open-multi-agent-kit 0.99.0 → 1.2.0

package/dist/commands/neo-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"neo-cli.js","sourceRoot":"","sources":["../../src/commands/neo-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS1D,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,IAAuB,EAAE,OAAsB,EAAU;IAClF,MAAM,CAAC,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC;QACJ,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI;gBACJ,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;aAC9F,CAAC,CAAC,CAAC;YACJ,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CACb;gBACC,MAAM,EAAE,QAAQ;gBAChB,MAAM;gBACN,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,EAAE;gBAClF,IAAI,EAAE,oGAAoG;aAC1G,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;YACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACV,CAAC;QACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACzB,IACC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAClD,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,UAAU,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CACb;oBACC,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;oBACtC,OAAO;oBACP,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC;oBAChC,QAAQ,EACP,+KAA+K;iBAChL,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;gBACF,OAAO,CAAC,CAAC;YACV,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CACb;gBACC,MAAM,EAAE,0BAA0B;gBAClC,MAAM;gBACN,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,uKAAuK;aAC7K,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;YACF,OAAO,CAAC,CAAC;QACV,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC9G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAC3G,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;AAAA,CACD","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { NEO_MCP_PRESETS, NEO_SKILL_NAMES, neoMcpConfig, selectNeoMcpPresets } from \"../core/neo/catalog.ts\";\nimport { createNeoMcpConfig } from \"../core/neo/setup.ts\";\n\nexport interface NeoCliContext {\n\treadonly packageDir: string;\n\treadonly cwd: string;\n\treadonly home: string;\n\treadonly output: (text: string) => void;\n}\n\n/** Local, keyless distribution/setup commands. Never starts a server or a browser. */\nexport function runNeoCli(args: readonly string[], context: NeoCliContext): number {\n\tconst [command = \"list\", ...rest] = args;\n\ttry {\n\t\tif (command === \"list\" && rest.length === 0) {\n\t\t\tconst skills = NEO_SKILL_NAMES.map((name) => ({\n\t\t\t\tname,\n\t\t\t\tpackaged: existsSync(join(context.packageDir, \"resources\", \"neo\", \"skills\", name, \"SKILL.md\")),\n\t\t\t}));\n\t\t\tcontext.output(\n\t\t\t\tJSON.stringify(\n\t\t\t\t\t{\n\t\t\t\t\t\tbundle: \"neo-v1\",\n\t\t\t\t\t\tskills,\n\t\t\t\t\t\tmcp: { offered: NEO_MCP_PRESETS, connected: null, connectionStatus: \"not_probed\" },\n\t\t\t\t\t\tnote: \"Packaged does not mean selected. Offered does not mean installed, enabled, connected, or approved.\",\n\t\t\t\t\t},\n\t\t\t\t\tnull,\n\t\t\t\t\t2,\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn skills.every((skill) => skill.packaged) ? 0 : 1;\n\t\t}\n\t\tif (command === \"mcp-config\") {\n\t\t\tcontext.output(JSON.stringify(neoMcpConfig(rest, false), null, 2));\n\t\t\treturn 0;\n\t\t}\n\t\tif (command === \"setup\") {\n\t\t\tif (\n\t\t\t\trest.filter((arg) => arg === \"--apply\").length > 1 ||\n\t\t\t\trest.filter((arg) => arg === \"--global\").length > 1\n\t\t\t) {\n\t\t\t\tthrow new Error(\"Duplicate setup flag\");\n\t\t\t}\n\t\t\tconst apply = rest.includes(\"--apply\");\n\t\t\tconst root = rest.includes(\"--global\") ? context.home : context.cwd;\n\t\t\tconst ids = rest.filter((arg) => arg !== \"--apply\" && arg !== \"--global\");\n\t\t\tconst presets = selectNeoMcpPresets(ids);\n\t\t\tif (!apply) {\n\t\t\t\tcontext.output(\n\t\t\t\t\tJSON.stringify(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tstatus: \"dry_run\",\n\t\t\t\t\t\t\ttarget: join(root, \".omk\", \"mcp.json\"),\n\t\t\t\t\t\t\tpresets,\n\t\t\t\t\t\t\tconfig: neoMcpConfig(ids, false),\n\t\t\t\t\t\t\tapproval:\n\t\t\t\t\t\t\t\t\"--apply creates enabled entries. On the next OMK startup npx may download and execute the pinned servers, which can access the network. No server is started by this command.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t\tnull,\n\t\t\t\t\t\t2,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn 0;\n\t\t\t}\n\t\t\tconst target = createNeoMcpConfig(root, ids);\n\t\t\tcontext.output(\n\t\t\t\tJSON.stringify(\n\t\t\t\t\t{\n\t\t\t\t\t\tstatus: \"configured_not_connected\",\n\t\t\t\t\t\ttarget,\n\t\t\t\t\t\tpresets: ids,\n\t\t\t\t\t\tnext: \"Restart OMK, inspect the MCP connection/tool roster, and run a read-only health check before acting. Existing .omk/mcp.json in a project can override global entries.\",\n\t\t\t\t\t},\n\t\t\t\t\tnull,\n\t\t\t\t\t2,\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn 0;\n\t\t}\n\t\tthrow new Error(\"Usage: omk neo [list | mcp-config <presets...> | setup <presets...> [--global] [--apply]]\");\n\t} catch (error) {\n\t\tcontext.output(\n\t\t\tJSON.stringify({ status: \"blocked\", error: error instanceof Error ? error.message : \"Neo command failed\" }),\n\t\t);\n\t\treturn 1;\n\t}\n}\n"]}

package/dist/coordination/awareness.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Change awareness: what a change invalidates, and who may proceed next.
+ *
+ * Both functions are deliberately conservative. Invalidation treats an
+ * unmapped dependent as affected, because "we have no edge for it" is not
+ * evidence that it is unaffected. Frontier admission lets an unrelated
+ * follower pass a blocked leader, but never lets a later request that
+ * conflicts with an older waiting one jump ahead of it.
+ */
+import type { ResourceClaim } from "./types.ts";
+export interface WaitingRequest {
+    readonly requestId: string;
+    readonly claims: readonly ResourceClaim[];
+}
+/**
+ * Transitive closure over reverse dependencies.
+ *
+ * `unknownDependents` are nodes whose dependencies could not be resolved; they
+ * join the affected set rather than being assumed safe. Reaching a fixpoint
+ * terminates on cycles because the set only grows and is bounded by the graph.
+ */
+export declare function invalidate(dependencies: Readonly<Record<string, readonly string[]>>, changed: readonly string[], unknownDependents?: readonly string[]): Set<string>;
+/**
+ * Requests admissible right now, in queue order.
+ *
+ * A request is admitted only when it conflicts neither with the active claims
+ * nor with any earlier waiting request. Accumulating earlier claims — whether
+ * or not they were admitted — is what stops a stream of later readers from
+ * starving an older writer. Capacity fairness is not modelled here.
+ */
+export declare function admissibleFrontier(waiting: readonly WaitingRequest[], active: readonly ResourceClaim[]): string[];
+//# sourceMappingURL=awareness.d.ts.map

package/dist/coordination/awareness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"awareness.d.ts","sourceRoot":"","sources":["../../src/coordination/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACzB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACzD,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACvC,GAAG,CAAC,MAAM,CAAC,CAab;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,EAAE,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,EAAE,CAYjH","sourcesContent":["/**\n * Change awareness: what a change invalidates, and who may proceed next.\n *\n * Both functions are deliberately conservative. Invalidation treats an\n * unmapped dependent as affected, because \"we have no edge for it\" is not\n * evidence that it is unaffected. Frontier admission lets an unrelated\n * follower pass a blocked leader, but never lets a later request that\n * conflicts with an older waiting one jump ahead of it.\n */\n\nimport { claimSetsConflict } from \"./resource.ts\";\nimport type { ResourceClaim } from \"./types.ts\";\n\nexport interface WaitingRequest {\n\treadonly requestId: string;\n\treadonly claims: readonly ResourceClaim[];\n}\n\n/**\n * Transitive closure over reverse dependencies.\n *\n * `unknownDependents` are nodes whose dependencies could not be resolved; they\n * join the affected set rather than being assumed safe. Reaching a fixpoint\n * terminates on cycles because the set only grows and is bounded by the graph.\n */\nexport function invalidate(\n\tdependencies: Readonly<Record<string, readonly string[]>>,\n\tchanged: readonly string[],\n\tunknownDependents: readonly string[] = [],\n): Set<string> {\n\tconst affected = new Set<string>([...changed, ...unknownDependents]);\n\tfor (;;) {\n\t\tlet grew = false;\n\t\tfor (const [node, deps] of Object.entries(dependencies)) {\n\t\t\tif (affected.has(node)) continue;\n\t\t\tif (deps.some((dep) => affected.has(dep))) {\n\t\t\t\taffected.add(node);\n\t\t\t\tgrew = true;\n\t\t\t}\n\t\t}\n\t\tif (!grew) return affected;\n\t}\n}\n\n/**\n * Requests admissible right now, in queue order.\n *\n * A request is admitted only when it conflicts neither with the active claims\n * nor with any earlier waiting request. Accumulating earlier claims — whether\n * or not they were admitted — is what stops a stream of later readers from\n * starving an older writer. Capacity fairness is not modelled here.\n */\nexport function admissibleFrontier(waiting: readonly WaitingRequest[], active: readonly ResourceClaim[]): string[] {\n\tconst chosen: string[] = [];\n\tconst reserved: ResourceClaim[] = [...active];\n\tconst earlier: ResourceClaim[] = [];\n\tfor (const request of waiting) {\n\t\tif (!claimSetsConflict(request.claims, reserved) && !claimSetsConflict(request.claims, earlier)) {\n\t\t\tchosen.push(request.requestId);\n\t\t\treserved.push(...request.claims);\n\t\t}\n\t\tearlier.push(...request.claims);\n\t}\n\treturn chosen;\n}\n"]}

package/dist/coordination/awareness.js

@@ -0,0 +1,55 @@
+/**
+ * Change awareness: what a change invalidates, and who may proceed next.
+ *
+ * Both functions are deliberately conservative. Invalidation treats an
+ * unmapped dependent as affected, because "we have no edge for it" is not
+ * evidence that it is unaffected. Frontier admission lets an unrelated
+ * follower pass a blocked leader, but never lets a later request that
+ * conflicts with an older waiting one jump ahead of it.
+ */
+import { claimSetsConflict } from "./resource.js";
+/**
+ * Transitive closure over reverse dependencies.
+ *
+ * `unknownDependents` are nodes whose dependencies could not be resolved; they
+ * join the affected set rather than being assumed safe. Reaching a fixpoint
+ * terminates on cycles because the set only grows and is bounded by the graph.
+ */
+export function invalidate(dependencies, changed, unknownDependents = []) {
+    const affected = new Set([...changed, ...unknownDependents]);
+    for (;;) {
+        let grew = false;
+        for (const [node, deps] of Object.entries(dependencies)) {
+            if (affected.has(node))
+                continue;
+            if (deps.some((dep) => affected.has(dep))) {
+                affected.add(node);
+                grew = true;
+            }
+        }
+        if (!grew)
+            return affected;
+    }
+}
+/**
+ * Requests admissible right now, in queue order.
+ *
+ * A request is admitted only when it conflicts neither with the active claims
+ * nor with any earlier waiting request. Accumulating earlier claims — whether
+ * or not they were admitted — is what stops a stream of later readers from
+ * starving an older writer. Capacity fairness is not modelled here.
+ */
+export function admissibleFrontier(waiting, active) {
+    const chosen = [];
+    const reserved = [...active];
+    const earlier = [];
+    for (const request of waiting) {
+        if (!claimSetsConflict(request.claims, reserved) && !claimSetsConflict(request.claims, earlier)) {
+            chosen.push(request.requestId);
+            reserved.push(...request.claims);
+        }
+        earlier.push(...request.claims);
+    }
+    return chosen;
+}
+//# sourceMappingURL=awareness.js.map

package/dist/coordination/awareness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awareness.js","sourceRoot":"","sources":["../../src/coordination/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAQlD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACzB,YAAyD,EACzD,OAA0B,EAC1B,iBAAiB,GAAsB,EAAE,EAC3B;IACd,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC;QACT,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,GAAG,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;IAC5B,CAAC;AAAA,CACD;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC,EAAE,MAAgC,EAAY;IAClH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAoB,CAAC,GAAG,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACjG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd","sourcesContent":["/**\n * Change awareness: what a change invalidates, and who may proceed next.\n *\n * Both functions are deliberately conservative. Invalidation treats an\n * unmapped dependent as affected, because \"we have no edge for it\" is not\n * evidence that it is unaffected. Frontier admission lets an unrelated\n * follower pass a blocked leader, but never lets a later request that\n * conflicts with an older waiting one jump ahead of it.\n */\n\nimport { claimSetsConflict } from \"./resource.ts\";\nimport type { ResourceClaim } from \"./types.ts\";\n\nexport interface WaitingRequest {\n\treadonly requestId: string;\n\treadonly claims: readonly ResourceClaim[];\n}\n\n/**\n * Transitive closure over reverse dependencies.\n *\n * `unknownDependents` are nodes whose dependencies could not be resolved; they\n * join the affected set rather than being assumed safe. Reaching a fixpoint\n * terminates on cycles because the set only grows and is bounded by the graph.\n */\nexport function invalidate(\n\tdependencies: Readonly<Record<string, readonly string[]>>,\n\tchanged: readonly string[],\n\tunknownDependents: readonly string[] = [],\n): Set<string> {\n\tconst affected = new Set<string>([...changed, ...unknownDependents]);\n\tfor (;;) {\n\t\tlet grew = false;\n\t\tfor (const [node, deps] of Object.entries(dependencies)) {\n\t\t\tif (affected.has(node)) continue;\n\t\t\tif (deps.some((dep) => affected.has(dep))) {\n\t\t\t\taffected.add(node);\n\t\t\t\tgrew = true;\n\t\t\t}\n\t\t}\n\t\tif (!grew) return affected;\n\t}\n}\n\n/**\n * Requests admissible right now, in queue order.\n *\n * A request is admitted only when it conflicts neither with the active claims\n * nor with any earlier waiting request. Accumulating earlier claims — whether\n * or not they were admitted — is what stops a stream of later readers from\n * starving an older writer. Capacity fairness is not modelled here.\n */\nexport function admissibleFrontier(waiting: readonly WaitingRequest[], active: readonly ResourceClaim[]): string[] {\n\tconst chosen: string[] = [];\n\tconst reserved: ResourceClaim[] = [...active];\n\tconst earlier: ResourceClaim[] = [];\n\tfor (const request of waiting) {\n\t\tif (!claimSetsConflict(request.claims, reserved) && !claimSetsConflict(request.claims, earlier)) {\n\t\t\tchosen.push(request.requestId);\n\t\t\treserved.push(...request.claims);\n\t\t}\n\t\tearlier.push(...request.claims);\n\t}\n\treturn chosen;\n}\n"]}

package/dist/coordination/broker.d.ts

@@ -0,0 +1,79 @@
+/**
+ * In-process admission broker for parallel sessions.
+ *
+ * Safety property: a grant that may still own a live external effect keeps
+ * holding its claims. Expiry, cancellation and authority restart are
+ * authorization events; only a trusted supervisor reporting termination frees
+ * the claims. Treating a lapsed deadline as "the effect stopped" is exactly how
+ * two sessions end up writing the same path.
+ *
+ * Bounded reference semantics: a single trusted state machine, canonical claim
+ * keys, and every shared effect crossing this broker. No IPC, no OS fencing,
+ * no persistence — those belong to the supervisor this broker reports to.
+ */
+import type { EffectState, GrantToken, ResourceClaim, Sequence } from "./types.ts";
+export interface AdmissionBrokerOptions {
+    /** Total admissible weight of concurrently active grants. */
+    readonly capacity: number;
+}
+export interface AcquireInput {
+    readonly sessionId: string;
+    readonly incarnation: Sequence | string;
+    readonly claims: readonly ResourceClaim[];
+    readonly now: number;
+    readonly ttl: number;
+    readonly weight?: number;
+}
+export interface StartInput {
+    readonly token: GrantToken;
+    readonly now: number;
+    /** Claims the operation actually resolved to after approval hooks. */
+    readonly actualClaims: readonly ResourceClaim[];
+}
+export declare class AdmissionBroker {
+    private readonly capacity;
+    private authorityEpoch;
+    private grantCounter;
+    private readonly incarnations;
+    private readonly grants;
+    constructor(options: AdmissionBrokerOptions);
+    /**
+     * Announce a session incarnation. Re-registering does not free the previous
+     * incarnation's grants: a restarted session cannot assume its predecessor's
+     * effects stopped.
+     */
+    register(sessionId: string): Sequence;
+    /** Grants still holding their claims, including quarantined ones. */
+    private activeGrants;
+    acquire(input: AcquireInput): GrantToken | null;
+    /** Resolve a token that is still authoritative for new action. */
+    private authoritative;
+    /** Resolve a token for settlement only; accepts superseded epochs. */
+    private settleable;
+    /**
+     * Bind an effect to its reservation. The actual claims must equal the
+     * reserved set exactly — an approval hook that widened scope has to be
+     * re-admitted, not silently allowed to run under the old grant.
+     */
+    start(input: StartInput): boolean;
+    /**
+     * Apply lapsed authorization deadlines. A reservation that never started is
+     * released; a running effect is quarantined and keeps its claims.
+     */
+    expire(now: number): void;
+    /** Withdraw authorization. Requested cancellation is not observed termination. */
+    cancel(token: GrantToken): boolean;
+    /**
+     * Trusted supervisor event: this exact effect is gone. Accepted for
+     * superseded epochs so a restarted authority can still settle what the
+     * previous one started, never to authorize new work.
+     */
+    confirmTerminated(token: GrantToken): boolean;
+    /** Fence the authority. Live effects stay quarantined until confirmed. */
+    restart(): void;
+    stateOf(token: GrantToken): EffectState | undefined;
+    claimsOf(token: GrantToken): readonly ResourceClaim[];
+    /** Invariant: active grants fit capacity and never pairwise conflict. */
+    isSafe(): boolean;
+}
+//# sourceMappingURL=broker.d.ts.map

package/dist/coordination/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../src/coordination/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAYnF,MAAM,WAAW,sBAAsB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,SAAS,aAAa,EAAE,CAAC;CAChD;AAQD,qBAAa,eAAe;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,cAAc,CAA2B;IACjD,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAEnD,YAAY,OAAO,EAAE,sBAAsB,EAG1C;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAOpC;IAED,qEAAqE;IACrE,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,UAAU,GAAG,IAAI,CAuC9C;IAED,kEAAkE;IAClE,OAAO,CAAC,aAAa;IASrB,sEAAsE;IACtE,OAAO,CAAC,UAAU;IAMlB;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAShC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOxB;IAED,kFAAkF;IAClF,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAKjC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAM5C;IAED,0EAA0E;IAC1E,OAAO,IAAI,IAAI,CAKd;IAED,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAGlD;IAED,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,aAAa,EAAE,CAGpD;IAED,yEAAyE;IACzE,MAAM,IAAI,OAAO,CAShB;CACD","sourcesContent":["/**\n * In-process admission broker for parallel sessions.\n *\n * Safety property: a grant that may still own a live external effect keeps\n * holding its claims. Expiry, cancellation and authority restart are\n * authorization events; only a trusted supervisor reporting termination frees\n * the claims. Treating a lapsed deadline as \"the effect stopped\" is exactly how\n * two sessions end up writing the same path.\n *\n * Bounded reference semantics: a single trusted state machine, canonical claim\n * keys, and every shared effect crossing this broker. No IPC, no OS fencing,\n * no persistence — those belong to the supervisor this broker reports to.\n */\n\nimport { claimSetsConflict, sameClaimSet } from \"./resource.ts\";\nimport type { EffectState, GrantToken, ResourceClaim, Sequence } from \"./types.ts\";\nimport { nextSequence, SETTLED_EFFECT_STATES, sequence } from \"./types.ts\";\n\ninterface Grant {\n\treadonly token: GrantToken;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly weight: number;\n\tstate: EffectState;\n\t/** True once an external effect may exist. Never inferred from the clock. */\n\teffectLive: boolean;\n}\n\nexport interface AdmissionBrokerOptions {\n\t/** Total admissible weight of concurrently active grants. */\n\treadonly capacity: number;\n}\n\nexport interface AcquireInput {\n\treadonly sessionId: string;\n\treadonly incarnation: Sequence | string;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly now: number;\n\treadonly ttl: number;\n\treadonly weight?: number;\n}\n\nexport interface StartInput {\n\treadonly token: GrantToken;\n\treadonly now: number;\n\t/** Claims the operation actually resolved to after approval hooks. */\n\treadonly actualClaims: readonly ResourceClaim[];\n}\n\nfunction assertNonNegativeInteger(value: number, label: string): void {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n\t\tthrow new TypeError(`${label} must be a nonnegative safe integer`);\n\t}\n}\n\nexport class AdmissionBroker {\n\tprivate readonly capacity: number;\n\tprivate authorityEpoch: Sequence = sequence(\"1\");\n\tprivate grantCounter: Sequence = sequence(\"0\");\n\tprivate readonly incarnations = new Map<string, Sequence>();\n\tprivate readonly grants = new Map<string, Grant>();\n\n\tconstructor(options: AdmissionBrokerOptions) {\n\t\tassertNonNegativeInteger(options.capacity, \"capacity\");\n\t\tthis.capacity = options.capacity;\n\t}\n\n\t/**\n\t * Announce a session incarnation. Re-registering does not free the previous\n\t * incarnation's grants: a restarted session cannot assume its predecessor's\n\t * effects stopped.\n\t */\n\tregister(sessionId: string): Sequence {\n\t\tif (typeof sessionId !== \"string\" || sessionId.length === 0) {\n\t\t\tthrow new TypeError(\"sessionId must be a non-empty string\");\n\t\t}\n\t\tconst next = nextSequence(this.incarnations.get(sessionId) ?? sequence(\"0\"));\n\t\tthis.incarnations.set(sessionId, next);\n\t\treturn next;\n\t}\n\n\t/** Grants still holding their claims, including quarantined ones. */\n\tprivate activeGrants(): Grant[] {\n\t\treturn [...this.grants.values()].filter((g) => !SETTLED_EFFECT_STATES.has(g.state));\n\t}\n\n\tacquire(input: AcquireInput): GrantToken | null {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst weight = input.weight ?? 1;\n\t\tassertNonNegativeInteger(weight, \"weight\");\n\t\tif (!Number.isSafeInteger(input.ttl) || input.ttl <= 0) {\n\t\t\tthrow new TypeError(\"ttl must be a positive safe integer\");\n\t\t}\n\t\tconst incarnation = sequence(input.incarnation);\n\t\tif (this.incarnations.get(input.sessionId) !== incarnation) {\n\t\t\tthrow new TypeError(\"stale session incarnation\");\n\t\t}\n\t\tif (input.claims.length === 0) {\n\t\t\tthrow new TypeError(\"an unknown scope must not be admitted as an empty scope\");\n\t\t}\n\n\t\t// Settle lapsed authorizations first; this never evicts a live effect.\n\t\tthis.expire(input.now);\n\t\tconst active = this.activeGrants();\n\t\tconst used = active.reduce((sum, g) => sum + g.weight, 0);\n\t\tif (weight + used > this.capacity) return null;\n\t\tconst claims = [...input.claims];\n\t\tif (active.some((g) => claimSetsConflict(claims, g.claims))) return null;\n\n\t\tthis.grantCounter = nextSequence(this.grantCounter);\n\t\tconst token: GrantToken = Object.freeze({\n\t\t\tauthorityEpoch: this.authorityEpoch,\n\t\t\tgrantSequence: this.grantCounter,\n\t\t\tsessionId: input.sessionId,\n\t\t\tsessionIncarnation: incarnation,\n\t\t\tauthorizationDeadline: input.now + input.ttl,\n\t\t});\n\t\tthis.grants.set(token.grantSequence, {\n\t\t\ttoken,\n\t\t\tclaims: Object.freeze(claims),\n\t\t\tweight,\n\t\t\tstate: \"reserved\",\n\t\t\teffectLive: false,\n\t\t});\n\t\treturn token;\n\t}\n\n\t/** Resolve a token that is still authoritative for new action. */\n\tprivate authoritative(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\tif (token.authorityEpoch !== this.authorityEpoch) return undefined;\n\t\tif (this.incarnations.get(token.sessionId) !== token.sessionIncarnation) return undefined;\n\t\tif (SETTLED_EFFECT_STATES.has(grant.state)) return undefined;\n\t\treturn grant;\n\t}\n\n\t/** Resolve a token for settlement only; accepts superseded epochs. */\n\tprivate settleable(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\treturn SETTLED_EFFECT_STATES.has(grant.state) ? undefined : grant;\n\t}\n\n\t/**\n\t * Bind an effect to its reservation. The actual claims must equal the\n\t * reserved set exactly — an approval hook that widened scope has to be\n\t * re-admitted, not silently allowed to run under the old grant.\n\t */\n\tstart(input: StartInput): boolean {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst grant = this.authoritative(input.token);\n\t\tif (grant === undefined || grant.state !== \"reserved\") return false;\n\t\tif (input.now >= grant.token.authorizationDeadline) return false;\n\t\tif (!sameClaimSet(input.actualClaims, grant.claims)) return false;\n\t\tgrant.state = \"running\";\n\t\tgrant.effectLive = true;\n\t\treturn true;\n\t}\n\n\t/**\n\t * Apply lapsed authorization deadlines. A reservation that never started is\n\t * released; a running effect is quarantined and keeps its claims.\n\t */\n\texpire(now: number): void {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tif (now >= grant.token.authorizationDeadline) {\n\t\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t\t}\n\t\t}\n\t}\n\n\t/** Withdraw authorization. Requested cancellation is not observed termination. */\n\tcancel(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\treturn true;\n\t}\n\n\t/**\n\t * Trusted supervisor event: this exact effect is gone. Accepted for\n\t * superseded epochs so a restarted authority can still settle what the\n\t * previous one started, never to authorize new work.\n\t */\n\tconfirmTerminated(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.effectLive = false;\n\t\tgrant.state = \"terminated\";\n\t\treturn true;\n\t}\n\n\t/** Fence the authority. Live effects stay quarantined until confirmed. */\n\trestart(): void {\n\t\tthis.authorityEpoch = nextSequence(this.authorityEpoch);\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t}\n\t}\n\n\tstateOf(token: GrantToken): EffectState | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.state : undefined;\n\t}\n\n\tclaimsOf(token: GrantToken): readonly ResourceClaim[] {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.claims : [];\n\t}\n\n\t/** Invariant: active grants fit capacity and never pairwise conflict. */\n\tisSafe(): boolean {\n\t\tconst active = this.activeGrants();\n\t\tif (active.reduce((sum, g) => sum + g.weight, 0) > this.capacity) return false;\n\t\tfor (const [index, grant] of active.entries()) {\n\t\t\tfor (const other of active.slice(index + 1)) {\n\t\t\t\tif (claimSetsConflict(grant.claims, other.claims)) return false;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n}\n\nfunction sameToken(a: GrantToken, b: GrantToken): boolean {\n\treturn (\n\t\ta.authorityEpoch === b.authorityEpoch &&\n\t\ta.grantSequence === b.grantSequence &&\n\t\ta.sessionId === b.sessionId &&\n\t\ta.sessionIncarnation === b.sessionIncarnation &&\n\t\ta.authorizationDeadline === b.authorizationDeadline\n\t);\n}\n"]}

package/dist/coordination/broker.js

@@ -0,0 +1,195 @@
+/**
+ * In-process admission broker for parallel sessions.
+ *
+ * Safety property: a grant that may still own a live external effect keeps
+ * holding its claims. Expiry, cancellation and authority restart are
+ * authorization events; only a trusted supervisor reporting termination frees
+ * the claims. Treating a lapsed deadline as "the effect stopped" is exactly how
+ * two sessions end up writing the same path.
+ *
+ * Bounded reference semantics: a single trusted state machine, canonical claim
+ * keys, and every shared effect crossing this broker. No IPC, no OS fencing,
+ * no persistence — those belong to the supervisor this broker reports to.
+ */
+import { claimSetsConflict, sameClaimSet } from "./resource.js";
+import { nextSequence, SETTLED_EFFECT_STATES, sequence } from "./types.js";
+function assertNonNegativeInteger(value, label) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+        throw new TypeError(`${label} must be a nonnegative safe integer`);
+    }
+}
+export class AdmissionBroker {
+    capacity;
+    authorityEpoch = sequence("1");
+    grantCounter = sequence("0");
+    incarnations = new Map();
+    grants = new Map();
+    constructor(options) {
+        assertNonNegativeInteger(options.capacity, "capacity");
+        this.capacity = options.capacity;
+    }
+    /**
+     * Announce a session incarnation. Re-registering does not free the previous
+     * incarnation's grants: a restarted session cannot assume its predecessor's
+     * effects stopped.
+     */
+    register(sessionId) {
+        if (typeof sessionId !== "string" || sessionId.length === 0) {
+            throw new TypeError("sessionId must be a non-empty string");
+        }
+        const next = nextSequence(this.incarnations.get(sessionId) ?? sequence("0"));
+        this.incarnations.set(sessionId, next);
+        return next;
+    }
+    /** Grants still holding their claims, including quarantined ones. */
+    activeGrants() {
+        return [...this.grants.values()].filter((g) => !SETTLED_EFFECT_STATES.has(g.state));
+    }
+    acquire(input) {
+        assertNonNegativeInteger(input.now, "now");
+        const weight = input.weight ?? 1;
+        assertNonNegativeInteger(weight, "weight");
+        if (!Number.isSafeInteger(input.ttl) || input.ttl <= 0) {
+            throw new TypeError("ttl must be a positive safe integer");
+        }
+        const incarnation = sequence(input.incarnation);
+        if (this.incarnations.get(input.sessionId) !== incarnation) {
+            throw new TypeError("stale session incarnation");
+        }
+        if (input.claims.length === 0) {
+            throw new TypeError("an unknown scope must not be admitted as an empty scope");
+        }
+        // Settle lapsed authorizations first; this never evicts a live effect.
+        this.expire(input.now);
+        const active = this.activeGrants();
+        const used = active.reduce((sum, g) => sum + g.weight, 0);
+        if (weight + used > this.capacity)
+            return null;
+        const claims = [...input.claims];
+        if (active.some((g) => claimSetsConflict(claims, g.claims)))
+            return null;
+        this.grantCounter = nextSequence(this.grantCounter);
+        const token = Object.freeze({
+            authorityEpoch: this.authorityEpoch,
+            grantSequence: this.grantCounter,
+            sessionId: input.sessionId,
+            sessionIncarnation: incarnation,
+            authorizationDeadline: input.now + input.ttl,
+        });
+        this.grants.set(token.grantSequence, {
+            token,
+            claims: Object.freeze(claims),
+            weight,
+            state: "reserved",
+            effectLive: false,
+        });
+        return token;
+    }
+    /** Resolve a token that is still authoritative for new action. */
+    authoritative(token) {
+        const grant = this.grants.get(token.grantSequence);
+        if (grant === undefined || !sameToken(grant.token, token))
+            return undefined;
+        if (token.authorityEpoch !== this.authorityEpoch)
+            return undefined;
+        if (this.incarnations.get(token.sessionId) !== token.sessionIncarnation)
+            return undefined;
+        if (SETTLED_EFFECT_STATES.has(grant.state))
+            return undefined;
+        return grant;
+    }
+    /** Resolve a token for settlement only; accepts superseded epochs. */
+    settleable(token) {
+        const grant = this.grants.get(token.grantSequence);
+        if (grant === undefined || !sameToken(grant.token, token))
+            return undefined;
+        return SETTLED_EFFECT_STATES.has(grant.state) ? undefined : grant;
+    }
+    /**
+     * Bind an effect to its reservation. The actual claims must equal the
+     * reserved set exactly — an approval hook that widened scope has to be
+     * re-admitted, not silently allowed to run under the old grant.
+     */
+    start(input) {
+        assertNonNegativeInteger(input.now, "now");
+        const grant = this.authoritative(input.token);
+        if (grant === undefined || grant.state !== "reserved")
+            return false;
+        if (input.now >= grant.token.authorizationDeadline)
+            return false;
+        if (!sameClaimSet(input.actualClaims, grant.claims))
+            return false;
+        grant.state = "running";
+        grant.effectLive = true;
+        return true;
+    }
+    /**
+     * Apply lapsed authorization deadlines. A reservation that never started is
+     * released; a running effect is quarantined and keeps its claims.
+     */
+    expire(now) {
+        assertNonNegativeInteger(now, "now");
+        for (const grant of this.activeGrants()) {
+            if (now >= grant.token.authorizationDeadline) {
+                grant.state = grant.effectLive ? "quarantined" : "cancelled";
+            }
+        }
+    }
+    /** Withdraw authorization. Requested cancellation is not observed termination. */
+    cancel(token) {
+        const grant = this.settleable(token);
+        if (grant === undefined)
+            return false;
+        grant.state = grant.effectLive ? "quarantined" : "cancelled";
+        return true;
+    }
+    /**
+     * Trusted supervisor event: this exact effect is gone. Accepted for
+     * superseded epochs so a restarted authority can still settle what the
+     * previous one started, never to authorize new work.
+     */
+    confirmTerminated(token) {
+        const grant = this.settleable(token);
+        if (grant === undefined)
+            return false;
+        grant.effectLive = false;
+        grant.state = "terminated";
+        return true;
+    }
+    /** Fence the authority. Live effects stay quarantined until confirmed. */
+    restart() {
+        this.authorityEpoch = nextSequence(this.authorityEpoch);
+        for (const grant of this.activeGrants()) {
+            grant.state = grant.effectLive ? "quarantined" : "cancelled";
+        }
+    }
+    stateOf(token) {
+        const grant = this.grants.get(token.grantSequence);
+        return grant !== undefined && sameToken(grant.token, token) ? grant.state : undefined;
+    }
+    claimsOf(token) {
+        const grant = this.grants.get(token.grantSequence);
+        return grant !== undefined && sameToken(grant.token, token) ? grant.claims : [];
+    }
+    /** Invariant: active grants fit capacity and never pairwise conflict. */
+    isSafe() {
+        const active = this.activeGrants();
+        if (active.reduce((sum, g) => sum + g.weight, 0) > this.capacity)
+            return false;
+        for (const [index, grant] of active.entries()) {
+            for (const other of active.slice(index + 1)) {
+                if (claimSetsConflict(grant.claims, other.claims))
+                    return false;
+            }
+        }
+        return true;
+    }
+}
+function sameToken(a, b) {
+    return (a.authorityEpoch === b.authorityEpoch &&
+        a.grantSequence === b.grantSequence &&
+        a.sessionId === b.sessionId &&
+        a.sessionIncarnation === b.sessionIncarnation &&
+        a.authorizationDeadline === b.authorizationDeadline);
+}
+//# sourceMappingURL=broker.js.map

package/dist/coordination/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/coordination/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgC3E,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa,EAAQ;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACpE,CAAC;AAAA,CACD;AAED,MAAM,OAAO,eAAe;IACV,QAAQ,CAAS;IAC1B,cAAc,GAAa,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,YAAY,GAAa,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEnD,YAAY,OAA+B,EAAE;QAC5C,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAA,CACjC;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAAiB,EAAY;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,qEAAqE;IAC7D,YAAY,GAAY;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAAA,CACpF;IAED,OAAO,CAAC,KAAmB,EAAqB;QAC/C,wBAAwB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,WAAW,EAAE,CAAC;YAC5D,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QAChF,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,KAAK,GAAe,MAAM,CAAC,MAAM,CAAC;YACvC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,kBAAkB,EAAE,WAAW;YAC/B,qBAAqB,EAAE,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE;YACpC,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7B,MAAM;YACN,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IAAA,CACb;IAED,kEAAkE;IAC1D,aAAa,CAAC,KAAiB,EAAqB;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QACnE,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAAE,OAAO,SAAS,CAAC;QAC1F,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7D,OAAO,KAAK,CAAC;IAAA,CACb;IAED,sEAAsE;IAC9D,UAAU,CAAC,KAAiB,EAAqB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAAA,CAClE;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAiB,EAAW;QACjC,wBAAwB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,qBAAqB;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QACxB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IAAA,CACZ;IAED;;;OAGG;IACH,MAAM,CAAC,GAAW,EAAQ;QACzB,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;gBAC9C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;YAC9D,CAAC;QACF,CAAC;IAAA,CACD;IAED,kFAAkF;IAClF,MAAM,CAAC,KAAiB,EAAW;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7D,OAAO,IAAI,CAAC;IAAA,CACZ;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAiB,EAAW;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;QACzB,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC;QAC3B,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,0EAA0E;IAC1E,OAAO,GAAS;QACf,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAC9D,CAAC;IAAA,CACD;IAED,OAAO,CAAC,KAAiB,EAA2B;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CACtF;IAED,QAAQ,CAAC,KAAiB,EAA4B;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAChF;IAED,yEAAyE;IACzE,MAAM,GAAY;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/E,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC7C,IAAI,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC;YACjE,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IAAA,CACZ;CACD;AAED,SAAS,SAAS,CAAC,CAAa,EAAE,CAAa,EAAW;IACzD,OAAO,CACN,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc;QACrC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QACnC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,kBAAkB;QAC7C,CAAC,CAAC,qBAAqB,KAAK,CAAC,CAAC,qBAAqB,CACnD,CAAC;AAAA,CACF","sourcesContent":["/**\n * In-process admission broker for parallel sessions.\n *\n * Safety property: a grant that may still own a live external effect keeps\n * holding its claims. Expiry, cancellation and authority restart are\n * authorization events; only a trusted supervisor reporting termination frees\n * the claims. Treating a lapsed deadline as \"the effect stopped\" is exactly how\n * two sessions end up writing the same path.\n *\n * Bounded reference semantics: a single trusted state machine, canonical claim\n * keys, and every shared effect crossing this broker. No IPC, no OS fencing,\n * no persistence — those belong to the supervisor this broker reports to.\n */\n\nimport { claimSetsConflict, sameClaimSet } from \"./resource.ts\";\nimport type { EffectState, GrantToken, ResourceClaim, Sequence } from \"./types.ts\";\nimport { nextSequence, SETTLED_EFFECT_STATES, sequence } from \"./types.ts\";\n\ninterface Grant {\n\treadonly token: GrantToken;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly weight: number;\n\tstate: EffectState;\n\t/** True once an external effect may exist. Never inferred from the clock. */\n\teffectLive: boolean;\n}\n\nexport interface AdmissionBrokerOptions {\n\t/** Total admissible weight of concurrently active grants. */\n\treadonly capacity: number;\n}\n\nexport interface AcquireInput {\n\treadonly sessionId: string;\n\treadonly incarnation: Sequence | string;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly now: number;\n\treadonly ttl: number;\n\treadonly weight?: number;\n}\n\nexport interface StartInput {\n\treadonly token: GrantToken;\n\treadonly now: number;\n\t/** Claims the operation actually resolved to after approval hooks. */\n\treadonly actualClaims: readonly ResourceClaim[];\n}\n\nfunction assertNonNegativeInteger(value: number, label: string): void {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n\t\tthrow new TypeError(`${label} must be a nonnegative safe integer`);\n\t}\n}\n\nexport class AdmissionBroker {\n\tprivate readonly capacity: number;\n\tprivate authorityEpoch: Sequence = sequence(\"1\");\n\tprivate grantCounter: Sequence = sequence(\"0\");\n\tprivate readonly incarnations = new Map<string, Sequence>();\n\tprivate readonly grants = new Map<string, Grant>();\n\n\tconstructor(options: AdmissionBrokerOptions) {\n\t\tassertNonNegativeInteger(options.capacity, \"capacity\");\n\t\tthis.capacity = options.capacity;\n\t}\n\n\t/**\n\t * Announce a session incarnation. Re-registering does not free the previous\n\t * incarnation's grants: a restarted session cannot assume its predecessor's\n\t * effects stopped.\n\t */\n\tregister(sessionId: string): Sequence {\n\t\tif (typeof sessionId !== \"string\" || sessionId.length === 0) {\n\t\t\tthrow new TypeError(\"sessionId must be a non-empty string\");\n\t\t}\n\t\tconst next = nextSequence(this.incarnations.get(sessionId) ?? sequence(\"0\"));\n\t\tthis.incarnations.set(sessionId, next);\n\t\treturn next;\n\t}\n\n\t/** Grants still holding their claims, including quarantined ones. */\n\tprivate activeGrants(): Grant[] {\n\t\treturn [...this.grants.values()].filter((g) => !SETTLED_EFFECT_STATES.has(g.state));\n\t}\n\n\tacquire(input: AcquireInput): GrantToken | null {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst weight = input.weight ?? 1;\n\t\tassertNonNegativeInteger(weight, \"weight\");\n\t\tif (!Number.isSafeInteger(input.ttl) || input.ttl <= 0) {\n\t\t\tthrow new TypeError(\"ttl must be a positive safe integer\");\n\t\t}\n\t\tconst incarnation = sequence(input.incarnation);\n\t\tif (this.incarnations.get(input.sessionId) !== incarnation) {\n\t\t\tthrow new TypeError(\"stale session incarnation\");\n\t\t}\n\t\tif (input.claims.length === 0) {\n\t\t\tthrow new TypeError(\"an unknown scope must not be admitted as an empty scope\");\n\t\t}\n\n\t\t// Settle lapsed authorizations first; this never evicts a live effect.\n\t\tthis.expire(input.now);\n\t\tconst active = this.activeGrants();\n\t\tconst used = active.reduce((sum, g) => sum + g.weight, 0);\n\t\tif (weight + used > this.capacity) return null;\n\t\tconst claims = [...input.claims];\n\t\tif (active.some((g) => claimSetsConflict(claims, g.claims))) return null;\n\n\t\tthis.grantCounter = nextSequence(this.grantCounter);\n\t\tconst token: GrantToken = Object.freeze({\n\t\t\tauthorityEpoch: this.authorityEpoch,\n\t\t\tgrantSequence: this.grantCounter,\n\t\t\tsessionId: input.sessionId,\n\t\t\tsessionIncarnation: incarnation,\n\t\t\tauthorizationDeadline: input.now + input.ttl,\n\t\t});\n\t\tthis.grants.set(token.grantSequence, {\n\t\t\ttoken,\n\t\t\tclaims: Object.freeze(claims),\n\t\t\tweight,\n\t\t\tstate: \"reserved\",\n\t\t\teffectLive: false,\n\t\t});\n\t\treturn token;\n\t}\n\n\t/** Resolve a token that is still authoritative for new action. */\n\tprivate authoritative(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\tif (token.authorityEpoch !== this.authorityEpoch) return undefined;\n\t\tif (this.incarnations.get(token.sessionId) !== token.sessionIncarnation) return undefined;\n\t\tif (SETTLED_EFFECT_STATES.has(grant.state)) return undefined;\n\t\treturn grant;\n\t}\n\n\t/** Resolve a token for settlement only; accepts superseded epochs. */\n\tprivate settleable(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\treturn SETTLED_EFFECT_STATES.has(grant.state) ? undefined : grant;\n\t}\n\n\t/**\n\t * Bind an effect to its reservation. The actual claims must equal the\n\t * reserved set exactly — an approval hook that widened scope has to be\n\t * re-admitted, not silently allowed to run under the old grant.\n\t */\n\tstart(input: StartInput): boolean {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst grant = this.authoritative(input.token);\n\t\tif (grant === undefined || grant.state !== \"reserved\") return false;\n\t\tif (input.now >= grant.token.authorizationDeadline) return false;\n\t\tif (!sameClaimSet(input.actualClaims, grant.claims)) return false;\n\t\tgrant.state = \"running\";\n\t\tgrant.effectLive = true;\n\t\treturn true;\n\t}\n\n\t/**\n\t * Apply lapsed authorization deadlines. A reservation that never started is\n\t * released; a running effect is quarantined and keeps its claims.\n\t */\n\texpire(now: number): void {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tif (now >= grant.token.authorizationDeadline) {\n\t\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t\t}\n\t\t}\n\t}\n\n\t/** Withdraw authorization. Requested cancellation is not observed termination. */\n\tcancel(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\treturn true;\n\t}\n\n\t/**\n\t * Trusted supervisor event: this exact effect is gone. Accepted for\n\t * superseded epochs so a restarted authority can still settle what the\n\t * previous one started, never to authorize new work.\n\t */\n\tconfirmTerminated(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.effectLive = false;\n\t\tgrant.state = \"terminated\";\n\t\treturn true;\n\t}\n\n\t/** Fence the authority. Live effects stay quarantined until confirmed. */\n\trestart(): void {\n\t\tthis.authorityEpoch = nextSequence(this.authorityEpoch);\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t}\n\t}\n\n\tstateOf(token: GrantToken): EffectState | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.state : undefined;\n\t}\n\n\tclaimsOf(token: GrantToken): readonly ResourceClaim[] {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.claims : [];\n\t}\n\n\t/** Invariant: active grants fit capacity and never pairwise conflict. */\n\tisSafe(): boolean {\n\t\tconst active = this.activeGrants();\n\t\tif (active.reduce((sum, g) => sum + g.weight, 0) > this.capacity) return false;\n\t\tfor (const [index, grant] of active.entries()) {\n\t\t\tfor (const other of active.slice(index + 1)) {\n\t\t\t\tif (claimSetsConflict(grant.claims, other.claims)) return false;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n}\n\nfunction sameToken(a: GrantToken, b: GrantToken): boolean {\n\treturn (\n\t\ta.authorityEpoch === b.authorityEpoch &&\n\t\ta.grantSequence === b.grantSequence &&\n\t\ta.sessionId === b.sessionId &&\n\t\ta.sessionIncarnation === b.sessionIncarnation &&\n\t\ta.authorizationDeadline === b.authorizationDeadline\n\t);\n}\n"]}

package/dist/coordination/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Parallel-session coordination kernel.
+ *
+ * Pure, deterministic, bounded. Implements the P0 shared by the 2026-09-20
+ * coordination design and the Jev audit: bind admission to actual claims, and
+ * keep a possibly-live effect's claims held until termination is observed.
+ * No IPC, no process control, no persistence.
+ */
+export * from "./awareness.ts";
+export * from "./broker.ts";
+export * from "./integration.ts";
+export * from "./operation.ts";
+export * from "./resource.ts";
+export * from "./session.ts";
+export * from "./types.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/coordination/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/coordination/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC","sourcesContent":["/**\n * Parallel-session coordination kernel.\n *\n * Pure, deterministic, bounded. Implements the P0 shared by the 2026-09-20\n * coordination design and the Jev audit: bind admission to actual claims, and\n * keep a possibly-live effect's claims held until termination is observed.\n * No IPC, no process control, no persistence.\n */\nexport * from \"./awareness.ts\";\nexport * from \"./broker.ts\";\nexport * from \"./integration.ts\";\nexport * from \"./operation.ts\";\nexport * from \"./resource.ts\";\nexport * from \"./session.ts\";\nexport * from \"./types.ts\";\n"]}

package/dist/coordination/index.js

@@ -0,0 +1,16 @@
+/**
+ * Parallel-session coordination kernel.
+ *
+ * Pure, deterministic, bounded. Implements the P0 shared by the 2026-09-20
+ * coordination design and the Jev audit: bind admission to actual claims, and
+ * keep a possibly-live effect's claims held until termination is observed.
+ * No IPC, no process control, no persistence.
+ */
+export * from "./awareness.js";
+export * from "./broker.js";
+export * from "./integration.js";
+export * from "./operation.js";
+export * from "./resource.js";
+export * from "./session.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/coordination/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/coordination/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC","sourcesContent":["/**\n * Parallel-session coordination kernel.\n *\n * Pure, deterministic, bounded. Implements the P0 shared by the 2026-09-20\n * coordination design and the Jev audit: bind admission to actual claims, and\n * keep a possibly-live effect's claims held until termination is observed.\n * No IPC, no process control, no persistence.\n */\nexport * from \"./awareness.ts\";\nexport * from \"./broker.ts\";\nexport * from \"./integration.ts\";\nexport * from \"./operation.ts\";\nexport * from \"./resource.ts\";\nexport * from \"./session.ts\";\nexport * from \"./types.ts\";\n"]}

package/dist/coordination/integration.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Candidate publication with read-version preconditions and bound receipts.
+ *
+ * A publication is admitted only when the snapshot that was verified is still
+ * the snapshot being published. Three separate facts are checked, because any
+ * one of them alone lets a stale candidate through:
+ *   - every key the proposal read is still at the version it read,
+ *   - the parent revision has not advanced,
+ *   - the receipt is bound to this candidate, contract, check set and
+ *     environment rather than to an earlier composition of them.
+ *
+ * Absence is a dependency: reading a key that did not exist records version 0,
+ * so a later creation invalidates the proposal instead of silently racing it.
+ *
+ * Bounded model: one accepted snapshot pointer, file effects abstracted as a
+ * single update. Real multi-file atomicity needs immutable candidates plus a
+ * Git CAS/outbox protocol; this class does not provide that.
+ */
+export type PublicationOutcome = "accepted" | "already-accepted" | "id-collision" | "stale" | "invalid-binding" | "unverified";
+export type WriteValue = string | null;
+export interface ChangeProposal {
+    readonly proposalId: string;
+    /** Every key touched, with the version observed at propose time. */
+    readonly readVersions: readonly (readonly [string, number])[];
+    /** `null` deletes the key. */
+    readonly writes: readonly (readonly [string, WriteValue])[];
+}
+export interface StagedChange {
+    readonly proposal: ChangeProposal;
+    readonly parentRevision: number;
+    readonly candidateDigest: string;
+    readonly contractDigest: string;
+    readonly checkDigest: string;
+    readonly environmentDigest: string;
+}
+export interface VerificationReceipt {
+    readonly candidateDigest: string;
+    readonly contractDigest: string;
+    readonly checkDigest: string;
+    readonly environmentDigest: string;
+    readonly verdict: "pass" | "fail" | "inconclusive";
+    readonly pendingEffects: number;
+}
+export declare class IntegrationPublisher {
+    private readonly values;
+    private readonly versions;
+    private readonly acceptedFingerprints;
+    private currentRevision;
+    constructor(initial: Readonly<Record<string, string>>);
+    get revision(): number;
+    snapshot(): Record<string, string>;
+    /** Record the versions of every key this change reads or writes. */
+    propose(proposalId: string, reads: readonly string[], writes: Readonly<Record<string, WriteValue>>): ChangeProposal;
+    private isCurrent;
+    private applied;
+    stage(proposal: ChangeProposal, contractDigest?: string, checkDigest?: string, environmentDigest?: string): StagedChange | null;
+    publish(staged: StagedChange, receipt: VerificationReceipt): PublicationOutcome;
+}
+//# sourceMappingURL=integration.d.ts.map

package/dist/coordination/integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../src/coordination/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,MAAM,MAAM,kBAAkB,GAC3B,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,OAAO,GACP,iBAAiB,GACjB,YAAY,CAAC;AAEhB,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC;AAEvC,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IAC9D,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;CAC5D;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CAChC;AAWD,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,eAAe,CAAK;IAE5B,YAAY,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAKpD;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjC;IAED,oEAAoE;IACpE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAAG,cAAc,CAgBlH;IAED,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,OAAO;IASf,KAAK,CACJ,QAAQ,EAAE,cAAc,EACxB,cAAc,SAAgB,EAC9B,WAAW,SAAc,EACzB,iBAAiB,SAAW,GAC1B,YAAY,GAAG,IAAI,CAUrB;IAED,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CAyB9E;CACD","sourcesContent":["/**\n * Candidate publication with read-version preconditions and bound receipts.\n *\n * A publication is admitted only when the snapshot that was verified is still\n * the snapshot being published. Three separate facts are checked, because any\n * one of them alone lets a stale candidate through:\n *   - every key the proposal read is still at the version it read,\n *   - the parent revision has not advanced,\n *   - the receipt is bound to this candidate, contract, check set and\n *     environment rather than to an earlier composition of them.\n *\n * Absence is a dependency: reading a key that did not exist records version 0,\n * so a later creation invalidates the proposal instead of silently racing it.\n *\n * Bounded model: one accepted snapshot pointer, file effects abstracted as a\n * single update. Real multi-file atomicity needs immutable candidates plus a\n * Git CAS/outbox protocol; this class does not provide that.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { canonical } from \"../metacognition/validation.ts\";\n\nexport type PublicationOutcome =\n\t| \"accepted\"\n\t| \"already-accepted\"\n\t| \"id-collision\"\n\t| \"stale\"\n\t| \"invalid-binding\"\n\t| \"unverified\";\n\nexport type WriteValue = string | null;\n\nexport interface ChangeProposal {\n\treadonly proposalId: string;\n\t/** Every key touched, with the version observed at propose time. */\n\treadonly readVersions: readonly (readonly [string, number])[];\n\t/** `null` deletes the key. */\n\treadonly writes: readonly (readonly [string, WriteValue])[];\n}\n\nexport interface StagedChange {\n\treadonly proposal: ChangeProposal;\n\treadonly parentRevision: number;\n\treadonly candidateDigest: string;\n\treadonly contractDigest: string;\n\treadonly checkDigest: string;\n\treadonly environmentDigest: string;\n}\n\nexport interface VerificationReceipt {\n\treadonly candidateDigest: string;\n\treadonly contractDigest: string;\n\treadonly checkDigest: string;\n\treadonly environmentDigest: string;\n\treadonly verdict: \"pass\" | \"fail\" | \"inconclusive\";\n\treadonly pendingEffects: number;\n}\n\nfunction digest(value: unknown): string {\n\treturn createHash(\"sha256\").update(canonical(value), \"utf8\").digest(\"hex\");\n}\n\nfunction byKey(a: readonly [string, unknown], b: readonly [string, unknown]): number {\n\tif (a[0] < b[0]) return -1;\n\treturn a[0] > b[0] ? 1 : 0;\n}\n\nexport class IntegrationPublisher {\n\tprivate readonly values = new Map<string, string>();\n\tprivate readonly versions = new Map<string, number>();\n\tprivate readonly acceptedFingerprints = new Map<string, string>();\n\tprivate currentRevision = 0;\n\n\tconstructor(initial: Readonly<Record<string, string>>) {\n\t\tfor (const [key, value] of Object.entries(initial)) {\n\t\t\tthis.values.set(key, value);\n\t\t\tthis.versions.set(key, 1);\n\t\t}\n\t}\n\n\tget revision(): number {\n\t\treturn this.currentRevision;\n\t}\n\n\tsnapshot(): Record<string, string> {\n\t\treturn Object.fromEntries(this.values);\n\t}\n\n\t/** Record the versions of every key this change reads or writes. */\n\tpropose(proposalId: string, reads: readonly string[], writes: Readonly<Record<string, WriteValue>>): ChangeProposal {\n\t\tif (typeof proposalId !== \"string\" || proposalId.length === 0) {\n\t\t\tthrow new TypeError(\"proposalId must be a non-empty string\");\n\t\t}\n\t\tconst touched = new Set<string>([...reads, ...Object.keys(writes)]);\n\t\treturn Object.freeze({\n\t\t\tproposalId,\n\t\t\treadVersions: Object.freeze(\n\t\t\t\t[...touched].map((key) => Object.freeze([key, this.versions.get(key) ?? 0] as const)).sort(byKey),\n\t\t\t),\n\t\t\twrites: Object.freeze(\n\t\t\t\tObject.entries(writes)\n\t\t\t\t\t.map(([key, value]) => Object.freeze([key, value] as const))\n\t\t\t\t\t.sort(byKey),\n\t\t\t),\n\t\t});\n\t}\n\n\tprivate isCurrent(proposal: ChangeProposal): boolean {\n\t\tconst declared = new Map(proposal.readVersions);\n\t\tif (proposal.writes.some(([key]) => !declared.has(key))) return false;\n\t\treturn proposal.readVersions.every(([key, version]) => (this.versions.get(key) ?? 0) === version);\n\t}\n\n\tprivate applied(proposal: ChangeProposal): Map<string, string> {\n\t\tconst next = new Map(this.values);\n\t\tfor (const [key, value] of proposal.writes) {\n\t\t\tif (value === null) next.delete(key);\n\t\t\telse next.set(key, value);\n\t\t}\n\t\treturn next;\n\t}\n\n\tstage(\n\t\tproposal: ChangeProposal,\n\t\tcontractDigest = \"contract-v1\",\n\t\tcheckDigest = \"checks-v1\",\n\t\tenvironmentDigest = \"env-v1\",\n\t): StagedChange | null {\n\t\tif (!this.isCurrent(proposal)) return null;\n\t\treturn Object.freeze({\n\t\t\tproposal,\n\t\t\tparentRevision: this.currentRevision,\n\t\t\tcandidateDigest: digest(Object.fromEntries(this.applied(proposal))),\n\t\t\tcontractDigest,\n\t\t\tcheckDigest,\n\t\t\tenvironmentDigest,\n\t\t});\n\t}\n\n\tpublish(staged: StagedChange, receipt: VerificationReceipt): PublicationOutcome {\n\t\tconst proposal = staged.proposal;\n\t\tconst fingerprint = digest({\n\t\t\tproposalId: proposal.proposalId,\n\t\t\treadVersions: proposal.readVersions,\n\t\t\twrites: proposal.writes,\n\t\t});\n\t\tconst seen = this.acceptedFingerprints.get(proposal.proposalId);\n\t\tif (seen !== undefined) return seen === fingerprint ? \"already-accepted\" : \"id-collision\";\n\t\tif (staged.parentRevision !== this.currentRevision || !this.isCurrent(proposal)) return \"stale\";\n\t\tif (!sameBinding(staged, receipt)) return \"invalid-binding\";\n\t\tif (receipt.verdict !== \"pass\" || receipt.pendingEffects !== 0) return \"unverified\";\n\n\t\t// Recompute the candidate: guards a staged payload swapped after verification.\n\t\tconst rebuilt = this.stage(proposal, staged.contractDigest, staged.checkDigest, staged.environmentDigest);\n\t\tif (rebuilt === null || rebuilt.candidateDigest !== staged.candidateDigest) return \"invalid-binding\";\n\n\t\tfor (const [key, value] of proposal.writes) {\n\t\t\tif (value === null) this.values.delete(key);\n\t\t\telse this.values.set(key, value);\n\t\t\tthis.versions.set(key, (this.versions.get(key) ?? 0) + 1);\n\t\t}\n\t\tthis.currentRevision += 1;\n\t\tthis.acceptedFingerprints.set(proposal.proposalId, fingerprint);\n\t\treturn \"accepted\";\n\t}\n}\n\nfunction sameBinding(staged: StagedChange, receipt: VerificationReceipt): boolean {\n\treturn (\n\t\tstaged.candidateDigest === receipt.candidateDigest &&\n\t\tstaged.contractDigest === receipt.contractDigest &&\n\t\tstaged.checkDigest === receipt.checkDigest &&\n\t\tstaged.environmentDigest === receipt.environmentDigest\n\t);\n}\n"]}