memeloop 0.2.3 → 0.2.5

package/dist/orchestration-portable.cjs

@@ -1397,6 +1397,74 @@ function containsSecrets(value, options = {}) {
   return walk(value);
 }
 
+// src/orchestration/drivers/driverState.ts
+function assertFencedDriverRequestEnvelope(request, options) {
+  assertDriverRequestEnvelope(request, {
+    now: options.now,
+    requireRun: options.requireRun,
+    requireFencing: true,
+    requireCapability: true,
+    expectedMethod: options.expectedMethod
+  });
+  if (options.actorKinds && !options.actorKinds.includes(request.actor.kind)) {
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: options.forbiddenMessage?.(request.actor.kind) ?? `actor kind '${request.actor.kind}' cannot call ${options.expectedMethod}`,
+      retryable: false
+    });
+  }
+  const epoch = request.fencingEpoch;
+  const current = options.fences.get(request.resource.uid) ?? 0;
+  if (epoch < current) {
+    throw new OrchestrationError({
+      code: "STALE_EPOCH",
+      message: `stale ${options.fenceName} fencing epoch ${epoch}; current epoch is ${current}`,
+      retryable: false
+    });
+  }
+  options.fences.set(request.resource.uid, epoch);
+  return epoch;
+}
+function driverOperationKey(request, operation) {
+  return `${request.resource.uid}:${operation}:${request.idempotencyKey}`;
+}
+function findIdempotentDriverHandle(state, request, operation, driverName) {
+  const key = driverOperationKey(request, operation);
+  const handle = state.idempotency.get(key);
+  if (handle === void 0) return void 0;
+  if (state.idempotencyFingerprints.get(key) !== canonicalDriverValue(request.payload)) {
+    throw new OrchestrationError({
+      code: "CONFLICT",
+      message: `${driverName} ${operation} idempotency key was reused with different input`,
+      retryable: false
+    });
+  }
+  return handle;
+}
+function rememberIdempotentDriverHandle(state, request, operation, handle) {
+  const key = driverOperationKey(request, operation);
+  state.idempotency.set(key, handle);
+  state.idempotencyFingerprints.set(key, canonicalDriverValue(request.payload));
+}
+function getOwnedDriverValue(collection, handle, resourceUid, kind) {
+  const value = collection.get(handle);
+  if (!value) {
+    throw new OrchestrationError({
+      code: "NOT_FOUND",
+      message: `${kind} handle '${handle}' was not found`,
+      retryable: false
+    });
+  }
+  if (value.resourceUid !== resourceUid) {
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `${kind} handle '${handle}' belongs to another resource`,
+      retryable: false
+    });
+  }
+  return value;
+}
+
 // src/orchestration/drivers/auditTelemetryManagement.ts
 function createFakeAuditTelemetryState() {
   return {
@@ -1412,16 +1480,8 @@ var FORBIDDEN_ATTRIBUTE = /(?:secret|token|password|credential|authorization|coo
 function invalid3(message) {
   throw new OrchestrationError({ code: "INVALID", message, retryable: false });
 }
-function stable(value) {
-  if (value === void 0) return "undefined";
-  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
-  if (value !== null && typeof value === "object") {
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stable(item)}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? typeof value;
-}
 async function digest(value) {
-  const bytes = new TextEncoder().encode(stable(value));
+  const bytes = new TextEncoder().encode(canonicalDriverValue(value));
   const result = await globalThis.crypto.subtle.digest("SHA-256", bytes);
   return `sha256:${[...new Uint8Array(result)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
@@ -1439,29 +1499,13 @@ function createFakeAuditTelemetryManagementDriver(options = {}) {
   const maxRecordsPerResource = options.maxRecordsPerResource ?? 1e4;
   const maxAttributes = options.maxAttributes ?? 16;
   function validate(request, expectedMethod, actorKinds) {
-    assertDriverRequestEnvelope(request, {
+    assertFencedDriverRequestEnvelope(request, {
       now,
-      requireFencing: true,
-      requireCapability: true,
-      expectedMethod
+      fences: state.fences,
+      expectedMethod,
+      fenceName: "audit",
+      actorKinds
     });
-    if (!actorKinds.includes(request.actor.kind)) {
-      throw new OrchestrationError({
-        code: "FORBIDDEN",
-        message: `actor kind '${request.actor.kind}' cannot call ${expectedMethod}`,
-        retryable: false
-      });
-    }
-    const epoch = request.fencingEpoch;
-    const current = state.fences.get(request.resource.uid) ?? 0;
-    if (epoch < current) {
-      throw new OrchestrationError({
-        code: "STALE_EPOCH",
-        message: `stale audit fencing epoch ${epoch}; current epoch is ${current}`,
-        retryable: false
-      });
-    }
-    state.fences.set(request.resource.uid, epoch);
   }
   function common(request) {
     const policyDigest = requiredString2(request.payload, "policyDigest", 80);
@@ -1491,7 +1535,7 @@ function createFakeAuditTelemetryManagementDriver(options = {}) {
   }
   async function append(request, kind, data) {
     const idempotencyKey = `${request.resource.uid}:${request.method}:${request.idempotencyKey}`;
-    const fingerprint = stable(request.payload);
+    const fingerprint = canonicalDriverValue(request.payload);
     let release;
     const previousAppend = state.appendTail;
     state.appendTail = new Promise((resolve) => {
@@ -2612,24 +2656,6 @@ function requiredString4(payload, field) {
   if (payload === null || typeof payload !== "object" || typeof payload[field] !== "string" || !payload[field]) invalid5(`identity payload '${field}' is required`);
   return payload[field];
 }
-function owned(collection, handle, resourceUid, kind) {
-  const value = collection.get(handle);
-  if (!value) {
-    throw new OrchestrationError({
-      code: "NOT_FOUND",
-      message: `${kind} handle '${handle}' was not found`,
-      retryable: false
-    });
-  }
-  if (value.resourceUid !== resourceUid) {
-    throw new OrchestrationError({
-      code: "FORBIDDEN",
-      message: `${kind} handle '${handle}' belongs to another resource`,
-      retryable: false
-    });
-  }
-  return value;
-}
 function createFakeIdentityAttestationManagementDriver(options = {}) {
   const state = options.state ?? createFakeIdentityAttestationState();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -2646,29 +2672,13 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
     `sha256:${"a".repeat(64)}`
   ];
   function validate(request, expectedMethod, actorKinds) {
-    assertDriverRequestEnvelope(request, {
+    assertFencedDriverRequestEnvelope(request, {
       now,
-      requireFencing: true,
-      requireCapability: true,
-      expectedMethod
+      fences: state.fences,
+      expectedMethod,
+      fenceName: "identity",
+      actorKinds
     });
-    if (!actorKinds.includes(request.actor.kind)) {
-      throw new OrchestrationError({
-        code: "FORBIDDEN",
-        message: `actor kind '${request.actor.kind}' cannot call ${expectedMethod}`,
-        retryable: false
-      });
-    }
-    const fence = request.fencingEpoch;
-    const current = state.fences.get(request.resource.uid) ?? 0;
-    if (fence < current) {
-      throw new OrchestrationError({
-        code: "STALE_EPOCH",
-        message: `stale identity fencing epoch ${fence}; current epoch is ${current}`,
-        retryable: false
-      });
-    }
-    state.fences.set(request.resource.uid, fence);
   }
   function ttl(payload, field, maximum) {
     if (payload === null || typeof payload !== "object") {
@@ -2683,34 +2693,11 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
     state.nextHandle += 1;
     return handle;
   }
-  function key(request, operation) {
-    return `${request.resource.uid}:${operation}:${request.idempotencyKey}`;
-  }
-  function stable6(value) {
-    if (value === void 0) return "undefined";
-    if (Array.isArray(value)) return `[${value.map(stable6).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-      return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([name, item]) => `${JSON.stringify(name)}:${stable6(item)}`).join(",")}}`;
-    }
-    return JSON.stringify(value) ?? typeof value;
-  }
   function previous(request, operation) {
-    const idempotency = key(request, operation);
-    const handle = state.idempotency.get(idempotency);
-    if (!handle) return void 0;
-    if (state.idempotencyFingerprints.get(idempotency) !== stable6(request.payload)) {
-      throw new OrchestrationError({
-        code: "CONFLICT",
-        message: `identity ${operation} idempotency key was reused with different input`,
-        retryable: false
-      });
-    }
-    return handle;
+    return findIdempotentDriverHandle(state, request, operation, "identity");
   }
   function remember(request, operation, handle) {
-    const idempotency = key(request, operation);
-    state.idempotency.set(idempotency, handle);
-    state.idempotencyFingerprints.set(idempotency, stable6(request.payload));
+    rememberIdempotentDriverHandle(state, request, operation, handle);
   }
   function assertActiveIdentity(identity) {
     if (identity.revoked) {
@@ -2754,7 +2741,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
       const ttlMs = ttl(request.payload, "ttlMs", maxSessionTtlMs);
       const existing = previous(request, "enroll");
       if (existing) {
-        return structuredClone(owned(
+        return structuredClone(getOwnedDriverValue(
           state.enrollments,
           existing,
           request.resource.uid,
@@ -2778,7 +2765,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
     },
     async challenge(request) {
       validate(request, "identity.challenge", ["controller", "admin"]);
-      const enrollment = owned(
+      const enrollment = getOwnedDriverValue(
         state.enrollments,
         requiredString4(request.payload, "enrollmentHandle"),
         request.resource.uid,
@@ -2791,7 +2778,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
       const ttlMs = ttl(request.payload, "ttlMs", maxChallengeTtlMs);
       const existing = previous(request, "challenge");
       if (existing) {
-        return structuredClone(owned(
+        return structuredClone(getOwnedDriverValue(
           state.challenges,
           existing,
           request.resource.uid,
@@ -2821,13 +2808,13 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
     },
     async attest(request) {
       validate(request, "identity.attest", ["controller", "verifier"]);
-      const challenge = owned(
+      const challenge = getOwnedDriverValue(
         state.challenges,
         requiredString4(request.payload, "challengeHandle"),
         request.resource.uid,
         "challenge"
       );
-      const enrollment = owned(
+      const enrollment = getOwnedDriverValue(
         state.enrollments,
         challenge.enrollmentHandle,
         request.resource.uid,
@@ -2863,7 +2850,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
       }
       const existing = previous(request, "attest");
       if (existing) {
-        return structuredClone(owned(
+        return structuredClone(getOwnedDriverValue(
           state.identities,
           existing,
           request.resource.uid,
@@ -2898,7 +2885,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
     },
     async issueSession(request) {
       validate(request, "identity.issue-session", ["controller", "admin"]);
-      const identity = owned(
+      const identity = getOwnedDriverValue(
         state.identities,
         requiredString4(request.payload, "identityHandle"),
         request.resource.uid,
@@ -2927,7 +2914,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
       const ttlMs = ttl(request.payload, "ttlMs", maxSessionTtlMs);
       const existing = previous(request, "issue-session");
       if (existing) {
-        return structuredClone(owned(
+        return structuredClone(getOwnedDriverValue(
           state.sessions,
           existing,
           request.resource.uid,
@@ -2951,7 +2938,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
     },
     async rotate(request) {
       validate(request, "identity.rotate", ["controller", "admin"]);
-      const identity = owned(
+      const identity = getOwnedDriverValue(
         state.identities,
         requiredString4(request.payload, "identityHandle"),
         request.resource.uid,
@@ -2968,7 +2955,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
       );
       const existing = previous(request, "rotate");
       if (existing) {
-        return structuredClone(owned(
+        return structuredClone(getOwnedDriverValue(
           state.identities,
           existing,
           request.resource.uid,
@@ -2996,7 +2983,7 @@ function createFakeIdentityAttestationManagementDriver(options = {}) {
     },
     async revoke(request) {
       validate(request, "identity.revoke", ["controller", "admin"]);
-      const identity = owned(
+      const identity = getOwnedDriverValue(
         state.identities,
         requiredString4(request.payload, "identityHandle"),
         request.resource.uid,
@@ -4063,12 +4050,12 @@ function createManagedCredentialBrokerAdapter(broker, options) {
           retryable: false
         });
       }
-      const stable6 = options.stableHandleFor?.(request) ?? stableHandle();
-      if (!stable6 || stable6.length > 2048) {
+      const stable = options.stableHandleFor?.(request) ?? stableHandle();
+      if (!stable || stable.length > 2048) {
         invalid6("credential stable handle is empty or too long");
       }
       if (options.handleStore) {
-        const adopted = await options.handleStore.get(stable6);
+        const adopted = await options.handleStore.get(stable);
         if (adopted) {
           const inspection = await broker.inspect(adopted.token);
           const exact = inspection.grantId === request.resource.uid && canonicalDriverValue(inspection.scope) === canonicalDriverValue({
@@ -4088,13 +4075,13 @@ function createManagedCredentialBrokerAdapter(broker, options) {
             });
           }
           const adoptedRecord = {
-            stableHandle: stable6,
+            stableHandle: stable,
             token: adopted.token,
             resourceUid: request.resource.uid,
             targetDriver: request.payload.targetDriver
           };
-          records.set(stable6, adoptedRecord);
-          await rememberIdempotency(key, request, stable6);
+          records.set(stable, adoptedRecord);
+          await rememberIdempotency(key, request, stable);
           return managed(adoptedRecord, inspection);
         }
       }
@@ -4110,7 +4097,7 @@ function createManagedCredentialBrokerAdapter(broker, options) {
         grantId: request.resource.uid
       });
       const record2 = {
-        stableHandle: stable6,
+        stableHandle: stable,
         token: issued.token,
         resourceUid: request.resource.uid,
         targetDriver: request.payload.targetDriver
@@ -5260,13 +5247,6 @@ function createFakeNetworkManagementState() {
     nextHandle: 1
   };
 }
-function stable2(value) {
-  if (Array.isArray(value)) return `[${value.map(stable2).join(",")}]`;
-  if (value !== null && typeof value === "object") {
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stable2(item)}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? typeof value;
-}
 function invalid7(message) {
   throw new OrchestrationError({ code: "INVALID", message, retryable: false });
 }
@@ -5467,31 +5447,15 @@ function createFakeNetworkManagementDriver(options = {}) {
     ...options.capabilities
   };
   function validate(request, method) {
-    assertDriverRequestEnvelope(request, {
+    return assertFencedDriverRequestEnvelope(request, {
       now,
+      fences: state.fences,
       requireRun: true,
-      requireFencing: true,
-      requireCapability: true,
-      expectedMethod: method
+      expectedMethod: method,
+      fenceName: "network",
+      actorKinds: ["controller", "admin"],
+      forbiddenMessage: () => "network lifecycle requires a controller or admin actor"
     });
-    if (request.actor.kind !== "controller" && request.actor.kind !== "admin") {
-      throw new OrchestrationError({
-        code: "FORBIDDEN",
-        message: "network lifecycle requires a controller or admin actor",
-        retryable: false
-      });
-    }
-    const fence = request.fencingEpoch;
-    const current = state.fences.get(request.resource.uid) ?? 0;
-    if (fence < current) {
-      throw new OrchestrationError({
-        code: "STALE_EPOCH",
-        message: `stale network fencing epoch ${fence}; current epoch is ${current}`,
-        retryable: false
-      });
-    }
-    state.fences.set(request.resource.uid, fence);
-    return fence;
   }
   function nextHandle(prefix) {
     const handle = `${prefix}:${state.nextHandle}`;
@@ -5555,7 +5519,7 @@ function createFakeNetworkManagementDriver(options = {}) {
   }
   function idempotent(request, operation) {
     const key = `${request.resource.uid}:${operation}:${request.idempotencyKey}`;
-    const fingerprint = stable2(request.payload);
+    const fingerprint = canonicalDriverValue(request.payload);
     const existing = state.idempotency.get(key);
     if (existing) {
       if (existing.fingerprint !== fingerprint) {
@@ -5572,7 +5536,7 @@ function createFakeNetworkManagementDriver(options = {}) {
   function remember(request, operation, resultHandle) {
     state.idempotency.set(
       `${request.resource.uid}:${operation}:${request.idempotencyKey}`,
-      { fingerprint: stable2(request.payload), resultHandle }
+      { fingerprint: canonicalDriverValue(request.payload), resultHandle }
     );
   }
   return {
@@ -6120,14 +6084,6 @@ function createFakeModelManagementState() {
     nextHandle: 1
   };
 }
-function stable3(value) {
-  if (value === void 0) return "undefined";
-  if (Array.isArray(value)) return `[${value.map(stable3).join(",")}]`;
-  if (value !== null && typeof value === "object") {
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stable3(item)}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? typeof value;
-}
 function invalid8(message) {
   throw new OrchestrationError({ code: "INVALID", message, retryable: false });
 }
@@ -6186,31 +6142,15 @@ function createFakeModelManagementDriver(options = {}) {
   };
   const active = /* @__PURE__ */ new Map();
   function validate(request, method) {
-    assertDriverRequestEnvelope(request, {
+    return assertFencedDriverRequestEnvelope(request, {
       now,
+      fences: state.fences,
       requireRun: true,
-      requireFencing: true,
-      requireCapability: true,
-      expectedMethod: method
+      expectedMethod: method,
+      fenceName: "model",
+      actorKinds: ["controller", "admin"],
+      forbiddenMessage: () => "model provider access requires a controller or admin actor"
     });
-    if (request.actor.kind !== "controller" && request.actor.kind !== "admin") {
-      throw new OrchestrationError({
-        code: "FORBIDDEN",
-        message: "model provider access requires a controller or admin actor",
-        retryable: false
-      });
-    }
-    const fence = request.fencingEpoch;
-    const current = state.fences.get(request.resource.uid) ?? 0;
-    if (fence < current) {
-      throw new OrchestrationError({
-        code: "STALE_EPOCH",
-        message: `stale model fencing epoch ${fence}; current epoch is ${current}`,
-        retryable: false
-      });
-    }
-    state.fences.set(request.resource.uid, fence);
-    return fence;
   }
   function modelFor(payload) {
     assertOnlyFields2(
@@ -6337,7 +6277,7 @@ function createFakeModelManagementDriver(options = {}) {
       const fence = validate(request, "model.generate");
       const model = modelFor(request.payload);
       await authorize(request, model);
-      const inputFingerprint = stable3({
+      const inputFingerprint = canonicalDriverValue({
         payload: request.payload,
         run: request.run,
         session: request.session,
@@ -6576,7 +6516,9 @@ function createModelManagementConformanceSuite(options) {
           );
           const first = await collect(driver, request);
           const second = await collect(driver, request);
-          if (stable3(first) !== stable3(second)) throw new Error("model generation did not replay");
+          if (canonicalDriverValue(first) !== canonicalDriverValue(second)) {
+            throw new Error("model generation did not replay");
+          }
           if (first.at(-1)?.type !== "done") throw new Error("model stream did not complete");
           let driftRejected = false;
           try {
@@ -6710,16 +6652,8 @@ function requiredString6(value, field) {
   if (value === null || typeof value !== "object" || typeof value[field] !== "string" || !value[field]) invalid9(`policy payload '${field}' is required`);
   return value[field];
 }
-function stable4(value) {
-  if (value === void 0) return "undefined";
-  if (Array.isArray(value)) return `[${value.map(stable4).join(",")}]`;
-  if (value !== null && typeof value === "object") {
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stable4(item)}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? typeof value;
-}
 async function digest2(value) {
-  const bytes = new TextEncoder().encode(stable4(value));
+  const bytes = new TextEncoder().encode(canonicalDriverValue(value));
   const result = await globalThis.crypto.subtle.digest("SHA-256", bytes);
   return `sha256:${[...new Uint8Array(result)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
@@ -6740,34 +6674,18 @@ function createFakePolicyApprovalManagementDriver(options = {}) {
     ]
   );
   function validate(request, expectedMethod, actorKinds) {
-    assertDriverRequestEnvelope(request, {
+    assertFencedDriverRequestEnvelope(request, {
       now,
-      requireFencing: true,
-      requireCapability: true,
-      expectedMethod
+      fences: state.fences,
+      expectedMethod,
+      fenceName: "policy",
+      actorKinds
     });
-    if (!actorKinds.includes(request.actor.kind)) {
-      throw new OrchestrationError({
-        code: "FORBIDDEN",
-        message: `actor kind '${request.actor.kind}' cannot call ${expectedMethod}`,
-        retryable: false
-      });
-    }
-    const epoch = request.fencingEpoch;
-    const current = state.fences.get(request.resource.uid) ?? 0;
-    if (epoch < current) {
-      throw new OrchestrationError({
-        code: "STALE_EPOCH",
-        message: `stale policy fencing epoch ${epoch}; current epoch is ${current}`,
-        retryable: false
-      });
-    }
-    state.fences.set(request.resource.uid, epoch);
   }
   function assertPolicyDigest(value) {
     if (!SHA2566.test(value)) invalid9("policyDigest must be a canonical sha256 digest");
   }
-  function owned2(handle, resourceUid) {
+  function owned(handle, resourceUid) {
     const decision = state.decisions.get(handle);
     if (!decision) {
       throw new OrchestrationError({
@@ -6787,18 +6705,14 @@ function createFakePolicyApprovalManagementDriver(options = {}) {
   }
   async function decide(request, operation, kind, outcome, policyDigest, reasons, obligations = [], approval) {
     assertPolicyDigest(policyDigest);
-    const key = `${request.resource.uid}:${operation}:${request.idempotencyKey}`;
-    const fingerprint = stable4(request.payload);
-    const previousHandle = state.idempotency.get(key);
+    const previousHandle = findIdempotentDriverHandle(
+      state,
+      request,
+      operation,
+      "policy"
+    );
     if (previousHandle) {
-      if (state.idempotencyFingerprints.get(key) !== fingerprint) {
-        throw new OrchestrationError({
-          code: "CONFLICT",
-          message: `policy ${operation} idempotency key was reused with different input`,
-          retryable: false
-        });
-      }
-      return structuredClone(owned2(previousHandle, request.resource.uid));
+      return structuredClone(owned(previousHandle, request.resource.uid));
     }
     const decision = {
       decisionHandle: `policy-decision:${state.nextHandle++}`,
@@ -6814,8 +6728,12 @@ function createFakePolicyApprovalManagementDriver(options = {}) {
       approval
     };
     state.decisions.set(decision.decisionHandle, decision);
-    state.idempotency.set(key, decision.decisionHandle);
-    state.idempotencyFingerprints.set(key, fingerprint);
+    rememberIdempotentDriverHandle(
+      state,
+      request,
+      operation,
+      decision.decisionHandle
+    );
     return structuredClone(decision);
   }
   return {
@@ -6888,7 +6806,7 @@ function createFakePolicyApprovalManagementDriver(options = {}) {
       }
       let approval;
       if (request.payload.approvalDecisionHandle) {
-        approval = owned2(request.payload.approvalDecisionHandle, request.resource.uid);
+        approval = owned(request.payload.approvalDecisionHandle, request.resource.uid);
       }
       const needsApproval = effect !== "read";
       const approvalValid = !needsApproval || approval?.kind === "approval" && approval.outcome === "allow" && approval.policyDigest === policyDigest && approval.approval?.subjectDigest === operationDigest && Date.parse(approval.approval.expiresAt) > now().getTime();
@@ -6936,7 +6854,7 @@ function createFakePolicyApprovalManagementDriver(options = {}) {
       if (!["allow", "deny"].includes(request.payload.outcome)) {
         invalid9("approval outcome must be allow or deny");
       }
-      const decision = owned2(handle, request.resource.uid);
+      const decision = owned(handle, request.resource.uid);
       if (decision.kind !== "approval") invalid9("decision is not an approval");
       if (decision.approval && Date.parse(decision.approval.expiresAt) <= now().getTime()) {
         decision.outcome = "deny";
@@ -6999,7 +6917,7 @@ function createFakePolicyApprovalManagementDriver(options = {}) {
         "verifier",
         "admin"
       ]);
-      const decision = owned2(
+      const decision = owned(
         requiredString6(request.payload, "decisionHandle"),
         request.resource.uid
       );
@@ -7236,6 +7154,7 @@ function createFakeStorageManagementState() {
     stages: /* @__PURE__ */ new Map(),
     publications: /* @__PURE__ */ new Map(),
     idempotency: /* @__PURE__ */ new Map(),
+    idempotencyFingerprints: /* @__PURE__ */ new Map(),
     fences: /* @__PURE__ */ new Map(),
     nextHandle: 1
   };
@@ -7263,32 +7182,18 @@ function createFakeStorageManagementDriver(options = {}) {
   const state = options.state ?? createFakeStorageManagementState();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   function validate(request, expectedMethod) {
-    assertDriverRequestEnvelope(request, {
+    return assertFencedDriverRequestEnvelope(request, {
       now,
-      requireFencing: true,
-      requireCapability: true,
-      expectedMethod
+      fences: state.fences,
+      expectedMethod,
+      fenceName: "storage"
     });
-    const fence = request.fencingEpoch;
-    const current = state.fences.get(request.resource.uid) ?? 0;
-    if (fence < current) {
-      throw new OrchestrationError({
-        code: "STALE_EPOCH",
-        message: `stale storage fencing epoch ${fence}; current epoch is ${current}`,
-        retryable: false
-      });
-    }
-    state.fences.set(request.resource.uid, fence);
-    return fence;
   }
   function nextHandle(prefix) {
     const handle = `${prefix}:${state.nextHandle}`;
     state.nextHandle += 1;
     return handle;
   }
-  function operationKey(request, operation) {
-    return `${request.resource.uid}:${operation}:${request.idempotencyKey}`;
-  }
   function getVolume(handle, resourceUid) {
     const record2 = state.volumes.get(handle);
     if (!record2 || record2.volume.phase === "Deleted") {
@@ -7307,27 +7212,8 @@ function createFakeStorageManagementDriver(options = {}) {
     }
     return record2;
   }
-  function owned2(collection, handle, resourceUid, kind) {
-    const value = collection.get(handle);
-    if (!value) {
-      throw new OrchestrationError({
-        code: "NOT_FOUND",
-        message: `${kind} handle '${handle}' was not found`,
-        retryable: false
-      });
-    }
-    if (value.resourceUid !== resourceUid) {
-      throw new OrchestrationError({
-        code: "FORBIDDEN",
-        message: `${kind} handle '${handle}' belongs to another resource`,
-        retryable: false
-      });
-    }
-    return value;
-  }
   function createVolume(request, capacityBytes, accessMode, replicaCount, operation) {
-    const key = operationKey(request, operation);
-    const existing = state.idempotency.get(key);
+    const existing = findIdempotentDriverHandle(state, request, operation, "storage");
     if (existing) return getVolume(existing, request.resource.uid).volume;
     const volume = {
       volumeHandle: nextHandle("volume"),
@@ -7338,7 +7224,7 @@ function createFakeStorageManagementDriver(options = {}) {
       phase: "Available"
     };
     state.volumes.set(volume.volumeHandle, { volume, desiredReplicas: replicaCount });
-    state.idempotency.set(key, volume.volumeHandle);
+    rememberIdempotentDriverHandle(state, request, operation, volume.volumeHandle);
     return volume;
   }
   return {
@@ -7394,9 +7280,10 @@ function createFakeStorageManagementDriver(options = {}) {
       validate(request, "storage.snapshot");
       const volumeHandle = requiredString7(request.payload, "volumeHandle");
       getVolume(volumeHandle, request.resource.uid);
-      const key = operationKey(request, "snapshot");
-      const existing = state.idempotency.get(key);
-      if (existing) return owned2(state.snapshots, existing, request.resource.uid, "snapshot");
+      const existing = findIdempotentDriverHandle(state, request, "snapshot", "storage");
+      if (existing) {
+        return getOwnedDriverValue(state.snapshots, existing, request.resource.uid, "snapshot");
+      }
       const snapshot = {
         snapshotHandle: nextHandle("snapshot"),
         volumeHandle,
@@ -7404,12 +7291,12 @@ function createFakeStorageManagementDriver(options = {}) {
         createdAt: now().toISOString()
       };
       state.snapshots.set(snapshot.snapshotHandle, snapshot);
-      state.idempotency.set(key, snapshot.snapshotHandle);
+      rememberIdempotentDriverHandle(state, request, "snapshot", snapshot.snapshotHandle);
       return snapshot;
     },
     async restoreSnapshot(request) {
       validate(request, "storage.restore");
-      const snapshot = owned2(
+      const snapshot = getOwnedDriverValue(
         state.snapshots,
         requiredString7(request.payload, "snapshotHandle"),
         request.resource.uid,
@@ -7472,9 +7359,10 @@ function createFakeStorageManagementDriver(options = {}) {
       validate(request, "storage.backup");
       const volumeHandle = requiredString7(request.payload, "volumeHandle");
       getVolume(volumeHandle, request.resource.uid);
-      const key = operationKey(request, "backup");
-      const existing = state.idempotency.get(key);
-      if (existing) return owned2(state.backups, existing, request.resource.uid, "backup");
+      const existing = findIdempotentDriverHandle(state, request, "backup", "storage");
+      if (existing) {
+        return getOwnedDriverValue(state.backups, existing, request.resource.uid, "backup");
+      }
       const backup = {
         backupHandle: nextHandle("backup"),
         volumeHandle,
@@ -7482,7 +7370,7 @@ function createFakeStorageManagementDriver(options = {}) {
         createdAt: now().toISOString()
       };
       state.backups.set(backup.backupHandle, backup);
-      state.idempotency.set(key, backup.backupHandle);
+      rememberIdempotentDriverHandle(state, request, "backup", backup.backupHandle);
       return backup;
     },
     async stage(request) {
@@ -7490,9 +7378,10 @@ function createFakeStorageManagementDriver(options = {}) {
       const volumeHandle = requiredString7(request.payload, "volumeHandle");
       getVolume(volumeHandle, request.resource.uid);
       const nodeId = requiredString7(request.payload, "nodeId");
-      const key = operationKey(request, "stage");
-      const existing = state.idempotency.get(key);
-      if (existing) return owned2(state.stages, existing, request.resource.uid, "stage");
+      const existing = findIdempotentDriverHandle(state, request, "stage", "storage");
+      if (existing) {
+        return getOwnedDriverValue(state.stages, existing, request.resource.uid, "stage");
+      }
       const stage = {
         stageHandle: nextHandle("stage"),
         volumeHandle,
@@ -7500,12 +7389,12 @@ function createFakeStorageManagementDriver(options = {}) {
         nodeId
       };
       state.stages.set(stage.stageHandle, stage);
-      state.idempotency.set(key, stage.stageHandle);
+      rememberIdempotentDriverHandle(state, request, "stage", stage.stageHandle);
       return stage;
     },
     async publish(request) {
       validate(request, "storage.publish");
-      const stage = owned2(
+      const stage = getOwnedDriverValue(
         state.stages,
         requiredString7(request.payload, "stageHandle"),
         request.resource.uid,
@@ -7514,10 +7403,14 @@ function createFakeStorageManagementDriver(options = {}) {
       getVolume(stage.volumeHandle, request.resource.uid);
       const workloadUid = requiredString7(request.payload, "workloadUid");
       if (typeof request.payload.readOnly !== "boolean") invalid10("publish readOnly is required");
-      const key = operationKey(request, "publish");
-      const existing = state.idempotency.get(key);
+      const existing = findIdempotentDriverHandle(state, request, "publish", "storage");
       if (existing) {
-        return owned2(state.publications, existing, request.resource.uid, "publication");
+        return getOwnedDriverValue(
+          state.publications,
+          existing,
+          request.resource.uid,
+          "publication"
+        );
       }
       const publication = {
         publishHandle: nextHandle("publication"),
@@ -7527,7 +7420,7 @@ function createFakeStorageManagementDriver(options = {}) {
         readOnly: request.payload.readOnly
       };
       state.publications.set(publication.publishHandle, publication);
-      state.idempotency.set(key, publication.publishHandle);
+      rememberIdempotentDriverHandle(state, request, "publish", publication.publishHandle);
       return publication;
     },
     async unpublish(request) {
@@ -7535,7 +7428,7 @@ function createFakeStorageManagementDriver(options = {}) {
       const handle = requiredString7(request.payload, "publishHandle");
       const publication = state.publications.get(handle);
       if (!publication) return;
-      owned2(state.publications, handle, request.resource.uid, "publication");
+      getOwnedDriverValue(state.publications, handle, request.resource.uid, "publication");
       state.publications.delete(handle);
     },
     async unstage(request) {
@@ -7543,7 +7436,7 @@ function createFakeStorageManagementDriver(options = {}) {
       const handle = requiredString7(request.payload, "stageHandle");
       const stage = state.stages.get(handle);
       if (!stage) return;
-      owned2(state.stages, handle, request.resource.uid, "stage");
+      getOwnedDriverValue(state.stages, handle, request.resource.uid, "stage");
       if ([...state.publications.values()].some(
         (publication) => publication.stageHandle === handle
       )) {
@@ -7557,13 +7450,13 @@ function createFakeStorageManagementDriver(options = {}) {
     },
     async getStats(request) {
       validate(request, "storage.stats");
-      const publication = owned2(
+      const publication = getOwnedDriverValue(
         state.publications,
         requiredString7(request.payload, "publishHandle"),
         request.resource.uid,
         "publication"
       );
-      const stage = owned2(
+      const stage = getOwnedDriverValue(
         state.stages,
         publication.stageHandle,
         request.resource.uid,
@@ -7789,18 +7682,10 @@ function requiredString8(value, field, maximum = 256) {
   if (!result || result.length > maximum) invalid11(`tool payload '${field}' is invalid`);
   return result;
 }
-function stable5(value) {
-  if (value === void 0) return "undefined";
-  if (Array.isArray(value)) return `[${value.map(stable5).join(",")}]`;
-  if (value !== null && typeof value === "object") {
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stable5(item)}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? typeof value;
-}
 async function digest3(value) {
   const result = await globalThis.crypto.subtle.digest(
     "SHA-256",
-    new TextEncoder().encode(stable5(value))
+    new TextEncoder().encode(canonicalDriverValue(value))
   );
   return `sha256:${[...new Uint8Array(result)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
@@ -7883,37 +7768,21 @@ function createFakeToolManagementDriver(options = {}) {
         if (!SHA2567.test(descriptor.schemaDigest) || descriptor.schemaDigest !== actualSchemaDigest || !descriptor.name || !descriptor.version || !descriptor.targets.length) invalid11(`tool catalog descriptor '${descriptor.name}' is invalid`);
       }
       return digest3(
-        tools.map(descriptorInput).sort((left, right) => stable5(left).localeCompare(stable5(right)))
+        tools.map(descriptorInput).sort((left, right) => canonicalDriverValue(left).localeCompare(canonicalDriverValue(right)))
       );
     })();
     return catalogDigestPromise;
   }
   function validate(request, expectedMethod, actorKinds = ["controller"]) {
-    assertDriverRequestEnvelope(request, {
+    assertFencedDriverRequestEnvelope(request, {
       now,
-      requireFencing: true,
-      requireCapability: true,
-      expectedMethod
+      fences: state.fences,
+      expectedMethod,
+      fenceName: "tool",
+      actorKinds
     });
-    if (!actorKinds.includes(request.actor.kind)) {
-      throw new OrchestrationError({
-        code: "FORBIDDEN",
-        message: `actor kind '${request.actor.kind}' cannot call ${expectedMethod}`,
-        retryable: false
-      });
-    }
-    const epoch = request.fencingEpoch;
-    const current = state.fences.get(request.resource.uid) ?? 0;
-    if (epoch < current) {
-      throw new OrchestrationError({
-        code: "STALE_EPOCH",
-        message: `stale tool fencing epoch ${epoch}; current epoch is ${current}`,
-        retryable: false
-      });
-    }
-    state.fences.set(request.resource.uid, epoch);
   }
-  function owned2(collection, handle, resourceUid, kind) {
+  function owned(collection, handle, resourceUid, kind) {
     const value = collection.get(handle);
     if (!value) {
       throw new OrchestrationError({
@@ -7938,21 +7807,10 @@ function createFakeToolManagementDriver(options = {}) {
     return `${prefix}:${state.nextHandle++}`;
   }
   function idempotency(request, operation) {
-    const key = `${request.resource.uid}:${operation}:${request.idempotencyKey}`;
-    const previous = state.idempotency.get(key);
-    if (previous && state.idempotencyFingerprints.get(key) !== stable5(request.payload)) {
-      throw new OrchestrationError({
-        code: "CONFLICT",
-        message: `tool ${operation} idempotency key was reused with different input`,
-        retryable: false
-      });
-    }
-    return previous;
+    return findIdempotentDriverHandle(state, request, operation, "tool");
   }
   function remember(request, operation, handle) {
-    const key = `${request.resource.uid}:${operation}:${request.idempotencyKey}`;
-    state.idempotency.set(key, handle);
-    state.idempotencyFingerprints.set(key, stable5(request.payload));
+    rememberIdempotentDriverHandle(state, request, operation, handle);
   }
   async function* defaultExecutor(descriptor, target, arguments_) {
     yield JSON.stringify({ tool: descriptor.name, target, arguments: arguments_ });
@@ -8035,7 +7893,7 @@ function createFakeToolManagementDriver(options = {}) {
       if (request.payload.operationIdempotencyKey && !descriptor.supportsIdempotency) invalid11("tool does not support operation idempotency");
       const previous = idempotency(request, "prepare");
       if (previous) {
-        return structuredClone(owned2(
+        return structuredClone(owned(
           state.preparations,
           previous,
           request.resource.uid,
@@ -8060,7 +7918,7 @@ function createFakeToolManagementDriver(options = {}) {
     },
     async authorize(request) {
       validate(request, "tool.authorize", ["controller", "admin"]);
-      const preparation = owned2(
+      const preparation = owned(
         state.preparations,
         requiredString8(request.payload, "preparationHandle"),
         request.resource.uid,
@@ -8091,7 +7949,7 @@ function createFakeToolManagementDriver(options = {}) {
       }
       const previous = idempotency(request, "authorize");
       if (previous) {
-        return structuredClone(owned2(
+        return structuredClone(owned(
           state.authorizations,
           previous,
           request.resource.uid,
@@ -8113,13 +7971,13 @@ function createFakeToolManagementDriver(options = {}) {
     },
     async *invoke(request, invokeOptions = {}) {
       validate(request, "tool.invoke");
-      const preparation = owned2(
+      const preparation = owned(
         state.preparations,
         requiredString8(request.payload, "preparationHandle"),
         request.resource.uid,
         "tool preparation"
       );
-      const authorization = owned2(
+      const authorization = owned(
         state.authorizations,
         requiredString8(request.payload, "authorizationHandle"),
         request.resource.uid,
@@ -8139,7 +7997,7 @@ function createFakeToolManagementDriver(options = {}) {
       }
       const previous = idempotency(request, "invoke");
       if (previous) {
-        const execution2 = owned2(
+        const execution2 = owned(
           state.executions,
           previous,
           request.resource.uid,
@@ -8244,14 +8102,14 @@ function createFakeToolManagementDriver(options = {}) {
     },
     async reconcileUnknownEffect(request) {
       validate(request, "tool.reconcile-unknown", ["controller", "verifier", "admin"]);
-      const execution = owned2(
+      const execution = owned(
         state.executions,
         requiredString8(request.payload, "executionHandle"),
         request.resource.uid,
         "tool execution"
       );
       if (execution.phase !== "Unknown") return structuredClone(execution);
-      const preparation = owned2(
+      const preparation = owned(
         state.preparations,
         execution.preparationHandle,
         request.resource.uid,
@@ -8277,14 +8135,14 @@ function createFakeToolManagementDriver(options = {}) {
     },
     async collectEvidence(request) {
       validate(request, "tool.collect-evidence", ["controller", "verifier", "admin"]);
-      const execution = owned2(
+      const execution = owned(
         state.executions,
         requiredString8(request.payload, "executionHandle"),
         request.resource.uid,
         "tool execution"
       );
       const descriptor = tool(
-        owned2(
+        owned(
           state.preparations,
           execution.preparationHandle,
           request.resource.uid,
@@ -8294,7 +8152,7 @@ function createFakeToolManagementDriver(options = {}) {
       if (!descriptor?.supportsEvidence) invalid11("tool does not support evidence");
       const previous = idempotency(request, "evidence");
       if (previous) {
-        return structuredClone(owned2(
+        return structuredClone(owned(
           state.evidence,
           previous,
           request.resource.uid,
@@ -8315,14 +8173,14 @@ function createFakeToolManagementDriver(options = {}) {
     },
     async cleanup(request) {
       validate(request, "tool.cleanup");
-      const preparation = owned2(
+      const preparation = owned(
         state.preparations,
         requiredString8(request.payload, "preparationHandle"),
         request.resource.uid,
         "tool preparation"
       );
       if (request.payload.executionHandle) {
-        const execution = owned2(
+        const execution = owned(
           state.executions,
           request.payload.executionHandle,
           request.resource.uid,
@@ -8481,7 +8339,7 @@ function createToolManagementConformanceSuite(options) {
             { executionHandle: first[0].executionHandle },
             "inspect-invoke"
           ));
-          if (!first.at(-1)?.final || stable5(first) !== stable5(replay) || execution?.phase !== "Completed") throw new Error("tool streaming or retry did not converge");
+          if (!first.at(-1)?.final || canonicalDriverValue(first) !== canonicalDriverValue(replay) || execution?.phase !== "Completed") throw new Error("tool streaming or retry did not converge");
         }
       },
       {