage(principal, toTaskId, messageId, \"read\"))) return null;\n      const record = await processingRecord(messageId);\n      if (record && record.toTaskId !== toTaskId)\n        throw new TaskMessageError(\"Processing record recipient mismatch\");\n      return record;\n    },\n    effectKey({ messageId, operation }) {\n      taskMessageIdSchema.parse(messageId);\n      z.string().min(1).max(256).parse(operation);\n      return `effect_${hash([messageId, operation])}`;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;AA+JA,IAAa,mBAAb,cAAsC,MAAM,CAAC;;AAE7C,IAAa,2BAAb,cAA8C,iBAAiB,CAAC;;AAEhE,IAAa,gCAAb,cAAmD,iBAAiB,CAAC;;AAErE,IAAa,wBAAb,cAA2C,iBAAiB,CAAC;;AAE7D,IAAa,8BAAb,cAAiD,iBAAiB;CAErD;CACA;CACA;CACA;CAJX,YACE,WACA,QACA,gBACA,aACA;EACA,MACE,4BAA4B,UAAU,WAAW,OAAO,OAAO,WAAW,OAAO,QAAQ,oBAAoB,eAAe,UAAU,YAAY,+FACpJ;EAPS,KAAA,YAAA;EACA,KAAA,SAAA;EACA,KAAA,iBAAA;EACA,KAAA,cAAA;EAKT,KAAK,OAAO;CACd;AACF;;;;;AAMA,MAAa,0BAAgD,EAC3D,WACA,QACA,UACA,aACI;CACJ,IAAI,WAAW,aAAa,WAAW,eAAe,OAAO;CAC7D,IAAI,WAAW,QAAQ,OAAO,UAAU,WAAW,OAAO;CAC1D,IAAI,CAAC,YAAY,CAAC,UAAU,QAAQ,OAAO;CAC3C,OACE,UAAU,WAAW,SAAS,OAC7B,SAAS,iBAAiB,OAAO,MAAM,OAAO,iBAAiB,SAAS;AAE7E;AACA,MAAM,qBAAqB,EAAE,aAAa;CACxC,SAAS,EACN,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,IAAI,GAAO,CAAC,CACZ,SAAS,kDAAkD;CAC9D,kBAAkB,EACf,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,wJACF;AACJ,CAAC;AACD,MAAM,uBAAuB,EAAE,aAAa,EAC1C,kBAAkB,EAAE,QAAQ,IAAI,CAAC,CAAC,SAAS,+CAA+C,EAC5F,CAAC;AACD,MAAM,QAAQ,UACZ,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK;AACjE,MAAM,gBAAgB,QAAgB,cACpC,oBAAoB,MAAM,OAAO,KAAK,CAAC,QAAQ,SAAS,CAAC,GAAG;AAC9D,MAAM,kBAAkB,EAAE,WAAW,YAAY,GAAG,cAA2B;AAC/E,MAAM,aAAa,UACjB,iBAAiB,wBAAwB,iBAAiB;;AAG5D,SAAgB,uBAAuB,SAA0D;CAC/F,MAAM,EAAE,QAAQ,KAAK,SAAS,WAAW,cAAc;CACvD,IAAI,OAAO,cAAc,YACvB,MAAM,IAAI,8BACR,uFACF;CAEF,eAAe,KAAK,IAA2B;EAC7C,MAAM,QAAQ,MAAM,QAAQ,aAAa,MAAM,EAAE,CAAC;EAClD,IAAI,CAAC,SAAS,MAAM,OAAO,IAAI,MAAM,IAAI,iBAAiB,gBAAgB,IAAI;EAC9E,aAAa,MAAM,MAAM,UAAU;EACnC,OAAO;CACT;CACA,eAAe,MACb,WACA,QACA,UACA,YACA;EACA,MAAM,SAAS,MAAM,KAAK,QAAQ;EAClC,MAAM,WAAW,eAAe,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,UAAU;EAC7E,IAAI,YAAY,SAAS,eAAe,OAAO,YAC7C,MAAM,IAAI,8BAA8B,4CAA4C;EACtF,KACG,WAAW,UAAU,WAAW,kBACjC,UAAU,WAAW,KAAA,KACrB,UAAU,WAAW,YAErB,MAAM,IAAI,8BAA8B,yCAAyC;EAEnF,IAAK,MAAM,UAAU,gBAAgB;GAAE;GAAW;GAAQ;GAAU;EAAO,CAAC,CAAC,MAAO,MAClF,MAAM,IAAI,8BAA8B,gBAAgB,OAAO,cAAc,UAAU,IAAI;EAE7F,OAAO;GAAE;GAAU;EAAO;CAC5B;CACA,SAAS,gBAAgB,OAAa,UAAwB;EAC5D,IAAI,MAAM,YAAY,UACpB,MAAM,IAAI,iBACR,QAAQ,MAAM,GAAG,4BAA4B,MAAM,QAAQ,aAAa,UAC1E;CACJ;CACA,SAAS,cAAc,OAAa,UAAwB;EAC1D,IAAI,MAAM,YAAY,YAAY,CAAC;GAAC;GAAU;GAAW;EAAa,CAAC,CAAC,SAAS,MAAM,KAAK,GAC1F,MAAM,IAAI,iBACR,QAAQ,MAAM,GAAG,4BAA4B,MAAM,QAAQ,2CAC7D;CAEJ;CACA,SAAS,cAAc,OAAa,UAAwB;EAC1D,gBAAgB,OAAO,QAAQ;EAC/B,IAAI,CAAC;GAAC;GAAa;GAAU;EAAW,CAAC,CAAC,SAAS,MAAM,KAAK,GAC5D,MAAM,IAAI,iBACR,QAAQ,MAAM,GAAG,kFACnB;CAEJ;CACA,SAAS,iBAAiB,OAAa,UAAkB,kBAAiC;EACxF,IAAI,qBAAqB,MAAM,UAAU,eAAe,MAAM,UAAU,WACtE,gBAAgB,OAAO,QAAQ;OAC5B,cAAc,OAAO,QAAQ;CACpC;CACA,SAAS,aAAa,OAA6B;EAEjD,MAAM,EAAE,aAAa,UAAU,GAAG,YAAY,kBAAkB,MAAM,KAAK;EAC3E,IAAI,QAAQ,OAAO,aAAa,QAAQ,YAAY,QAAQ,WAAW,GACrE,MAAM,IAAI,yBACR,2DACF;EACF,OAAO;GACL,GAAG;GACH,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;GACnD,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS;GAC7C,SAAS,UAAU,eAAe,QAAQ,MAAM,QAAQ,OAAO;EACjE;CACF;CACA,SAAS,iBACP,SACA,MACmB;EACnB,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM,QAAQ,KAAK,YAAY,KAAK,SAC/D,MAAM,IAAI,yBAAyB,+CAA+C;EACpF,MAAM,UAAU,UAAU,eAAe,MAAM,QAAQ,OAAO;EAC9D,OAAO,gBAAgB;GAAE,GAAG;GAAS;EAAQ,CAAC;CAChD;CACA,eAAe,iBAAiB,QAAkD;EAChF,MAAM,SAAS,MAAM,OAAO,IAAI,gBAAgB,OAAO,EAAE;EACzD,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,YAAY,aAAa,OAAO,KAAK;EAC3C,IAAI,CAAC,kBAAkB,eAAe,SAAS,GAAG,eAAe,MAAM,CAAC,GACtE,MAAM,IAAI,yBACR,aAAa,OAAO,YAAY,8CAClC;EAEF,OAAO;CACT;CACA,eAAe,UACb,YACA,IACA,OACA,OACY;EACZ,MAAM,YAAY,MAAM,KAAK;EAC7B,IAAI;GACF,MAAM,OAAO,OAAO;IAAE;IAAY;IAAI,OAAO;GAAU,CAAC;EAC1D,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,oBAAoB,MAAM;GACjD,MAAM,SAAS,MAAM,OAAO,IAAI,YAAY,EAAE;GAC9C,IAAI,CAAC,UAAU,CAAC,kBAAkB,MAAM,OAAO,KAAK,GAAG,SAAS,GAC9D,MAAM,IAAI,yBAAyB,oBAAoB,GAAG,uBAAuB;EACrF;EACA,OAAO;CACT;CACA,eAAe,MAAM,UAAkB;EACrC,MAAM,SAAS,MAAM,OAAO,IAAI,eAAe,QAAQ;EACvD,MAAM,QAAQ,SACV,gBAAgB,MAAM,OAAO,KAAK,IAClC,gBAAgB,MAAM;GACpB,eAAA;GACA;GACA,YAAY;GACZ,SAAS,CAAC;EACZ,CAAC;EACL,IAAI,MAAM,aAAa,UAAU,MAAM,IAAI,iBAAiB,iCAAiC;EAC7F,MAAM,UAAU,MAAM,QAAQ,IAAI,YAAY;EAC9C,OAAO;GAAE;GAAO,SAAS,QAAQ;EAAQ;CAC3C;CACA,eAAe,UAAU,OAAkB,SAA+C;EACxF,MAAM,YAAY,gBAAgB,MAAM,KAAK;EAC7C,IAAI;GACF,IAAI,YAAY,KAAA,GACd,MAAM,OAAO,OAAO;IAAE,YAAY;IAAe,IAAI,MAAM;IAAU,OAAO;GAAU,CAAC;QAEvF,MAAM,OAAO,OAAO;IAClB,YAAY;IACZ,IAAI,MAAM;IACV,OAAO;IACP,iBAAiB;GACnB,CAAC;GACH,OAAO;EACT,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,GAAG,OAAO;GAC7B,MAAM;EACR;CACF;CACA,eAAe,OACb,WACA,UACA,QACA,UACA;EACA,SAAS;GACP,MAAM,MAAM,WAAW,QAAQ,QAAQ;GACvC,MAAM,UAAU,MAAM,MAAM,QAAQ;GAGpC,KAAK,MAAM,WAAW,QAAQ,MAAM,SAAS;IAC3C,IAAI,aAAa,KAAA,KAAa,QAAQ,OAAO,UAAU;IACvD,MAAM,UAAU,gBAAgB,QAAQ,IAAI,SAAS,YAAY;GACnE;GACA,MAAM,EAAE,YAAY,cAAc,QAAQ;GAC1C,MAAM,WAAW,cAAc;GAC/B,IAAI,CAAC,YAAa,aAAa,KAAA,KAAa,SAAS,cAAc,UAAW,OAAO;GACrF,IAAI,YACF,MAAM,UAAU,yBAAyB,WAAW,WAAW,aAAa,UAC1E,4BAA4B,MAAM,KAAK,CACzC;GACF,IAAI,WACF,MAAM,UAAU,uBAAuB,UAAU,WAAW,YAAY,UACtE,yBAAyB,MAAM,KAAK,CACtC;GAQF,IAAI,MAAM,UAAU;IANlB,GAAG,QAAQ;IACX,SAAS,QAAQ,MAAM,QAAQ,QAAQ,YAAY,QAAQ,OAAO,SAAS,SAAS;IACpF,OAAO,KAAA;IACP,YAAY,KAAA;IACZ,WAAW,KAAA;GAEU,GAAG,QAAQ,OAAO,GAAG;EAC9C;CACF;CACA,eAAe,QAAQ,SAAsB,eAA6C;EACxF,MAAM,MAAM,eAAe,QAAQ;EACnC,MAAM,cAAc,6BAA6B,MAAM;GACrD,eAAA;GACA;GACA;EACF,CAAC;EACD,IAAI;GACF,MAAM,OAAO,OAAO;IAAE,YAAY;IAAyB,IAAI;IAAK,OAAO;GAAY,CAAC;GACxF,OAAO;EACT,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,oBAAoB,MAAM;GACjD,MAAM,SAAS,MAAM,OAAO,IAAI,yBAAyB,GAAG;GAC5D,IAAI,CAAC,QACH,MAAM,IAAI,yBAAyB,iCAAiC,QAAQ,IAAI;GAClF,MAAM,WAAW,6BAA6B,MAAM,OAAO,KAAK;GAChE,MAAM,WAAW,aAAa,SAAS,OAAO;GAC9C,IACE,SAAS,kBAAkB,iBAC3B,CAAC,kBAAkB,eAAe,QAAQ,GAAG,eAAe,OAAO,CAAC,GAEpE,MAAM,IAAI,yBACR,aAAa,QAAQ,YAAY,8CACnC;GAEF,OAAO;EACT;CACF;CACA,eAAe,YACb,WACA,UACA,WACA,QAC6B;EAC7B,oBAAoB,MAAM,SAAS;EACnC,MAAM,MAAM,WAAW,QAAQ,QAAQ;EACvC,MAAM,OAAO,WAAW,UAAU,QAAQ,SAAS;EACnD,MAAM,SAAS,MAAM,OAAO,IAAI,gBAAgB,SAAS;EACzD,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,UAAU,aAAa,OAAO,KAAK;EACzC,IAAI,QAAQ,OAAO,aAAa,QAAQ,aAAa,UACnD,MAAM,IAAI,8BAA8B,2CAA2C;EACrF,MAAM,MAAM,WAAW,QAAQ,UAAU,QAAQ,UAAU;EAC3D,OAAO;CACT;CACA,eAAe,iBAAiB,WAAiE;EAC/F,MAAM,SAAS,MAAM,OAAO,IAAI,yBAAyB,SAAS;EAClE,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,SAAS,4BAA4B,MAAM,OAAO,KAAK;EAC7D,IAAI,OAAO,cAAc,WACvB,MAAM,IAAI,iBAAiB,qCAAqC;EAClE,OAAO;CACT;CACA,eAAe,cAAc,WAA8D;EACzF,MAAM,SAAS,MAAM,OAAO,IAAI,uBAAuB,SAAS;EAChE,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,SAAS,yBAAyB,MAAM,OAAO,KAAK;EAC1D,IAAI,OAAO,cAAc,WACvB,MAAM,IAAI,iBAAiB,kCAAkC;EAC/D,OAAO;CACT;CACA,eAAe,iBACb,WACA,OACA,SACe;EACf,IAAI,UAAU,OAAO,MAAM,aACzB,MAAM,IAAI,8BACR,qDACF;EACF,gBAAgB,MAAM,KAAK,MAAM,QAAQ,GAAG,MAAM,OAAO;EACzD,MAAM,OAAO,IAAI;EACjB,IACE,QAAQ,cACR,QAAQ,aACR,QAAQ,eAAe,MAAM,cAC7B,CAAC,kBAAkB,QAAQ,OAAO,KAAK,KACvC,KAAK,MAAM,MAAM,SAAS,KAAK,KAAK,QAAQ,GAE5C,MAAM,IAAI,sBACR,yEACF;EAEF,OAAO;CACT;CACA,SAAS,aACP,QACA,OACuB;EACvB,MAAM,EACJ,eAAe,gBACf,aAAa,cACb,kBAAkB,mBAClB,GAAG,aACD;EACJ,IAAI,CAAC,kBAAkB,UAAU,KAAK,GACpC,MAAM,IAAI,sBACR,mEACF;EACF,OAAO;CACT;CAEA,eAAe,KACb,SACA,OACA,UAC4B;EAC5B,MAAM,YAAY,2BAA2B,MAAM,OAAO;EAC1D,MAAM,SAAS,2BAA2B,MAAM,KAAK;EACrD,MAAM,UAAU,UAAU,SAAS,MAAM,MAAM,OAAO,OAAO;EAC7D,MAAM,EAAE,kBAAkB;EAC1B,MAAM,SAAS,aAAa,WAAW,gBAAgB;EACvD,MAAM,MAAM,WAAW,QAAQ,OAAO,UAAU,OAAO,UAAU;EACjE,MAAM,SAAS,iBACb,aAAa;GACX,GAAG;GACH;GACA;GACA,eAAA;GACA,IAAI,aAAa,OAAO,YAAY,OAAO,WAAW;GACtD,WAAW,IAAI,CAAC,CAAC,YAAY;EAC/B,CAAC,GACD,MAAM,IACR;EACA,MAAM,YAAY,MAAM,iBAAiB,MAAM;EAC/C,IAAI,aAAa,UAAU,cAAc,MAAM,KAAK,OAAO,UAAU,GAAG,aAAa;EACrF,IAAI,WAAW,OAAO,iBAAiB,WAAW,MAAM,IAAI;EAC5D,IAAI,aAAa,UAAU,cAAc,MAAM,KAAK,OAAO,UAAU,GAAG,aAAa;EACrF,MAAM,YAAY,MAAM,KAAK,OAAO,QAAQ;EAC5C,cAAc,WAAW,UAAU,OAAO;EAC1C,IAAI,OAAO,aAAa;GACtB,MAAM,SAAS,MAAM,OAAO,IAAI,gBAAgB,OAAO,WAAW;GAClE,IAAI,CAAC,QACH,MAAM,IAAI,iBAAiB,qDAAqD;GAClF,MAAM,QAAQ,aAAa,OAAO,KAAK;GACvC,MAAM,MAAM,WAAW,QAAQ,MAAM,UAAU,MAAM,UAAU;GAC/D,KAAK,MAAM,KAAK,MAAM,QAAQ,EAAA,CAAG,eAAe,UAAU,YACxD,MAAM,IAAI,8BAA8B,0CAA0C;EACtF;EACA,MAAM,UAAU,iBAAiB,MAAM,QAAQ,QAAQ,aAAa,GAAG,MAAM,IAAI;EACjF,SAAS;GACP,MAAM,MAAM,WAAW,QAAQ,QAAQ,UAAU,QAAQ,UAAU;GACnE,MAAM,UAAU,MAAM,MAAM,QAAQ,QAAQ;GAC5C,MAAM,YAAY,MAAM,iBAAiB,OAAO;GAChD,IAAI,aAAa,UAAU,cAAc,MAAM,KAAK,QAAQ,UAAU,GAAG,aAAa;GACtF,IAAI,WAAW,OAAO,iBAAiB,WAAW,MAAM,IAAI;GAC5D,IAAI,aAAa,UAAU,cAAc,MAAM,KAAK,QAAQ,UAAU,GAAG,aAAa;GACtF,MAAM,YAAY,MAAM,KAAK,QAAQ,QAAQ;GAC7C,cAAc,WAAW,UAAU,OAAO;GAC1C,MAAM,UAAU,QAAQ,MAAM,QAAQ,MAAM,UAAU,MAAM,OAAO,QAAQ,EAAE;GAC7E,IAAI,SACE;QAAA,CAAC,kBAAkB,SAAS,OAAO,GACrC,MAAM,IAAI,yBAAyB,4CAA4C;GAAA,OAC5E;IACL,IAAI,QAAQ,MAAM,QAAQ,UAAA,KACxB,MAAM,IAAI,iBACR,uDACF;IACF,IACE,CAAE,MAAM,UACN;KAAE,GAAG,QAAQ;KAAO,SAAS,CAAC,GAAG,QAAQ,MAAM,SAAS,OAAO;IAAE,GACjE,QAAQ,OACV,GAEA;GACJ;GACA,OAAO,iBACL,MAAM,UAAU,gBAAgB,QAAQ,IAAI,SAAS,YAAY,GACjE,MAAM,IACR;EACF;CACF;CAEA,eAAe,cACb,WACA,OACA,UAC4B;EAC5B,MAAM,UAAU,MAAM,KAAK,WAAW,OAAO,QAAQ;EACrD,IAAI,QAAQ,QAAQ;GAClB,MAAM,YAAY,MAAM,KAAK,QAAQ,QAAQ;GAC7C,MAAM,QAAQ,OAAO;IAAE,YAAY,UAAU;IAAY,KAAK,WAAW,QAAQ;GAAK,CAAC;EACzF;EACA,OAAO;CACT;CAEA,OAAO;EACL,OAAO,EAAE,WAAW,cAAc,cAAc,WAAW,OAAO;EAClE,aAAa,EAAE,WAAW,cAAc,cAAc,WAAW,SAAS,QAAQ;EAClF,MAAM,IAAI,EAAE,WAAW,SAAS,UAAU,aAAa;GACrD,OAAO,YAAY,2BAA2B,MAAM,OAAO,GAAG,UAAU,WAAW,MAAM;EAC3F;EACA,MAAM,QAAQ,EAAE,WAAW,SAAS,YAAY;GAC9C,MAAM,YAAY,2BAA2B,MAAM,OAAO;GAC1D,MAAM,UAAU,MAAM,OAAO,WAAW,UAAU,MAAM;GACxD,KAAK,MAAM,WAAW,QAAQ,MAAM,SAClC,MAAM,MAAM,WAAW,QAAQ,UAAU,QAAQ,UAAU;GAC7D,OAAO,QAAQ,MAAM;EACvB;EACA,MAAM,MAAM,EAAE,WAAW,SAAS,MAAM,WAAW,GAAG,SAAS;GAC7D,MAAM,YAAY,2BAA2B,MAAM,OAAO;GAC1D,MAAM,EAAE,QAAQ,UAAU,YAAY,qBAAqB,MAAM,SAAS;GAC1E,MAAM,EAAE,SAAS,qBAAqB,mBAAmB,MAAM,KAAK;GACpE,SAAS;IACP,MAAM,UAAU,MAAM,OAAO,WAAW,UAAU,OAAO;IACzD,MAAM,UAAU,QAAQ,MAAM,QAAQ;IACtC,IAAI,SAAS,MAAM,MAAM,WAAW,SAAS,UAAU,QAAQ,UAAU;IACzE,MAAM,YAAY,MAAM,KAAK,QAAQ;IACrC,iBAAiB,WAAW,SAAS,gBAAgB;IACrD,IACE,QAAQ,MAAM,SACd,QAAQ,MAAM,MAAM,YAAY,UAAU,WAC1C,KAAK,MAAM,QAAQ,MAAM,MAAM,SAAS,IAAI,IAAI,CAAC,CAAC,QAAQ,GAE1D,OAAO;IACT,IAAI,CAAC,SAAS,OAAO;IACrB,MAAM,SAAS,MAAM,KAAK,QAAQ,UAAU;IAE5C,IADsB,UAAU,YAAY,QAAQ,IAAI,MAAM,aAE1C,OAAO,YAAY,QAAQ,iBAC5C,OAAO,UAAU,eAAe,QAAQ,aAAa,UAEtD,MAAM,IAAI,4BACR,QAAQ,IACR;KAAE,QAAQ,OAAO;KAAI,SAAS,QAAQ;IAAc,GACpD,OAAO,SACP,OAAO,KACT;IAEF,iBAAiB,MAAM,KAAK,QAAQ,GAAG,SAAS,gBAAgB;IAChE,MAAM,OAAO,IAAI;IACjB,MAAM,QAAQ,uBAAuB,MAAM;KACzC,WAAW,QAAQ;KACnB;KACA,YAAY,QAAQ,MAAM,aAAa;KACvC,aAAa,UAAU;KACvB;KACA,WAAW,IAAI,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY;IAC5D,CAAC;IACD,IACE,MAAM,UACJ;KAAE,GAAG,QAAQ;KAAO,YAAY,MAAM;KAAY,OAAO;IAAM,GAC/D,QAAQ,OACV,GAEA,OAAO;KAAE;KAAO;IAAQ;GAC5B;EACF;EACA,MAAM,SAAS,EAAE,WAAW,SAAS,OAAO,OAAO,oBAAoB;GACrE,MAAM,YAAY,2BAA2B,MAAM,OAAO;GAC1D,MAAM,QAAQ,uBAAuB,MAAM,KAAK;GAChD,qBAAqB,MAAM,EAAE,iBAAiB,CAAC;GAC/C,IAAI,UAAU,OAAO,MAAM,aACzB,MAAM,IAAI,8BACR,wDACF;GACF,MAAM,UAAU,MAAM,YAAY,WAAW,MAAM,UAAU,MAAM,WAAW,UAAU;GACxF,IAAI,CAAC,SAAS,MAAM,IAAI,sBAAsB,gCAAgC;GAC9E,SAAS;IACP,MAAM,MAAM,WAAW,YAAY,MAAM,UAAU,QAAQ,UAAU;IACrE,MAAM,UAAU,MAAM,MAAM,MAAM,QAAQ;IAC1C,MAAM,YAAY,MAAM,iBAAiB,MAAM,SAAS;IACxD,IAAI,WAAW,OAAO,aAAa,WAAW,KAAK;IACnD,IAAI,QAAQ,MAAM,YAAY;KAC5B,aAAa,QAAQ,MAAM,YAAY,KAAK;KAC5C,MAAM,OAAO,WAAW,MAAM,UAAU,YAAY,MAAM,SAAS;KACnE;IACF;IACA,MAAM,OAAO,MAAM,iBAAiB,WAAW,OAAO,QAAQ,KAAK;IACnE,MAAM,aAAa,4BAA4B,MAAM;KACnD,GAAG;KACH,eAAA;KACA,kBAAkB;KAClB,aAAa,KAAK,YAAY;IAChC,CAAC;IAGD,IAAI,CAAE,MAAM,UAAU;KAAE,GAAG,QAAQ;KAAO;IAAW,GAAG,QAAQ,OAAO,GAAI;IAC3E,MAAM,OAAO,WAAW,MAAM,UAAU,YAAY,MAAM,SAAS;IACnE,OAAO;GACT;EACF;EACA,MAAM,YAAY,EAAE,WAAW,SAAS,OAAO,SAAS;GACtD,MAAM,YAAY,2BAA2B,MAAM,OAAO;GAC1D,MAAM,QAAQ,uBAAuB,MAAM,KAAK;GAChD,IAAI,UAAU,OAAO,MAAM,aACzB,MAAM,IAAI,8BACR,qDACF;GACF,MAAM,MAAM,WAAW,SAAS,MAAM,QAAQ;GAC9C,MAAM,SAAS,MAAM,OAAO,IAAI,gBAAgB,MAAM,SAAS;GAC/D,IAAI,CAAC,QAAQ,MAAM,IAAI,sBAAsB,gCAAgC;GAC7E,MAAM,UAAU,aAAa,OAAO,KAAK;GACzC,IAAI,QAAQ,OAAO,MAAM,aAAa,QAAQ,aAAa,MAAM,UAC/D,MAAM,IAAI,8BAA8B,yCAAyC;GACnF,MAAM,MAAM,WAAW,SAAS,MAAM,UAAU,QAAQ,UAAU;GAClE,MAAM,MAAM,WAAW,YAAY,MAAM,UAAU,QAAQ,UAAU;GACrE,MAAM,YAAY,MAAM,iBAAiB,MAAM,SAAS;GACxD,IAAI,WAAW;IACb,aAAa,WAAW,KAAK;IAC7B,MAAM,IAAI,sBACR,uEACF;GACF;GACA,MAAM,iBAAiB,WAAW,QAAQ,MAAM,MAAM,MAAM,QAAQ,EAAA,CAAG,KAAK;EAC9E;EACA,MAAM,QAAQ,EAAE,WAAW,SAAS,UAAU,WAAW,QAAQ,eAAe;GAC9E,MAAM,YAAY,2BAA2B,MAAM,OAAO;GAC1D,MAAM,SAAS,yBAAyB,MAAM,OAAO,MAAM,WAAW;GACtE,MAAM,UAAU,MAAM,YAAY,WAAW,UAAU,WAAW,SAAS;GAC3E,IAAI,CAAC,SAAS,MAAM,IAAI,iBAAiB,kCAAkC;GAC3E,SAAS;IACP,MAAM,MAAM,WAAW,WAAW,UAAU,QAAQ,UAAU;IAC9D,MAAM,UAAU,MAAM,OAAO,WAAW,UAAU,WAAW,SAAS;IACtE,MAAM,YAAY,MAAM,cAAc,SAAS;IAC/C,IAAI,WAAW;KACb,IACE,UAAU,aAAa,YACvB,UAAU,WAAW,UACrB,CAAC,kBAAkB,UAAU,IAAI,SAAS,GAE1C,MAAM,IAAI,yBAAyB,kDAAkD;KACvF;IACF;IACA,IAAI,MAAM,iBAAiB,SAAS,GAClC,MAAM,IAAI,yBAAyB,wCAAwC;IAC7E,IAAI,QAAQ,MAAM,QAAQ,EAAE,EAAE,OAAO,WACnC,MAAM,IAAI,iBAAiB,8CAA8C;IAC3E,MAAM,OAAO,IAAI;IACjB,IAAI,QAAQ,MAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,MAAM,SAAS,IAAI,KAAK,QAAQ,GAClF,MAAM,IAAI,sBACR,2FACF;IACF,MAAM,YAAY,yBAAyB,MAAM;KAC/C,eAAA;KACA;KACA;KACA;KACA,IAAI;KACJ,aAAa,KAAK,YAAY;IAChC,CAAC;IACD,IAAI,CAAE,MAAM,UAAU;KAAE,GAAG,QAAQ;KAAO,OAAO,KAAA;KAAW;IAAU,GAAG,QAAQ,OAAO,GACtF;IACF,MAAM,OAAO,WAAW,UAAU,WAAW,SAAS;IACtD;GACF;EACF;EACA,MAAM,UAAU,EAAE,WAAW,SAAS,UAAU,aAAa;GAE3D,IAAI,CAAE,MAAM,YADM,2BAA2B,MAAM,OACnB,GAAG,UAAU,WAAW,MAAM,GAAI,OAAO;GACzE,MAAM,SAAS,MAAM,cAAc,SAAS;GAC5C,IAAI,UAAU,OAAO,aAAa,UAChC,MAAM,IAAI,iBAAiB,mCAAmC;GAChE,OAAO;EACT;EACA,MAAM,WAAW,EAAE,WAAW,SAAS,UAAU,aAAa;GAE5D,IAAI,CAAE,MAAM,YADM,2BAA2B,MAAM,OACnB,GAAG,UAAU,WAAW,MAAM,GAAI,OAAO;GACzE,MAAM,SAAS,MAAM,iBAAiB,SAAS;GAC/C,IAAI,UAAU,OAAO,aAAa,UAChC,MAAM,IAAI,iBAAiB,sCAAsC;GACnE,OAAO;EACT;EACA,UAAU,EAAE,WAAW,aAAa;GAClC,oBAAoB,MAAM,SAAS;GACnC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,SAAS;GAC1C,OAAO,UAAU,KAAK,CAAC,WAAW,SAAS,CAAC;EAC9C;CACF;AACF"}

package/dist/store/task-work.d.mts

@@ -0,0 +1,65 @@
+import { TaskId } from "../schema/id.mjs";
+import { JsonValue, WorkflowBinding } from "../schema/work.mjs";
+import { Task } from "../schema/task.mjs";
+import { WorkflowRegistry } from "../workflows.mjs";
+import { IsoDateTimeClock } from "../schema/common.mjs";
+import { TaskAttemptRef } from "../schema/execution.mjs";
+import { StoreDriver } from "./driver.mjs";
+import { FactoryStores } from "./engine.mjs";
+//#region src/store/task-work.d.ts
+/** Workflow-facing Task operations for completion, message waiting, recovery, and usage aggregation. */
+interface TaskWorkStore {
+  /** Complete through the dynamic registry boundary, which validates unknown output at runtime. */
+  complete(input: CompleteTaskWorkInput): Promise<Task>;
+  /** Complete work while statically checking output against its exact workflow binding. */
+  completeWorkflow<Output extends JsonValue>(input: CompleteWorkflowTaskWorkInput<Output>): Promise<Task>;
+  waitForMessages(input: WaitForTaskMessagesInput): Promise<Task>;
+  resume(input: ResumeTaskWorkInput): Promise<Task>;
+  /** Repair admitted creation snapshots by direct graph IDs, never by scanning the bucket. */
+  recover(rootTaskId: TaskId): Promise<readonly Task[]>;
+  /** Each Task contributes local measured usage once; no parent roll-up is charged again. */
+  usage(rootTaskId: TaskId): Promise<TaskWorkUsage>;
+}
+/** Exact Task attempt and candidate workflow output used to complete work. */
+interface CompleteTaskWorkInput {
+  task: TaskAttemptRef;
+  output: unknown;
+}
+/** Exact Task attempt, workflow contract, and statically checked output used to complete work. */
+interface CompleteWorkflowTaskWorkInput<Output extends JsonValue = JsonValue> {
+  task: TaskAttemptRef;
+  workflow: WorkflowBinding<JsonValue, Output>;
+  output: NoInfer<Output>;
+}
+/** Aggregated measured usage across one canonical Task graph. */
+interface TaskWorkUsage {
+  costUsd: number;
+  inputTokens: number;
+  outputTokens: number;
+  taskCount: number;
+}
+/** Exact running Task attempt and optional workflow phase used to await messages. */
+interface WaitForTaskMessagesInput {
+  task: TaskAttemptRef;
+  phase?: string;
+}
+/** Exact running Task attempt to resume after message delivery. */
+interface ResumeTaskWorkInput {
+  task: TaskAttemptRef;
+}
+/** Canonical Task graph, receipt, and Task capabilities used by workflow-facing operations. */
+type TaskWorkStores = Pick<FactoryStores, "graphs" | "receipts" | "tasks">;
+/** Engine-owned dependencies used to construct workflow-facing Task operations. */
+interface CreateTaskWorkStoreOptions {
+  driver: StoreDriver;
+  now: IsoDateTimeClock;
+  stores: () => TaskWorkStores;
+  workflows: WorkflowRegistry;
+  update(task: Task, version: number): Promise<void>;
+  restore(task: Task): Promise<Task>;
+}
+/** Creates workflow-facing Task operations backed by canonical graph and Task stores. */
+declare function createTaskWorkStore(options: CreateTaskWorkStoreOptions): TaskWorkStore;
+//#endregion
+export { CompleteTaskWorkInput, CompleteWorkflowTaskWorkInput, CreateTaskWorkStoreOptions, ResumeTaskWorkInput, TaskWorkStore, TaskWorkStores, TaskWorkUsage, WaitForTaskMessagesInput, createTaskWorkStore };
+//# sourceMappingURL=task-work.d.mts.map