@victframework/runtime 0.1.0

package/dist/control-in-memory.js

@@ -0,0 +1,886 @@
+import { createHash } from 'node:crypto';
+import { InMemoryActorDirectory, isDurableStreamKind } from './control-types.js';
+export { InMemoryActorDirectory };
+import { VictControlError, VICT_IDEMPOTENCY_FENCE_CONFLICT, CHANGESET_BASE_NONE, commandIdempotencyFenceToken, validateStreamLedgerAppend, } from './control-types.js';
+/**
+ * Stage 06B in-memory reference implementations of the neutral control
+ * plane and agent-execution store ports. The SQLite adapter implements the
+ * SAME semantics in `@victframework/store-sqlite`; the shared conformance suite
+ * (`control-conformance.ts`) proves the adapters cannot diverge.
+ *
+ * In-memory durability model: process-local maps guarded by a single
+ * synchronous critical section per mutation (compare-and-set semantics are
+ * enforced inside each mutation, so concurrent callers see one truthful
+ * winner).
+ */
+/** Deterministic test-stability digest (ids are derived, never random). */
+function digest(payload) {
+    return createHash('sha256').update(payload, 'utf8').digest('hex').slice(0, 24);
+}
+/** In-memory ControlPlaneStore. */
+export class InMemoryControlPlaneStore {
+    #changesets = new Map();
+    #approvals = new Map();
+    #approvalsByChangeset = new Map();
+    #releases = new Map();
+    #selections = new Map();
+    #audit = [];
+    #controlRuns = new Map();
+    #operationReceipts = new Map();
+    async saveChangeSet(record) {
+        if (this.#changesets.has(record.changesetId)) {
+            throw new VictControlError('VICT_CONTROL_CHANGESET_EXISTS', 'A ChangeSet with this id already exists; propose a distinct changesetId.');
+        }
+        this.#changesets.set(record.changesetId, { record: structuredCloneControl(record) });
+    }
+    async getChangeSet(changesetId) {
+        const found = this.#changesets.get(changesetId);
+        return found === undefined ? undefined : structuredCloneControl(found.record);
+    }
+    async listChangeSets() {
+        return [...this.#changesets.values()]
+            .map((entry) => entry.record)
+            .sort((a, b) => (a.changesetId < b.changesetId ? -1 : 1))
+            .map((record) => structuredCloneControl(record));
+    }
+    async updateChangeSet(changesetId, update) {
+        const entry = this.#changesets.get(changesetId);
+        if (entry === undefined) {
+            throw new VictControlError('VICT_CONTROL_CHANGESET_MISSING', 'The ChangeSet does not exist.');
+        }
+        const updated = update(structuredCloneControl(entry.record));
+        if (updated.changesetId !== changesetId) {
+            throw new VictControlError('VICT_CONTROL_CHANGESET_IMMUTABLE_ID', 'A ChangeSet update may not change its changesetId.');
+        }
+        if (updated.contentHash !== entry.record.contentHash) {
+            // Content mutation is a distinct service-level operation (revise) that
+            // must reset evidence/approvals; the raw store update enforces the
+            // content identity invariant.
+            throw new VictControlError('VICT_CONTROL_CONTENT_HASH_MISMATCH', 'A ChangeSet update may not change its immutable content identity.');
+        }
+        entry.record = structuredCloneControl(updated);
+        return structuredCloneControl(updated);
+    }
+    async reviseChangeSetContent(changesetId, revise) {
+        const entry = this.#changesets.get(changesetId);
+        if (entry === undefined) {
+            throw new VictControlError('VICT_CONTROL_CHANGESET_MISSING', 'The ChangeSet does not exist.');
+        }
+        const updated = revise(structuredCloneControl(entry.record));
+        if (updated.changesetId !== changesetId) {
+            throw new VictControlError('VICT_CONTROL_CHANGESET_IMMUTABLE_ID', 'A ChangeSet update may not change its changesetId.');
+        }
+        if (updated.contentHash === entry.record.contentHash) {
+            throw new VictControlError('VICT_CONTROL_REVISION_NOT_CHANGED', 'A content revision must change the immutable content identity.');
+        }
+        if (updated.validation !== undefined || updated.simulation !== undefined) {
+            throw new VictControlError('VICT_CONTROL_EVIDENCE_NOT_INVALIDATED', 'A content revision must reset validation and simulation evidence.');
+        }
+        entry.record = structuredCloneControl(updated);
+        return structuredCloneControl(updated);
+    }
+    async recordChangeSetApproval(decision) {
+        const key = `${decision.changesetId}\u0000${decision.approverActorId}`;
+        const existing = this.#approvals.get(key);
+        if (existing !== undefined) {
+            if (existing.decision !== decision.decision ||
+                existing.contentHash !== decision.contentHash) {
+                throw new VictControlError('VICT_CONTROL_APPROVAL_CONFLICT', 'A competing decision already exists for this ChangeSet and approver; the first durable decision stands.');
+            }
+            return; // idempotent identical decision
+        }
+        this.#approvals.set(key, structuredCloneControl(decision));
+        const list = this.#approvalsByChangeset.get(decision.changesetId) ?? [];
+        list.push(key);
+        this.#approvalsByChangeset.set(decision.changesetId, list);
+    }
+    async listChangeSetApprovals(changesetId) {
+        const keys = this.#approvalsByChangeset.get(changesetId) ?? [];
+        return keys
+            .map((key) => this.#approvals.get(key))
+            .filter((entry) => entry !== undefined)
+            .map((decision) => structuredCloneControl(decision));
+    }
+    async recordControlRun(record) {
+        const existing = this.#controlRuns.get(record.runId);
+        if (existing !== undefined) {
+            if (JSON.stringify(existing) !== JSON.stringify(record)) {
+                throw new VictControlError('VICT_CONTROL_RUN_COLLISION', 'A governance run with this id already exists with different content.');
+            }
+            return; // idempotent re-record
+        }
+        this.#controlRuns.set(record.runId, structuredCloneControl(record));
+    }
+    async getControlRun(runId) {
+        const found = this.#controlRuns.get(runId);
+        return found === undefined ? undefined : structuredCloneControl(found);
+    }
+    async recordOperationIntent(receipt) {
+        const key = `${receipt.changesetId}\u0000${receipt.operationIndex}`;
+        const existing = this.#operationReceipts.get(key);
+        if (existing !== undefined) {
+            if (existing.operationDigest !== receipt.operationDigest) {
+                throw new VictControlError('VICT_CONTROL_OPERATION_IDENTITY_CONFLICT', 'The operation identity already exists with different content; conflicting content fails closed.');
+            }
+            return 'exists'; // idempotent re-intent
+        }
+        this.#operationReceipts.set(key, structuredCloneControl(receipt));
+        return 'recorded';
+    }
+    async markOperationApplied(input) {
+        const key = `${input.changesetId}\u0000${input.operationIndex}`;
+        const existing = this.#operationReceipts.get(key);
+        if (existing === undefined) {
+            throw new VictControlError('VICT_CONTROL_OPERATION_RECEIPT_MISSING', 'No prepared operation intent exists for this operation index.');
+        }
+        if (existing.state === 'applied') {
+            return structuredCloneControl(existing); // idempotent
+        }
+        const updated = {
+            ...existing,
+            state: 'applied',
+            appliedAt: input.at,
+        };
+        this.#operationReceipts.set(key, updated);
+        return structuredCloneControl(updated);
+    }
+    async recordOperationReceipt(receipt) {
+        const key = `${receipt.changesetId}\u0000${receipt.operationIndex}`;
+        const existing = this.#operationReceipts.get(key);
+        if (existing !== undefined) {
+            if (JSON.stringify(existing) !== JSON.stringify(receipt)) {
+                throw new VictControlError('VICT_CONTROL_OPERATION_RECEIPT_COLLISION', 'An operation receipt already exists with different content.');
+            }
+            return; // idempotent re-record
+        }
+        this.#operationReceipts.set(key, structuredCloneControl(receipt));
+    }
+    async listOperationReceipts(changesetId) {
+        return [...this.#operationReceipts.values()]
+            .filter((receipt) => receipt.changesetId === changesetId)
+            .sort((a, b) => a.operationIndex - b.operationIndex)
+            .map((receipt) => structuredCloneControl(receipt));
+    }
+    async compareAndSetChangeSetStatus(input) {
+        const entry = this.#changesets.get(input.changesetId);
+        if (entry === undefined) {
+            throw new VictControlError('VICT_CONTROL_CHANGESET_MISSING', 'The ChangeSet does not exist.');
+        }
+        if (entry.record.status !== input.expectedStatus) {
+            throw new VictControlError('VICT_CONTROL_CHANGESET_STATUS_CONFLICT', `The ChangeSet is not in the expected status; one concurrent transition already won.`);
+        }
+        const updated = {
+            ...structuredCloneControl(entry.record),
+            status: input.nextStatus,
+        };
+        entry.record = structuredCloneControl(updated);
+        return structuredCloneControl(updated);
+    }
+    async publishRelease(record) {
+        const existing = this.#releases.get(record.releaseVersion);
+        if (existing !== undefined) {
+            if (JSON.stringify(existing) !== JSON.stringify(record)) {
+                throw new VictControlError('VICT_CONTROL_RELEASE_COLLISION', 'A release with this version exists with different content (immutability guard).');
+            }
+            return; // idempotent republish
+        }
+        this.#releases.set(record.releaseVersion, structuredCloneControl(record));
+    }
+    async applyReleaseOperation(input) {
+        // In-memory composition: the three steps run inside ONE synchronous
+        // critical section (no await between effect and receipt), so the
+        // effect/receipt dual-write window cannot interleave.
+        await this.publishRelease(input.release);
+        const selection = await this.selectRelease(input.selection);
+        await this.markOperationApplied({
+            changesetId: input.receipt.changesetId,
+            operationIndex: input.receipt.operationIndex,
+            at: input.receipt.appliedAt,
+        });
+        return selection;
+    }
+    async getRelease(releaseVersion) {
+        const found = this.#releases.get(releaseVersion);
+        return found === undefined ? undefined : structuredCloneControl(found);
+    }
+    async listReleases(applicationId) {
+        return [...this.#releases.values()]
+            .filter((record) => record.applicationId === applicationId)
+            .sort((a, b) => (a.releaseVersion < b.releaseVersion ? -1 : 1))
+            .map((record) => structuredCloneControl(record));
+    }
+    async selectRelease(command) {
+        const existing = this.#releases.get(command.releaseVersion);
+        if (existing === undefined || existing.applicationId !== command.applicationId) {
+            throw new VictControlError('VICT_CONTROL_RELEASE_MISSING', 'The release version does not exist for this application.');
+        }
+        // Operation-identity idempotency: re-application returns the ORIGINAL
+        // selection revision without adding another one; conflicting content
+        // under the same identity fails closed.
+        if (command.operationId !== undefined) {
+            const selections = this.#selections.get(command.applicationId) ?? [];
+            const existingOp = selections.find((selection) => selection.operationId !== undefined &&
+                selection.operationId === command.operationId &&
+                selection.reason === command.reason);
+            if (existingOp !== undefined) {
+                if (existingOp.releaseVersion !== command.releaseVersion) {
+                    throw new VictControlError('VICT_CONTROL_OPERATION_IDENTITY_CONFLICT', 'The operation identity already applied a different release; conflicting content fails closed.');
+                }
+                return { selectionRevision: existingOp.selectionRevision };
+            }
+        }
+        // SUBJECT-LEVEL base guard, evaluated in the same synchronous critical
+        // section as the append (two racing ChangeSets on one base: exactly one
+        // winner; the loser receives the stable stale-base conflict).
+        if (command.expectedBaseVersion !== undefined) {
+            const selected = await this.getSelectedRelease(command.applicationId);
+            const selectedVersion = selected?.releaseVersion;
+            const expected = command.expectedBaseVersion === CHANGESET_BASE_NONE
+                ? undefined
+                : command.expectedBaseVersion;
+            if (selectedVersion !== expected) {
+                throw new VictControlError('VICT_CONTROL_BASE_STALE', 'The subject base changed before the selection was applied; exactly one concurrent ChangeSet may win the base.');
+            }
+        }
+        const selections = this.#selections.get(command.applicationId) ?? [];
+        const selectionRevision = selections.length + 1;
+        const record = {
+            ...structuredCloneControl(command),
+            selectionRevision,
+        };
+        selections.push(record);
+        this.#selections.set(command.applicationId, selections);
+        return { selectionRevision };
+    }
+    async getSelectedRelease(applicationId) {
+        const selections = this.#selections.get(applicationId) ?? [];
+        const latest = selections.at(-1);
+        if (latest === undefined) {
+            return undefined;
+        }
+        return this.getRelease(latest.releaseVersion);
+    }
+    async listReleaseSelections(applicationId) {
+        return (this.#selections.get(applicationId) ?? []).map((record) => structuredCloneControl(record));
+    }
+    async appendAuditEvent(event) {
+        if (this.#audit.some((entry) => entry.auditId === event.auditId)) {
+            return; // idempotent append (idempotent by auditId)
+        }
+        this.#audit.push(structuredCloneControl(event));
+    }
+    async listAuditEvents(subject) {
+        return this.#audit
+            .filter((event) => (subject.subjectType === undefined || event.subjectType === subject.subjectType) &&
+            (subject.subjectId === undefined || event.subjectId === subject.subjectId))
+            .map((event) => structuredCloneControl(event));
+    }
+}
+// ---- Turns ------------------------------------------------------------------
+/** In-memory AgentTurnStore with compare-and-set state machine enforcement. */
+export class InMemoryAgentTurnStore {
+    #turns = new Map();
+    #cancels = new Map();
+    async createTurnIntent(record) {
+        const existing = this.#turns.get(record.turnId);
+        if (existing !== undefined) {
+            if (JSON.stringify(existing) !== JSON.stringify(record)) {
+                throw new VictControlError('VICT_CONTROL_TURN_COLLISION', 'A turn intent with this id already exists with different content.');
+            }
+            return; // idempotent re-intent
+        }
+        if (record.status !== 'intent') {
+            throw new VictControlError('VICT_CONTROL_TURN_INVALID_STATE', 'A new turn must be recorded as intent.');
+        }
+        this.#turns.set(record.turnId, structuredCloneControl(record));
+    }
+    async getTurn(turnId) {
+        const record = this.#turns.get(turnId);
+        return record === undefined ? undefined : structuredCloneControl(record);
+    }
+    async listTurns() {
+        return [...this.#turns.values()]
+            .sort((a, b) => (a.turnId < b.turnId ? -1 : 1))
+            .map((record) => structuredCloneControl(record));
+    }
+    async listOpenTurns() {
+        return (await this.listTurns()).filter((record) => record.status !== 'completed' &&
+            record.status !== 'failed' &&
+            record.status !== 'cancelled' &&
+            record.status !== 'blocked');
+    }
+    async startTurn(turnId, at) {
+        return this.#transition(turnId, at, (status) => (status === 'intent' ? 'running' : undefined));
+    }
+    async awaitApproval(turnId, at, approvalId) {
+        return this.#transition(turnId, at, (status) => (status === 'running' ? 'awaiting-approval' : undefined), { approvalId });
+    }
+    async resumeTurn(turnId, at) {
+        return this.#transition(turnId, at, (status) => status === 'awaiting-approval' ? 'running' : undefined);
+    }
+    async recordTurnCorrelation(turnId, correlation) {
+        const record = this.#turns.get(turnId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_TURN_MISSING', 'The turn does not exist.');
+        }
+        this.#turns.set(turnId, {
+            ...record,
+            traceId: correlation.traceId ?? record.traceId,
+            victRunId: correlation.victRunId ?? record.victRunId,
+            mastraRunId: correlation.mastraRunId ?? record.mastraRunId,
+            updatedAt: record.updatedAt,
+        });
+    }
+    async completeTurn(command) {
+        return this.#transition(command.turnId, command.at, (status) => status === 'running' || status === 'awaiting-approval' || status === 'intent'
+            ? command.status
+            : undefined, { errorCode: command.errorCode });
+    }
+    async recordCancelIntent(command) {
+        const list = this.#cancels.get(command.turnId) ?? [];
+        if (list.some((entry) => entry.cancelId === command.cancelId)) {
+            return { accepted: false, duplicate: true };
+        }
+        list.push({
+            cancelId: command.cancelId,
+            actorId: command.actorId,
+            reasonCode: command.reasonCode,
+            at: command.at,
+        });
+        this.#cancels.set(command.turnId, list);
+        return { accepted: true, duplicate: false };
+    }
+    async hasCancelIntent(turnId) {
+        return (this.#cancels.get(turnId) ?? []).length > 0;
+    }
+    async reconcileTurn(command) {
+        const record = this.#turns.get(command.turnId);
+        if (record === undefined) {
+            return undefined;
+        }
+        if (record.status === 'completed' ||
+            record.status === 'failed' ||
+            record.status === 'cancelled' ||
+            record.status === 'blocked') {
+            return structuredCloneControl(record); // already terminal
+        }
+        const updated = {
+            ...record,
+            status: command.status,
+            errorCode: command.reasonCode,
+            terminalAt: command.at,
+            updatedAt: command.at,
+        };
+        this.#turns.set(command.turnId, updated);
+        return structuredCloneControl(updated);
+    }
+    async listCancelIntents(turnId) {
+        return [...(this.#cancels.get(turnId) ?? [])];
+    }
+    #transition(turnId, at, allowed, extra = {}) {
+        const record = this.#turns.get(turnId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_TURN_MISSING', 'The turn does not exist.');
+        }
+        const next = allowed(record.status);
+        if (next === undefined) {
+            throw new VictControlError('VICT_CONTROL_TURN_INVALID_TRANSITION', `The turn status '${record.status}' cannot transition as requested.`);
+        }
+        const updated = {
+            ...record,
+            status: next,
+            updatedAt: at,
+            ...(next === 'completed' || next === 'failed' || next === 'cancelled' || next === 'blocked'
+                ? { terminalAt: at }
+                : {}),
+            ...(extra.errorCode !== undefined ? { errorCode: extra.errorCode } : {}),
+        };
+        this.#turns.set(turnId, updated);
+        return structuredCloneControl(updated);
+    }
+}
+// ---- Tool invocations ---------------------------------------------------------
+/** In-memory AgentToolInvocationStore (durable-before-invocation semantics). */
+export class InMemoryAgentToolInvocationStore {
+    #invocations = new Map();
+    #byKey = new Map();
+    #turnSlots = new Map();
+    #turnSlotMax = new Map();
+    async allocateTurnToolSlot(input) {
+        const key = `${input.turnId}\u0000${input.toolName}\u0000${input.argDigest}`;
+        const existing = this.#turnSlots.get(key);
+        if (existing !== undefined) {
+            return structuredCloneControl(existing); // same logical request: same slot
+        }
+        const slot = (this.#turnSlotMax.get(input.turnId) ?? 0) + 1;
+        this.#turnSlotMax.set(input.turnId, slot);
+        const allocation = {
+            slot,
+            turnId: input.turnId,
+            toolName: input.toolName,
+            argDigest: input.argDigest,
+            toolCallId: `slot-${slot}-${digest(input.turnId).slice(0, 12)}`,
+        };
+        this.#turnSlots.set(key, allocation);
+        return structuredCloneControl(allocation);
+    }
+    async recordInvocationIntent(record) {
+        const existingByKey = this.#byKey.get(record.idempotencyKey);
+        if (existingByKey !== undefined) {
+            const existing = this.#invocations.get(existingByKey);
+            if (existing !== undefined && existing.argDigest !== record.argDigest) {
+                throw new VictControlError('VICT_CONTROL_INVOCATION_KEY_COLLISION', 'The idempotency key exists with a different canonical argument digest.');
+            }
+            if (existing !== undefined) {
+                return structuredCloneControl(existing); // idempotent retry
+            }
+        }
+        const existing = this.#invocations.get(record.invocationId);
+        if (existing !== undefined) {
+            if (JSON.stringify(existing) !== JSON.stringify(record)) {
+                throw new VictControlError('VICT_CONTROL_INVOCATION_COLLISION', 'An invocation with this id already exists with different content.');
+            }
+            return structuredCloneControl(existing);
+        }
+        if (record.status !== 'intent') {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_INVALID_STATE', 'A new invocation must be recorded as intent (durable-before-invocation).');
+        }
+        this.#invocations.set(record.invocationId, structuredCloneControl(record));
+        this.#byKey.set(record.idempotencyKey, record.invocationId);
+        return structuredCloneControl(record);
+    }
+    async getInvocation(invocationId) {
+        const record = this.#invocations.get(invocationId);
+        return record === undefined ? undefined : structuredCloneControl(record);
+    }
+    async getInvocationByIdempotencyKey(idempotencyKey) {
+        const invocationId = this.#byKey.get(idempotencyKey);
+        return invocationId === undefined ? undefined : this.getInvocation(invocationId);
+    }
+    async updateInvocationStatus(command) {
+        const record = this.#invocations.get(command.invocationId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_MISSING', 'The invocation does not exist.');
+        }
+        const ORDER = {
+            intent: 0,
+            approved: 1,
+            running: 2,
+            completed: 3,
+            failed: 3,
+            declined: 3,
+            cancelled: 3,
+            outcome_unknown: 3,
+        };
+        const orderOf = (status) => ORDER[status] ?? 0;
+        if (orderOf(command.status) < orderOf(record.status)) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_REGRESSION', 'An invocation status may only move forward.');
+        }
+        if (orderOf(record.status) >= 3 && command.status !== record.status) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_TERMINAL', 'The invocation is already terminal; late results are fenced.');
+        }
+        const updated = {
+            ...record,
+            status: command.status,
+            updatedAt: command.at,
+            completedAt: orderOf(command.status) >= 3 ? command.at : record.completedAt,
+            ...(command.resultSummary !== undefined ? { resultSummary: command.resultSummary } : {}),
+            ...(command.errorCode !== undefined ? { errorCode: command.errorCode } : {}),
+        };
+        this.#invocations.set(command.invocationId, updated);
+        return structuredCloneControl(updated);
+    }
+    async listInvocationsForTurn(turnId) {
+        return [...this.#invocations.values()]
+            .filter((record) => record.turnId === turnId)
+            .sort((a, b) => (a.invocationId < b.invocationId ? -1 : 1))
+            .map((record) => structuredCloneControl(record));
+    }
+    async claimInvocationRun(command) {
+        const record = this.#invocations.get(command.invocationId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_MISSING', 'The invocation does not exist.');
+        }
+        if (record.status === 'running') {
+            // Exactly one live owner: a second claim is the duplicate of the
+            // current owner and NEVER mutates the record.
+            throw new VictControlError('VICT_CONTROL_INVOCATION_OWNER_ACTIVE', 'The invocation attempt is already claimed by a live owner.');
+        }
+        if (record.status !== 'intent' && record.status !== 'approved') {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_TERMINAL', 'The invocation is already terminal; no new attempt can be claimed.');
+        }
+        const updated = {
+            ...record,
+            status: 'running',
+            updatedAt: command.at,
+            runFenceToken: command.fenceToken,
+            runFenceAt: command.at,
+            runOwnerIdentity: command.ownerIdentity,
+            runGeneration: (record.runGeneration ?? 0) + 1,
+        };
+        this.#invocations.set(command.invocationId, updated);
+        return structuredCloneControl(updated);
+    }
+    async settleInvocationRun(command) {
+        const record = this.#invocations.get(command.invocationId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_MISSING', 'The invocation does not exist.');
+        }
+        // The EXACT attempt binding comes first: a stale owner (an earlier
+        // fence token, e.g. after reconciliation re-fenced the record) can
+        // never settle — not even idempotently — a later generation.
+        if ((record.runFenceToken ?? undefined) !== command.fenceToken) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_FENCE_MISMATCH', 'The settlement fence does not bind the current attempt owner.');
+        }
+        if (record.status === 'running') {
+            const updated = {
+                ...record,
+                status: command.status,
+                updatedAt: command.at,
+                completedAt: command.at,
+                ...(command.resultSummary !== undefined ? { resultSummary: command.resultSummary } : {}),
+                ...(command.errorCode !== undefined ? { errorCode: command.errorCode } : {}),
+            };
+            this.#invocations.set(command.invocationId, updated);
+            return structuredCloneControl(updated);
+        }
+        // Terminal idempotency ONLY on the exact requested state and binding.
+        if (record.status === command.status &&
+            record.errorCode === command.errorCode &&
+            record.resultSummary === command.resultSummary) {
+            return structuredCloneControl(record);
+        }
+        throw new VictControlError('VICT_CONTROL_INVOCATION_TERMINAL', 'The invocation is already terminal with a different settlement.');
+    }
+    async settleInvocationPending(command) {
+        const record = this.#invocations.get(command.invocationId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_MISSING', 'The invocation does not exist.');
+        }
+        if (record.status === 'running') {
+            // A claimed (live-owned) attempt is never touched by a late
+            // pre-running settlement.
+            throw new VictControlError('VICT_CONTROL_INVOCATION_OWNER_ACTIVE', 'The invocation attempt is claimed by a live owner.');
+        }
+        if (record.status === 'intent' || record.status === 'approved') {
+            const updated = {
+                ...record,
+                status: command.status,
+                updatedAt: command.at,
+                completedAt: command.at,
+                ...(command.errorCode !== undefined ? { errorCode: command.errorCode } : {}),
+            };
+            this.#invocations.set(command.invocationId, updated);
+            return structuredCloneControl(updated);
+        }
+        // Terminal idempotency ONLY on the exact requested state and binding.
+        if (record.status === command.status && record.errorCode === command.errorCode) {
+            return structuredCloneControl(record);
+        }
+        throw new VictControlError('VICT_CONTROL_INVOCATION_TERMINAL', 'The invocation is already terminal with a different disposition.');
+    }
+    async reconcileAbandonedRun(command) {
+        const record = this.#invocations.get(command.invocationId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_MISSING', 'The invocation does not exist.');
+        }
+        // Exact observed-state binding: only a genuinely running attempt under
+        // the exact observed fence is reconciled. Anything else is refused
+        // (idempotent truthfulness, never a state-changing guess).
+        if (record.status !== 'running' ||
+            (record.runFenceToken ?? '') !== command.observedFenceToken) {
+            throw new VictControlError('VICT_CONTROL_INVOCATION_FENCE_MISMATCH', 'The observed durable state is not the abandoned attempt requested.');
+        }
+        const updated = {
+            ...record,
+            status: 'outcome_unknown',
+            updatedAt: command.at,
+            completedAt: command.at,
+            errorCode: 'VICT_CONTROL_INVOCATION_RUN_RECONCILED',
+            runFenceToken: command.reconciledFenceToken,
+            runFenceAt: command.at,
+            runGeneration: (record.runGeneration ?? 0) + 1,
+        };
+        this.#invocations.set(command.invocationId, updated);
+        return structuredCloneControl(updated);
+    }
+}
+// ---- Approvals ---------------------------------------------------------------
+/** In-memory AgentApprovalStore (first decision wins; exact binding). */
+export class InMemoryAgentApprovalStore {
+    #approvals = new Map();
+    #byInvocation = new Map();
+    async createPendingApproval(record) {
+        if (this.#approvals.has(record.approvalId)) {
+            const existing = this.#approvals.get(record.approvalId);
+            if (JSON.stringify(existing) !== JSON.stringify(record)) {
+                throw new VictControlError('VICT_CONTROL_APPROVAL_COLLISION', 'An approval with this id already exists with different content.');
+            }
+            return structuredCloneControl(existing);
+        }
+        if (this.#byInvocation.has(record.invocationId)) {
+            // One pending approval per invocation: a duplicate request for the
+            // same logical invocation reuses the existing record.
+            const existingId = this.#byInvocation.get(record.invocationId);
+            const existing = this.#approvals.get(existingId);
+            if (existing !== undefined && existing.status === 'pending') {
+                return structuredCloneControl(existing);
+            }
+        }
+        if (record.status !== 'pending') {
+            throw new VictControlError('VICT_CONTROL_APPROVAL_INVALID_STATE', 'A new approval record must be pending.');
+        }
+        this.#approvals.set(record.approvalId, structuredCloneControl(record));
+        this.#byInvocation.set(record.invocationId, record.approvalId);
+        return structuredCloneControl(record);
+    }
+    async getApproval(approvalId) {
+        const record = this.#approvals.get(approvalId);
+        return record === undefined ? undefined : structuredCloneControl(record);
+    }
+    async listOpenApprovals() {
+        return [...this.#approvals.values()]
+            .filter((record) => record.status === 'pending')
+            .sort((a, b) => (a.approvalId < b.approvalId ? -1 : 1))
+            .map((record) => structuredCloneControl(record));
+    }
+    async listApprovalsForInvocation(invocationId) {
+        const approvalId = this.#byInvocation.get(invocationId);
+        if (approvalId === undefined) {
+            return [];
+        }
+        const record = this.#approvals.get(approvalId);
+        return record === undefined ? [] : [structuredCloneControl(record)];
+    }
+    async decideApproval(command) {
+        const record = this.#approvals.get(command.approvalId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_APPROVAL_MISSING', 'The approval record does not exist.');
+        }
+        if (record.status === 'approved' || record.status === 'declined') {
+            if (record.status === command.decision) {
+                return structuredCloneControl(record); // idempotent identical decision
+            }
+            throw new VictControlError('VICT_CONTROL_APPROVAL_CONFLICT', 'A competing decision already stands; the first durable decision is the winner.');
+        }
+        if (record.status === 'expired') {
+            throw new VictControlError('VICT_CONTROL_APPROVAL_EXPIRED', 'The approval request expired and cannot be decided.');
+        }
+        const updated = {
+            ...record,
+            status: command.decision,
+            decidedAt: command.decidedAt,
+            approverActorId: command.approverActorId,
+            ...(command.decisionReason !== undefined ? { decisionReason: command.decisionReason } : {}),
+        };
+        this.#approvals.set(command.approvalId, updated);
+        return structuredCloneControl(updated);
+    }
+    async expireApproval(command) {
+        const record = this.#approvals.get(command.approvalId);
+        if (record === undefined) {
+            throw new VictControlError('VICT_CONTROL_APPROVAL_MISSING', 'The approval record does not exist.');
+        }
+        if (record.status === 'expired') {
+            return structuredCloneControl(record); // idempotent
+        }
+        if (record.status !== 'pending') {
+            throw new VictControlError('VICT_CONTROL_APPROVAL_INVALID_STATE', 'Only a pending approval can expire.');
+        }
+        const updated = { ...record, status: 'expired', decidedAt: command.at };
+        this.#approvals.set(command.approvalId, updated);
+        return structuredCloneControl(updated);
+    }
+}
+// ---- Stream ledger -----------------------------------------------------------
+/** In-memory AgentStreamLedgerStore (per-stream monotonic sequences).
+ *
+ * The RAW ledger port enforces the final `vict.agent-stream@1` schema at
+ * the store boundary: plain-JS callers cannot persist unknown kinds,
+ * non-canonical payloads, or mismatched content. Validation happens
+ * BEFORE any sequence state or storage mutates, so a rejected write
+ * leaves the stream exactly as before.
+ */
+export class InMemoryAgentStreamLedgerStore {
+    #streams = new Map();
+    #events = new Map();
+    async appendEvent(command) {
+        // The gate: compute the sequence that WOULD be assigned and validate
+        // the full event BEFORE incrementing any state.
+        const next = (this.#streams.get(command.streamId) ?? 0) + 1;
+        validateStreamLedgerAppend({
+            streamId: command.streamId,
+            kind: command.kind,
+            payload: command.payload,
+            assignedSeq: next,
+        });
+        this.#streams.set(command.streamId, next);
+        const persisted = isDurableStreamKind(command.kind);
+        if (persisted) {
+            const list = this.#events.get(command.streamId) ?? [];
+            list.push({
+                streamId: command.streamId,
+                seq: next,
+                kind: command.kind,
+                payload: command.payload,
+                createdAt: command.at,
+            });
+            this.#events.set(command.streamId, list);
+        }
+        return { seq: next, persisted };
+    }
+    async latestSeq(streamId) {
+        return this.#streams.get(streamId) ?? 0;
+    }
+    async listEventsFrom(streamId, afterSeq, limit) {
+        const matched = (this.#events.get(streamId) ?? []).filter((event) => event.seq > afterSeq);
+        const bounded = limit !== undefined ? matched.slice(0, Math.max(0, limit)) : matched;
+        return bounded.map((event) => structuredCloneControl(event));
+    }
+    async listStreamIds() {
+        return [...this.#streams.keys()].sort();
+    }
+}
+// ---- Command idempotency ------------------------------------------------------
+// ---- Command idempotency ------------------------------------------------------
+/**
+ * In-memory CommandIdempotencyStore. Receipts are NAMESPACED by
+ * (actor, command, key); `pending` receipts carry a durable lease
+ * (owner + expiry + attempts) so a crashed claimer never sticks the key:
+ * a retrying caller takes the expired lease over. Deterministic failures
+ * settle `failed` (replayed); retryable failures RELEASE the claim.
+ */
+export class InMemoryCommandIdempotencyStore {
+    #receipts = new Map();
+    static #name(receipt) {
+        return `${receipt.actorId}\u0000${receipt.command}\u0000${receipt.idempotencyKey}`;
+    }
+    async claimReceipt(record) {
+        const key = InMemoryCommandIdempotencyStore.#name(record);
+        const existing = this.#receipts.get(key);
+        if (existing !== undefined) {
+            return 'exists';
+        }
+        this.#receipts.set(key, structuredCloneControl(record));
+        return 'claimed';
+    }
+    /**
+     * Fenced settlement: the presented fence token must match the receipt's
+     * CURRENT claim generation exactly. A stale owner receives a stable
+     * non-echoing conflict and the receipt is left BYTE-IDENTICAL.
+     */
+    #requireLivePendingFence(key, fenceToken) {
+        const found = this.#receipts.get(key);
+        if (found === undefined) {
+            throw new VictControlError('VICT_IDEMPOTENCY_RECEIPT_MISSING', 'No idempotency receipt exists for this key namespace.');
+        }
+        if (found.status !== 'pending') {
+            // Settled receipts are never re-settled (duplicate replay is handled
+            // by the service layer): a fence mismatch is the truthful outcome.
+            throw new VictControlError(VICT_IDEMPOTENCY_FENCE_CONFLICT, 'VICT_IDEMPOTENCY_FENCE_CONFLICT: the idempotency claim is no longer pending; the presented fence token does not own it.');
+        }
+        if (found.fenceToken === undefined || found.fenceToken !== fenceToken) {
+            throw new VictControlError(VICT_IDEMPOTENCY_FENCE_CONFLICT, 'VICT_IDEMPOTENCY_FENCE_CONFLICT: the settlement fence token does not match the current claim generation; the claim is untouched.');
+        }
+        return found;
+    }
+    async getReceipt(name) {
+        const found = this.#receipts.get(InMemoryCommandIdempotencyStore.#name(name));
+        return found === undefined ? undefined : structuredCloneControl(found);
+    }
+    async findReceiptByActorKey(input) {
+        for (const receipt of this.#receipts.values()) {
+            if (receipt.actorId === input.actorId && receipt.idempotencyKey === input.idempotencyKey) {
+                return structuredCloneControl(receipt);
+            }
+        }
+        return undefined;
+    }
+    async completeReceipt(input) {
+        const key = InMemoryCommandIdempotencyStore.#name(input);
+        const found = this.#requireLivePendingFence(key, input.fenceToken);
+        const updated = {
+            ...found,
+            status: 'completed',
+            resultJson: input.resultJson,
+            settledAt: input.at,
+            owner: undefined,
+            leaseUntil: undefined,
+            fenceToken: undefined,
+        };
+        this.#receipts.set(key, structuredCloneControl(updated));
+    }
+    async failReceipt(input) {
+        const key = InMemoryCommandIdempotencyStore.#name(input);
+        const found = this.#requireLivePendingFence(key, input.fenceToken);
+        const updated = {
+            ...found,
+            status: 'failed',
+            responseCode: input.responseCode,
+            settledAt: input.at,
+            owner: undefined,
+            leaseUntil: undefined,
+            fenceToken: undefined,
+        };
+        this.#receipts.set(key, structuredCloneControl(updated));
+    }
+    async releaseReceipt(input) {
+        const key = InMemoryCommandIdempotencyStore.#name(input);
+        // FENCED release: only the current claim generation may release the
+        // claim; a stale owner receives a conflict and the live claim survives
+        // byte-identically.
+        this.#requireLivePendingFence(key, input.fenceToken);
+        this.#receipts.delete(key); // claimable again (retryable failure)
+    }
+    async takeOverExpiredLease(input) {
+        const key = InMemoryCommandIdempotencyStore.#name(input);
+        const found = this.#receipts.get(key);
+        if (found === undefined) {
+            return { outcome: 'missing' };
+        }
+        if (found.status !== 'pending') {
+            return { outcome: 'not-expired' }; // settled: replay path handles it
+        }
+        if ((found.leaseUntil ?? 0) > input.at) {
+            return { outcome: 'not-expired' }; // the previous owner may still be executing
+        }
+        const attempts = found.attempts + 1;
+        const fenceToken = commandIdempotencyFenceToken({
+            actorId: input.actorId,
+            command: input.command,
+            idempotencyKey: input.idempotencyKey,
+            owner: input.owner,
+            attempts,
+        });
+        const updated = {
+            ...found,
+            owner: input.owner,
+            leaseUntil: input.leaseUntil,
+            attempts,
+            fenceToken,
+        };
+        this.#receipts.set(key, structuredCloneControl(updated));
+        return { outcome: 'taken', fenceToken };
+    }
+}
+/** The in-memory Stage 06B store set. */
+export function createInMemoryAgentControlStores() {
+    return {
+        actors: new InMemoryActorDirectory(),
+        control: new InMemoryControlPlaneStore(),
+        turns: new InMemoryAgentTurnStore(),
+        invocations: new InMemoryAgentToolInvocationStore(),
+        approvals: new InMemoryAgentApprovalStore(),
+        streamLedger: new InMemoryAgentStreamLedgerStore(),
+        commandIdempotency: new InMemoryCommandIdempotencyStore(),
+    };
+}
+/** Structured clone that preserves plain canonical records. */
+function structuredCloneControl(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+/** Deterministic id helper for in-memory fixtures. */
+export function deterministicId(prefix, seed) {
+    return `${prefix}_${digest(seed)}`;
+}
+//# sourceMappingURL=control-in-memory.js.map