glirastes 0.3.2 → 0.5.0

package/dist/cjs/runtime/policy-overlay.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPolicyOverlay = applyPolicyOverlay;
+exports.relaxableToolIds = relaxableToolIds;
+exports.overlayDescriptions = overlayDescriptions;
+exports.policyOverlayFromRevision = policyOverlayFromRevision;
+const index_js_1 = require("../contracts/index.js");
+const tool_policy_js_1 = require("../contracts/tool-policy.js");
+/**
+ * Composes the local effective policies with a verified Platform overlay
+ * (spec 4.9, resolveToolPolicy semantics). The overlay restricts: disable,
+ * raise the risk class, narrow roles, require confirmation; `enabled: true`
+ * and a lower risk class are no-ops. Its one relaxation is D16 (spec 4.5 as
+ * amended 2026-10-05): a signed `requiresApproval: false` switches a tool's
+ * confirmation off where `confirmationRelaxationOutcome` applies at the
+ * effective risk class (pinned to this tool, at most tier 2, lapsing once
+ * the risk rises above the pin; tier 3 and `unknown` never) and only for
+ * tools in `relaxableToolIds`, so a local lock in tool-policy.json always
+ * wins. Overlay ids without a local policy are ignored and reported.
+ */
+function applyPolicyOverlay(local, overlay, options = {}) {
+    const relaxable = options.relaxableToolIds ?? new Set();
+    const localIds = new Set(local.map((policy) => policy.toolId));
+    const entriesByToolId = new Map();
+    const ignored = new Set();
+    for (const { toolId, ...entry } of overlay) {
+        if (!localIds.has(toolId)) {
+            ignored.add(toolId);
+            continue;
+        }
+        entriesByToolId.set(toolId, [...(entriesByToolId.get(toolId) ?? []), entry]);
+    }
+    const relaxations = [];
+    const policies = local.map((policy) => {
+        const entries = entriesByToolId.get(policy.toolId) ?? [];
+        const restricted = entries.reduce(restrictPolicy, policy);
+        if (!restricted.requiresApproval
+            || !entries.some((entry) => entry.requiresApproval === false)) {
+            return restricted;
+        }
+        const outcome = relaxationOutcome(policy.toolId, entries, restricted.riskClass, relaxable);
+        relaxations.push({ toolId: policy.toolId, outcome });
+        return outcome === 'applied'
+            ? { ...restricted, requiresApproval: false }
+            : restricted;
+    });
+    return {
+        policies,
+        ignored: [...ignored].sort().map((toolId) => ({
+            toolId,
+            reason: 'platform-tool-not-in-code',
+        })),
+        relaxations,
+    };
+}
+function restrictPolicy(policy, entry) {
+    const riskClass = (0, tool_policy_js_1.mostRestrictiveRiskClass)(policy.riskClass, entry.riskClass);
+    const roles = (0, tool_policy_js_1.intersectAllowedRoles)(policy.allowedRoles, entry.allowedRoles);
+    const raisedIntoConfirmation = (0, tool_policy_js_1.riskTier)(riskClass) >= 2
+        && (0, tool_policy_js_1.riskTier)(riskClass) > (0, tool_policy_js_1.riskTier)(policy.riskClass);
+    return {
+        toolId: policy.toolId,
+        // Disjoint role restrictions mean nobody, never everyone.
+        enabled: policy.enabled && entry.enabled !== false && !roles.disjoint,
+        riskClass,
+        requiresApproval: (0, tool_policy_js_1.confirmationFloor)(riskClass, policy.requiresApproval
+            || entry.requiresApproval === true
+            || raisedIntoConfirmation),
+        allowedRoles: roles.roles,
+    };
+}
+/** D16 for one asking tool, checked after every restriction of its decision. */
+function relaxationOutcome(toolId, entries, riskClass, relaxable) {
+    if (entries.length !== 1)
+        return 'duplicate-decisions';
+    const outcome = (0, tool_policy_js_1.confirmationRelaxationOutcome)(toolId, entries[0].pin, riskClass);
+    if (outcome !== 'applies')
+        return outcome;
+    return relaxable.has(toolId) ? 'applied' : 'locked-locally';
+}
+/**
+ * The tools of the running code whose confirmation a signed Platform decision
+ * may switch off (D16): those the committed setup artifact (the code report)
+ * attributes to the code default, up to tier 2 (`platformMayRelaxConfirmation`).
+ * An explicit `requiresApproval: true` or a risk raise in tool-policy.json and
+ * an artifact without provenance are local locks.
+ */
+function relaxableToolIds(setupArtifact) {
+    const artifact = index_js_1.AppSetupArtifactSchema.parse(setupArtifact);
+    return new Set(artifact.tools
+        .filter((tool) => (0, tool_policy_js_1.platformMayRelaxConfirmation)(tool.riskClass, tool.provenance?.policyOrigin?.requiresApproval))
+        .map((tool) => tool.toolId));
+}
+/**
+ * Platform descriptions for tools the deployed code has (spec 4.5: Platform >
+ * local > code for prose). The last delta for a tool wins, like the policy
+ * layers; deltas for tools the code does not have are ignored.
+ */
+function overlayDescriptions(localToolIds, overlay) {
+    const descriptions = new Map();
+    for (const entry of overlay) {
+        if (entry.description !== undefined && localToolIds.has(entry.toolId)) {
+            descriptions.set(entry.toolId, entry.description);
+        }
+    }
+    return descriptions;
+}
+/**
+ * Reads a Platform policy revision the sync manager already verified as an
+ * overlay. The entries are the signed `toolOverrides` deltas (P08b shared
+ * contract item 2), never the reported `toolPolicies`: those repeat what the
+ * code reported and would freeze an old local value, and a relaxation there
+ * is no decision. The revision id keeps Platform revocations matching.
+ */
+function policyOverlayFromRevision(revision) {
+    return {
+        revisionId: revision.revisionId,
+        revision: revision.revision,
+        entries: revision.toolOverrides.map((delta) => ({ ...delta })),
+        budget: revision.budget,
+    };
+}

package/dist/cjs/runtime/postgres-store.d.ts

@@ -0,0 +1,111 @@
+export interface PostgresQueryClient {
+    unsafe<T extends Record<string, unknown>>(query: string, parameters?: readonly unknown[]): Promise<T[]>;
+}
+export type ConversationVisibility = 'private' | 'tenant';
+export interface RuntimeStoreScope {
+    environmentId: string;
+    tenantId: string;
+    subjectId: string;
+}
+export interface SaveConversationInput extends RuntimeStoreScope {
+    conversationId: string;
+    visibility: ConversationVisibility;
+    messages: unknown[];
+    expiresAt?: Date | null;
+}
+export interface LoadConversationInput extends RuntimeStoreScope {
+    conversationId: string;
+}
+export interface ConversationRecord {
+    conversationId: string;
+    tenantId: string;
+    ownerSubjectId: string;
+    visibility: ConversationVisibility;
+    messages: unknown[];
+    updatedAt: Date;
+    expiresAt: Date | null;
+}
+export interface ProjectConversationInput extends LoadConversationInput {
+    maxMessages: number;
+    maxCharacters: number;
+}
+export type RuntimeCheckpointStatus = 'running' | 'paused' | 'completed' | 'failed' | 'cancelled';
+export interface SaveCheckpointInput {
+    environmentId: string;
+    runId: string;
+    turnId: string;
+    agentRevisionId: string;
+    expectedSequence: number;
+    status: RuntimeCheckpointStatus;
+    state: unknown;
+    checkpointId?: string;
+}
+export interface RuntimeCheckpoint {
+    checkpointId: string;
+    runId: string;
+    turnId: string;
+    agentRevisionId: string;
+    sequence: number;
+    status: RuntimeCheckpointStatus;
+    state: unknown;
+    createdAt: Date;
+}
+export interface ToolExecutionClaimInput {
+    environmentId: string;
+    runId: string;
+    idempotencyKey: string;
+    toolUuid: string;
+    inputFingerprint: string;
+}
+export type ToolExecutionStatus = 'pending' | 'completed' | 'failed';
+export interface ToolExecutionEvidence {
+    claimed: boolean;
+    idempotencyKey: string;
+    toolUuid: string;
+    inputFingerprint: string;
+    status: ToolExecutionStatus;
+    result: unknown | null;
+    resultFingerprint: string | null;
+    createdAt: Date;
+    completedAt: Date | null;
+}
+export interface CompleteToolExecutionInput extends ToolExecutionClaimInput {
+    status: Exclude<ToolExecutionStatus, 'pending'>;
+    result: unknown;
+    resultFingerprint: string;
+}
+export interface DurableRuntimeStore {
+    saveCheckpoint(input: SaveCheckpointInput): Promise<RuntimeCheckpoint>;
+    loadLatestCheckpoint(input: {
+        environmentId: string;
+        runId: string;
+    }): Promise<RuntimeCheckpoint | null>;
+    claimToolExecution(input: ToolExecutionClaimInput): Promise<ToolExecutionEvidence>;
+    completeToolExecution(input: CompleteToolExecutionInput): Promise<ToolExecutionEvidence>;
+}
+export interface RuntimePersistenceRequirement {
+    executionMode: 'interactive' | 'asynchronous' | 'scheduled' | 'unattended';
+    resumableAcrossRestarts: boolean;
+    store?: DurableRuntimeStore;
+}
+export declare function assertRuntimePersistenceReady(requirement: RuntimePersistenceRequirement): void;
+export declare class CheckpointConflictError extends Error {
+    constructor(runId: string, expectedSequence: number);
+}
+export declare const POSTGRES_RUNTIME_STORE_SCHEMA_SQL = "/* glirastes:initialize-store */\nCREATE TABLE IF NOT EXISTS glirastes_runtime_conversations (\n  environment_id text NOT NULL,\n  conversation_id text NOT NULL,\n  tenant_id text NOT NULL,\n  owner_subject_id text NOT NULL,\n  visibility text NOT NULL CHECK (visibility IN ('private', 'tenant')),\n  messages jsonb NOT NULL,\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  expires_at timestamptz,\n  PRIMARY KEY (environment_id, conversation_id)\n);\nCREATE INDEX IF NOT EXISTS glirastes_runtime_conversations_access_idx\n  ON glirastes_runtime_conversations (environment_id, tenant_id, owner_subject_id);\nCREATE INDEX IF NOT EXISTS glirastes_runtime_conversations_expiry_idx\n  ON glirastes_runtime_conversations (expires_at)\n  WHERE expires_at IS NOT NULL;\n\nCREATE TABLE IF NOT EXISTS glirastes_runtime_checkpoints (\n  environment_id text NOT NULL,\n  run_id text NOT NULL,\n  checkpoint_id text NOT NULL,\n  turn_id text NOT NULL,\n  agent_revision_id text NOT NULL,\n  sequence bigint NOT NULL CHECK (sequence > 0),\n  status text NOT NULL CHECK (\n    status IN ('running', 'paused', 'completed', 'failed', 'cancelled')\n  ),\n  state jsonb NOT NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  PRIMARY KEY (environment_id, run_id, sequence),\n  UNIQUE (environment_id, checkpoint_id)\n);\n\nCREATE TABLE IF NOT EXISTS glirastes_runtime_tool_executions (\n  environment_id text NOT NULL,\n  run_id text NOT NULL,\n  idempotency_key text NOT NULL,\n  tool_uuid text NOT NULL,\n  input_fingerprint text NOT NULL,\n  claim_token text NOT NULL,\n  status text NOT NULL CHECK (status IN ('pending', 'completed', 'failed')),\n  result jsonb,\n  result_fingerprint text,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  completed_at timestamptz,\n  PRIMARY KEY (environment_id, run_id, idempotency_key)\n);\nCREATE INDEX IF NOT EXISTS glirastes_runtime_tool_executions_tool_idx\n  ON glirastes_runtime_tool_executions (environment_id, tool_uuid, created_at);\n";
+export declare function createPostgresRuntimeStore(client: PostgresQueryClient): {
+    initialize(): Promise<void>;
+    saveConversation(input: SaveConversationInput): Promise<void>;
+    loadConversation: (input: LoadConversationInput) => Promise<ConversationRecord | null>;
+    projectConversation(input: ProjectConversationInput): Promise<unknown[]>;
+    deleteConversation(input: LoadConversationInput): Promise<boolean>;
+    purgeExpiredConversations(now?: Date): Promise<number>;
+    saveCheckpoint(input: SaveCheckpointInput): Promise<RuntimeCheckpoint>;
+    loadLatestCheckpoint(input: {
+        environmentId: string;
+        runId: string;
+    }): Promise<RuntimeCheckpoint | null>;
+    claimToolExecution(input: ToolExecutionClaimInput): Promise<ToolExecutionEvidence>;
+    completeToolExecution(input: CompleteToolExecutionInput): Promise<ToolExecutionEvidence>;
+};
+export type PostgresRuntimeStore = ReturnType<typeof createPostgresRuntimeStore>;

package/dist/cjs/runtime/postgres-store.js

@@ -0,0 +1,368 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POSTGRES_RUNTIME_STORE_SCHEMA_SQL = exports.CheckpointConflictError = void 0;
+exports.assertRuntimePersistenceReady = assertRuntimePersistenceReady;
+exports.createPostgresRuntimeStore = createPostgresRuntimeStore;
+function assertRuntimePersistenceReady(requirement) {
+    const requiresDurableStore = requirement.executionMode !== 'interactive'
+        || requirement.resumableAcrossRestarts;
+    if (requiresDurableStore && !requirement.store) {
+        throw new Error(`A durable RuntimeStore is required for ${requirement.executionMode} or restart-resumable execution.`);
+    }
+}
+class CheckpointConflictError extends Error {
+    constructor(runId, expectedSequence) {
+        super(`Checkpoint sequence conflict for run "${runId}" at expected sequence ${expectedSequence}.`);
+        this.name = 'CheckpointConflictError';
+    }
+}
+exports.CheckpointConflictError = CheckpointConflictError;
+exports.POSTGRES_RUNTIME_STORE_SCHEMA_SQL = `/* glirastes:initialize-store */
+CREATE TABLE IF NOT EXISTS glirastes_runtime_conversations (
+  environment_id text NOT NULL,
+  conversation_id text NOT NULL,
+  tenant_id text NOT NULL,
+  owner_subject_id text NOT NULL,
+  visibility text NOT NULL CHECK (visibility IN ('private', 'tenant')),
+  messages jsonb NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  expires_at timestamptz,
+  PRIMARY KEY (environment_id, conversation_id)
+);
+CREATE INDEX IF NOT EXISTS glirastes_runtime_conversations_access_idx
+  ON glirastes_runtime_conversations (environment_id, tenant_id, owner_subject_id);
+CREATE INDEX IF NOT EXISTS glirastes_runtime_conversations_expiry_idx
+  ON glirastes_runtime_conversations (expires_at)
+  WHERE expires_at IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS glirastes_runtime_checkpoints (
+  environment_id text NOT NULL,
+  run_id text NOT NULL,
+  checkpoint_id text NOT NULL,
+  turn_id text NOT NULL,
+  agent_revision_id text NOT NULL,
+  sequence bigint NOT NULL CHECK (sequence > 0),
+  status text NOT NULL CHECK (
+    status IN ('running', 'paused', 'completed', 'failed', 'cancelled')
+  ),
+  state jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (environment_id, run_id, sequence),
+  UNIQUE (environment_id, checkpoint_id)
+);
+
+CREATE TABLE IF NOT EXISTS glirastes_runtime_tool_executions (
+  environment_id text NOT NULL,
+  run_id text NOT NULL,
+  idempotency_key text NOT NULL,
+  tool_uuid text NOT NULL,
+  input_fingerprint text NOT NULL,
+  claim_token text NOT NULL,
+  status text NOT NULL CHECK (status IN ('pending', 'completed', 'failed')),
+  result jsonb,
+  result_fingerprint text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  completed_at timestamptz,
+  PRIMARY KEY (environment_id, run_id, idempotency_key)
+);
+CREATE INDEX IF NOT EXISTS glirastes_runtime_tool_executions_tool_idx
+  ON glirastes_runtime_tool_executions (environment_id, tool_uuid, created_at);
+`;
+function parseJson(value) {
+    if (typeof value !== 'string') {
+        return value;
+    }
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+function asDate(value) {
+    return value instanceof Date ? value : new Date(String(value));
+}
+function asOptionalDate(value) {
+    return value === null || value === undefined ? null : asDate(value);
+}
+function mapConversation(row) {
+    const messages = parseJson(row.messages);
+    return {
+        conversationId: String(row.conversation_id),
+        tenantId: String(row.tenant_id),
+        ownerSubjectId: String(row.owner_subject_id),
+        visibility: row.visibility,
+        messages: Array.isArray(messages) ? messages : [],
+        updatedAt: asDate(row.updated_at),
+        expiresAt: asOptionalDate(row.expires_at),
+    };
+}
+function mapCheckpoint(row) {
+    return {
+        checkpointId: String(row.checkpoint_id),
+        runId: String(row.run_id),
+        turnId: String(row.turn_id),
+        agentRevisionId: String(row.agent_revision_id),
+        sequence: Number(row.sequence),
+        status: row.status,
+        state: parseJson(row.state),
+        createdAt: asDate(row.created_at),
+    };
+}
+function mapToolEvidence(row) {
+    return {
+        claimed: Boolean(row.claimed),
+        idempotencyKey: String(row.idempotency_key),
+        toolUuid: String(row.tool_uuid),
+        inputFingerprint: String(row.input_fingerprint),
+        status: row.status,
+        result: row.result === null ? null : parseJson(row.result),
+        resultFingerprint: row.result_fingerprint === null ? null : String(row.result_fingerprint),
+        createdAt: asDate(row.created_at),
+        completedAt: asOptionalDate(row.completed_at),
+    };
+}
+function projectTail(messages, maxMessages, maxCharacters) {
+    if (!Number.isInteger(maxMessages) || maxMessages < 0) {
+        throw new Error('maxMessages must be a non-negative integer.');
+    }
+    if (!Number.isInteger(maxCharacters) || maxCharacters < 0) {
+        throw new Error('maxCharacters must be a non-negative integer.');
+    }
+    const projected = [];
+    let characters = 0;
+    for (let index = messages.length - 1; index >= 0 && projected.length < maxMessages; index -= 1) {
+        const message = messages[index];
+        const size = JSON.stringify(message).length;
+        if (characters + size > maxCharacters) {
+            break;
+        }
+        projected.unshift(message);
+        characters += size;
+    }
+    return projected;
+}
+function createPostgresRuntimeStore(client) {
+    async function loadConversation(input) {
+        const rows = await client.unsafe(`/* glirastes:load-conversation */
+SELECT
+  conversation_id,
+  tenant_id,
+  owner_subject_id,
+  visibility,
+  messages,
+  updated_at,
+  expires_at
+FROM glirastes_runtime_conversations
+WHERE environment_id = $1
+  AND conversation_id = $2
+  AND tenant_id = $3
+  AND (visibility = 'tenant' OR owner_subject_id = $4)
+  AND (expires_at IS NULL OR expires_at > now())
+LIMIT 1`, [
+            input.environmentId,
+            input.conversationId,
+            input.tenantId,
+            input.subjectId,
+        ]);
+        return rows[0] ? mapConversation(rows[0]) : null;
+    }
+    return {
+        async initialize() {
+            await client.unsafe(exports.POSTGRES_RUNTIME_STORE_SCHEMA_SQL);
+        },
+        async saveConversation(input) {
+            const rows = await client.unsafe(`/* glirastes:save-conversation */
+INSERT INTO glirastes_runtime_conversations (
+  environment_id,
+  conversation_id,
+  tenant_id,
+  owner_subject_id,
+  visibility,
+  messages,
+  expires_at
+) VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7::timestamptz)
+ON CONFLICT (environment_id, conversation_id) DO UPDATE SET
+  tenant_id = EXCLUDED.tenant_id,
+  owner_subject_id = EXCLUDED.owner_subject_id,
+  visibility = EXCLUDED.visibility,
+  messages = EXCLUDED.messages,
+  expires_at = EXCLUDED.expires_at,
+  updated_at = now()
+WHERE glirastes_runtime_conversations.tenant_id = EXCLUDED.tenant_id
+  AND glirastes_runtime_conversations.owner_subject_id = EXCLUDED.owner_subject_id
+RETURNING conversation_id`, [
+                input.environmentId,
+                input.conversationId,
+                input.tenantId,
+                input.subjectId,
+                input.visibility,
+                JSON.stringify(input.messages),
+                input.expiresAt?.toISOString() ?? null,
+            ]);
+            if (!rows[0]) {
+                throw new Error(`Conversation "${input.conversationId}" is owned by a different principal.`);
+            }
+        },
+        loadConversation,
+        async projectConversation(input) {
+            const conversation = await loadConversation(input);
+            return conversation
+                ? projectTail(conversation.messages, input.maxMessages, input.maxCharacters)
+                : [];
+        },
+        async deleteConversation(input) {
+            const rows = await client.unsafe(`/* glirastes:delete-conversation */
+DELETE FROM glirastes_runtime_conversations
+WHERE environment_id = $1
+  AND conversation_id = $2
+  AND tenant_id = $3
+  AND owner_subject_id = $4
+RETURNING conversation_id`, [
+                input.environmentId,
+                input.conversationId,
+                input.tenantId,
+                input.subjectId,
+            ]);
+            return rows.length > 0;
+        },
+        async purgeExpiredConversations(now = new Date()) {
+            const rows = await client.unsafe(`/* glirastes:purge-conversations */
+WITH deleted AS (
+  DELETE FROM glirastes_runtime_conversations
+  WHERE expires_at IS NOT NULL AND expires_at <= $1::timestamptz
+  RETURNING 1
+)
+SELECT count(*)::integer AS deleted_count FROM deleted`, [now.toISOString()]);
+            return Number(rows[0]?.deleted_count ?? 0);
+        },
+        async saveCheckpoint(input) {
+            const checkpointId = input.checkpointId ?? crypto.randomUUID();
+            const rows = await client.unsafe(`/* glirastes:save-checkpoint */
+WITH lock_run AS MATERIALIZED (
+  SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || $2, 0))
+),
+current_sequence AS MATERIALIZED (
+  SELECT COALESCE(max(sequence), 0)::bigint AS sequence
+  FROM glirastes_runtime_checkpoints, lock_run
+  WHERE environment_id = $1 AND run_id = $2
+),
+inserted AS (
+  INSERT INTO glirastes_runtime_checkpoints (
+    environment_id,
+    run_id,
+    checkpoint_id,
+    turn_id,
+    agent_revision_id,
+    sequence,
+    status,
+    state
+  )
+  SELECT $1, $2, $3, $4, $5, $6::bigint + 1, $7, $8::jsonb
+  FROM current_sequence
+  WHERE sequence = $6::bigint
+  RETURNING checkpoint_id, run_id, turn_id, agent_revision_id,
+    sequence, status, state, created_at
+)
+SELECT * FROM inserted`, [
+                input.environmentId,
+                input.runId,
+                checkpointId,
+                input.turnId,
+                input.agentRevisionId,
+                input.expectedSequence,
+                input.status,
+                JSON.stringify(input.state),
+            ]);
+            if (!rows[0]) {
+                throw new CheckpointConflictError(input.runId, input.expectedSequence);
+            }
+            return mapCheckpoint(rows[0]);
+        },
+        async loadLatestCheckpoint(input) {
+            const rows = await client.unsafe(`/* glirastes:load-checkpoint */
+SELECT checkpoint_id, run_id, turn_id, agent_revision_id,
+  sequence, status, state, created_at
+FROM glirastes_runtime_checkpoints
+WHERE environment_id = $1 AND run_id = $2
+ORDER BY sequence DESC
+LIMIT 1`, [input.environmentId, input.runId]);
+            return rows[0] ? mapCheckpoint(rows[0]) : null;
+        },
+        async claimToolExecution(input) {
+            const claimToken = crypto.randomUUID();
+            const rows = await client.unsafe(`/* glirastes:claim-tool-execution */
+INSERT INTO glirastes_runtime_tool_executions (
+  environment_id,
+  run_id,
+  idempotency_key,
+  tool_uuid,
+  input_fingerprint,
+  claim_token,
+  status
+) VALUES ($1, $2, $3, $4, $5, $6, 'pending')
+ON CONFLICT (environment_id, run_id, idempotency_key) DO UPDATE
+SET idempotency_key = EXCLUDED.idempotency_key
+RETURNING *, claim_token = $6 AS claimed`, [
+                input.environmentId,
+                input.runId,
+                input.idempotencyKey,
+                input.toolUuid,
+                input.inputFingerprint,
+                claimToken,
+            ]);
+            if (!rows[0]) {
+                throw new Error('Tool execution claim could not be persisted.');
+            }
+            const evidence = mapToolEvidence(rows[0]);
+            if (evidence.toolUuid !== input.toolUuid
+                || evidence.inputFingerprint !== input.inputFingerprint) {
+                throw new Error(`Idempotency key "${input.idempotencyKey}" was already used for a different tool or input.`);
+            }
+            return evidence;
+        },
+        async completeToolExecution(input) {
+            const rows = await client.unsafe(`/* glirastes:complete-tool-execution */
+WITH updated AS (
+  UPDATE glirastes_runtime_tool_executions
+  SET status = $6,
+    result = $7::jsonb,
+    result_fingerprint = $8,
+    completed_at = now()
+  WHERE environment_id = $1
+    AND run_id = $2
+    AND idempotency_key = $3
+    AND tool_uuid = $4
+    AND input_fingerprint = $5
+    AND status = 'pending'
+  RETURNING *
+)
+SELECT *, false AS claimed FROM updated
+UNION ALL
+SELECT *, false AS claimed
+FROM glirastes_runtime_tool_executions
+WHERE environment_id = $1
+  AND run_id = $2
+  AND idempotency_key = $3
+  AND tool_uuid = $4
+  AND input_fingerprint = $5
+  AND status = $6
+  AND result_fingerprint = $8
+  AND NOT EXISTS (SELECT 1 FROM updated)
+LIMIT 1`, [
+                input.environmentId,
+                input.runId,
+                input.idempotencyKey,
+                input.toolUuid,
+                input.inputFingerprint,
+                input.status,
+                JSON.stringify(input.result),
+                input.resultFingerprint,
+            ]);
+            if (!rows[0]) {
+                throw new Error(`Pending tool execution "${input.idempotencyKey}" was not found.`);
+            }
+            return mapToolEvidence(rows[0]);
+        },
+    };
+}

package/dist/cjs/runtime/prompt-bundle-store.d.ts

@@ -0,0 +1,58 @@
+import { type PromptPin, type SignedPromptBinding } from '../contracts/index.js';
+import { type RuntimePublicKeyProvider } from '../sync/signature-verifier.js';
+export interface PromptArtifactRegistry {
+    fetch(artifactRef: string): Promise<unknown>;
+}
+export interface PromptBundleSections {
+    readonly planner: string;
+    readonly appBehavior: string;
+    readonly responseStyle: string;
+    readonly capabilityFragments: ReadonlyArray<{
+        readonly id: string;
+        readonly content: string;
+    }>;
+}
+export interface StagedPromptBundle {
+    readonly revisionId: string;
+    readonly revision: number;
+    readonly bundleDigest: string;
+    readonly sections: PromptBundleSections;
+}
+export interface ActivePromptBundle extends StagedPromptBundle {
+}
+export interface PinnedPromptBundle extends StagedPromptBundle {
+    readonly turnId: string;
+}
+export interface PromptBundleStoreOptions {
+    appId: string;
+    registry: PromptArtifactRegistry;
+    keys: RuntimePublicKeyProvider;
+    maxBundleBytes?: number;
+}
+/**
+ * Local, verified prompt-bundle activation.
+ *
+ * Runtime and prompt bundles are separate artifacts. Staging performs every
+ * network and cryptographic step outside interactive turns; activation is a
+ * single atomic reference swap. A running turn keeps the revision it started
+ * with, a new turn atomically sees the activated revision, and there is no
+ * unsigned, stale, or partially verified fallback.
+ */
+export declare class PromptBundleStore {
+    private readonly options;
+    private readonly verifier;
+    private readonly maxBundleBytes;
+    private active?;
+    private previous?;
+    private readonly turnPins;
+    constructor(options: PromptBundleStoreOptions);
+    stage(binding: SignedPromptBinding): Promise<StagedPromptBundle>;
+    activate(staged: StagedPromptBundle): Promise<void>;
+    current(): ActivePromptBundle;
+    pinForTurn(turnId: string): PinnedPromptBundle;
+    releaseTurn(turnId: string): void;
+    /** Restores the previously verified pin without refetching or rebuilding. */
+    rollback(): void;
+    promptPin(): PromptPin;
+    private assertNotStale;
+}