effect-agent 0.1.0-beta.85 → 0.1.0-beta.87

package/dist/durable/ActivityStore.d.mts

@@ -0,0 +1,116 @@
+import { _ as Digest } from "../Records-BAGkekt8.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+declare namespace ActivityStore_d_exports {
+  export { ActivityBusy, ActivityClaim, ActivityClaimRequest, ActivityMutationFailpoint, ActivityMutationFailure, ActivityMutationPoint, ActivityOwnershipLost, ActivityProcessorKey, ActivityProcessorStore, ActivityProgress, ActivityStoreError, ActivityStoreFailure, ActivityWorkConflict, PreparedActivity };
+}
+declare const ActivityProcessorKey_base: Schema.Class<ActivityProcessorKey, Schema.Struct<{
+  readonly processorId: Schema.NonEmptyString;
+  readonly processorVersion: Schema.NonEmptyString;
+  readonly threadId: Schema.brand<Schema.NonEmptyString, "@effect-agent/core/ThreadId">;
+}>, {}>;
+/** Application-owned processor identity. Changing the version starts independent progress. */
+declare class ActivityProcessorKey extends ActivityProcessorKey_base {}
+declare const PreparedActivity_base: Schema.Class<PreparedActivity, Schema.Struct<{
+  readonly version: Schema.Literal<1>;
+  readonly key: typeof ActivityProcessorKey;
+  readonly sequence: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly workId: Schema.brand<Schema.String, "@effect-agent/thread/Digest">;
+  readonly recordId: Schema.brand<Schema.NonEmptyString, "@effect-agent/thread/RecordId">;
+  readonly recordDigest: Schema.brand<Schema.String, "@effect-agent/thread/Digest">;
+  readonly output: Schema.declare<Schema.Json, Schema.Json>;
+}>, {}>;
+/** Durable extraction output, pinned before any external application of that output. */
+declare class PreparedActivity extends PreparedActivity_base {}
+declare const ActivityClaim_base: Schema.Class<ActivityClaim, Schema.Struct<{
+  readonly key: typeof ActivityProcessorKey;
+  readonly owner: Schema.NonEmptyString;
+  readonly epoch: Schema.Int;
+  readonly throughSequence: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly leaseExpiresAt: Schema.Finite;
+  /** Pending output captured atomically at acquisition; advance returns null here. */
+  readonly pending: Schema.NullOr<typeof PreparedActivity>;
+}>, {}>;
+/** Independent from Thread ownership, submission delivery, and canonical checkpoints. */
+declare class ActivityClaim extends ActivityClaim_base {}
+declare const ActivityProgress_base: Schema.Class<ActivityProgress, Schema.Struct<{
+  readonly version: Schema.Literal<1>;
+  readonly key: typeof ActivityProcessorKey;
+  readonly throughSequence: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly epoch: Schema.Int;
+  readonly owner: Schema.NullOr<Schema.NonEmptyString>;
+  readonly leaseExpiresAt: Schema.Finite;
+  readonly pending: Schema.NullOr<typeof PreparedActivity>;
+  /** Time of the last cursor advance, not the activity time or a global freshness clock. */
+  readonly advancedAt: Schema.NullOr<Schema.Finite>;
+}>, {}>;
+declare class ActivityProgress extends ActivityProgress_base {}
+declare const ActivityStoreError_base: Schema.Class<ActivityStoreError, Schema.TaggedStruct<"ActivityStoreError", {
+  readonly operation: Schema.NonEmptyString;
+  readonly reason: Schema.Literals<readonly ["invalid-input", "unavailable", "corrupt", "incompatible"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class ActivityStoreError extends ActivityStoreError_base {}
+declare const ActivityBusy_base: Schema.Class<ActivityBusy, Schema.TaggedStruct<"ActivityBusy", {
+  readonly key: typeof ActivityProcessorKey;
+  readonly leaseExpiresAt: Schema.Finite;
+}>, import("effect/Cause").YieldableError>;
+declare class ActivityBusy extends ActivityBusy_base {}
+declare const ActivityOwnershipLost_base: Schema.Class<ActivityOwnershipLost, Schema.TaggedStruct<"ActivityOwnershipLost", {
+  readonly key: typeof ActivityProcessorKey;
+  readonly owner: Schema.NonEmptyString;
+  readonly epoch: Schema.Int;
+}>, import("effect/Cause").YieldableError>;
+declare class ActivityOwnershipLost extends ActivityOwnershipLost_base {}
+declare const ActivityWorkConflict_base: Schema.Class<ActivityWorkConflict, Schema.TaggedStruct<"ActivityWorkConflict", {
+  readonly key: typeof ActivityProcessorKey;
+  readonly workId: Schema.brand<Schema.String, "@effect-agent/thread/Digest">;
+}>, import("effect/Cause").YieldableError>;
+declare class ActivityWorkConflict extends ActivityWorkConflict_base {}
+declare const ActivityMutationPoint: Schema.Literals<readonly ["activity:initialize:before", "activity:initialize:after", "activity:claim:before", "activity:claim:after-state", "activity:claim:after", "activity:prepare:before", "activity:prepare:after-state", "activity:prepare:after", "activity:advance:before", "activity:advance:after-state", "activity:advance:after", "activity:release:before", "activity:release:after-state", "activity:release:after"]>;
+type ActivityMutationPoint = typeof ActivityMutationPoint.Type;
+declare const ActivityMutationFailure_base: Schema.Class<ActivityMutationFailure, Schema.TaggedStruct<"ActivityMutationFailure", {
+  readonly point: Schema.Literals<readonly ["activity:initialize:before", "activity:initialize:after", "activity:claim:before", "activity:claim:after-state", "activity:claim:after", "activity:prepare:before", "activity:prepare:after-state", "activity:prepare:after", "activity:advance:before", "activity:advance:after-state", "activity:advance:after", "activity:release:before", "activity:release:after-state", "activity:release:after"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class ActivityMutationFailure extends ActivityMutationFailure_base {}
+declare const ActivityMutationFailpoint_base: Context.ServiceClass<ActivityMutationFailpoint, "@effect-agent/thread/ActivityMutationFailpoint", {
+  readonly hit: (point: ActivityMutationPoint) => Effect.Effect<void, ActivityMutationFailure>;
+}>;
+declare class ActivityMutationFailpoint extends ActivityMutationFailpoint_base {
+  static readonly layer: Layer.Layer<ActivityMutationFailpoint, never, never>;
+}
+type ActivityStoreFailure = ActivityStoreError | ActivityBusy | ActivityOwnershipLost | ActivityWorkConflict | ActivityMutationFailure;
+declare const ActivityClaimRequest_base: Schema.Class<ActivityClaimRequest, Schema.Struct<{
+  readonly key: typeof ActivityProcessorKey;
+  readonly owner: Schema.NonEmptyString;
+  readonly leaseMillis: Schema.Int;
+}>, {}>;
+declare class ActivityClaimRequest extends ActivityClaimRequest_base {}
+declare const ActivityProcessorStore_base: Context.ServiceClass<ActivityProcessorStore, "@effect-agent/thread/ActivityProcessorStore", {
+  readonly inspect: (key: ActivityProcessorKey) => Effect.Effect<ActivityProgress | null, ActivityStoreError>;
+  readonly claim: (request: ActivityClaimRequest) => Effect.Effect<ActivityClaim, ActivityStoreFailure>;
+  readonly prepare: (request: {
+    readonly claim: ActivityClaim;
+    readonly work: PreparedActivity;
+  }) => Effect.Effect<PreparedActivity, ActivityStoreFailure>;
+  readonly advance: (request: {
+    readonly claim: ActivityClaim;
+    readonly workId: Digest;
+  }) => Effect.Effect<ActivityClaim, ActivityStoreFailure>;
+  readonly release: (claim: ActivityClaim) => Effect.Effect<void, ActivityStoreFailure>;
+}>;
+/**
+ * Optional durable progress for finite committed-activity passes. Every mutation is atomic.
+ * claim rejects an unexpired owner and allocates a strictly newer epoch on every successful
+ * acquisition, including an initial grant and reacquisition after release with the same owner. It preserves
+ * pending output and returns it with the claim. prepare and advance reject expired or superseded claims and
+ * require the claim's throughSequence to equal current progress. prepare accepts only the next
+ * sequence, pins one output, and rejects divergent reuse. advance requires its pending work ID,
+ * increments progress by exactly one, and clears pending in the same transaction.
+ *
+ * release checks owner/epoch, independent of the cursor, and never discards pending output.
+ * The adapter owns its lease clock. A failed release leaves only a bounded lease to expire.
+ * This port never owns, mutates, or checkpoints the canonical Thread log.
+ */
+declare class ActivityProcessorStore extends ActivityProcessorStore_base {}
+//#endregion
+export { ActivityBusy, ActivityClaim, ActivityClaimRequest, ActivityMutationFailpoint, ActivityMutationFailure, ActivityMutationPoint, ActivityOwnershipLost, ActivityProcessorKey, ActivityProcessorStore, ActivityProgress, ActivityStoreError, ActivityStoreFailure, ActivityWorkConflict, PreparedActivity, ActivityStore_d_exports as t };
+//# sourceMappingURL=ActivityStore.d.mts.map

package/dist/durable/ActivityStore.mjs

@@ -0,0 +1,131 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { ThreadId } from "../core/Identifiers.mjs";
+import { CanonicalSequence, Digest, PersistedJson, RecordId } from "./Records.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/durable/ActivityStore.ts
+var ActivityStore_exports = /* @__PURE__ */ __exportAll({
+	ActivityBusy: () => ActivityBusy,
+	ActivityClaim: () => ActivityClaim,
+	ActivityClaimRequest: () => ActivityClaimRequest,
+	ActivityMutationFailpoint: () => ActivityMutationFailpoint,
+	ActivityMutationFailure: () => ActivityMutationFailure,
+	ActivityMutationPoint: () => ActivityMutationPoint,
+	ActivityOwnershipLost: () => ActivityOwnershipLost,
+	ActivityProcessorKey: () => ActivityProcessorKey,
+	ActivityProcessorStore: () => ActivityProcessorStore,
+	ActivityProgress: () => ActivityProgress,
+	ActivityStoreError: () => ActivityStoreError,
+	ActivityWorkConflict: () => ActivityWorkConflict,
+	PreparedActivity: () => PreparedActivity
+});
+const Identity = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+const Epoch = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+}));
+const Timestamp = Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0));
+/** Application-owned processor identity. Changing the version starts independent progress. */
+var ActivityProcessorKey = class extends Schema.Class("@effect-agent/thread/ActivityProcessorKey")({
+	processorId: Identity,
+	processorVersion: Identity,
+	threadId: ThreadId.check(Schema.isMaxLength(1024))
+}) {};
+/** Durable extraction output, pinned before any external application of that output. */
+var PreparedActivity = class extends Schema.Class("@effect-agent/thread/PreparedActivity")({
+	version: Schema.Literal(1),
+	key: ActivityProcessorKey,
+	sequence: CanonicalSequence.check(Schema.isGreaterThan(0)),
+	workId: Digest,
+	recordId: RecordId,
+	recordDigest: Digest,
+	output: PersistedJson
+}) {};
+/** Independent from Thread ownership, submission delivery, and canonical checkpoints. */
+var ActivityClaim = class extends Schema.Class("@effect-agent/thread/ActivityClaim")({
+	key: ActivityProcessorKey,
+	owner: Identity,
+	epoch: Epoch,
+	throughSequence: CanonicalSequence,
+	leaseExpiresAt: Timestamp,
+	/** Pending output captured atomically at acquisition; advance returns null here. */
+	pending: Schema.NullOr(PreparedActivity)
+}) {};
+var ActivityProgress = class extends Schema.Class("@effect-agent/thread/ActivityProgress")({
+	version: Schema.Literal(1),
+	key: ActivityProcessorKey,
+	throughSequence: CanonicalSequence,
+	epoch: Epoch,
+	owner: Schema.NullOr(Identity),
+	leaseExpiresAt: Timestamp,
+	pending: Schema.NullOr(PreparedActivity),
+	/** Time of the last cursor advance, not the activity time or a global freshness clock. */
+	advancedAt: Schema.NullOr(Timestamp)
+}) {};
+var ActivityStoreError = class extends Schema.TaggedError()("ActivityStoreError", {
+	operation: Schema.NonEmptyString,
+	reason: Schema.Literals([
+		"invalid-input",
+		"unavailable",
+		"corrupt",
+		"incompatible"
+	])
+}) {};
+var ActivityBusy = class extends Schema.TaggedError()("ActivityBusy", {
+	key: ActivityProcessorKey,
+	leaseExpiresAt: Timestamp
+}) {};
+var ActivityOwnershipLost = class extends Schema.TaggedError()("ActivityOwnershipLost", {
+	key: ActivityProcessorKey,
+	owner: Identity,
+	epoch: Epoch
+}) {};
+var ActivityWorkConflict = class extends Schema.TaggedError()("ActivityWorkConflict", {
+	key: ActivityProcessorKey,
+	workId: Digest
+}) {};
+const ActivityMutationPoint = Schema.Literals([
+	"activity:initialize:before",
+	"activity:initialize:after",
+	"activity:claim:before",
+	"activity:claim:after-state",
+	"activity:claim:after",
+	"activity:prepare:before",
+	"activity:prepare:after-state",
+	"activity:prepare:after",
+	"activity:advance:before",
+	"activity:advance:after-state",
+	"activity:advance:after",
+	"activity:release:before",
+	"activity:release:after-state",
+	"activity:release:after"
+]);
+var ActivityMutationFailure = class extends Schema.TaggedError()("ActivityMutationFailure", { point: ActivityMutationPoint }) {};
+var ActivityMutationFailpoint = class extends Context.Service()("@effect-agent/thread/ActivityMutationFailpoint") {
+	static layer = Layer.succeed(this, { hit: () => Effect.void });
+};
+var ActivityClaimRequest = class extends Schema.Class("@effect-agent/thread/ActivityClaimRequest")({
+	key: ActivityProcessorKey,
+	owner: Identity,
+	leaseMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 6e5
+	}))
+}) {};
+/**
+* Optional durable progress for finite committed-activity passes. Every mutation is atomic.
+* claim rejects an unexpired owner and allocates a strictly newer epoch on every successful
+* acquisition, including an initial grant and reacquisition after release with the same owner. It preserves
+* pending output and returns it with the claim. prepare and advance reject expired or superseded claims and
+* require the claim's throughSequence to equal current progress. prepare accepts only the next
+* sequence, pins one output, and rejects divergent reuse. advance requires its pending work ID,
+* increments progress by exactly one, and clears pending in the same transaction.
+*
+* release checks owner/epoch, independent of the cursor, and never discards pending output.
+* The adapter owns its lease clock. A failed release leaves only a bounded lease to expire.
+* This port never owns, mutates, or checkpoints the canonical Thread log.
+*/
+var ActivityProcessorStore = class extends Context.Service()("@effect-agent/thread/ActivityProcessorStore") {};
+//#endregion
+export { ActivityBusy, ActivityClaim, ActivityClaimRequest, ActivityMutationFailpoint, ActivityMutationFailure, ActivityMutationPoint, ActivityOwnershipLost, ActivityProcessorKey, ActivityProcessorStore, ActivityProgress, ActivityStoreError, ActivityWorkConflict, PreparedActivity, ActivityStore_exports as t };
+
+//# sourceMappingURL=ActivityStore.mjs.map

package/dist/durable/ActivityStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActivityStore.mjs","names":[],"sources":["../../src/durable/ActivityStore.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema } from \"effect\";\n\nimport { ThreadId } from \"../core/Identifiers.ts\";\nimport { CanonicalSequence, Digest, PersistedJson, RecordId } from \"./Records.ts\";\n\nconst Identity = Schema.NonEmptyString.check(Schema.isMaxLength(256));\nconst Epoch = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }));\nconst Timestamp = Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0));\n\n/** Application-owned processor identity. Changing the version starts independent progress. */\nexport class ActivityProcessorKey extends Schema.Class<ActivityProcessorKey>(\n  \"@effect-agent/thread/ActivityProcessorKey\",\n)({\n  processorId: Identity,\n  processorVersion: Identity,\n  threadId: ThreadId.check(Schema.isMaxLength(1_024)),\n}) {}\n\n/** Durable extraction output, pinned before any external application of that output. */\nexport class PreparedActivity extends Schema.Class<PreparedActivity>(\n  \"@effect-agent/thread/PreparedActivity\",\n)({\n  version: Schema.Literal(1),\n  key: ActivityProcessorKey,\n  sequence: CanonicalSequence.check(Schema.isGreaterThan(0)),\n  workId: Digest,\n  recordId: RecordId,\n  recordDigest: Digest,\n  output: PersistedJson,\n}) {}\n\n/** Independent from Thread ownership, submission delivery, and canonical checkpoints. */\nexport class ActivityClaim extends Schema.Class<ActivityClaim>(\n  \"@effect-agent/thread/ActivityClaim\",\n)({\n  key: ActivityProcessorKey,\n  owner: Identity,\n  epoch: Epoch,\n  throughSequence: CanonicalSequence,\n  leaseExpiresAt: Timestamp,\n  /** Pending output captured atomically at acquisition; advance returns null here. */\n  pending: Schema.NullOr(PreparedActivity),\n}) {}\n\nexport class ActivityProgress extends Schema.Class<ActivityProgress>(\n  \"@effect-agent/thread/ActivityProgress\",\n)({\n  version: Schema.Literal(1),\n  key: ActivityProcessorKey,\n  throughSequence: CanonicalSequence,\n  epoch: Epoch,\n  owner: Schema.NullOr(Identity),\n  leaseExpiresAt: Timestamp,\n  pending: Schema.NullOr(PreparedActivity),\n  /** Time of the last cursor advance, not the activity time or a global freshness clock. */\n  advancedAt: Schema.NullOr(Timestamp),\n}) {}\n\nexport class ActivityStoreError extends Schema.TaggedError<ActivityStoreError>()(\n  \"ActivityStoreError\",\n  {\n    operation: Schema.NonEmptyString,\n    reason: Schema.Literals([\"invalid-input\", \"unavailable\", \"corrupt\", \"incompatible\"]),\n  },\n) {}\n\nexport class ActivityBusy extends Schema.TaggedError<ActivityBusy>()(\"ActivityBusy\", {\n  key: ActivityProcessorKey,\n  leaseExpiresAt: Timestamp,\n}) {}\n\nexport class ActivityOwnershipLost extends Schema.TaggedError<ActivityOwnershipLost>()(\n  \"ActivityOwnershipLost\",\n  { key: ActivityProcessorKey, owner: Identity, epoch: Epoch },\n) {}\n\nexport class ActivityWorkConflict extends Schema.TaggedError<ActivityWorkConflict>()(\n  \"ActivityWorkConflict\",\n  { key: ActivityProcessorKey, workId: Digest },\n) {}\n\nexport const ActivityMutationPoint = Schema.Literals([\n  \"activity:initialize:before\",\n  \"activity:initialize:after\",\n  \"activity:claim:before\",\n  \"activity:claim:after-state\",\n  \"activity:claim:after\",\n  \"activity:prepare:before\",\n  \"activity:prepare:after-state\",\n  \"activity:prepare:after\",\n  \"activity:advance:before\",\n  \"activity:advance:after-state\",\n  \"activity:advance:after\",\n  \"activity:release:before\",\n  \"activity:release:after-state\",\n  \"activity:release:after\",\n]);\n\nexport type ActivityMutationPoint = typeof ActivityMutationPoint.Type;\n\nexport class ActivityMutationFailure extends Schema.TaggedError<ActivityMutationFailure>()(\n  \"ActivityMutationFailure\",\n  { point: ActivityMutationPoint },\n) {}\n\nexport class ActivityMutationFailpoint extends Context.Service<\n  ActivityMutationFailpoint,\n  { readonly hit: (point: ActivityMutationPoint) => Effect.Effect<void, ActivityMutationFailure> }\n>()(\"@effect-agent/thread/ActivityMutationFailpoint\") {\n  static readonly layer = Layer.succeed(this, { hit: () => Effect.void });\n}\n\nexport type ActivityStoreFailure =\n  | ActivityStoreError\n  | ActivityBusy\n  | ActivityOwnershipLost\n  | ActivityWorkConflict\n  | ActivityMutationFailure;\n\nexport class ActivityClaimRequest extends Schema.Class<ActivityClaimRequest>(\n  \"@effect-agent/thread/ActivityClaimRequest\",\n)({\n  key: ActivityProcessorKey,\n  owner: Identity,\n  leaseMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 600_000 })),\n}) {}\n\n/**\n * Optional durable progress for finite committed-activity passes. Every mutation is atomic.\n * claim rejects an unexpired owner and allocates a strictly newer epoch on every successful\n * acquisition, including an initial grant and reacquisition after release with the same owner. It preserves\n * pending output and returns it with the claim. prepare and advance reject expired or superseded claims and\n * require the claim's throughSequence to equal current progress. prepare accepts only the next\n * sequence, pins one output, and rejects divergent reuse. advance requires its pending work ID,\n * increments progress by exactly one, and clears pending in the same transaction.\n *\n * release checks owner/epoch, independent of the cursor, and never discards pending output.\n * The adapter owns its lease clock. A failed release leaves only a bounded lease to expire.\n * This port never owns, mutates, or checkpoints the canonical Thread log.\n */\nexport class ActivityProcessorStore extends Context.Service<\n  ActivityProcessorStore,\n  {\n    readonly inspect: (\n      key: ActivityProcessorKey,\n    ) => Effect.Effect<ActivityProgress | null, ActivityStoreError>;\n    readonly claim: (\n      request: ActivityClaimRequest,\n    ) => Effect.Effect<ActivityClaim, ActivityStoreFailure>;\n    readonly prepare: (request: {\n      readonly claim: ActivityClaim;\n      readonly work: PreparedActivity;\n    }) => Effect.Effect<PreparedActivity, ActivityStoreFailure>;\n    readonly advance: (request: {\n      readonly claim: ActivityClaim;\n      readonly workId: Digest;\n    }) => Effect.Effect<ActivityClaim, ActivityStoreFailure>;\n    readonly release: (claim: ActivityClaim) => Effect.Effect<void, ActivityStoreFailure>;\n  }\n>()(\"@effect-agent/thread/ActivityProcessorStore\") {}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKA,MAAM,WAAW,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AACpE,MAAM,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CAAC;AACjG,MAAM,YAAY,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC;;AAGtE,IAAa,uBAAb,cAA0C,OAAO,MAC/C,2CACF,CAAC,CAAC;CACA,aAAa;CACb,kBAAkB;CAClB,UAAU,SAAS,MAAM,OAAO,YAAY,IAAK,CAAC;AACpD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,SAAS,OAAO,QAAQ,CAAC;CACzB,KAAK;CACL,UAAU,kBAAkB,MAAM,OAAO,cAAc,CAAC,CAAC;CACzD,QAAQ;CACR,UAAU;CACV,cAAc;CACd,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gBAAb,cAAmC,OAAO,MACxC,oCACF,CAAC,CAAC;CACA,KAAK;CACL,OAAO;CACP,OAAO;CACP,iBAAiB;CACjB,gBAAgB;;CAEhB,SAAS,OAAO,OAAO,gBAAgB;AACzC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,SAAS,OAAO,QAAQ,CAAC;CACzB,KAAK;CACL,iBAAiB;CACjB,OAAO;CACP,OAAO,OAAO,OAAO,QAAQ;CAC7B,gBAAgB;CAChB,SAAS,OAAO,OAAO,gBAAgB;;CAEvC,YAAY,OAAO,OAAO,SAAS;AACrC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA;CACE,WAAW,OAAO;CAClB,QAAQ,OAAO,SAAS;EAAC;EAAiB;EAAe;EAAW;CAAc,CAAC;AACrF,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,eAAb,cAAkC,OAAO,YAA0B,CAAC,CAAC,gBAAgB;CACnF,KAAK;CACL,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA;CAAE,KAAK;CAAsB,OAAO;CAAU,OAAO;AAAM,CAC7D,CAAC,CAAC,CAAC;AAEH,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA;CAAE,KAAK;CAAsB,QAAQ;AAAO,CAC9C,CAAC,CAAC,CAAC;AAEH,MAAa,wBAAwB,OAAO,SAAS;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,EAAE,OAAO,sBAAsB,CACjC,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,QAAQ,QAGrD,CAAC,CAAC,gDAAgD,CAAC,CAAC;CACpD,OAAgB,QAAQ,MAAM,QAAQ,MAAM,EAAE,WAAW,OAAO,KAAK,CAAC;AACxE;AASA,IAAa,uBAAb,cAA0C,OAAO,MAC/C,2CACF,CAAC,CAAC;CACA,KAAK;CACL,OAAO;CACP,aAAa,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAQ,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;AAeJ,IAAa,yBAAb,cAA4C,QAAQ,QAmBlD,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC"}

package/dist/durable/Admin.d.mts

@@ -0,0 +1,2 @@
+import { Cr as RetryCommand, Dr as predictRecoveryDisposition, Er as obligationSeverityOf, Or as recoveryDecisionMeaning, Sr as RecoveryExplanation, Tr as RetryRefused, _r as ObligationReport, br as RECOVERY_DECISION_MEANINGS, cr as ExplainedEvidence, dr as IntegrityCheck, fr as IntegrityCheckName, gr as ObligationEntry, hr as ObligationBlockedOn, kr as renderRecoveryExplanation, lr as ExplainedSubmission, mr as IntegrityReport, pr as IntegrityCheckStatus, ur as ExplainedUnknownCall, vr as ObligationSeverity, wr as RetryRefusalReason, xr as RecoveryDisposition, yr as ObligationThresholds } from "../Records-BAGkekt8.mjs";
+export { ExplainedEvidence, ExplainedSubmission, ExplainedUnknownCall, IntegrityCheck, IntegrityCheckName, IntegrityCheckStatus, IntegrityReport, ObligationBlockedOn, ObligationEntry, ObligationReport, ObligationSeverity, ObligationThresholds, RECOVERY_DECISION_MEANINGS, RecoveryDisposition, RecoveryExplanation, RetryCommand, RetryRefusalReason, RetryRefused, obligationSeverityOf, predictRecoveryDisposition, recoveryDecisionMeaning, renderRecoveryExplanation };

package/dist/durable/Admin.mjs

@@ -0,0 +1,328 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { SubmissionId, ThreadId, ToolCallId } from "../core/Identifiers.mjs";
+import { QueueSequence } from "../core/Receipt.mjs";
+import { CanonicalSequence, SettlementOutcome, ToolCallUnknown } from "./Records.mjs";
+import { AbortCommand, AbortIntent, ApprovalDecisionIntent, ChildAttachmentSnapshot, JoinSnapshot, ParentLinkage, SubmissionState, SuspensionSnapshot, UnknownResolutionIntent } from "./SubmissionLedger.mjs";
+import { OpenDelegationCallEvidence, OpenToolCallEvidence, PendingApprovalEvidence, RecoveryDecision } from "./Recovery.mjs";
+import { DateTime, Schema } from "effect";
+//#region src/durable/Admin.ts
+var Admin_exports = /* @__PURE__ */ __exportAll({
+	ExplainedEvidence: () => ExplainedEvidence,
+	ExplainedSubmission: () => ExplainedSubmission,
+	ExplainedUnknownCall: () => ExplainedUnknownCall,
+	IntegrityCheck: () => IntegrityCheck,
+	IntegrityCheckName: () => IntegrityCheckName,
+	IntegrityCheckStatus: () => IntegrityCheckStatus,
+	IntegrityReport: () => IntegrityReport,
+	ObligationBlockedOn: () => ObligationBlockedOn,
+	ObligationEntry: () => ObligationEntry,
+	ObligationReport: () => ObligationReport,
+	ObligationSeverity: () => ObligationSeverity,
+	ObligationThresholds: () => ObligationThresholds,
+	RECOVERY_DECISION_MEANINGS: () => RECOVERY_DECISION_MEANINGS,
+	RecoveryDisposition: () => RecoveryDisposition,
+	RecoveryExplanation: () => RecoveryExplanation,
+	RetryCommand: () => RetryCommand,
+	RetryRefusalReason: () => RetryRefusalReason,
+	RetryRefused: () => RetryRefused,
+	obligationSeverityOf: () => obligationSeverityOf,
+	predictRecoveryDisposition: () => predictRecoveryDisposition,
+	recoveryDecisionMeaning: () => recoveryDecisionMeaning,
+	renderRecoveryExplanation: () => renderRecoveryExplanation
+});
+/**
+* Pure report logic for the P7 administrative operations (plan §3): the Schema classes carried
+* by `DurableAgentRuntime.explain`/`verify`/`scanObligations`, the operator meaning table for
+* every recovery decision tag, and the text renderer. Everything here is pure — no port access,
+* no clocks, no writes — so hosts, CLIs, and wire envelopes share one report vocabulary.
+*/
+const BoundedDetail = Schema.String.check(Schema.isMaxLength(4096));
+/** Non-negative whole seconds derived from the Effect Clock. */
+const AgeSeconds = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/**
+* The disposition family of `RecoveryReport`, reused verbatim so an explanation predicts exactly
+* what `runRecovery`/`retry` would report for the same decision.
+*/
+const RecoveryDisposition = Schema.Literals([
+	"repaired",
+	"deferred",
+	"none",
+	"unknown"
+]);
+/** Submission identity, lane position, and Clock-derived ages (DUR-017 obligation visibility). */
+var ExplainedSubmission = class extends Schema.Class("@effect-agent/thread/ExplainedSubmission")({
+	submissionId: SubmissionId,
+	threadId: ThreadId,
+	state: SubmissionState,
+	queueSequence: QueueSequence,
+	createdAt: Schema.DateTimeUtcFromString,
+	readyAt: Schema.optionalKey(Schema.DateTimeUtcFromString),
+	/** Whole seconds since admission (`createdAt`). */
+	ageSeconds: AgeSeconds,
+	/** Whole seconds since readiness, present exactly when `readyAt` is recorded. */
+	readyAgeSeconds: Schema.optionalKey(AgeSeconds),
+	parentLinkage: Schema.optionalKey(ParentLinkage)
+}) {};
+/** One durable Unknown Outcome and whether a covering resolution intent exists (DUR-017). */
+var ExplainedUnknownCall = class extends Schema.Class("@effect-agent/thread/ExplainedUnknownCall")({
+	toolCallId: ToolCallId,
+	toolName: ToolCallUnknown.fields.toolName,
+	reason: ToolCallUnknown.fields.reason,
+	recordedAt: Schema.DateTimeUtcFromString,
+	/** A durable `resolveUnknown` intent covers this call. */
+	resolved: Schema.Boolean
+}) {};
+/**
+* The evidence summary of one explanation: the classifier's canonical-history inputs plus the
+* durable intents and subagent attachments the ledger snapshot carries. Everything is read-only
+* observation — assembling this value performs zero writes.
+*/
+var ExplainedEvidence = class extends Schema.Class("@effect-agent/thread/ExplainedEvidence")({
+	threadMaterialized: Schema.Boolean,
+	inputRecorded: Schema.Boolean,
+	abortRecorded: Schema.Boolean,
+	recordedSettlementOutcome: Schema.optionalKey(SettlementOutcome),
+	/** Prepared ordinary Tool Calls without a canonical outcome (DUR-009). */
+	openToolCalls: Schema.Array(OpenToolCallEvidence),
+	/** Delegation Tool Calls with an open parent-side obligation. */
+	openDelegationCalls: Schema.Array(OpenDelegationCallEvidence),
+	/** Canonically requested approvals without a canonical decision. */
+	approvalsPending: Schema.Array(PendingApprovalEvidence),
+	/** Durable Unknown Outcomes with their resolution coverage (DUR-017). */
+	unknownCalls: Schema.Array(ExplainedUnknownCall),
+	/** Durable approval decisions recorded against this Submission. */
+	approvalDecisions: Schema.Array(ApprovalDecisionIntent),
+	/** Durable unknown-outcome resolutions recorded against this Submission. */
+	unknownResolutions: Schema.Array(UnknownResolutionIntent),
+	/** Parent-side child attachments. */
+	childAttachments: Schema.Array(ChildAttachmentSnapshot),
+	/** Host-side joined/joining members of this Submission's Run (DUR-016). */
+	joins: Schema.Array(JoinSnapshot),
+	/** Joined-side host identity, when this Submission is joined to a host Run. */
+	hostSubmissionId: Schema.optionalKey(SubmissionId),
+	suspension: Schema.optionalKey(SuspensionSnapshot),
+	abortIntent: Schema.optionalKey(AbortIntent)
+}) {};
+/**
+* The read-only recovery explanation of one Submission (P7 exit gate "operators can explain
+* recovery state without editing storage"): the submission summary, the evidence the pure
+* classifier consumed, the exact `RecoveryDecision` it selected, that decision's operator
+* meaning, and the disposition the recovery pass would report for it.
+*/
+var RecoveryExplanation = class extends Schema.Class("@effect-agent/thread/RecoveryExplanation")({
+	submission: ExplainedSubmission,
+	evidence: ExplainedEvidence,
+	decision: RecoveryDecision,
+	/** Static operator meaning of `decision._tag` (see `RECOVERY_DECISION_MEANINGS`). */
+	decisionMeaning: BoundedDetail,
+	/**
+	* The disposition `runRecovery` would report when this decision executes without claim
+	* contention (see `predictRecoveryDisposition`): `repaired` = the recovery pass itself fixes
+	* it; `deferred` = a claiming worker must finish it; `unknown` = durably blocked on the
+	* authorized DUR-017 resolution path; `none` = settled, nothing owed.
+	*/
+	disposition: RecoveryDisposition,
+	explainedAt: Schema.DateTimeUtcFromString
+}) {};
+/**
+* Operator meaning of every recovery decision tag, matching the classifier docstrings in
+* `recovery.ts` (the classifier remains the semantic authority; this table is its operator
+* rendering). Exhaustive over `RecoveryDecision` — adding a decision without a meaning is a
+* compile error here.
+*/
+const RECOVERY_DECISION_MEANINGS = {
+	CompleteMaterialization: "Ledger admission committed but the Thread is not durable: recovery finishes materialization, appends ThreadCreated, and marks readiness.",
+	RepairReadiness: "The Thread is durable but the readiness marker is missing: recovery replays the idempotent markReady.",
+	ApplyInput: "No canonical input record exists yet: recovery appends the deterministic UserInputRecorded record and marks it applied.",
+	RepairInputMarker: "The canonical input record exists but the ledger marker was lost: recovery repairs the marker from history, never the reverse (DUR-015).",
+	ResumeFromTurnBoundary: "Input is applied and no terminal work is reserved: a claiming worker resumes the Run from the last committed Turn boundary; the model may be re-invoked and any duplicate cost is observable (durability §9).",
+	AppendReservedSettlement: "A settlement is reserved but not canonical: recovery appends the EXACT reserved record, then finalizes (DUR-011).",
+	FinalizeLedgerFromHistory: "The canonical settlement record exists: recovery rebuilds/finalizes the ledger from history and never rewrites history from the cached ledger status (DUR-011, DUR-015).",
+	SettleAborted: "A durable abort intent exists with no reserved outcome and no open attached-child obligation: recovery settles aborted, first recording ToolCallUnknown audits for open ordinary calls — abort never asserts external rollback (durability §13).",
+	MarkUnknown: "Prepared ordinary Tool Calls have no canonical outcome: recovery reconciles each open call and marks the remainder Unknown — never an automatic replay (DUR-009/DUR-017).",
+	ResumePendingToolBatch: "A committed tool-declaring response has zero prepared and zero settled records: a claiming worker resumes the declared batch without model re-invocation and without Unknown (durability §15).",
+	AwaitApprovalDecision: "Canonically requested approvals lack decisions: the lane waits durably for the authorized resolveApproval path (recovery repairs a lost suspend transition from history).",
+	ResumeSuspended: "Every pending approval has a durable decision: a claiming worker resumes the declared batch, appending the canonical ToolApprovalDecided records first.",
+	AwaitUnknownResolution: "Unknown Outcomes lack covering resolutions: the lane stays blocked awaiting the authorized DUR-017 resolveUnknown path; the obligation stays visible, nothing replays.",
+	ApplyUnknownResolutions: "Durable resolution intents cover every open call: recovery applies them canonically and reopens the lane.",
+	RevertJoining: "The Submission is joining without a canonical input record: recovery reverts it to ready — the input was never consumed and will be delivered exactly once later (DUR-016).",
+	RepairJoinMarker: "The canonical joined input exists but the joined marker was lost: recovery repairs the marker only; the input reattaches, never duplicates (DUR-015/DUR-016).",
+	SettleJoinedWithHost: "The host Run settled canonically: recovery settles this joined Submission with the host outcome — each joined Submission is owed its own settlement (DUR-002).",
+	AwaitHostSettlement: "The Submission is joined and its host Run is still live: nothing to repair — the input reattaches through the host's resume and the Submission settles with the host.",
+	CompleteChildAdmission: "A canonical SubagentRequested exists and the authoritative lookup proved not-admitted: recovery idempotently admits the intended child from the canonical request payload alone.",
+	AwaitChildAdmissionResolution: "The authoritative child-admission lookup answered indeterminate (or was not performed): recovery waits and retries the authoritative owner; a second admission never occurs (SUB-031).",
+	RepairSubagentStartLink: "The child is admitted but the parent's SubagentStarted link (or reservation attachment) is missing: recovery resolves the SAME child by its deterministic key and appends the exact link (SUB-016/SUB-017).",
+	EnsureWaitingForChild: "Children are established and at least one is nonterminal while the parent lane is not durably suspended: recovery restores the waitingForChild suspension; it reattaches the one existing child and never spawns a replacement (SUB-018/SUB-030).",
+	AwaitChildSettlement: "The parent is durably suspended waitingForChild and a listed child is not yet provably settled: the lane stays dormant, consumes no worker permit, and the child's Settlement wakes it durably (SUB-021/SUB-030).",
+	ResumeWaitingParent: "Every relevant child is provably settled but the parent has not joined: recovery replays the idempotent wake so a claiming worker resumes the declared batch and joins each child's canonical Settlement.",
+	ApplyJoinAccounting: "The canonical SubagentJoined record exists but the reservation release is incomplete: recovery replays the accounting decision FROM the canonical record — budget stays unavailable until repair, never available twice (DUR-015).",
+	PropagateChildAbort: "Parent abort is canonical while attached children are nonterminal: recovery idempotently issues each child's durable abort command and keeps the parent waiting for the joins — request-abort-and-join is the only close behavior.",
+	ReleaseOrphanChildReservation: "A child budget reservation can no longer bind a child: recovery freezes the deterministic zero-consumed accounting decision and releases the unused allocation exactly once.",
+	AwaitParentEstablishment: "The Submission is a parent-linked child whose Thread lacks the canonical lineage record: the child lane defers its own readiness repair — the parent's idempotent establishment completes it, so a child never runs a Turn before its lineage is canonical (P7 §7(a), SUB-016).",
+	NoAction: "The Submission is settled; nothing is owed."
+};
+/** The operator meaning of one recovery decision tag. */
+const recoveryDecisionMeaning = (tag) => RECOVERY_DECISION_MEANINGS[tag];
+/**
+* The disposition the recovery executor reports for a decision when its repair executes without
+* claim contention (pure prediction; `executeRecoveryDecision` in the coordinator remains the
+* execution authority — a lane concurrently claimed by a worker can always defer instead).
+* `AwaitApprovalDecision` depends on the snapshot: an already-suspended lane waits (`deferred`),
+* while a claimable lane with a lost suspend transition is repaired.
+*/
+const predictRecoveryDisposition = (decision, snapshot) => {
+	switch (decision._tag) {
+		case "NoAction": return "none";
+		case "AwaitUnknownResolution":
+		case "MarkUnknown": return "unknown";
+		case "ResumeFromTurnBoundary":
+		case "ResumePendingToolBatch":
+		case "ResumeSuspended":
+		case "AwaitHostSettlement":
+		case "AwaitChildAdmissionResolution":
+		case "AwaitChildSettlement":
+		case "AwaitParentEstablishment": return "deferred";
+		case "AwaitApprovalDecision": return snapshot.submission.state === "suspended" ? "deferred" : "repaired";
+		default: return "repaired";
+	}
+};
+const formatUtc = (value) => DateTime.formatIso(value);
+/** Pure operator text for one explanation (the CLI's `explain` output body). */
+const renderRecoveryExplanation = (explanation) => {
+	const submission = explanation.submission;
+	const evidence = explanation.evidence;
+	const lines = [
+		`Submission ${submission.submissionId} (thread ${submission.threadId})`,
+		`  state: ${submission.state}  queue: ${submission.queueSequence}  age: ${submission.ageSeconds}s`,
+		`  admitted: ${formatUtc(submission.createdAt)}${submission.readyAt === void 0 ? "" : `  ready: ${formatUtc(submission.readyAt)}`}`
+	];
+	if (submission.parentLinkage !== void 0) lines.push(`  attached child of ${submission.parentLinkage.parentSubmissionId} (tool call ${submission.parentLinkage.parentToolCallId})`);
+	lines.push(`  evidence: input=${evidence.inputRecorded ? "recorded" : "missing"} settlement=${evidence.recordedSettlementOutcome ?? "none"} abort=${evidence.abortRecorded ? "recorded" : "none"} materialized=${evidence.threadMaterialized ? "yes" : "no"}`);
+	if (evidence.openToolCalls.length > 0) lines.push(`  open ordinary tool calls: ${evidence.openToolCalls.map((call) => `${call.toolName}#${call.toolCallId}`).join(", ")}`);
+	if (evidence.openDelegationCalls.length > 0) lines.push(`  open delegation calls: ${evidence.openDelegationCalls.map((call) => `${call.toolName}#${call.toolCallId}(requested=${call.requested} started=${call.started} joined=${call.joined})`).join(", ")}`);
+	if (evidence.approvalsPending.length > 0) lines.push(`  approvals pending: ${evidence.approvalsPending.map((pending) => pending.toolCallId).join(", ")}`);
+	for (const unknown of evidence.unknownCalls) lines.push(`  unknown outcome: ${unknown.toolName}#${unknown.toolCallId} recorded ${formatUtc(unknown.recordedAt)} ${unknown.resolved ? "(resolution intent recorded)" : "(awaiting resolveUnknown)"}`);
+	if (evidence.childAttachments.length > 0) lines.push(`  attached children: ${evidence.childAttachments.map((child) => `${child.childSubmissionId}(${child.childState})`).join(", ")}`);
+	if (evidence.joins.length > 0) lines.push(`  joined members: ${evidence.joins.map((join) => `${join.submissionId}(${join.state})`).join(", ")}`);
+	if (evidence.hostSubmissionId !== void 0) lines.push(`  joined to host: ${evidence.hostSubmissionId}`);
+	if (evidence.suspension !== void 0) lines.push(`  suspended (${evidence.suspension.reason._tag}) since ${formatUtc(evidence.suspension.suspendedAt)}`);
+	if (evidence.abortIntent !== void 0) lines.push(`  abort intent by ${evidence.abortIntent.author} at ${formatUtc(evidence.abortIntent.requestedAt)}`);
+	lines.push(`  decision: ${explanation.decision._tag} → disposition ${explanation.disposition}`, `  meaning: ${explanation.decisionMeaning}`);
+	return lines.join("\n");
+};
+/** The named integrity checks `verifyThreadInvariants` performs. */
+const IntegrityCheckName = Schema.Literals([
+	"schema-round-trip",
+	"record-identity",
+	"sequence-contiguity",
+	"digest-chain",
+	"fifo-input-order",
+	"fifo-settlement-order",
+	"terminal-uniqueness",
+	"ledger-canonical-agreement",
+	"checkpoint-binding",
+	"all-settled"
+]);
+const IntegrityCheckStatus = Schema.Literals([
+	"passed",
+	"failed",
+	"skipped"
+]);
+/** One typed check result; `detail` explains a failure or the honest reason for a skip. */
+var IntegrityCheck = class extends Schema.Class("@effect-agent/thread/IntegrityCheck")({
+	name: IntegrityCheckName,
+	status: IntegrityCheckStatus,
+	detail: Schema.optionalKey(BoundedDetail)
+}) {};
+/**
+* The read-only integrity verdict for one Thread (plan §3 `verify`): typed per-check
+* results, never a repair. `ok` is true exactly when no check failed — skipped checks are
+* honest scope statements, not silent passes.
+*/
+var IntegrityReport = class extends Schema.Class("@effect-agent/thread/IntegrityReport")({
+	threadId: ThreadId,
+	tailSequence: CanonicalSequence,
+	recordCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	submissionCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	checks: Schema.Array(IntegrityCheck),
+	ok: Schema.Boolean
+}) {};
+/**
+* What one nonterminal Submission is visibly blocked on (DUR-017 operator surface; OPS-001).
+* `ready-aged`/`running-aged` are not blocks — they are accepted work whose settlement age is
+* measurable and alertable.
+*/
+const ObligationBlockedOn = Schema.Literals([
+	"unknown",
+	"approval",
+	"waitingForChild",
+	"ready-aged",
+	"running-aged"
+]);
+const ObligationSeverity = Schema.Literals([
+	"ok",
+	"aging",
+	"overdue"
+]);
+/** Host-supplied age thresholds; the framework deliberately does not own the alert loop. */
+var ObligationThresholds = class extends Schema.Class("@effect-agent/thread/ObligationThresholds")({
+	/** Age (whole seconds) at which an obligation is reported `aging`. */
+	agingSeconds: AgeSeconds,
+	/** Age (whole seconds) at which an obligation is reported `overdue`. */
+	overdueSeconds: AgeSeconds
+}) {};
+/** One nonterminal accepted-work obligation with its age and severity. */
+var ObligationEntry = class extends Schema.Class("@effect-agent/thread/ObligationEntry")({
+	submissionId: SubmissionId,
+	threadId: ThreadId,
+	state: SubmissionState,
+	blockedOn: ObligationBlockedOn,
+	ageSeconds: AgeSeconds,
+	severity: ObligationSeverity
+}) {};
+/**
+* The scan-based DUR-017/OPS-001 operator surface (plan §3): a fold of the ledger's nonterminal
+* scan into aged, severity-classified rows. Scan-based, never a daemon — hosts run it
+* periodically and export logs/metrics; ages need no storage-version bump because every source
+* timestamp already exists (`createdAt`/`readyAt`, `suspendedAt`, the canonical
+* `ToolCallUnknown` record's `createdAt`).
+*/
+var ObligationReport = class extends Schema.Class("@effect-agent/thread/ObligationReport")({
+	thresholds: ObligationThresholds,
+	entries: Schema.Array(ObligationEntry),
+	generatedAt: Schema.DateTimeUtcFromString
+}) {};
+/** Severity of one obligation age under the supplied thresholds. */
+const obligationSeverityOf = (ageSeconds, thresholds) => ageSeconds >= thresholds.overdueSeconds ? "overdue" : ageSeconds >= thresholds.agingSeconds ? "aging" : "ok";
+/**
+* The mandatory-audit retry command (SEC-011): `author`/`reason` carry the same bounds as the
+* canonical abort command so every mutating administrative operation stays attributable. The
+* executed repair itself appends the deterministic `RepairAnnotated` audit record (DUR-013) —
+* retry adds no new canonical record type.
+*/
+var RetryCommand = class extends Schema.Class("@effect-agent/thread/RetryCommand")({
+	submissionId: SubmissionId,
+	author: AbortCommand.fields.author,
+	reason: AbortCommand.fields.reason
+}) {};
+/** Why a retry was refused without executing anything. */
+const RetryRefusalReason = Schema.Literals([
+	"settled",
+	"await-unknown-resolution",
+	"await-approval-decision"
+]);
+/**
+* Typed refusal of `retry` (plan §3): lanes blocked on `AwaitUnknownResolution` or
+* `AwaitApprovalDecision` have their own authorized operations, and settled work is never
+* re-driven. The refusal names the classifier decision so the operator sees WHY.
+*/
+var RetryRefused = class extends Schema.TaggedError()("RetryRefused", {
+	submissionId: SubmissionId,
+	refusal: RetryRefusalReason,
+	decisionTag: Schema.String.check(Schema.isMaxLength(256)),
+	message: Schema.String.check(Schema.isMaxLength(4096))
+}) {};
+//#endregion
+export { ExplainedEvidence, ExplainedSubmission, ExplainedUnknownCall, IntegrityCheck, IntegrityCheckName, IntegrityCheckStatus, IntegrityReport, ObligationBlockedOn, ObligationEntry, ObligationReport, ObligationSeverity, ObligationThresholds, RECOVERY_DECISION_MEANINGS, RecoveryDisposition, RecoveryExplanation, RetryCommand, RetryRefusalReason, RetryRefused, obligationSeverityOf, predictRecoveryDisposition, recoveryDecisionMeaning, renderRecoveryExplanation, Admin_exports as t };
+
+//# sourceMappingURL=Admin.mjs.map