@xfey/tutti 0.1.119 → 0.1.120

package/dist/server-shell/managed-access/runners.js

@@ -0,0 +1,103 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createOpenAiProcedureWorkflowRunner, } from "../../control-plane/workflows/openai.js";
+import { createOpenAiReadOnlyChatAssistantModel, } from "../../providers/openai/chat-assistant.js";
+import { createOpenAiStructuredOutputClient } from "../../providers/openai/sdk-procedure-runner.js";
+import { inspectCodexLinuxSandboxReadiness } from "../../providers/openai/app-server/linux-sandbox-readiness.js";
+import { createOpenAiRunPipelineRunner, } from "../../run-pipeline/openai.js";
+import { getProjectUserSkillsRoot } from "../../skills/index.js";
+import { bindManagedExecution } from "./execution-binding.js";
+import { failedBeforeChecks } from "../../run-pipeline/result-projections.js";
+import { ManagedLocalStateError } from "./private-store.js";
+import { ManagedControlError } from "./model-control-client.js";
+import { NativeAuthorityTransportError } from "@tutti/relay-client";
+// Shell composition only. The provider adapters know nothing about account,
+// delegation, New API, or private native journals.
+export function createManagedWorkflowRunner(runtime, options) {
+    async function resolve(ref) {
+        const access = await bindManagedExecution(runtime, { kind: "workflow", ref });
+        return createOpenAiProcedureWorkflowRunner({
+            config: access.config,
+            client: createOpenAiStructuredOutputClient({
+                credentialLease: access.credentialLease,
+                apiBaseUrl: access.config.api_base_url,
+            }),
+            ...(options.promptsRoot === undefined ? {} : { promptsRoot: options.promptsRoot }),
+            ...(options.recordUsage === undefined ? {} : { recordUsage: options.recordUsage }),
+            readOnlyAppServer: {
+                ...options,
+                credentialLease: access.credentialLease,
+                userSkillsRoot: getProjectUserSkillsRoot(options.tuttiHome, options.projectId),
+            },
+        });
+    }
+    return {
+        async runScratchpadRefresh(input, context) {
+            return (await resolve(context.workflow_ref)).runScratchpadRefresh(input, context);
+        },
+        async runTaskCompile(input, context) {
+            return (await resolve(input.workflow_ref)).runTaskCompile(input, context);
+        },
+        async runProjectContextBootstrap(input, context) {
+            const runner = await resolve(context?.workflow_ref ?? randomUUID());
+            return runner.runProjectContextBootstrap(input, context);
+        },
+        async runContextSync(input, context) {
+            return (await resolve(input.workflow_ref)).runContextSync(input, context);
+        },
+        async runReferenceFileSummary(input, context) {
+            // One workflow drains multiple targets concurrently. Do not make two files
+            // share a model-session lease, or expose filesystem paths as owner refs.
+            const ref = createHash("sha256")
+                .update(JSON.stringify([input.workflow_ref, input.file.path, input.file.blob_oid]))
+                .digest("hex");
+            return (await resolve(ref)).runReferenceFileSummary(input, context);
+        },
+        async runProjectBriefRefresh(input, context) {
+            return (await resolve(context?.workflow_ref ?? randomUUID())).runProjectBriefRefresh(input, context);
+        },
+        async runFollowUpCheck(input, context) {
+            return (await resolve(input.workflow_ref)).runFollowUpCheck(input, context);
+        },
+    };
+}
+export function createManagedRunPipeline(runtime, options) {
+    return {
+        async runTask(input) {
+            let access;
+            try {
+                access = await bindManagedExecution(runtime, { kind: "task", ref: input.task.id });
+            }
+            catch (error) {
+                const known = error instanceof ManagedLocalStateError ||
+                    error instanceof ManagedControlError ||
+                    error instanceof NativeAuthorityTransportError;
+                return failedBeforeChecks({
+                    summary: "Tutti trial access is unavailable. Check project authorization and trial allowance before retrying.",
+                    errorCode: known ? error.code : "managed_selection_unavailable",
+                    retryable: true,
+                });
+            }
+            return createOpenAiRunPipelineRunner({
+                ...options,
+                ...access,
+                userSkillsRoot: getProjectUserSkillsRoot(options.tuttiHome, options.projectId),
+                ...(process.platform === "linux"
+                    ? { codexSandboxReadiness: () => inspectCodexLinuxSandboxReadiness() }
+                    : {}),
+            }).runTask(input);
+        },
+    };
+}
+export function createManagedChatModel(runtime, options) {
+    return {
+        async answer(input) {
+            const access = await bindManagedExecution(runtime, { kind: "chat", ref: randomUUID() });
+            return createOpenAiReadOnlyChatAssistantModel({
+                ...options,
+                ...access,
+                userSkillsRoot: getProjectUserSkillsRoot(options.tuttiHome, options.projectId),
+            }).answer(input);
+        },
+    };
+}
+//# sourceMappingURL=runners.js.map

package/dist/server-shell/managed-access/runtime-records.d.ts

@@ -0,0 +1,110 @@
+import { type Static } from "@sinclair/typebox";
+export declare const ModelSessionOwnerSchema: import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"chat">, import("@sinclair/typebox").TLiteral<"workflow">, import("@sinclair/typebox").TLiteral<"task">]>;
+    ref: import("@sinclair/typebox").TString;
+}>;
+export type ModelSessionOwner = Static<typeof ModelSessionOwnerSchema>;
+declare const SessionSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+    state: import("@sinclair/typebox").TLiteral<"ready">;
+    version: import("@sinclair/typebox").TLiteral<1>;
+    project_id: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
+    owner: import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"chat">, import("@sinclair/typebox").TLiteral<"workflow">, import("@sinclair/typebox").TLiteral<"task">]>;
+        ref: import("@sinclair/typebox").TString;
+    }>;
+    session_ref: import("@sinclair/typebox").TString;
+    route_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    provider_identity: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        model: import("@sinclair/typebox").TString;
+        base_url: import("@sinclair/typebox").TString;
+    }>>;
+}>, import("@sinclair/typebox").TObject<{
+    state: import("@sinclair/typebox").TLiteral<"issuing">;
+    request_ref: import("@sinclair/typebox").TString;
+    version: import("@sinclair/typebox").TLiteral<1>;
+    project_id: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
+    owner: import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"chat">, import("@sinclair/typebox").TLiteral<"workflow">, import("@sinclair/typebox").TLiteral<"task">]>;
+        ref: import("@sinclair/typebox").TString;
+    }>;
+    session_ref: import("@sinclair/typebox").TString;
+    route_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    provider_identity: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        model: import("@sinclair/typebox").TString;
+        base_url: import("@sinclair/typebox").TString;
+    }>>;
+}>, import("@sinclair/typebox").TObject<{
+    state: import("@sinclair/typebox").TLiteral<"active">;
+    request_ref: import("@sinclair/typebox").TString;
+    credential: import("@sinclair/typebox").TObject<{
+        credential_ref: import("@sinclair/typebox").TString;
+        session_ref: import("@sinclair/typebox").TString;
+        device_ref: import("@sinclair/typebox").TString;
+        state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"creating">, import("@sinclair/typebox").TLiteral<"active">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoking">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+        expires_at: import("@sinclair/typebox").TInteger;
+        quota_cap: import("@sinclair/typebox").TInteger;
+    }>;
+    provider: import("@sinclair/typebox").TObject<{
+        base_url: import("@sinclair/typebox").TString;
+        model: import("@sinclair/typebox").TString;
+        api_key: import("@sinclair/typebox").TString;
+    }>;
+    version: import("@sinclair/typebox").TLiteral<1>;
+    project_id: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
+    owner: import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"chat">, import("@sinclair/typebox").TLiteral<"workflow">, import("@sinclair/typebox").TLiteral<"task">]>;
+        ref: import("@sinclair/typebox").TString;
+    }>;
+    session_ref: import("@sinclair/typebox").TString;
+    route_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    provider_identity: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        model: import("@sinclair/typebox").TString;
+        base_url: import("@sinclair/typebox").TString;
+    }>>;
+}>, import("@sinclair/typebox").TObject<{
+    state: import("@sinclair/typebox").TLiteral<"revoking">;
+    request_ref: import("@sinclair/typebox").TString;
+    credential: import("@sinclair/typebox").TObject<{
+        credential_ref: import("@sinclair/typebox").TString;
+        session_ref: import("@sinclair/typebox").TString;
+        device_ref: import("@sinclair/typebox").TString;
+        state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"creating">, import("@sinclair/typebox").TLiteral<"active">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoking">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+        expires_at: import("@sinclair/typebox").TInteger;
+        quota_cap: import("@sinclair/typebox").TInteger;
+    }>;
+    version: import("@sinclair/typebox").TLiteral<1>;
+    project_id: import("@sinclair/typebox").TString;
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    tier: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"light">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"max">]>;
+    owner: import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"chat">, import("@sinclair/typebox").TLiteral<"workflow">, import("@sinclair/typebox").TLiteral<"task">]>;
+        ref: import("@sinclair/typebox").TString;
+    }>;
+    session_ref: import("@sinclair/typebox").TString;
+    route_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    provider_identity: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        model: import("@sinclair/typebox").TString;
+        base_url: import("@sinclair/typebox").TString;
+    }>>;
+}>]>;
+export type NativeModelSession = Static<typeof SessionSchema>;
+export declare function parseNativeModelSession(value: unknown): NativeModelSession;
+export declare function readyModelSession(row: NativeModelSession): NativeModelSession & {
+    state: "ready";
+};
+export {};
+//# sourceMappingURL=runtime-records.d.ts.map

package/dist/server-shell/managed-access/runtime-records.js

@@ -0,0 +1,65 @@
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { ProjectIdSchema, IdempotencyKeySchema } from "@tutti/shared/schemas/domain";
+import { HostDelegationRefSchema, HostInstallationRefSchema, ProjectModelGrantRefSchema, ManagedTierSchema, ManagedRuntimeSessionRefSchema, ManagedRouteRefSchema, ManagedCredentialProjectionSchema, ManagedProviderCredentialSchema, } from "@tutti/shared/schemas/internal";
+import { ManagedLocalStateError } from "./private-store.js";
+export const ModelSessionOwnerSchema = Type.Object({
+    kind: Type.Union([Type.Literal("chat"), Type.Literal("workflow"), Type.Literal("task")]),
+    ref: Type.String({ pattern: "^[A-Za-z0-9_-]{1,150}$" }),
+}, { additionalProperties: false });
+const Common = {
+    version: Type.Literal(1),
+    project_id: ProjectIdSchema,
+    delegation_ref: HostDelegationRefSchema,
+    grant_ref: ProjectModelGrantRefSchema,
+    installation_ref: HostInstallationRefSchema,
+    tier: ManagedTierSchema,
+    owner: ModelSessionOwnerSchema,
+    session_ref: ManagedRuntimeSessionRefSchema,
+    route_ref: Type.Optional(ManagedRouteRefSchema),
+    provider_identity: Type.Optional(Type.Object({
+        model: Type.String({ minLength: 1, maxLength: 100 }),
+        base_url: Type.String({ minLength: 1, maxLength: 500 }),
+    }, { additionalProperties: false })),
+};
+const SessionSchema = Type.Union([
+    Type.Object({ ...Common, state: Type.Literal("ready") }, { additionalProperties: false }),
+    Type.Object({ ...Common, state: Type.Literal("issuing"), request_ref: IdempotencyKeySchema }, { additionalProperties: false }),
+    Type.Object({
+        ...Common,
+        state: Type.Literal("active"),
+        request_ref: IdempotencyKeySchema,
+        credential: ManagedCredentialProjectionSchema,
+        provider: ManagedProviderCredentialSchema,
+    }, { additionalProperties: false }),
+    Type.Object({
+        ...Common,
+        state: Type.Literal("revoking"),
+        request_ref: IdempotencyKeySchema,
+        credential: ManagedCredentialProjectionSchema,
+    }, { additionalProperties: false }),
+]);
+export function parseNativeModelSession(value) {
+    if (!Value.Check(SessionSchema, value))
+        throw new ManagedLocalStateError("managed_model_session_invalid");
+    if ((value.state === "active" || value.state === "revoking") &&
+        value.credential.session_ref !== value.session_ref)
+        throw new ManagedLocalStateError("managed_model_session_invalid");
+    return value;
+}
+export function readyModelSession(row) {
+    return {
+        version: row.version,
+        project_id: row.project_id,
+        delegation_ref: row.delegation_ref,
+        grant_ref: row.grant_ref,
+        installation_ref: row.installation_ref,
+        tier: row.tier,
+        owner: row.owner,
+        session_ref: row.session_ref,
+        state: "ready",
+        ...(row.route_ref === undefined ? {} : { route_ref: row.route_ref }),
+        ...(row.provider_identity === undefined ? {} : { provider_identity: row.provider_identity }),
+    };
+}
+//# sourceMappingURL=runtime-records.js.map

package/dist/server-shell/managed-access/runtime.d.ts

@@ -0,0 +1,48 @@
+import type { ManagedProviderCredential } from "@tutti/shared/schemas/internal";
+import { type ModelSessionOwner } from "./runtime-records.js";
+export type ManagedRuntimeObservation = {
+    stage: "credential_ready" | "credential_revoked" | "credential_revoke_pending" | "managed_selection_failed" | "managed_invocation_failed";
+    session_ref?: string;
+    credential_ref?: string;
+    reason_code?: string;
+    request_id?: string;
+};
+export type ManagedInvocationAccess = {
+    provider: ManagedProviderCredential;
+    route_ref: string;
+    session_ref: string;
+    delegation_ref: string;
+    credential_ref: string;
+};
+export declare class NativeManagedRuntime {
+    private readonly options;
+    private readonly files;
+    private readonly state;
+    private readonly client;
+    private readonly now;
+    constructor(options: {
+        tuttiHome: string;
+        relayUrl: string;
+        projectId: string;
+        fetchImpl?: typeof fetch;
+        now?: () => Date;
+        observe?: (event: ManagedRuntimeObservation) => void;
+    });
+    private observe;
+    private name;
+    private readOrCreate;
+    private save;
+    private pin;
+    private providerEndpoint;
+    selection(owner: ModelSessionOwner): Promise<{
+        session_ref: string;
+        route_ref: string;
+        provider: {
+            model: string;
+            base_url: string;
+        };
+    }>;
+    private retire;
+    run<T>(owner: ModelSessionOwner, maxDurationSeconds: number, action: (access: ManagedInvocationAccess) => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/server-shell/managed-access/runtime.js

@@ -0,0 +1,301 @@
+import { createHash } from "node:crypto";
+import { Value } from "@sinclair/typebox/value";
+import { authorizeNativeModelRuntime, NativeAuthorityTransportError } from "@tutti/relay-client";
+import { createIdempotencyKey, createPrefixedId, ID_PREFIXES } from "@tutti/shared/ids";
+import { ensureManagedPrivateRoot, ManagedPrivateStore, ManagedLocalStateError, } from "./private-store.js";
+import { NativeModelControlClient, ManagedControlError } from "./model-control-client.js";
+import { ModelSessionOwnerSchema, parseNativeModelSession, readyModelSession, } from "./runtime-records.js";
+import { NativeManagedState, managedRelayOrigin } from "./state.js";
+export class NativeManagedRuntime {
+    options;
+    files;
+    state;
+    client;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.state = new NativeManagedState(options);
+        this.files = new ManagedPrivateStore(ensureManagedPrivateRoot(options.tuttiHome, createHash("sha256").update(this.state.origin).digest("hex")));
+        this.now = options.now ?? (() => new Date());
+        this.client = new NativeModelControlClient({
+            authorize: async () => {
+                const journal = this.state.project(options.projectId);
+                if (journal.state !== "registered")
+                    throw new ManagedLocalStateError("managed_project_not_registered");
+                const authority = await authorizeNativeModelRuntime({
+                    relayUrl: this.state.origin,
+                    body: {
+                        project_id: journal.project_id,
+                        relay_project_ref: journal.authority.relay_project_ref,
+                        delegation_ref: journal.authority.delegation_ref,
+                        installation_ref: journal.installation_ref,
+                        installation_secret: this.state.installation().secret,
+                        host_registration_secret: journal.host_registration_secret,
+                    },
+                    ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+                });
+                if (authority.tier !== journal.tier ||
+                    authority.expires_at <= Math.floor(this.now().getTime() / 1000))
+                    throw new ManagedLocalStateError("managed_runtime_authority_mismatch");
+                return authority;
+            },
+            ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+        });
+    }
+    observe(event) {
+        try {
+            this.options.observe?.(event);
+        }
+        catch {
+            /* Diagnostics cannot replay a model call. */
+        }
+    }
+    name(owner) {
+        if (!Value.Check(ModelSessionOwnerSchema, owner))
+            throw new ManagedLocalStateError("managed_session_owner_invalid");
+        return `model-${createHash("sha256")
+            .update(JSON.stringify([this.options.projectId, owner.kind, owner.ref]))
+            .digest("hex")}`;
+    }
+    readOrCreate(name, owner, authority, reauthorized) {
+        return this.files.transaction(() => {
+            const saved = this.files.read(`${name}.json`);
+            if (saved !== null) {
+                const row = parseNativeModelSession(saved);
+                if (row.project_id !== this.options.projectId ||
+                    row.owner.kind !== owner.kind ||
+                    row.owner.ref !== owner.ref ||
+                    row.installation_ref !== authority.installation_ref ||
+                    row.tier !== authority.tier)
+                    throw new ManagedLocalStateError("managed_model_session_scope_changed");
+                if (row.delegation_ref !== authority.delegation_ref ||
+                    row.grant_ref !== authority.grant_ref) {
+                    // An explicitly reauthorized native journal is the only entry to a new
+                    // scope. Relay admits it only after prior installation keys are confirmed
+                    // revoked. Keep the exact route/provider and durable Task Thread; the old
+                    // credential and service session are never reused across delegations.
+                    if (!reauthorized)
+                        throw new ManagedLocalStateError("managed_model_session_scope_changed");
+                    const renewed = {
+                        ...readyModelSession(row),
+                        delegation_ref: authority.delegation_ref,
+                        grant_ref: authority.grant_ref,
+                        session_ref: createPrefixedId(ID_PREFIXES.managedSession),
+                    };
+                    this.files.write(`${name}.json`, renewed);
+                    return renewed;
+                }
+                return row;
+            }
+            const row = {
+                version: 1,
+                project_id: this.options.projectId,
+                delegation_ref: authority.delegation_ref,
+                grant_ref: authority.grant_ref,
+                installation_ref: authority.installation_ref,
+                tier: authority.tier,
+                owner,
+                session_ref: createPrefixedId(ID_PREFIXES.managedSession),
+                state: "ready",
+            };
+            this.files.write(`${name}.json`, row, true);
+            return row;
+        });
+    }
+    save(name, row) {
+        this.files.transaction(() => {
+            this.files.write(`${name}.json`, parseNativeModelSession(row));
+        });
+        return row;
+    }
+    async pin(name, row) {
+        const pin = await this.client.pin(row.session_ref, row.route_ref);
+        if (pin.session_ref !== row.session_ref ||
+            pin.tier !== row.tier ||
+            (row.route_ref !== undefined && pin.route_ref !== row.route_ref) ||
+            (row.provider_identity !== undefined &&
+                (row.provider_identity.model !== pin.provider.model ||
+                    row.provider_identity.base_url !== pin.provider.base_url)))
+            throw new ManagedLocalStateError("managed_route_changed");
+        this.providerEndpoint(pin.provider.base_url);
+        return this.save(name, { ...row, route_ref: pin.route_ref, provider_identity: pin.provider });
+    }
+    providerEndpoint(value) {
+        try {
+            const endpoint = new URL(value);
+            managedRelayOrigin(endpoint.origin);
+            if (endpoint.username ||
+                endpoint.password ||
+                endpoint.search ||
+                endpoint.hash ||
+                !/^\/v1\/?$/.test(endpoint.pathname))
+                throw new Error();
+        }
+        catch {
+            throw new ManagedLocalStateError("managed_provider_endpoint_invalid");
+        }
+    }
+    // Resolve the immutable route before opening a durable Codex Thread. No key is
+    // issued by selection; each later turn obtains its own bounded credential lease.
+    async selection(owner) {
+        try {
+            const journal = this.state.project(this.options.projectId);
+            if (journal.state !== "registered")
+                throw new ManagedLocalStateError("managed_project_not_registered");
+            const name = this.name(owner), unlock = this.files.acquireExecutionLease(name);
+            try {
+                const row = await this.pin(name, this.readOrCreate(name, owner, journal.authority, journal.previous_request_ref !== undefined));
+                return {
+                    session_ref: row.session_ref,
+                    route_ref: row.route_ref,
+                    provider: row.provider_identity,
+                };
+            }
+            finally {
+                unlock();
+            }
+        }
+        catch (error) {
+            this.observe({
+                stage: "managed_selection_failed",
+                reason_code: error instanceof ManagedLocalStateError ||
+                    error instanceof ManagedControlError ||
+                    error instanceof NativeAuthorityTransportError
+                    ? error.code
+                    : "managed_selection_unavailable",
+                ...((error instanceof ManagedControlError ||
+                    error instanceof NativeAuthorityTransportError) &&
+                    error.requestId !== undefined
+                    ? { request_id: error.requestId }
+                    : {}),
+            });
+            throw error;
+        }
+    }
+    async retire(name, row) {
+        if (row.state !== "active" && row.state !== "revoking")
+            return row;
+        const pending = {
+            ...readyModelSession(row),
+            state: "revoking",
+            request_ref: row.request_ref,
+            credential: row.credential,
+        };
+        this.save(name, pending); // Drop the local key before any revoke I/O.
+        const response = await this.client.revoke(row.credential.credential_ref);
+        if (response.credential.credential_ref !== row.credential.credential_ref ||
+            response.credential.session_ref !== row.session_ref ||
+            response.credential.state !== "revoked")
+            throw new ManagedLocalStateError("managed_revocation_unconfirmed");
+        this.observe({
+            stage: "credential_revoked",
+            session_ref: row.session_ref,
+            credential_ref: row.credential.credential_ref,
+        });
+        return this.save(name, readyModelSession(row));
+    }
+    // One finite credential lease per bounded provider invocation. Fresh credentials
+    // renew automatically on the same pinned session; the model callback is never retried.
+    async run(owner, maxDurationSeconds, action) {
+        if (!Number.isSafeInteger(maxDurationSeconds) ||
+            maxDurationSeconds < 1 ||
+            maxDurationSeconds > 82_800)
+            throw new ManagedLocalStateError("managed_invocation_duration_invalid");
+        const journal = this.state.project(this.options.projectId);
+        if (journal.state !== "registered")
+            throw new ManagedLocalStateError("managed_project_not_registered");
+        const name = this.name(owner), unlock = this.files.acquireExecutionLease(name);
+        let row;
+        try {
+            row = this.readOrCreate(name, owner, journal.authority, journal.previous_request_ref !== undefined);
+            row = await this.retire(name, row);
+            row = await this.pin(name, row);
+            for (let attempt = 0; attempt < 2; attempt++) {
+                if (row.state === "ready")
+                    row = this.save(name, { ...row, state: "issuing", request_ref: createIdempotencyKey() });
+                if (row.state !== "issuing")
+                    throw new ManagedLocalStateError("managed_model_session_invalid");
+                const requestRef = row.request_ref;
+                const result = await this.client.issue(row.session_ref, requestRef);
+                if (result.credential.session_ref !== row.session_ref ||
+                    result.credential.device_ref !==
+                        row.installation_ref.replace(/^host_installation_/, "managed_device_"))
+                    throw new ManagedLocalStateError("managed_credential_scope_mismatch");
+                // Store enough metadata to revoke even when delivery or policy checks fail.
+                row = this.save(name, {
+                    ...readyModelSession(row),
+                    state: "revoking",
+                    request_ref: row.request_ref,
+                    credential: result.credential,
+                });
+                if (result.disposition === "already_issued") {
+                    row = await this.retire(name, row);
+                    continue;
+                }
+                if (result.route_ref !== row.route_ref ||
+                    result.credential.state !== "active" ||
+                    result.credential.expires_at <=
+                        Math.floor(this.now().getTime() / 1000) + maxDurationSeconds + 60)
+                    throw new ManagedLocalStateError("managed_credential_policy_invalid");
+                this.providerEndpoint(result.provider.base_url);
+                if (row.provider_identity &&
+                    (row.provider_identity.model !== result.provider.model ||
+                        row.provider_identity.base_url !== result.provider.base_url))
+                    throw new ManagedLocalStateError("managed_route_changed");
+                row = this.save(name, {
+                    ...readyModelSession(row),
+                    state: "active",
+                    request_ref: requestRef,
+                    credential: result.credential,
+                    provider: result.provider,
+                    provider_identity: { model: result.provider.model, base_url: result.provider.base_url },
+                });
+                this.observe({
+                    stage: "credential_ready",
+                    session_ref: row.session_ref,
+                    credential_ref: result.credential.credential_ref,
+                });
+                return await action({
+                    provider: result.provider,
+                    route_ref: result.route_ref,
+                    session_ref: row.session_ref,
+                    delegation_ref: row.delegation_ref,
+                    credential_ref: result.credential.credential_ref,
+                });
+            }
+            throw new ManagedLocalStateError("managed_credential_delivery_unconfirmed");
+        }
+        catch (error) {
+            if (row)
+                this.observe({
+                    stage: "managed_invocation_failed",
+                    session_ref: row.session_ref,
+                    reason_code: error instanceof ManagedLocalStateError ? error.code : "managed_invocation_unavailable",
+                    ...(error instanceof ManagedControlError && error.requestId !== undefined
+                        ? { request_id: error.requestId }
+                        : {}),
+                });
+            throw error;
+        }
+        finally {
+            try {
+                if (row)
+                    await this.retire(name, row);
+            }
+            catch (error) {
+                if (row)
+                    this.observe({
+                        stage: "credential_revoke_pending",
+                        session_ref: row.session_ref,
+                        reason_code: error instanceof ManagedLocalStateError
+                            ? error.code
+                            : "managed_revocation_unconfirmed",
+                    });
+            }
+            finally {
+                unlock();
+            }
+        }
+    }
+}
+//# sourceMappingURL=runtime.js.map