effect-agent 0.1.0-beta.85 → 0.1.0-beta.87

package/dist/durable/ThreadInvariants.d.mts

@@ -0,0 +1,74 @@
+import { A as ProducerId, Yt as ThreadExport, a as BatchId, mr as IntegrityReport, qa as SubmissionSnapshot, qt as ThreadCheckpoint } from "../Records-BAGkekt8.mjs";
+import { Crypto, Effect } from "effect";
+declare namespace ThreadInvariants_d_exports {
+  export { ThreadInvariantInput, verifyThreadInvariants };
+}
+/**
+ * The production thread invariant checker, shared by the durable coordinator, admin
+ * verification, and development harnesses. Keeping it independent of certification and
+ * conformance modules prevents ordinary runtime imports from loading test-only dependencies.
+ *
+ * `verifyThreadInvariants` — hoisted from the DC eviction harness's `assertConvergence`
+ * so the admin `verify` operation, the adapter certification tiers (WP2), and the chaos/soak
+ * properties (WP4) all assert one set of claims.
+ */
+/**
+ * Input of one invariant verification, assembled entirely from port reads (or from a captured
+ * copy under test):
+ *
+ * - `export` — the Thread's canonical export (`ThreadStore.export`).
+ * - `submissions` — every known Submission row of the lane (ledger scan + lookups). Order is
+ *   irrelevant; the checker sorts by `queueSequence`.
+ * - `batchProducers` — OPTIONAL per-batch producer identity directory. The digest chain hashes
+ *   each batch's Schema-encoded `CanonicalBatch` — including its `producerId`, which the
+ *   `ThreadStore` port deliberately does not export — so full chain recomputation needs
+ *   this directory (capture it at append time, or from adapter-private storage). Without it the
+ *   `digest-chain` and `checkpoint-binding` checks report `skipped` with the honest reason;
+ *   adapter-level `verifyOnOpen` remains the storage-side full audit.
+ * - `checkpoint` — the stored checkpoint to bind against the recomputed chain, when one exists.
+ * - `checkpointsSupported` — whether the caller inspected a supporting adapter. Without this
+ *   evidence or a supplied checkpoint, checkpoint verification is skipped.
+ * - `requireAllSettled` — convergence mode (certification Tier 2, chaos, soak): additionally
+ *   require every known Submission to be settled.
+ */
+interface ThreadInvariantInput {
+  readonly export: ThreadExport;
+  readonly submissions: ReadonlyArray<SubmissionSnapshot>;
+  readonly batchProducers?: ReadonlyMap<BatchId, ProducerId> | undefined;
+  readonly checkpoint?: ThreadCheckpoint | undefined;
+  /** Set only after checking the adapter's optional checkpoint capability. */
+  readonly checkpointsSupported?: boolean | undefined;
+  readonly requireAllSettled?: boolean | undefined;
+}
+/**
+ * The shared thread invariant checker (plan §1/§3): the DC harness `assertConvergence`
+ * claims, verbatim, as typed per-check results over a canonical export plus the lane's ledger
+ * rows — read-only, never a repair:
+ *
+ * 1. `schema-round-trip` — every envelope re-encodes and re-decodes through its canonical
+ *    Schema (a corrupted copy fails typed instead of decoding incorrectly).
+ * 2. `record-identity` — no canonical record identity appears twice (DUR-007 dedupe held).
+ * 3. `sequence-contiguity` — gap-free sequences from 1 through the exported tail.
+ * 4. `digest-chain` — the tail digest recomputes from `EMPTY_TAIL_DIGEST` through every batch
+ *    (requires the per-batch producer directory; skipped honestly otherwise).
+ * 5. `fifo-input-order` / `fifo-settlement-order` — canonical input and settlement records
+ *    follow the admitted queue order (DUR-004). Aborted settlements of never-run work (no
+ *    canonical `input:{sid}` record) are exempt from the settlement comparison: P7 §7(c)
+ *    settles them immediately without waiting for the head, and DUR-004 bounds execution
+ *    order, which never-run work has none of.
+ * 6. `terminal-uniqueness` — at most one canonical terminal record per Submission, exactly one
+ *    for every settled ledger row (DUR-002).
+ * 7. `ledger-canonical-agreement` — a settled ledger row has a canonical settlement record and
+ *    the outcomes agree; canonical history remains the authority (DUR-015).
+ * 8. `checkpoint-binding` — a stored checkpoint's digest matches the recomputed chain at its
+ *    sequence (needs the chain; bounds are checked regardless).
+ * 9. `all-settled` — convergence mode only: every known Submission settled.
+ *
+ * Requires only `Crypto.Crypto` (digest recomputation); it performs no port access, so the
+ * admin operation, certification runners, and chaos properties feed it whatever copies they
+ * hold.
+ */
+declare const verifyThreadInvariants: (input: ThreadInvariantInput) => Effect.Effect<IntegrityReport, never, Crypto.Crypto>;
+//#endregion
+export { ThreadInvariantInput, ThreadInvariants_d_exports as t, verifyThreadInvariants };
+//# sourceMappingURL=ThreadInvariants.d.mts.map

package/dist/durable/ThreadInvariants.mjs

@@ -0,0 +1,200 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { CanonicalBatch, CanonicalRecordEnvelope } from "./Records.mjs";
+import { submissionInputRecordId, submissionSettlementRecordId } from "./SubmissionLedger.mjs";
+import { IntegrityCheck, IntegrityReport } from "./Admin.mjs";
+import { EMPTY_TAIL_DIGEST, digestCanonicalBatch } from "./Digest.mjs";
+import { Effect, Schema } from "effect";
+//#region src/durable/ThreadInvariants.ts
+var ThreadInvariants_exports = /* @__PURE__ */ __exportAll({ verifyThreadInvariants: () => verifyThreadInvariants });
+const encodeEnvelope = Schema.encodeEffect(CanonicalRecordEnvelope);
+const decodeEnvelope = Schema.decodeUnknownEffect(CanonicalRecordEnvelope);
+const check = (name, status, detail) => IntegrityCheck.make({
+	name,
+	status,
+	...detail === void 0 ? {} : { detail: detail.slice(0, 4096) }
+});
+/** Group the export's records into their atomic append runs (batches append contiguously). */
+const batchRunsOf = (records) => {
+	const runs = [];
+	for (const envelope of records) {
+		const current = runs.at(-1);
+		if (current !== void 0 && current.batchId === envelope.batchId) {
+			current.records.push(envelope.record);
+			runs[runs.length - 1] = {
+				...current,
+				lastSequence: envelope.sequence
+			};
+			continue;
+		}
+		runs.push({
+			batchId: envelope.batchId,
+			records: [envelope.record],
+			lastSequence: envelope.sequence
+		});
+	}
+	return runs;
+};
+/**
+* The shared thread invariant checker (plan §1/§3): the DC harness `assertConvergence`
+* claims, verbatim, as typed per-check results over a canonical export plus the lane's ledger
+* rows — read-only, never a repair:
+*
+* 1. `schema-round-trip` — every envelope re-encodes and re-decodes through its canonical
+*    Schema (a corrupted copy fails typed instead of decoding incorrectly).
+* 2. `record-identity` — no canonical record identity appears twice (DUR-007 dedupe held).
+* 3. `sequence-contiguity` — gap-free sequences from 1 through the exported tail.
+* 4. `digest-chain` — the tail digest recomputes from `EMPTY_TAIL_DIGEST` through every batch
+*    (requires the per-batch producer directory; skipped honestly otherwise).
+* 5. `fifo-input-order` / `fifo-settlement-order` — canonical input and settlement records
+*    follow the admitted queue order (DUR-004). Aborted settlements of never-run work (no
+*    canonical `input:{sid}` record) are exempt from the settlement comparison: P7 §7(c)
+*    settles them immediately without waiting for the head, and DUR-004 bounds execution
+*    order, which never-run work has none of.
+* 6. `terminal-uniqueness` — at most one canonical terminal record per Submission, exactly one
+*    for every settled ledger row (DUR-002).
+* 7. `ledger-canonical-agreement` — a settled ledger row has a canonical settlement record and
+*    the outcomes agree; canonical history remains the authority (DUR-015).
+* 8. `checkpoint-binding` — a stored checkpoint's digest matches the recomputed chain at its
+*    sequence (needs the chain; bounds are checked regardless).
+* 9. `all-settled` — convergence mode only: every known Submission settled.
+*
+* Requires only `Crypto.Crypto` (digest recomputation); it performs no port access, so the
+* admin operation, certification runners, and chaos properties feed it whatever copies they
+* hold.
+*/
+const verifyThreadInvariants = Effect.fn("Thread.verifyThreadInvariants")(function* (input) {
+	const exported = input.export;
+	const records = exported.records;
+	const checks = [];
+	{
+		let failure;
+		for (const envelope of records) if ((yield* encodeEnvelope(envelope).pipe(Effect.flatMap(decodeEnvelope), Effect.exit))._tag === "Failure") {
+			failure = `record ${envelope.record.recordId} does not round-trip its Schema`;
+			break;
+		}
+		checks.push(failure === void 0 ? check("schema-round-trip", "passed") : check("schema-round-trip", "failed", failure));
+	}
+	{
+		const seen = /* @__PURE__ */ new Set();
+		const duplicates = /* @__PURE__ */ new Set();
+		for (const envelope of records) {
+			if (seen.has(envelope.record.recordId)) duplicates.add(envelope.record.recordId);
+			seen.add(envelope.record.recordId);
+		}
+		checks.push(duplicates.size === 0 ? check("record-identity", "passed") : check("record-identity", "failed", `duplicated canonical record identities: ${[...duplicates].join(", ")}`));
+	}
+	{
+		let contiguityFailure;
+		for (const [index, envelope] of records.entries()) if (envelope.sequence !== index + 1) {
+			contiguityFailure = `sequence ${envelope.sequence} at position ${index} (expected ${index + 1})`;
+			break;
+		}
+		if (contiguityFailure === void 0 && records.length !== exported.tailSequence) contiguityFailure = `exported tail sequence ${exported.tailSequence} disagrees with ${records.length} records`;
+		checks.push(contiguityFailure === void 0 ? check("sequence-contiguity", "passed") : check("sequence-contiguity", "failed", contiguityFailure));
+	}
+	const chainDigestAtSequence = /* @__PURE__ */ new Map();
+	if (input.batchProducers === void 0) checks.push(check("digest-chain", "skipped", "the ThreadStore port does not export per-batch producer identity; supply batchProducers (captured at append time) to recompute the chain — adapter-level verifyOnOpen performs the storage-side audit"));
+	else {
+		let chain = EMPTY_TAIL_DIGEST;
+		let chainFailure;
+		for (const run of batchRunsOf(records)) {
+			const producerId = input.batchProducers.get(run.batchId);
+			if (producerId === void 0) {
+				chainFailure = `no producer identity supplied for batch ${run.batchId}`;
+				break;
+			}
+			const [first, ...rest] = run.records;
+			if (first === void 0) {
+				chainFailure = `batch ${run.batchId} grouped zero records`;
+				break;
+			}
+			const digest = yield* digestCanonicalBatch(chain, CanonicalBatch.make({
+				batchId: run.batchId,
+				producerId,
+				records: [first, ...rest]
+			})).pipe(Effect.exit);
+			if (digest._tag === "Failure") {
+				chainFailure = `batch ${run.batchId} could not be re-digested`;
+				break;
+			}
+			chain = digest.value;
+			chainDigestAtSequence.set(run.lastSequence, chain);
+		}
+		if (chainFailure === void 0 && chain !== exported.tailDigest) chainFailure = `recomputed tail digest ${chain} disagrees with exported tail digest ${exported.tailDigest}`;
+		checks.push(chainFailure === void 0 ? check("digest-chain", "passed") : check("digest-chain", "failed", chainFailure));
+	}
+	const ordered = [...input.submissions].sort((left, right) => left.queueSequence - right.queueSequence);
+	const recordIds = records.map((envelope) => envelope.record.recordId);
+	{
+		const expectedInputs = ordered.map((row) => submissionInputRecordId(row.submissionId));
+		const expectedSet = new Set(expectedInputs);
+		const inputOrder = recordIds.filter((recordId) => expectedSet.has(recordId));
+		const presentInputs = new Set(inputOrder);
+		const expectedPresent = expectedInputs.filter((expected) => presentInputs.has(expected));
+		const matches = inputOrder.length === expectedPresent.length && inputOrder.every((recordId, index) => recordId === expectedPresent[index]);
+		checks.push(matches ? check("fifo-input-order", "passed") : check("fifo-input-order", "failed", `canonical input order [${inputOrder.join(", ")}] violates queue order`));
+	}
+	{
+		const recordIdSet = new Set(recordIds);
+		const abortedNeverRun = /* @__PURE__ */ new Set();
+		for (const envelope of records) {
+			const payload = envelope.record.payload;
+			if (payload._tag === "SubmissionSettled" && payload.outcome === "aborted" && !recordIdSet.has(submissionInputRecordId(payload.submissionId))) abortedNeverRun.add(payload.submissionId);
+		}
+		const expectedSettlements = ordered.filter((row) => !abortedNeverRun.has(row.submissionId)).map((row) => submissionSettlementRecordId(row.submissionId));
+		const expectedSet = new Set(expectedSettlements);
+		const settlementOrder = recordIds.filter((recordId) => expectedSet.has(recordId));
+		const presentSettlements = new Set(settlementOrder);
+		const expectedPresent = expectedSettlements.filter((expected) => presentSettlements.has(expected));
+		const matches = settlementOrder.length === expectedPresent.length && settlementOrder.every((recordId, index) => recordId === expectedPresent[index]);
+		checks.push(matches ? check("fifo-settlement-order", "passed") : check("fifo-settlement-order", "failed", `canonical settlement order [${settlementOrder.join(", ")}] violates queue order`));
+	}
+	{
+		const settlementsBySubmission = /* @__PURE__ */ new Map();
+		for (const envelope of records) {
+			if (envelope.record.payload._tag !== "SubmissionSettled") continue;
+			const submissionId = envelope.record.payload.submissionId;
+			const existing = settlementsBySubmission.get(submissionId) ?? [];
+			existing.push(envelope);
+			settlementsBySubmission.set(submissionId, existing);
+		}
+		let uniquenessFailure;
+		let agreementFailure;
+		for (const [submissionId, settlements] of settlementsBySubmission) if (settlements.length > 1) uniquenessFailure = `submission ${submissionId} has ${settlements.length} canonical terminal records`;
+		for (const row of ordered) {
+			const settlements = settlementsBySubmission.get(row.submissionId) ?? [];
+			const canonical = settlements[0]?.record.payload;
+			if (row.state === "settled") {
+				if (settlements.length !== 1) uniquenessFailure ??= `settled submission ${row.submissionId} has ${settlements.length} canonical terminal records (expected exactly 1)`;
+				if (canonical !== void 0 && canonical._tag === "SubmissionSettled" && row.settledOutcome !== void 0 && canonical.outcome !== row.settledOutcome) agreementFailure = `submission ${row.submissionId}: ledger outcome ${row.settledOutcome} disagrees with canonical outcome ${canonical.outcome}`;
+				if (settlements.length === 0) agreementFailure ??= `settled submission ${row.submissionId} has no canonical settlement record (DUR-015: history is the authority)`;
+			}
+		}
+		checks.push(uniquenessFailure === void 0 ? check("terminal-uniqueness", "passed") : check("terminal-uniqueness", "failed", uniquenessFailure));
+		checks.push(agreementFailure === void 0 ? check("ledger-canonical-agreement", "passed") : check("ledger-canonical-agreement", "failed", agreementFailure));
+	}
+	if (input.checkpoint === void 0 && input.checkpointsSupported !== true) checks.push(check("checkpoint-binding", "skipped", "checkpoint support was not supplied"));
+	else if (input.checkpoint === void 0) checks.push(check("checkpoint-binding", "passed", "no stored checkpoint"));
+	else if (input.checkpoint.throughSequence > exported.tailSequence) checks.push(check("checkpoint-binding", "failed", `checkpoint through-sequence ${input.checkpoint.throughSequence} is ahead of the tail ${exported.tailSequence}`));
+	else if (input.batchProducers === void 0) checks.push(check("checkpoint-binding", "skipped", "digest binding needs the recomputed chain; supply batchProducers (the adapter rejects mismatched checkpoints on save/load regardless)"));
+	else {
+		const bound = chainDigestAtSequence.get(input.checkpoint.throughSequence);
+		checks.push(bound === input.checkpoint.tailDigest ? check("checkpoint-binding", "passed") : check("checkpoint-binding", "failed", `checkpoint digest ${input.checkpoint.tailDigest} does not match the recomputed chain at sequence ${input.checkpoint.throughSequence}`));
+	}
+	if (input.requireAllSettled === true) {
+		const nonterminal = ordered.filter((row) => row.state !== "settled");
+		checks.push(nonterminal.length === 0 && ordered.length > 0 ? check("all-settled", "passed") : check("all-settled", "failed", ordered.length === 0 ? "no Submissions are known to the lane" : `nonterminal submissions: ${nonterminal.map((row) => `${row.submissionId}(${row.state})`).join(", ")}`));
+	}
+	return IntegrityReport.make({
+		threadId: exported.threadId,
+		tailSequence: exported.tailSequence,
+		recordCount: records.length,
+		submissionCount: ordered.length,
+		checks,
+		ok: checks.every((result) => result.status !== "failed")
+	});
+});
+//#endregion
+export { ThreadInvariants_exports as t, verifyThreadInvariants };
+
+//# sourceMappingURL=ThreadInvariants.mjs.map

package/dist/durable/ThreadInvariants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadInvariants.mjs","names":[],"sources":["../../src/durable/ThreadInvariants.ts"],"sourcesContent":["import type { Crypto } from \"effect\";\nimport { Effect, Schema } from \"effect\";\n\nimport { IntegrityCheck, IntegrityReport, type IntegrityCheckName } from \"./Admin.ts\";\nimport { digestCanonicalBatch, EMPTY_TAIL_DIGEST } from \"./Digest.ts\";\nimport {\n  CanonicalBatch,\n  CanonicalRecordEnvelope,\n  type BatchId,\n  type ProducerId,\n  type RecordEnvelope,\n} from \"./Records.ts\";\nimport {\n  submissionInputRecordId,\n  submissionSettlementRecordId,\n  type SubmissionSnapshot,\n} from \"./SubmissionLedger.ts\";\nimport type { ThreadCheckpoint, ThreadExport } from \"./ThreadStore.ts\";\n\n/**\n * The production thread invariant checker, shared by the durable coordinator, admin\n * verification, and development harnesses. Keeping it independent of certification and\n * conformance modules prevents ordinary runtime imports from loading test-only dependencies.\n *\n * `verifyThreadInvariants` — hoisted from the DC eviction harness's `assertConvergence`\n * so the admin `verify` operation, the adapter certification tiers (WP2), and the chaos/soak\n * properties (WP4) all assert one set of claims.\n */\n\n/**\n * Input of one invariant verification, assembled entirely from port reads (or from a captured\n * copy under test):\n *\n * - `export` — the Thread's canonical export (`ThreadStore.export`).\n * - `submissions` — every known Submission row of the lane (ledger scan + lookups). Order is\n *   irrelevant; the checker sorts by `queueSequence`.\n * - `batchProducers` — OPTIONAL per-batch producer identity directory. The digest chain hashes\n *   each batch's Schema-encoded `CanonicalBatch` — including its `producerId`, which the\n *   `ThreadStore` port deliberately does not export — so full chain recomputation needs\n *   this directory (capture it at append time, or from adapter-private storage). Without it the\n *   `digest-chain` and `checkpoint-binding` checks report `skipped` with the honest reason;\n *   adapter-level `verifyOnOpen` remains the storage-side full audit.\n * - `checkpoint` — the stored checkpoint to bind against the recomputed chain, when one exists.\n * - `checkpointsSupported` — whether the caller inspected a supporting adapter. Without this\n *   evidence or a supplied checkpoint, checkpoint verification is skipped.\n * - `requireAllSettled` — convergence mode (certification Tier 2, chaos, soak): additionally\n *   require every known Submission to be settled.\n */\nexport interface ThreadInvariantInput {\n  readonly export: ThreadExport;\n  readonly submissions: ReadonlyArray<SubmissionSnapshot>;\n  readonly batchProducers?: ReadonlyMap<BatchId, ProducerId> | undefined;\n  readonly checkpoint?: ThreadCheckpoint | undefined;\n  /** Set only after checking the adapter's optional checkpoint capability. */\n  readonly checkpointsSupported?: boolean | undefined;\n  readonly requireAllSettled?: boolean | undefined;\n}\n\nconst encodeEnvelope = Schema.encodeEffect(CanonicalRecordEnvelope);\nconst decodeEnvelope = Schema.decodeUnknownEffect(CanonicalRecordEnvelope);\n\nconst check = (\n  name: IntegrityCheckName,\n  status: \"passed\" | \"failed\" | \"skipped\",\n  detail?: string,\n): IntegrityCheck =>\n  IntegrityCheck.make({\n    name,\n    status,\n    ...(detail === undefined ? {} : { detail: detail.slice(0, 4_096) }),\n  });\n\ninterface BatchRun {\n  readonly batchId: BatchId;\n  readonly records: Array<RecordEnvelope>;\n  readonly lastSequence: number;\n}\n\n/** Group the export's records into their atomic append runs (batches append contiguously). */\nconst batchRunsOf = (records: ReadonlyArray<CanonicalRecordEnvelope>): Array<BatchRun> => {\n  const runs: Array<BatchRun> = [];\n\n  for (const envelope of records) {\n    const current = runs.at(-1);\n\n    if (current !== undefined && current.batchId === envelope.batchId) {\n      current.records.push(envelope.record);\n      runs[runs.length - 1] = { ...current, lastSequence: envelope.sequence };\n      continue;\n    }\n    runs.push({\n      batchId: envelope.batchId,\n      records: [envelope.record],\n      lastSequence: envelope.sequence,\n    });\n  }\n\n  return runs;\n};\n\n/**\n * The shared thread invariant checker (plan §1/§3): the DC harness `assertConvergence`\n * claims, verbatim, as typed per-check results over a canonical export plus the lane's ledger\n * rows — read-only, never a repair:\n *\n * 1. `schema-round-trip` — every envelope re-encodes and re-decodes through its canonical\n *    Schema (a corrupted copy fails typed instead of decoding incorrectly).\n * 2. `record-identity` — no canonical record identity appears twice (DUR-007 dedupe held).\n * 3. `sequence-contiguity` — gap-free sequences from 1 through the exported tail.\n * 4. `digest-chain` — the tail digest recomputes from `EMPTY_TAIL_DIGEST` through every batch\n *    (requires the per-batch producer directory; skipped honestly otherwise).\n * 5. `fifo-input-order` / `fifo-settlement-order` — canonical input and settlement records\n *    follow the admitted queue order (DUR-004). Aborted settlements of never-run work (no\n *    canonical `input:{sid}` record) are exempt from the settlement comparison: P7 §7(c)\n *    settles them immediately without waiting for the head, and DUR-004 bounds execution\n *    order, which never-run work has none of.\n * 6. `terminal-uniqueness` — at most one canonical terminal record per Submission, exactly one\n *    for every settled ledger row (DUR-002).\n * 7. `ledger-canonical-agreement` — a settled ledger row has a canonical settlement record and\n *    the outcomes agree; canonical history remains the authority (DUR-015).\n * 8. `checkpoint-binding` — a stored checkpoint's digest matches the recomputed chain at its\n *    sequence (needs the chain; bounds are checked regardless).\n * 9. `all-settled` — convergence mode only: every known Submission settled.\n *\n * Requires only `Crypto.Crypto` (digest recomputation); it performs no port access, so the\n * admin operation, certification runners, and chaos properties feed it whatever copies they\n * hold.\n */\nexport const verifyThreadInvariants = Effect.fn(\"Thread.verifyThreadInvariants\")(function* (\n  input: ThreadInvariantInput,\n): Effect.fn.Return<IntegrityReport, never, Crypto.Crypto> {\n  const exported = input.export;\n  const records = exported.records;\n  const checks: Array<IntegrityCheck> = [];\n\n  // 1. schema-round-trip\n  {\n    let failure: string | undefined;\n\n    for (const envelope of records) {\n      const roundTrip = yield* encodeEnvelope(envelope).pipe(\n        Effect.flatMap(decodeEnvelope),\n        Effect.exit,\n      );\n\n      if (roundTrip._tag === \"Failure\") {\n        failure = `record ${envelope.record.recordId} does not round-trip its Schema`;\n        break;\n      }\n    }\n    checks.push(\n      failure === undefined\n        ? check(\"schema-round-trip\", \"passed\")\n        : check(\"schema-round-trip\", \"failed\", failure),\n    );\n  }\n\n  // 2. record-identity\n  {\n    const seen = new Set<string>();\n    const duplicates = new Set<string>();\n\n    for (const envelope of records) {\n      if (seen.has(envelope.record.recordId)) duplicates.add(envelope.record.recordId);\n      seen.add(envelope.record.recordId);\n    }\n    checks.push(\n      duplicates.size === 0\n        ? check(\"record-identity\", \"passed\")\n        : check(\n            \"record-identity\",\n            \"failed\",\n            `duplicated canonical record identities: ${[...duplicates].join(\", \")}`,\n          ),\n    );\n  }\n\n  // 3. sequence-contiguity\n  {\n    let contiguityFailure: string | undefined;\n\n    for (const [index, envelope] of records.entries()) {\n      if (envelope.sequence !== index + 1) {\n        contiguityFailure = `sequence ${envelope.sequence} at position ${index} (expected ${index + 1})`;\n        break;\n      }\n    }\n    if (contiguityFailure === undefined && records.length !== exported.tailSequence) {\n      contiguityFailure = `exported tail sequence ${exported.tailSequence} disagrees with ${records.length} records`;\n    }\n    checks.push(\n      contiguityFailure === undefined\n        ? check(\"sequence-contiguity\", \"passed\")\n        : check(\"sequence-contiguity\", \"failed\", contiguityFailure),\n    );\n  }\n\n  // 4. digest-chain (+ collect per-sequence chain digests for checkpoint binding)\n  const chainDigestAtSequence = new Map<number, string>();\n\n  if (input.batchProducers === undefined) {\n    checks.push(\n      check(\n        \"digest-chain\",\n        \"skipped\",\n        \"the ThreadStore port does not export per-batch producer identity; supply batchProducers (captured at append time) to recompute the chain — adapter-level verifyOnOpen performs the storage-side audit\",\n      ),\n    );\n  } else {\n    let chain = EMPTY_TAIL_DIGEST;\n    let chainFailure: string | undefined;\n\n    for (const run of batchRunsOf(records)) {\n      const producerId = input.batchProducers.get(run.batchId);\n\n      if (producerId === undefined) {\n        chainFailure = `no producer identity supplied for batch ${run.batchId}`;\n        break;\n      }\n      const [first, ...rest] = run.records;\n\n      if (first === undefined) {\n        chainFailure = `batch ${run.batchId} grouped zero records`;\n        break;\n      }\n\n      const digest = yield* digestCanonicalBatch(\n        chain,\n        CanonicalBatch.make({ batchId: run.batchId, producerId, records: [first, ...rest] }),\n      ).pipe(Effect.exit);\n\n      if (digest._tag === \"Failure\") {\n        chainFailure = `batch ${run.batchId} could not be re-digested`;\n        break;\n      }\n      chain = digest.value;\n      chainDigestAtSequence.set(run.lastSequence, chain);\n    }\n    if (chainFailure === undefined && chain !== exported.tailDigest) {\n      chainFailure = `recomputed tail digest ${chain} disagrees with exported tail digest ${exported.tailDigest}`;\n    }\n    checks.push(\n      chainFailure === undefined\n        ? check(\"digest-chain\", \"passed\")\n        : check(\"digest-chain\", \"failed\", chainFailure),\n    );\n  }\n\n  // Shared FIFO/terminal machinery\n  const ordered = [...input.submissions].sort(\n    (left, right) => left.queueSequence - right.queueSequence,\n  );\n\n  const recordIds = records.map((envelope) => envelope.record.recordId);\n\n  // 5a. fifo-input-order\n  {\n    const expectedInputs = ordered.map((row) => submissionInputRecordId(row.submissionId));\n    const expectedSet = new Set<string>(expectedInputs);\n    const inputOrder = recordIds.filter((recordId) => expectedSet.has(recordId));\n    const presentInputs = new Set(inputOrder);\n    const expectedPresent = expectedInputs.filter((expected) => presentInputs.has(expected));\n\n    const matches =\n      inputOrder.length === expectedPresent.length &&\n      inputOrder.every((recordId, index) => recordId === expectedPresent[index]);\n\n    checks.push(\n      matches\n        ? check(\"fifo-input-order\", \"passed\")\n        : check(\n            \"fifo-input-order\",\n            \"failed\",\n            `canonical input order [${inputOrder.join(\", \")}] violates queue order`,\n          ),\n    );\n  }\n\n  // 5b. fifo-settlement-order — P7 §7(c) exemption: an ABORTED settlement for never-run work\n  // (no canonical `input:{sid}` record) settles immediately by design, without waiting to\n  // head the lane, so it is excluded from the FIFO comparison. DUR-004 bounds EXECUTION\n  // order; the exempted rows provably never executed.\n  {\n    const recordIdSet = new Set<string>(recordIds);\n    const abortedNeverRun = new Set<string>();\n\n    for (const envelope of records) {\n      const payload = envelope.record.payload;\n\n      if (\n        payload._tag === \"SubmissionSettled\" &&\n        payload.outcome === \"aborted\" &&\n        !recordIdSet.has(submissionInputRecordId(payload.submissionId))\n      ) {\n        abortedNeverRun.add(payload.submissionId);\n      }\n    }\n\n    const expectedSettlements = ordered\n      .filter((row) => !abortedNeverRun.has(row.submissionId))\n      .map((row) => submissionSettlementRecordId(row.submissionId));\n\n    const expectedSet = new Set<string>(expectedSettlements);\n    const settlementOrder = recordIds.filter((recordId) => expectedSet.has(recordId));\n\n    const presentSettlements = new Set(settlementOrder);\n\n    const expectedPresent = expectedSettlements.filter((expected) =>\n      presentSettlements.has(expected),\n    );\n\n    const matches =\n      settlementOrder.length === expectedPresent.length &&\n      settlementOrder.every((recordId, index) => recordId === expectedPresent[index]);\n\n    checks.push(\n      matches\n        ? check(\"fifo-settlement-order\", \"passed\")\n        : check(\n            \"fifo-settlement-order\",\n            \"failed\",\n            `canonical settlement order [${settlementOrder.join(\", \")}] violates queue order`,\n          ),\n    );\n  }\n\n  // 6 + 7. terminal-uniqueness and ledger-canonical-agreement\n  {\n    const settlementsBySubmission = new Map<string, Array<CanonicalRecordEnvelope>>();\n\n    for (const envelope of records) {\n      if (envelope.record.payload._tag !== \"SubmissionSettled\") continue;\n      const submissionId = envelope.record.payload.submissionId;\n      const existing = settlementsBySubmission.get(submissionId) ?? [];\n\n      existing.push(envelope);\n      settlementsBySubmission.set(submissionId, existing);\n    }\n    let uniquenessFailure: string | undefined;\n    let agreementFailure: string | undefined;\n\n    for (const [submissionId, settlements] of settlementsBySubmission) {\n      if (settlements.length > 1) {\n        uniquenessFailure = `submission ${submissionId} has ${settlements.length} canonical terminal records`;\n      }\n    }\n    for (const row of ordered) {\n      const settlements = settlementsBySubmission.get(row.submissionId) ?? [];\n      const canonical = settlements[0]?.record.payload;\n\n      if (row.state === \"settled\") {\n        if (settlements.length !== 1) {\n          uniquenessFailure ??= `settled submission ${row.submissionId} has ${settlements.length} canonical terminal records (expected exactly 1)`;\n        }\n        if (\n          canonical !== undefined &&\n          canonical._tag === \"SubmissionSettled\" &&\n          row.settledOutcome !== undefined &&\n          canonical.outcome !== row.settledOutcome\n        ) {\n          agreementFailure = `submission ${row.submissionId}: ledger outcome ${row.settledOutcome} disagrees with canonical outcome ${canonical.outcome}`;\n        }\n        if (settlements.length === 0) {\n          agreementFailure ??= `settled submission ${row.submissionId} has no canonical settlement record (DUR-015: history is the authority)`;\n        }\n      }\n    }\n    checks.push(\n      uniquenessFailure === undefined\n        ? check(\"terminal-uniqueness\", \"passed\")\n        : check(\"terminal-uniqueness\", \"failed\", uniquenessFailure),\n    );\n    checks.push(\n      agreementFailure === undefined\n        ? check(\"ledger-canonical-agreement\", \"passed\")\n        : check(\"ledger-canonical-agreement\", \"failed\", agreementFailure),\n    );\n  }\n\n  // 8. checkpoint-binding\n  if (input.checkpoint === undefined && input.checkpointsSupported !== true) {\n    checks.push(check(\"checkpoint-binding\", \"skipped\", \"checkpoint support was not supplied\"));\n  } else if (input.checkpoint === undefined) {\n    checks.push(check(\"checkpoint-binding\", \"passed\", \"no stored checkpoint\"));\n  } else if (input.checkpoint.throughSequence > exported.tailSequence) {\n    checks.push(\n      check(\n        \"checkpoint-binding\",\n        \"failed\",\n        `checkpoint through-sequence ${input.checkpoint.throughSequence} is ahead of the tail ${exported.tailSequence}`,\n      ),\n    );\n  } else if (input.batchProducers === undefined) {\n    checks.push(\n      check(\n        \"checkpoint-binding\",\n        \"skipped\",\n        \"digest binding needs the recomputed chain; supply batchProducers (the adapter rejects mismatched checkpoints on save/load regardless)\",\n      ),\n    );\n  } else {\n    const bound = chainDigestAtSequence.get(input.checkpoint.throughSequence);\n\n    checks.push(\n      bound === input.checkpoint.tailDigest\n        ? check(\"checkpoint-binding\", \"passed\")\n        : check(\n            \"checkpoint-binding\",\n            \"failed\",\n            `checkpoint digest ${input.checkpoint.tailDigest} does not match the recomputed chain at sequence ${input.checkpoint.throughSequence}`,\n          ),\n    );\n  }\n\n  // 9. all-settled (convergence mode)\n  if (input.requireAllSettled === true) {\n    const nonterminal = ordered.filter((row) => row.state !== \"settled\");\n\n    checks.push(\n      nonterminal.length === 0 && ordered.length > 0\n        ? check(\"all-settled\", \"passed\")\n        : check(\n            \"all-settled\",\n            \"failed\",\n            ordered.length === 0\n              ? \"no Submissions are known to the lane\"\n              : `nonterminal submissions: ${nonterminal\n                  .map((row) => `${row.submissionId}(${row.state})`)\n                  .join(\", \")}`,\n          ),\n    );\n  }\n\n  return IntegrityReport.make({\n    threadId: exported.threadId,\n    tailSequence: exported.tailSequence,\n    recordCount: records.length,\n    submissionCount: ordered.length,\n    checks,\n    ok: checks.every((result) => result.status !== \"failed\"),\n  });\n});\n"],"mappings":";;;;;;;;AA0DA,MAAM,iBAAiB,OAAO,aAAa,uBAAuB;AAClE,MAAM,iBAAiB,OAAO,oBAAoB,uBAAuB;AAEzE,MAAM,SACJ,MACA,QACA,WAEA,eAAe,KAAK;CAClB;CACA;CACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,GAAG,IAAK,EAAE;AACnE,CAAC;;AASH,MAAM,eAAe,YAAqE;CACxF,MAAM,OAAwB,CAAC;CAE/B,KAAK,MAAM,YAAY,SAAS;EAC9B,MAAM,UAAU,KAAK,GAAG,EAAE;EAE1B,IAAI,YAAY,KAAA,KAAa,QAAQ,YAAY,SAAS,SAAS;GACjE,QAAQ,QAAQ,KAAK,SAAS,MAAM;GACpC,KAAK,KAAK,SAAS,KAAK;IAAE,GAAG;IAAS,cAAc,SAAS;GAAS;GACtE;EACF;EACA,KAAK,KAAK;GACR,SAAS,SAAS;GAClB,SAAS,CAAC,SAAS,MAAM;GACzB,cAAc,SAAS;EACzB,CAAC;CACH;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAa,yBAAyB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/E,OACyD;CACzD,MAAM,WAAW,MAAM;CACvB,MAAM,UAAU,SAAS;CACzB,MAAM,SAAgC,CAAC;CAGvC;EACE,IAAI;EAEJ,KAAK,MAAM,YAAY,SAMrB,KAAI,OALqB,eAAe,QAAQ,CAAC,CAAC,KAChD,OAAO,QAAQ,cAAc,GAC7B,OAAO,IACT,EAAA,CAEc,SAAS,WAAW;GAChC,UAAU,UAAU,SAAS,OAAO,SAAS;GAC7C;EACF;EAEF,OAAO,KACL,YAAY,KAAA,IACR,MAAM,qBAAqB,QAAQ,IACnC,MAAM,qBAAqB,UAAU,OAAO,CAClD;CACF;CAGA;EACE,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,6BAAa,IAAI,IAAY;EAEnC,KAAK,MAAM,YAAY,SAAS;GAC9B,IAAI,KAAK,IAAI,SAAS,OAAO,QAAQ,GAAG,WAAW,IAAI,SAAS,OAAO,QAAQ;GAC/E,KAAK,IAAI,SAAS,OAAO,QAAQ;EACnC;EACA,OAAO,KACL,WAAW,SAAS,IAChB,MAAM,mBAAmB,QAAQ,IACjC,MACE,mBACA,UACA,2CAA2C,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,IAAI,GACtE,CACN;CACF;CAGA;EACE,IAAI;EAEJ,KAAK,MAAM,CAAC,OAAO,aAAa,QAAQ,QAAQ,GAC9C,IAAI,SAAS,aAAa,QAAQ,GAAG;GACnC,oBAAoB,YAAY,SAAS,SAAS,eAAe,MAAM,aAAa,QAAQ,EAAE;GAC9F;EACF;EAEF,IAAI,sBAAsB,KAAA,KAAa,QAAQ,WAAW,SAAS,cACjE,oBAAoB,0BAA0B,SAAS,aAAa,kBAAkB,QAAQ,OAAO;EAEvG,OAAO,KACL,sBAAsB,KAAA,IAClB,MAAM,uBAAuB,QAAQ,IACrC,MAAM,uBAAuB,UAAU,iBAAiB,CAC9D;CACF;CAGA,MAAM,wCAAwB,IAAI,IAAoB;CAEtD,IAAI,MAAM,mBAAmB,KAAA,GAC3B,OAAO,KACL,MACE,gBACA,WACA,uMACF,CACF;MACK;EACL,IAAI,QAAQ;EACZ,IAAI;EAEJ,KAAK,MAAM,OAAO,YAAY,OAAO,GAAG;GACtC,MAAM,aAAa,MAAM,eAAe,IAAI,IAAI,OAAO;GAEvD,IAAI,eAAe,KAAA,GAAW;IAC5B,eAAe,2CAA2C,IAAI;IAC9D;GACF;GACA,MAAM,CAAC,OAAO,GAAG,QAAQ,IAAI;GAE7B,IAAI,UAAU,KAAA,GAAW;IACvB,eAAe,SAAS,IAAI,QAAQ;IACpC;GACF;GAEA,MAAM,SAAS,OAAO,qBACpB,OACA,eAAe,KAAK;IAAE,SAAS,IAAI;IAAS;IAAY,SAAS,CAAC,OAAO,GAAG,IAAI;GAAE,CAAC,CACrF,CAAC,CAAC,KAAK,OAAO,IAAI;GAElB,IAAI,OAAO,SAAS,WAAW;IAC7B,eAAe,SAAS,IAAI,QAAQ;IACpC;GACF;GACA,QAAQ,OAAO;GACf,sBAAsB,IAAI,IAAI,cAAc,KAAK;EACnD;EACA,IAAI,iBAAiB,KAAA,KAAa,UAAU,SAAS,YACnD,eAAe,0BAA0B,MAAM,uCAAuC,SAAS;EAEjG,OAAO,KACL,iBAAiB,KAAA,IACb,MAAM,gBAAgB,QAAQ,IAC9B,MAAM,gBAAgB,UAAU,YAAY,CAClD;CACF;CAGA,MAAM,UAAU,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MACpC,MAAM,UAAU,KAAK,gBAAgB,MAAM,aAC9C;CAEA,MAAM,YAAY,QAAQ,KAAK,aAAa,SAAS,OAAO,QAAQ;CAGpE;EACE,MAAM,iBAAiB,QAAQ,KAAK,QAAQ,wBAAwB,IAAI,YAAY,CAAC;EACrF,MAAM,cAAc,IAAI,IAAY,cAAc;EAClD,MAAM,aAAa,UAAU,QAAQ,aAAa,YAAY,IAAI,QAAQ,CAAC;EAC3E,MAAM,gBAAgB,IAAI,IAAI,UAAU;EACxC,MAAM,kBAAkB,eAAe,QAAQ,aAAa,cAAc,IAAI,QAAQ,CAAC;EAEvF,MAAM,UACJ,WAAW,WAAW,gBAAgB,UACtC,WAAW,OAAO,UAAU,UAAU,aAAa,gBAAgB,MAAM;EAE3E,OAAO,KACL,UACI,MAAM,oBAAoB,QAAQ,IAClC,MACE,oBACA,UACA,0BAA0B,WAAW,KAAK,IAAI,EAAE,uBAClD,CACN;CACF;CAMA;EACE,MAAM,cAAc,IAAI,IAAY,SAAS;EAC7C,MAAM,kCAAkB,IAAI,IAAY;EAExC,KAAK,MAAM,YAAY,SAAS;GAC9B,MAAM,UAAU,SAAS,OAAO;GAEhC,IACE,QAAQ,SAAS,uBACjB,QAAQ,YAAY,aACpB,CAAC,YAAY,IAAI,wBAAwB,QAAQ,YAAY,CAAC,GAE9D,gBAAgB,IAAI,QAAQ,YAAY;EAE5C;EAEA,MAAM,sBAAsB,QACzB,QAAQ,QAAQ,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,CAAC,CACvD,KAAK,QAAQ,6BAA6B,IAAI,YAAY,CAAC;EAE9D,MAAM,cAAc,IAAI,IAAY,mBAAmB;EACvD,MAAM,kBAAkB,UAAU,QAAQ,aAAa,YAAY,IAAI,QAAQ,CAAC;EAEhF,MAAM,qBAAqB,IAAI,IAAI,eAAe;EAElD,MAAM,kBAAkB,oBAAoB,QAAQ,aAClD,mBAAmB,IAAI,QAAQ,CACjC;EAEA,MAAM,UACJ,gBAAgB,WAAW,gBAAgB,UAC3C,gBAAgB,OAAO,UAAU,UAAU,aAAa,gBAAgB,MAAM;EAEhF,OAAO,KACL,UACI,MAAM,yBAAyB,QAAQ,IACvC,MACE,yBACA,UACA,+BAA+B,gBAAgB,KAAK,IAAI,EAAE,uBAC5D,CACN;CACF;CAGA;EACE,MAAM,0CAA0B,IAAI,IAA4C;EAEhF,KAAK,MAAM,YAAY,SAAS;GAC9B,IAAI,SAAS,OAAO,QAAQ,SAAS,qBAAqB;GAC1D,MAAM,eAAe,SAAS,OAAO,QAAQ;GAC7C,MAAM,WAAW,wBAAwB,IAAI,YAAY,KAAK,CAAC;GAE/D,SAAS,KAAK,QAAQ;GACtB,wBAAwB,IAAI,cAAc,QAAQ;EACpD;EACA,IAAI;EACJ,IAAI;EAEJ,KAAK,MAAM,CAAC,cAAc,gBAAgB,yBACxC,IAAI,YAAY,SAAS,GACvB,oBAAoB,cAAc,aAAa,OAAO,YAAY,OAAO;EAG7E,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,cAAc,wBAAwB,IAAI,IAAI,YAAY,KAAK,CAAC;GACtE,MAAM,YAAY,YAAY,EAAE,EAAE,OAAO;GAEzC,IAAI,IAAI,UAAU,WAAW;IAC3B,IAAI,YAAY,WAAW,GACzB,sBAAsB,sBAAsB,IAAI,aAAa,OAAO,YAAY,OAAO;IAEzF,IACE,cAAc,KAAA,KACd,UAAU,SAAS,uBACnB,IAAI,mBAAmB,KAAA,KACvB,UAAU,YAAY,IAAI,gBAE1B,mBAAmB,cAAc,IAAI,aAAa,mBAAmB,IAAI,eAAe,oCAAoC,UAAU;IAExI,IAAI,YAAY,WAAW,GACzB,qBAAqB,sBAAsB,IAAI,aAAa;GAEhE;EACF;EACA,OAAO,KACL,sBAAsB,KAAA,IAClB,MAAM,uBAAuB,QAAQ,IACrC,MAAM,uBAAuB,UAAU,iBAAiB,CAC9D;EACA,OAAO,KACL,qBAAqB,KAAA,IACjB,MAAM,8BAA8B,QAAQ,IAC5C,MAAM,8BAA8B,UAAU,gBAAgB,CACpE;CACF;CAGA,IAAI,MAAM,eAAe,KAAA,KAAa,MAAM,yBAAyB,MACnE,OAAO,KAAK,MAAM,sBAAsB,WAAW,qCAAqC,CAAC;MACpF,IAAI,MAAM,eAAe,KAAA,GAC9B,OAAO,KAAK,MAAM,sBAAsB,UAAU,sBAAsB,CAAC;MACpE,IAAI,MAAM,WAAW,kBAAkB,SAAS,cACrD,OAAO,KACL,MACE,sBACA,UACA,+BAA+B,MAAM,WAAW,gBAAgB,wBAAwB,SAAS,cACnG,CACF;MACK,IAAI,MAAM,mBAAmB,KAAA,GAClC,OAAO,KACL,MACE,sBACA,WACA,uIACF,CACF;MACK;EACL,MAAM,QAAQ,sBAAsB,IAAI,MAAM,WAAW,eAAe;EAExE,OAAO,KACL,UAAU,MAAM,WAAW,aACvB,MAAM,sBAAsB,QAAQ,IACpC,MACE,sBACA,UACA,qBAAqB,MAAM,WAAW,WAAW,mDAAmD,MAAM,WAAW,iBACvH,CACN;CACF;CAGA,IAAI,MAAM,sBAAsB,MAAM;EACpC,MAAM,cAAc,QAAQ,QAAQ,QAAQ,IAAI,UAAU,SAAS;EAEnE,OAAO,KACL,YAAY,WAAW,KAAK,QAAQ,SAAS,IACzC,MAAM,eAAe,QAAQ,IAC7B,MACE,eACA,UACA,QAAQ,WAAW,IACf,yCACA,4BAA4B,YACzB,KAAK,QAAQ,GAAG,IAAI,aAAa,GAAG,IAAI,MAAM,EAAE,CAAC,CACjD,KAAK,IAAI,GAClB,CACN;CACF;CAEA,OAAO,gBAAgB,KAAK;EAC1B,UAAU,SAAS;EACnB,cAAc,SAAS;EACvB,aAAa,QAAQ;EACrB,iBAAiB,QAAQ;EACzB;EACA,IAAI,OAAO,OAAO,WAAW,OAAO,WAAW,QAAQ;CACzD,CAAC;AACH,CAAC"}

package/dist/durable/ThreadProjection.d.mts

@@ -0,0 +1,78 @@
+import { u as ThreadId } from "../Identifiers-CN2s30fF.mjs";
+import { G as SubmissionSettled, H as SubagentLineageRecorded, K as SubmissionSettledRecord, U as SubagentRequested, V as SubagentJoined, W as SubagentStarted, X as ToolApprovalRequested, Y as ToolApprovalDecided, _ as Digest, l as CanonicalRecordEnvelope, t as AbortRequested, tt as ToolCallUnknown } from "../Records-BAGkekt8.mjs";
+import { Schema } from "effect";
+declare namespace ThreadProjection_d_exports {
+  export { ApprovalRecord, OpenToolCallState, SubagentInvocationState, ThreadProjection, initialThreadProjection, reduceThreadRecord, replayThread, replayThreadFromCheckpoint };
+}
+declare const OpenToolCallState_base: Schema.Class<OpenToolCallState, Schema.Struct<{
+  readonly toolCallId: Schema.brand<Schema.NonEmptyString, "@effect-agent/core/ToolCallId">;
+  readonly toolName: Schema.NonEmptyString;
+  readonly turn: Schema.Int;
+  readonly runId: Schema.brand<Schema.NonEmptyString, "@effect-agent/core/RunId">;
+}>, {}>;
+/** One prepared ordinary Tool Call still awaiting a canonical settled/resolved outcome. */
+declare class OpenToolCallState extends OpenToolCallState_base {}
+/** The canonical approval trail: requests and decisions in canonical order. */
+declare const ApprovalRecord: Schema.Union<readonly [typeof ToolApprovalRequested, typeof ToolApprovalDecided]>;
+type ApprovalRecord = typeof ApprovalRecord.Type;
+declare const SubagentInvocationState_base: Schema.Class<SubagentInvocationState, Schema.Struct<{
+  readonly runId: Schema.brand<Schema.NonEmptyString, "@effect-agent/core/RunId">;
+  readonly toolCallId: Schema.brand<Schema.NonEmptyString, "@effect-agent/core/ToolCallId">;
+  readonly requested: Schema.optionalKey<typeof SubagentRequested>;
+  readonly started: Schema.optionalKey<typeof SubagentStarted>;
+  readonly joined: Schema.optionalKey<typeof SubagentJoined>;
+}>, {}>;
+/**
+ * Parent-side view of one Subagent Invocation, keyed by the parent Run and Tool Call: the canonical
+ * `SubagentRequested`/`SubagentStarted`/`SubagentJoined` payloads as they become canonical
+ * in history. A disposable derived view — the canonical records and the child's
+ * own Settlement remain the recovery truth (DUR-015).
+ */
+declare class SubagentInvocationState extends SubagentInvocationState_base {}
+declare const ThreadProjection_base: Schema.Class<ThreadProjection, Schema.Struct<{
+  readonly schemaVersion: Schema.Literal<2>;
+  readonly threadId: Schema.brand<Schema.NonEmptyString, "@effect-agent/core/ThreadId">;
+  readonly throughSequence: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly tailDigest: Schema.brand<Schema.String, "@effect-agent/thread/Digest">;
+  readonly inputs: Schema.$Array<Schema.declare<Schema.Json, Schema.Json>>;
+  readonly modelOutputs: Schema.$Array<Schema.declare<Schema.Json, Schema.Json>>;
+  readonly completedRuns: Schema.$Array<Schema.brand<Schema.NonEmptyString, "@effect-agent/core/RunId">>;
+  readonly failedRuns: Schema.$Array<Schema.brand<Schema.NonEmptyString, "@effect-agent/core/RunId">>;
+  readonly settlements: Schema.$Array<Schema.refine<SubmissionSettledRecord, typeof SubmissionSettled>>;
+  readonly abortRequests: Schema.$Array<typeof AbortRequested>;
+  readonly openToolCalls: Schema.$Array<typeof OpenToolCallState>;
+  readonly unknownToolCalls: Schema.$Array<typeof ToolCallUnknown>;
+  readonly approvals: Schema.$Array<Schema.Union<readonly [typeof ToolApprovalRequested, typeof ToolApprovalDecided]>>;
+  readonly subagentInvocations: Schema.$Array<typeof SubagentInvocationState>;
+  readonly parentLink: Schema.optionalKey<typeof SubagentLineageRecorded>;
+}>, {}>;
+/**
+ * Rebuildable canonical projection. It contains only canonical values and can be discarded and
+ * reconstructed from the record stream at any time.
+ *
+ * Phase 4 added `settlements` and `abortRequests`; Phase 5 added `openToolCalls` (the
+ * prepared-minus-settled/resolved fold), `unknownToolCalls`, and `approvals`; S2 adds
+ * `subagentInvocations` (the parent-side requested/started/joined fold) and `parentLink` (the
+ * child-side immutable lineage). A checkpoint whose persisted state lacks these fields fails to
+ * decode against this schema; callers must reject the checkpoint and rebuild the projection from
+ * canonical records (documented disposable-checkpoint behavior, STORE-007/STORE-008).
+ * Version 2 scopes Tool identities by Run. Earlier projections must rebuild, including empty
+ * invocation views that may have already lost an earlier Run's unresolved Tool evidence.
+ * `ModelResponseRecorded` advances `throughSequence` without dedicated projection state: Prompt
+ * reconstruction reads canonical records directly.
+ */
+declare class ThreadProjection extends ThreadProjection_base {}
+declare const initialThreadProjection: (threadId: ThreadId) => ThreadProjection;
+/** Pure one-record Thread transition. */
+declare const reduceThreadRecord: (projection: ThreadProjection, envelope: CanonicalRecordEnvelope, tailDigest?: Digest) => ThreadProjection;
+/** Pure full replay from the canonical beginning. */
+declare const replayThread: (threadId: ThreadId, records: ReadonlyArray<CanonicalRecordEnvelope>, tailDigest?: Digest) => ThreadProjection;
+/**
+ * Pure checkpoint replay. A validated checkpoint projection and its canonical tail produce the
+ * same reducer path as full replay for every later record.
+ * Decode persisted state with `ThreadProjection` first; an incompatible state requires full replay.
+ */
+declare const replayThreadFromCheckpoint: (checkpoint: ThreadProjection, records: ReadonlyArray<CanonicalRecordEnvelope>, tailDigest?: Digest) => ThreadProjection;
+//#endregion
+export { ApprovalRecord, OpenToolCallState, SubagentInvocationState, ThreadProjection, initialThreadProjection, reduceThreadRecord, replayThread, replayThreadFromCheckpoint, ThreadProjection_d_exports as t };
+//# sourceMappingURL=ThreadProjection.d.mts.map

package/dist/durable/ThreadProjection.mjs

@@ -0,0 +1,158 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { RunId, ThreadId, ToolCallId } from "../core/Identifiers.mjs";
+import { AbortRequested, CanonicalSequence, Digest, PersistedJson, SubagentJoined, SubagentLineageRecorded, SubagentRequested, SubagentStarted, SubmissionSettledRecord, ToolApprovalDecided, ToolApprovalRequested, ToolCallPrepared, ToolCallUnknown } from "./Records.mjs";
+import { EMPTY_TAIL_DIGEST } from "./Digest.mjs";
+import { Schema } from "effect";
+//#region src/durable/ThreadProjection.ts
+var ThreadProjection_exports = /* @__PURE__ */ __exportAll({
+	ApprovalRecord: () => ApprovalRecord,
+	OpenToolCallState: () => OpenToolCallState,
+	SubagentInvocationState: () => SubagentInvocationState,
+	ThreadProjection: () => ThreadProjection,
+	initialThreadProjection: () => initialThreadProjection,
+	reduceThreadRecord: () => reduceThreadRecord,
+	replayThread: () => replayThread,
+	replayThreadFromCheckpoint: () => replayThreadFromCheckpoint
+});
+/** One prepared ordinary Tool Call still awaiting a canonical settled/resolved outcome. */
+var OpenToolCallState = class extends Schema.Class("@effect-agent/thread/OpenToolCallState")({
+	toolCallId: ToolCallId,
+	toolName: ToolCallPrepared.fields.toolName,
+	turn: ToolCallPrepared.fields.turn,
+	runId: RunId
+}) {};
+/** The canonical approval trail: requests and decisions in canonical order. */
+const ApprovalRecord = Schema.Union([ToolApprovalRequested, ToolApprovalDecided]);
+/**
+* Parent-side view of one Subagent Invocation, keyed by the parent Run and Tool Call: the canonical
+* `SubagentRequested`/`SubagentStarted`/`SubagentJoined` payloads as they become canonical
+* in history. A disposable derived view — the canonical records and the child's
+* own Settlement remain the recovery truth (DUR-015).
+*/
+var SubagentInvocationState = class extends Schema.Class("@effect-agent/thread/SubagentInvocationState")({
+	runId: RunId,
+	toolCallId: ToolCallId,
+	requested: Schema.optionalKey(SubagentRequested),
+	started: Schema.optionalKey(SubagentStarted),
+	joined: Schema.optionalKey(SubagentJoined)
+}) {};
+/**
+* Rebuildable canonical projection. It contains only canonical values and can be discarded and
+* reconstructed from the record stream at any time.
+*
+* Phase 4 added `settlements` and `abortRequests`; Phase 5 added `openToolCalls` (the
+* prepared-minus-settled/resolved fold), `unknownToolCalls`, and `approvals`; S2 adds
+* `subagentInvocations` (the parent-side requested/started/joined fold) and `parentLink` (the
+* child-side immutable lineage). A checkpoint whose persisted state lacks these fields fails to
+* decode against this schema; callers must reject the checkpoint and rebuild the projection from
+* canonical records (documented disposable-checkpoint behavior, STORE-007/STORE-008).
+* Version 2 scopes Tool identities by Run. Earlier projections must rebuild, including empty
+* invocation views that may have already lost an earlier Run's unresolved Tool evidence.
+* `ModelResponseRecorded` advances `throughSequence` without dedicated projection state: Prompt
+* reconstruction reads canonical records directly.
+*/
+var ThreadProjection = class extends Schema.Class("@effect-agent/thread/ThreadProjection")({
+	schemaVersion: Schema.Literal(2),
+	threadId: ThreadId,
+	throughSequence: CanonicalSequence,
+	tailDigest: Digest,
+	inputs: Schema.Array(PersistedJson),
+	modelOutputs: Schema.Array(PersistedJson),
+	completedRuns: Schema.Array(RunId),
+	failedRuns: Schema.Array(RunId),
+	settlements: Schema.Array(SubmissionSettledRecord),
+	abortRequests: Schema.Array(AbortRequested),
+	openToolCalls: Schema.Array(OpenToolCallState),
+	unknownToolCalls: Schema.Array(ToolCallUnknown),
+	approvals: Schema.Array(ApprovalRecord),
+	subagentInvocations: Schema.Array(SubagentInvocationState),
+	parentLink: Schema.optionalKey(SubagentLineageRecorded)
+}) {};
+const initialThreadProjection = (threadId) => ThreadProjection.make({
+	schemaVersion: 2,
+	threadId,
+	throughSequence: Schema.decodeSync(CanonicalSequence)(0),
+	tailDigest: EMPTY_TAIL_DIGEST,
+	inputs: [],
+	modelOutputs: [],
+	completedRuns: [],
+	failedRuns: [],
+	settlements: [],
+	abortRequests: [],
+	openToolCalls: [],
+	unknownToolCalls: [],
+	approvals: [],
+	subagentInvocations: []
+});
+/**
+* Idempotent per-Run-and-Tool-Call upsert of the parent-side Subagent fold. Deterministic record
+* identities make duplicates impossible in one canonical stream; the first canonical payload of
+* each stage wins so a replayed reduce is a no-op.
+*/
+const upsertSubagentInvocation = (invocations, payload) => {
+	const existing = invocations.find((invocation) => invocation.runId === payload.runId && invocation.toolCallId === payload.toolCallId);
+	const requested = existing?.requested ?? (payload._tag === "SubagentRequested" ? payload : void 0);
+	const started = existing?.started ?? (payload._tag === "SubagentStarted" ? payload : void 0);
+	const joined = existing?.joined ?? (payload._tag === "SubagentJoined" ? payload : void 0);
+	const next = SubagentInvocationState.make({
+		runId: payload.runId,
+		toolCallId: payload.toolCallId,
+		...requested === void 0 ? {} : { requested },
+		...started === void 0 ? {} : { started },
+		...joined === void 0 ? {} : { joined }
+	});
+	return existing === void 0 ? [...invocations, next] : invocations.map((invocation) => invocation.runId === payload.runId && invocation.toolCallId === payload.toolCallId ? next : invocation);
+};
+/** Pure one-record Thread transition. */
+const reduceThreadRecord = (projection, envelope, tailDigest = projection.tailDigest) => {
+	const payload = envelope.record.payload;
+	const inputs = payload._tag === "UserInputRecorded" ? [...projection.inputs, payload.input] : projection.inputs;
+	const modelOutputs = payload._tag === "ModelCompleted" ? [...projection.modelOutputs, payload.output] : projection.modelOutputs;
+	const completedRuns = payload._tag === "RunCompleted" ? [...projection.completedRuns, payload.runId] : projection.completedRuns;
+	const failedRuns = payload._tag === "RunFailed" ? [...projection.failedRuns, payload.runId] : projection.failedRuns;
+	const settlements = payload._tag === "SubmissionSettled" ? [...projection.settlements, payload] : projection.settlements;
+	const abortRequests = payload._tag === "AbortRequested" ? [...projection.abortRequests, payload] : projection.abortRequests;
+	const openToolCalls = payload._tag === "ToolCallPrepared" ? projection.openToolCalls.some((call) => call.runId === payload.runId && call.toolCallId === payload.toolCallId) ? projection.openToolCalls : [...projection.openToolCalls, OpenToolCallState.make({
+		toolCallId: payload.toolCallId,
+		toolName: payload.toolName,
+		turn: payload.turn,
+		runId: payload.runId
+	})] : payload._tag === "ToolCallSettled" || payload._tag === "ToolCallResolved" ? projection.openToolCalls.filter((call) => call.runId !== payload.runId || call.toolCallId !== payload.toolCallId) : projection.openToolCalls;
+	const unknownToolCalls = payload._tag === "ToolCallUnknown" ? [...projection.unknownToolCalls, payload] : projection.unknownToolCalls;
+	const approvals = payload._tag === "ToolApprovalRequested" || payload._tag === "ToolApprovalDecided" ? [...projection.approvals, payload] : projection.approvals;
+	const subagentInvocations = payload._tag === "SubagentRequested" || payload._tag === "SubagentStarted" || payload._tag === "SubagentJoined" ? upsertSubagentInvocation(projection.subagentInvocations, payload) : projection.subagentInvocations;
+	const parentLink = projection.parentLink ?? (payload._tag === "SubagentLineageRecorded" ? payload : void 0);
+	return ThreadProjection.make({
+		schemaVersion: 2,
+		threadId: projection.threadId,
+		throughSequence: envelope.sequence,
+		tailDigest,
+		inputs,
+		modelOutputs,
+		completedRuns,
+		failedRuns,
+		settlements,
+		abortRequests,
+		openToolCalls,
+		unknownToolCalls,
+		approvals,
+		subagentInvocations,
+		...parentLink === void 0 ? {} : { parentLink }
+	});
+};
+/** Pure full replay from the canonical beginning. */
+const replayThread = (threadId, records, tailDigest = EMPTY_TAIL_DIGEST) => replayThreadFromCheckpoint(initialThreadProjection(threadId), records, tailDigest);
+/**
+* Pure checkpoint replay. A validated checkpoint projection and its canonical tail produce the
+* same reducer path as full replay for every later record.
+* Decode persisted state with `ThreadProjection` first; an incompatible state requires full replay.
+*/
+const replayThreadFromCheckpoint = (checkpoint, records, tailDigest = checkpoint.tailDigest) => {
+	let projection = checkpoint;
+	for (const record of records) projection = reduceThreadRecord(projection, record, tailDigest);
+	return projection;
+};
+//#endregion
+export { ApprovalRecord, OpenToolCallState, SubagentInvocationState, ThreadProjection, initialThreadProjection, reduceThreadRecord, replayThread, replayThreadFromCheckpoint, ThreadProjection_exports as t };
+
+//# sourceMappingURL=ThreadProjection.mjs.map

package/dist/durable/ThreadProjection.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadProjection.mjs","names":[],"sources":["../../src/durable/ThreadProjection.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { ThreadId, RunId, ToolCallId } from \"../core/Identifiers.ts\";\nimport { EMPTY_TAIL_DIGEST } from \"./Digest.ts\";\nimport type { CanonicalRecordEnvelope } from \"./Records.ts\";\nimport {\n  AbortRequested,\n  CanonicalSequence,\n  Digest,\n  PersistedJson,\n  SubagentJoined,\n  SubagentLineageRecorded,\n  SubagentRequested,\n  SubagentStarted,\n  SubmissionSettledRecord,\n  ToolApprovalDecided,\n  ToolApprovalRequested,\n  ToolCallPrepared,\n  ToolCallUnknown,\n} from \"./Records.ts\";\n\n/** One prepared ordinary Tool Call still awaiting a canonical settled/resolved outcome. */\nexport class OpenToolCallState extends Schema.Class<OpenToolCallState>(\n  \"@effect-agent/thread/OpenToolCallState\",\n)({\n  toolCallId: ToolCallId,\n  toolName: ToolCallPrepared.fields.toolName,\n  turn: ToolCallPrepared.fields.turn,\n  runId: RunId,\n}) {}\n\n/** The canonical approval trail: requests and decisions in canonical order. */\nexport const ApprovalRecord = Schema.Union([ToolApprovalRequested, ToolApprovalDecided]);\nexport type ApprovalRecord = typeof ApprovalRecord.Type;\n\n/**\n * Parent-side view of one Subagent Invocation, keyed by the parent Run and Tool Call: the canonical\n * `SubagentRequested`/`SubagentStarted`/`SubagentJoined` payloads as they become canonical\n * in history. A disposable derived view — the canonical records and the child's\n * own Settlement remain the recovery truth (DUR-015).\n */\nexport class SubagentInvocationState extends Schema.Class<SubagentInvocationState>(\n  \"@effect-agent/thread/SubagentInvocationState\",\n)({\n  runId: RunId,\n  toolCallId: ToolCallId,\n  requested: Schema.optionalKey(SubagentRequested),\n  started: Schema.optionalKey(SubagentStarted),\n  joined: Schema.optionalKey(SubagentJoined),\n}) {}\n\n/**\n * Rebuildable canonical projection. It contains only canonical values and can be discarded and\n * reconstructed from the record stream at any time.\n *\n * Phase 4 added `settlements` and `abortRequests`; Phase 5 added `openToolCalls` (the\n * prepared-minus-settled/resolved fold), `unknownToolCalls`, and `approvals`; S2 adds\n * `subagentInvocations` (the parent-side requested/started/joined fold) and `parentLink` (the\n * child-side immutable lineage). A checkpoint whose persisted state lacks these fields fails to\n * decode against this schema; callers must reject the checkpoint and rebuild the projection from\n * canonical records (documented disposable-checkpoint behavior, STORE-007/STORE-008).\n * Version 2 scopes Tool identities by Run. Earlier projections must rebuild, including empty\n * invocation views that may have already lost an earlier Run's unresolved Tool evidence.\n * `ModelResponseRecorded` advances `throughSequence` without dedicated projection state: Prompt\n * reconstruction reads canonical records directly.\n */\nexport class ThreadProjection extends Schema.Class<ThreadProjection>(\n  \"@effect-agent/thread/ThreadProjection\",\n)({\n  schemaVersion: Schema.Literal(2),\n  threadId: ThreadId,\n  throughSequence: CanonicalSequence,\n  tailDigest: Digest,\n  inputs: Schema.Array(PersistedJson),\n  modelOutputs: Schema.Array(PersistedJson),\n  completedRuns: Schema.Array(RunId),\n  failedRuns: Schema.Array(RunId),\n  settlements: Schema.Array(SubmissionSettledRecord),\n  abortRequests: Schema.Array(AbortRequested),\n  openToolCalls: Schema.Array(OpenToolCallState),\n  unknownToolCalls: Schema.Array(ToolCallUnknown),\n  approvals: Schema.Array(ApprovalRecord),\n  subagentInvocations: Schema.Array(SubagentInvocationState),\n  parentLink: Schema.optionalKey(SubagentLineageRecorded),\n}) {}\n\nexport const initialThreadProjection = (threadId: ThreadId): ThreadProjection =>\n  ThreadProjection.make({\n    schemaVersion: 2,\n    threadId,\n    throughSequence: Schema.decodeSync(CanonicalSequence)(0),\n    tailDigest: EMPTY_TAIL_DIGEST,\n    inputs: [],\n    modelOutputs: [],\n    completedRuns: [],\n    failedRuns: [],\n    settlements: [],\n    abortRequests: [],\n    openToolCalls: [],\n    unknownToolCalls: [],\n    approvals: [],\n    subagentInvocations: [],\n  });\n\n/**\n * Idempotent per-Run-and-Tool-Call upsert of the parent-side Subagent fold. Deterministic record\n * identities make duplicates impossible in one canonical stream; the first canonical payload of\n * each stage wins so a replayed reduce is a no-op.\n */\nconst upsertSubagentInvocation = (\n  invocations: ReadonlyArray<SubagentInvocationState>,\n  payload: SubagentRequested | SubagentStarted | SubagentJoined,\n): ReadonlyArray<SubagentInvocationState> => {\n  const existing = invocations.find(\n    (invocation) =>\n      invocation.runId === payload.runId && invocation.toolCallId === payload.toolCallId,\n  );\n\n  const requested =\n    existing?.requested ?? (payload._tag === \"SubagentRequested\" ? payload : undefined);\n\n  const started = existing?.started ?? (payload._tag === \"SubagentStarted\" ? payload : undefined);\n  const joined = existing?.joined ?? (payload._tag === \"SubagentJoined\" ? payload : undefined);\n\n  const next = SubagentInvocationState.make({\n    runId: payload.runId,\n    toolCallId: payload.toolCallId,\n    ...(requested === undefined ? {} : { requested }),\n    ...(started === undefined ? {} : { started }),\n    ...(joined === undefined ? {} : { joined }),\n  });\n\n  return existing === undefined\n    ? [...invocations, next]\n    : invocations.map((invocation) =>\n        invocation.runId === payload.runId && invocation.toolCallId === payload.toolCallId\n          ? next\n          : invocation,\n      );\n};\n\n/** Pure one-record Thread transition. */\nexport const reduceThreadRecord = (\n  projection: ThreadProjection,\n  envelope: CanonicalRecordEnvelope,\n  tailDigest: Digest = projection.tailDigest,\n): ThreadProjection => {\n  const payload = envelope.record.payload;\n\n  const inputs =\n    payload._tag === \"UserInputRecorded\"\n      ? [...projection.inputs, payload.input]\n      : projection.inputs;\n\n  const modelOutputs =\n    payload._tag === \"ModelCompleted\"\n      ? [...projection.modelOutputs, payload.output]\n      : projection.modelOutputs;\n\n  const completedRuns =\n    payload._tag === \"RunCompleted\"\n      ? [...projection.completedRuns, payload.runId]\n      : projection.completedRuns;\n\n  const failedRuns =\n    payload._tag === \"RunFailed\"\n      ? [...projection.failedRuns, payload.runId]\n      : projection.failedRuns;\n\n  const settlements =\n    payload._tag === \"SubmissionSettled\"\n      ? [...projection.settlements, payload]\n      : projection.settlements;\n\n  const abortRequests =\n    payload._tag === \"AbortRequested\"\n      ? [...projection.abortRequests, payload]\n      : projection.abortRequests;\n\n  // `ToolCallPrepared` opens a call; `ToolCallSettled` (results batch or late settle) and\n  // `ToolCallResolved` (DUR-017) close it. `ToolCallUnknown` does NOT close it: the call stays\n  // open until an authorized resolution or a recovered result arrives.\n  const openToolCalls =\n    payload._tag === \"ToolCallPrepared\"\n      ? projection.openToolCalls.some(\n          (call) => call.runId === payload.runId && call.toolCallId === payload.toolCallId,\n        )\n        ? projection.openToolCalls\n        : [\n            ...projection.openToolCalls,\n            OpenToolCallState.make({\n              toolCallId: payload.toolCallId,\n              toolName: payload.toolName,\n              turn: payload.turn,\n              runId: payload.runId,\n            }),\n          ]\n      : payload._tag === \"ToolCallSettled\" || payload._tag === \"ToolCallResolved\"\n        ? projection.openToolCalls.filter(\n            (call) => call.runId !== payload.runId || call.toolCallId !== payload.toolCallId,\n          )\n        : projection.openToolCalls;\n\n  const unknownToolCalls =\n    payload._tag === \"ToolCallUnknown\"\n      ? [...projection.unknownToolCalls, payload]\n      : projection.unknownToolCalls;\n\n  const approvals =\n    payload._tag === \"ToolApprovalRequested\" || payload._tag === \"ToolApprovalDecided\"\n      ? [...projection.approvals, payload]\n      : projection.approvals;\n\n  const subagentInvocations =\n    payload._tag === \"SubagentRequested\" ||\n    payload._tag === \"SubagentStarted\" ||\n    payload._tag === \"SubagentJoined\"\n      ? upsertSubagentInvocation(projection.subagentInvocations, payload)\n      : projection.subagentInvocations;\n\n  // The child-side lineage is immutable (SUB-004): the first canonical record wins forever.\n  const parentLink =\n    projection.parentLink ?? (payload._tag === \"SubagentLineageRecorded\" ? payload : undefined);\n\n  return ThreadProjection.make({\n    schemaVersion: 2,\n    threadId: projection.threadId,\n    throughSequence: envelope.sequence,\n    tailDigest,\n    inputs,\n    modelOutputs,\n    completedRuns,\n    failedRuns,\n    settlements,\n    abortRequests,\n    openToolCalls,\n    unknownToolCalls,\n    approvals,\n    subagentInvocations,\n    ...(parentLink === undefined ? {} : { parentLink }),\n  });\n};\n\n/** Pure full replay from the canonical beginning. */\nexport const replayThread = (\n  threadId: ThreadId,\n  records: ReadonlyArray<CanonicalRecordEnvelope>,\n  tailDigest: Digest = EMPTY_TAIL_DIGEST,\n): ThreadProjection =>\n  replayThreadFromCheckpoint(initialThreadProjection(threadId), records, tailDigest);\n\n/**\n * Pure checkpoint replay. A validated checkpoint projection and its canonical tail produce the\n * same reducer path as full replay for every later record.\n * Decode persisted state with `ThreadProjection` first; an incompatible state requires full replay.\n */\nexport const replayThreadFromCheckpoint = (\n  checkpoint: ThreadProjection,\n  records: ReadonlyArray<CanonicalRecordEnvelope>,\n  tailDigest: Digest = checkpoint.tailDigest,\n): ThreadProjection => {\n  let projection = checkpoint;\n\n  for (const record of records) {\n    projection = reduceThreadRecord(projection, record, tailDigest);\n  }\n\n  return projection;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAsBA,IAAa,oBAAb,cAAuC,OAAO,MAC5C,wCACF,CAAC,CAAC;CACA,YAAY;CACZ,UAAU,iBAAiB,OAAO;CAClC,MAAM,iBAAiB,OAAO;CAC9B,OAAO;AACT,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,iBAAiB,OAAO,MAAM,CAAC,uBAAuB,mBAAmB,CAAC;;;;;;;AASvF,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,OAAO;CACP,YAAY;CACZ,WAAW,OAAO,YAAY,iBAAiB;CAC/C,SAAS,OAAO,YAAY,eAAe;CAC3C,QAAQ,OAAO,YAAY,cAAc;AAC3C,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;AAiBJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,eAAe,OAAO,QAAQ,CAAC;CAC/B,UAAU;CACV,iBAAiB;CACjB,YAAY;CACZ,QAAQ,OAAO,MAAM,aAAa;CAClC,cAAc,OAAO,MAAM,aAAa;CACxC,eAAe,OAAO,MAAM,KAAK;CACjC,YAAY,OAAO,MAAM,KAAK;CAC9B,aAAa,OAAO,MAAM,uBAAuB;CACjD,eAAe,OAAO,MAAM,cAAc;CAC1C,eAAe,OAAO,MAAM,iBAAiB;CAC7C,kBAAkB,OAAO,MAAM,eAAe;CAC9C,WAAW,OAAO,MAAM,cAAc;CACtC,qBAAqB,OAAO,MAAM,uBAAuB;CACzD,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,2BAA2B,aACtC,iBAAiB,KAAK;CACpB,eAAe;CACf;CACA,iBAAiB,OAAO,WAAW,iBAAiB,CAAC,CAAC,CAAC;CACvD,YAAY;CACZ,QAAQ,CAAC;CACT,cAAc,CAAC;CACf,eAAe,CAAC;CAChB,YAAY,CAAC;CACb,aAAa,CAAC;CACd,eAAe,CAAC;CAChB,eAAe,CAAC;CAChB,kBAAkB,CAAC;CACnB,WAAW,CAAC;CACZ,qBAAqB,CAAC;AACxB,CAAC;;;;;;AAOH,MAAM,4BACJ,aACA,YAC2C;CAC3C,MAAM,WAAW,YAAY,MAC1B,eACC,WAAW,UAAU,QAAQ,SAAS,WAAW,eAAe,QAAQ,UAC5E;CAEA,MAAM,YACJ,UAAU,cAAc,QAAQ,SAAS,sBAAsB,UAAU,KAAA;CAE3E,MAAM,UAAU,UAAU,YAAY,QAAQ,SAAS,oBAAoB,UAAU,KAAA;CACrF,MAAM,SAAS,UAAU,WAAW,QAAQ,SAAS,mBAAmB,UAAU,KAAA;CAElF,MAAM,OAAO,wBAAwB,KAAK;EACxC,OAAO,QAAQ;EACf,YAAY,QAAQ;EACpB,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;EAC/C,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;EAC3C,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;CAC3C,CAAC;CAED,OAAO,aAAa,KAAA,IAChB,CAAC,GAAG,aAAa,IAAI,IACrB,YAAY,KAAK,eACf,WAAW,UAAU,QAAQ,SAAS,WAAW,eAAe,QAAQ,aACpE,OACA,UACN;AACN;;AAGA,MAAa,sBACX,YACA,UACA,aAAqB,WAAW,eACX;CACrB,MAAM,UAAU,SAAS,OAAO;CAEhC,MAAM,SACJ,QAAQ,SAAS,sBACb,CAAC,GAAG,WAAW,QAAQ,QAAQ,KAAK,IACpC,WAAW;CAEjB,MAAM,eACJ,QAAQ,SAAS,mBACb,CAAC,GAAG,WAAW,cAAc,QAAQ,MAAM,IAC3C,WAAW;CAEjB,MAAM,gBACJ,QAAQ,SAAS,iBACb,CAAC,GAAG,WAAW,eAAe,QAAQ,KAAK,IAC3C,WAAW;CAEjB,MAAM,aACJ,QAAQ,SAAS,cACb,CAAC,GAAG,WAAW,YAAY,QAAQ,KAAK,IACxC,WAAW;CAEjB,MAAM,cACJ,QAAQ,SAAS,sBACb,CAAC,GAAG,WAAW,aAAa,OAAO,IACnC,WAAW;CAEjB,MAAM,gBACJ,QAAQ,SAAS,mBACb,CAAC,GAAG,WAAW,eAAe,OAAO,IACrC,WAAW;CAKjB,MAAM,gBACJ,QAAQ,SAAS,qBACb,WAAW,cAAc,MACtB,SAAS,KAAK,UAAU,QAAQ,SAAS,KAAK,eAAe,QAAQ,UACxE,IACE,WAAW,gBACX,CACE,GAAG,WAAW,eACd,kBAAkB,KAAK;EACrB,YAAY,QAAQ;EACpB,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,OAAO,QAAQ;CACjB,CAAC,CACH,IACF,QAAQ,SAAS,qBAAqB,QAAQ,SAAS,qBACrD,WAAW,cAAc,QACtB,SAAS,KAAK,UAAU,QAAQ,SAAS,KAAK,eAAe,QAAQ,UACxE,IACA,WAAW;CAEnB,MAAM,mBACJ,QAAQ,SAAS,oBACb,CAAC,GAAG,WAAW,kBAAkB,OAAO,IACxC,WAAW;CAEjB,MAAM,YACJ,QAAQ,SAAS,2BAA2B,QAAQ,SAAS,wBACzD,CAAC,GAAG,WAAW,WAAW,OAAO,IACjC,WAAW;CAEjB,MAAM,sBACJ,QAAQ,SAAS,uBACjB,QAAQ,SAAS,qBACjB,QAAQ,SAAS,mBACb,yBAAyB,WAAW,qBAAqB,OAAO,IAChE,WAAW;CAGjB,MAAM,aACJ,WAAW,eAAe,QAAQ,SAAS,4BAA4B,UAAU,KAAA;CAEnF,OAAO,iBAAiB,KAAK;EAC3B,eAAe;EACf,UAAU,WAAW;EACrB,iBAAiB,SAAS;EAC1B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;CACnD,CAAC;AACH;;AAGA,MAAa,gBACX,UACA,SACA,aAAqB,sBAErB,2BAA2B,wBAAwB,QAAQ,GAAG,SAAS,UAAU;;;;;;AAOnF,MAAa,8BACX,YACA,SACA,aAAqB,WAAW,eACX;CACrB,IAAI,aAAa;CAEjB,KAAK,MAAM,UAAU,SACnB,aAAa,mBAAmB,YAAY,QAAQ,UAAU;CAGhE,OAAO;AACT"}