open-multi-agent-kit 1.0.0 → 1.2.2

package/dist/commands/verified-run-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"verified-run-cli.js","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAEtF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE1F,MAAM,KAAK,GAAG;;;;;;;;;iPASmO,CAAC;AAgBlP,SAAS,KAAK,CAAC,IAAuB,EAAU;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IACC,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,gBAAgB;QAC3B,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU;QAErB,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC;IACtD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,OAAO,GACZ,MAAM,KAAK,MAAM;QAChB,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC1B,CAAC,CAAC,MAAM,KAAK,OAAO;YACnB,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,CAAC;YACtE,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa;gBAC/E,CAAC,CAAC;oBACA,WAAW;oBACX,WAAW;oBACX,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;oBAC9C,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,YAAY;oBACZ,cAAc;oBACd,cAAc;oBACd,aAAa;oBACb,QAAQ;iBACR;gBACF,CAAC,CAAC,MAAM,KAAK,UAAU;oBACtB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC;oBACpD,CAAC,CAAC,MAAM,KAAK,SAAS;wBACrB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;wBACjF,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzG,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;QACtG,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAAA,CAC7B;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAU;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,KAAK,UAAU,aAAa,CAAI,GAAwC,EAAc;IACrF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;AAAA,CACD;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAc,EACd,OAA4B,EACwC;IACpE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,cAAc,CACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EACvE,OAAO,CACP,CAAC;QACF,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM;gBACV,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM;YACP,KAAK,OAAO,EAAE,CAAC;gBACd,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,WAAW,CAAC,KAAK,CAChB,QAAQ,EACR;oBACC,aAAa,EAAE,wBAAwB;oBACvC,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,SAAS;oBACT,gBAAgB,EAAE,CAAC;oBACnB,kBAAkB,EAAE,CAAC;oBACrB,cAAc,EAAE,sBAAsB;iBACtC,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACD,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,QAAQ,CAAC;YACd,KAAK,aAAa,CAAC;YACnB,KAAK,gBAAgB,EAAE,CAAC;gBACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC9B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,OAAO,GAAG;oBACf,aAAa,EAAE,wBAAwB;oBACvC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;oBACtB,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;oBAC3C,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACxD,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC5D,cAAc,EAAE,sBAAsB;iBACtC,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,MAAM,KAAK,aAAa;oBAC9B,CAAC,CAAC,WAAW,CAAC,UAAU,CACtB;wBACC,GAAG,OAAO;wBACV,IAAI,EAAE,aAAa;wBACnB,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;qBAC1F,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;oBACF,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;wBAC3B,CAAC,CAAC,WAAW,CAAC,MAAM,CAClB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,EAChF,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;wBACF,CAAC,CAAC,WAAW,CAAC,aAAa,CACzB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAC9E,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACJ,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,SAAS;gBACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACtC,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;wBACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;4BACpC,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;4BAClD,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,MAAM;YACP,KAAK,UAAU;gBACd,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,MAAM;YACP,KAAK,UAAU,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACrE,MAAM,GAAG;oBACR,eAAe,EAAE,SAAS;oBAC1B,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;oBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;oBACvB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC9B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,MAAM,CAAC,MAAM,CAAC;gBACxC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,YAAY,gBAAgB,IAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACjH,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,IAAI,KAAK,YAAY,gBAAgB;YACrE,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,gCAAgC,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;AAAA,CACD","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence ID [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"inspect\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nasync function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\":\n\t\t\t\tresult = coordinator.evidence(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}
+{"version":3,"file":"verified-run-cli.js","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,KAAK,GAAG;;;;;;;;;;;iPAWmO,CAAC;AAoBlP,SAAS,KAAK,CAAC,IAAuB,EAAU;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IACC,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,gBAAgB;QAC3B,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU;QAErB,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,WAAW,CAAC;IAChF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,OAAO,GACZ,MAAM,KAAK,MAAM;QAChB,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC1B,CAAC,CAAC,MAAM,KAAK,OAAO;YACnB,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,CAAC;YACtE,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa;gBAC/E,CAAC,CAAC;oBACA,WAAW;oBACX,WAAW;oBACX,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;oBAC9C,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,YAAY;oBACZ,cAAc;oBACd,cAAc;oBACd,aAAa;oBACb,QAAQ;iBACR;gBACF,CAAC,CAAC,MAAM,KAAK,SAAS;oBACrB,CAAC,CAAC;wBACA,WAAW;wBACX,YAAY;wBACZ,WAAW;wBACX,aAAa;wBACb,UAAU;wBACV,WAAW;wBACX,YAAY;wBACZ,cAAc;wBACd,cAAc;wBACd,aAAa;wBACb,QAAQ;qBACR;oBACF,CAAC,CAAC,MAAM,KAAK,UAAU;wBACtB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC;wBACpD,CAAC,CAAC,MAAM,KAAK,SAAS;4BACrB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;4BACjF,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzG,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;QACtG,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAAA,CAC7B;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAU;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAc,EACd,OAA4B,EACwC;IACpE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,cAAc,CACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EACvE,OAAO,CACP,CAAC;QACF,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM;gBACV,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM;YACP,KAAK,OAAO,EAAE,CAAC;gBACd,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,WAAW,CAAC,KAAK,CAChB,QAAQ,EACR;oBACC,aAAa,EAAE,wBAAwB;oBACvC,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,SAAS;oBACT,gBAAgB,EAAE,CAAC;oBACnB,kBAAkB,EAAE,CAAC;oBACrB,cAAc,EAAE,sBAAsB;iBACtC,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACD,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,QAAQ,CAAC;YACd,KAAK,aAAa,CAAC;YACnB,KAAK,gBAAgB,EAAE,CAAC;gBACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC9B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,OAAO,GAAG;oBACf,aAAa,EAAE,wBAAwB;oBACvC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;oBACtB,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;oBAC3C,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACxD,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC5D,cAAc,EAAE,sBAAsB;iBACtC,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,MAAM,KAAK,aAAa;oBAC9B,CAAC,CAAC,WAAW,CAAC,UAAU,CACtB;wBACC,GAAG,OAAO;wBACV,IAAI,EAAE,aAAa;wBACnB,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;qBAC1F,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;oBACF,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;wBAC3B,CAAC,CAAC,WAAW,CAAC,MAAM,CAClB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,EAChF,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;wBACF,CAAC,CAAC,WAAW,CAAC,aAAa,CACzB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAC9E,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACJ,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBAChB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC9B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,WAAW,CAAC,OAAO,CAClB;oBACC,aAAa,EAAE,wBAAwB;oBACvC,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;oBACtB,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;oBAC3C,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACxD,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC5D,cAAc,EAAE,sBAAsB;oBACtC,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;oBAChD,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;oBACvC,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;oBAC5C,YAAY,EAAE,mBAAmB,CAAC,QAAQ,CAAC;iBAC3C,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACD,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,MAAM;YACP,CAAC;YACD,KAAK,SAAS;gBACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACtC,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;wBACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;4BACpC,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;4BAClD,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,MAAM;YACP,KAAK,QAAQ,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,MAAM,GAAG,MAAM,CAAC;gBAChB,+DAA+D;gBAC/D,yDAAyD;gBACzD,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvC,MAAM;YACP,CAAC;YACD,KAAK,QAAQ;gBACZ,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7C,MAAM;YACP,KAAK,WAAW;gBACf,MAAM,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC;gBACxC,MAAM;YACP,KAAK,UAAU,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;gBACnD,QAAQ,GAAG,UAAU,CAAC,YAAY,KAAK,OAAO,IAAI,UAAU,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/F,MAAM;YACP,CAAC;YACD,KAAK,UAAU,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACrE,MAAM,GAAG;oBACR,eAAe,EAAE,SAAS;oBAC1B,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;oBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;oBACvB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC9B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,MAAM,CAAC,MAAM,CAAC;gBACxC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,YAAY,gBAAgB,IAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACjH,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,IAAI,KAAK,YAAY,gBAAgB;YACrE,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,gCAAgC,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;AAAA,CACD","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport { publishPolicyDigest } from \"../core/verified-run/run-publish.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\nimport { withRunSignal } from \"./verified-run-signal.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence|status|events ID [--state-dir DIR] [--json]\n       omk run authority [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run publish ID --execute --contract FILE --approve DIGEST --candidate DIGEST --parent OID --receipt DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"publish\"\n\t\t| \"inspect\"\n\t\t| \"status\"\n\t\t| \"events\"\n\t\t| \"authority\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"publish\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"status\" &&\n\t\taction !== \"events\" &&\n\t\taction !== \"authority\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\" && action !== \"authority\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"publish\"\n\t\t\t\t\t\t? [\n\t\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\t\"--contract\",\n\t\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\t\t\"--candidate\",\n\t\t\t\t\t\t\t\t\"--parent\",\n\t\t\t\t\t\t\t\t\"--receipt\",\n\t\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"publish\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.publish(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"publish\",\n\t\t\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t\tcandidateDigest: required(parsed, \"--candidate\"),\n\t\t\t\t\t\t\tparentOid: required(parsed, \"--parent\"),\n\t\t\t\t\t\t\treceiptDigest: required(parsed, \"--receipt\"),\n\t\t\t\t\t\t\tpolicyDigest: publishPolicyDigest(contract),\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.publication === \"accepted\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"status\": {\n\t\t\t\tconst status = coordinator.status(parsed.id ?? \"\");\n\t\t\t\tresult = status;\n\t\t\t\t// Same truth the start/publish exit codes encode: a recovered,\n\t\t\t\t// quarantined or unverified run is never a clean exit 0.\n\t\t\t\texitCode = status.cleanSuccess ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"events\":\n\t\t\t\tresult = coordinator.events(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"authority\":\n\t\t\t\tresult = coordinator.inspectAuthority();\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\": {\n\t\t\t\tconst projection = coordinator.evidenceRead(parsed.id ?? \"\");\n\t\t\t\tresult = { ...projection.evidence, ...projection };\n\t\t\t\texitCode = projection.authenticity === \"valid\" && projection.verification === \"passed\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}

package/dist/commands/verified-run-signal.d.ts

@@ -0,0 +1,3 @@
+/** Own CLI cancellation listeners for the complete awaited run operation. */
+export declare function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T>;
+//# sourceMappingURL=verified-run-signal.d.ts.map

package/dist/commands/verified-run-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-run-signal.d.ts","sourceRoot":"","sources":["../../src/commands/verified-run-signal.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,wBAAsB,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAW3F","sourcesContent":["/** Own CLI cancellation listeners for the complete awaited run operation. */\nexport async function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n"]}

package/dist/commands/verified-run-signal.js

@@ -0,0 +1,15 @@
+/** Own CLI cancellation listeners for the complete awaited run operation. */
+export async function withRunSignal(run) {
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    process.once("SIGINT", cancel);
+    process.once("SIGTERM", cancel);
+    try {
+        return await run(controller.signal);
+    }
+    finally {
+        process.off("SIGINT", cancel);
+        process.off("SIGTERM", cancel);
+    }
+}
+//# sourceMappingURL=verified-run-signal.js.map

package/dist/commands/verified-run-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-run-signal.js","sourceRoot":"","sources":["../../src/commands/verified-run-signal.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,GAAwC,EAAc;IAC5F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;AAAA,CACD","sourcesContent":["/** Own CLI cancellation listeners for the complete awaited run operation. */\nexport async function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n"]}

package/dist/coordination/awareness.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Change awareness: what a change invalidates, and who may proceed next.
+ *
+ * Both functions are deliberately conservative. Invalidation treats an
+ * unmapped dependent as affected, because "we have no edge for it" is not
+ * evidence that it is unaffected. Frontier admission lets an unrelated
+ * follower pass a blocked leader, but never lets a later request that
+ * conflicts with an older waiting one jump ahead of it.
+ */
+import type { ResourceClaim } from "./types.ts";
+export interface WaitingRequest {
+    readonly requestId: string;
+    readonly claims: readonly ResourceClaim[];
+}
+/**
+ * Transitive closure over reverse dependencies.
+ *
+ * `unknownDependents` are nodes whose dependencies could not be resolved; they
+ * join the affected set rather than being assumed safe. Reaching a fixpoint
+ * terminates on cycles because the set only grows and is bounded by the graph.
+ */
+export declare function invalidate(dependencies: Readonly<Record<string, readonly string[]>>, changed: readonly string[], unknownDependents?: readonly string[]): Set<string>;
+/**
+ * Requests admissible right now, in queue order.
+ *
+ * A request is admitted only when it conflicts neither with the active claims
+ * nor with any earlier waiting request. Accumulating earlier claims — whether
+ * or not they were admitted — is what stops a stream of later readers from
+ * starving an older writer. Capacity fairness is not modelled here.
+ */
+export declare function admissibleFrontier(waiting: readonly WaitingRequest[], active: readonly ResourceClaim[]): string[];
+//# sourceMappingURL=awareness.d.ts.map

package/dist/coordination/awareness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"awareness.d.ts","sourceRoot":"","sources":["../../src/coordination/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACzB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACzD,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACvC,GAAG,CAAC,MAAM,CAAC,CAab;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,EAAE,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,EAAE,CAYjH","sourcesContent":["/**\n * Change awareness: what a change invalidates, and who may proceed next.\n *\n * Both functions are deliberately conservative. Invalidation treats an\n * unmapped dependent as affected, because \"we have no edge for it\" is not\n * evidence that it is unaffected. Frontier admission lets an unrelated\n * follower pass a blocked leader, but never lets a later request that\n * conflicts with an older waiting one jump ahead of it.\n */\n\nimport { claimSetsConflict } from \"./resource.ts\";\nimport type { ResourceClaim } from \"./types.ts\";\n\nexport interface WaitingRequest {\n\treadonly requestId: string;\n\treadonly claims: readonly ResourceClaim[];\n}\n\n/**\n * Transitive closure over reverse dependencies.\n *\n * `unknownDependents` are nodes whose dependencies could not be resolved; they\n * join the affected set rather than being assumed safe. Reaching a fixpoint\n * terminates on cycles because the set only grows and is bounded by the graph.\n */\nexport function invalidate(\n\tdependencies: Readonly<Record<string, readonly string[]>>,\n\tchanged: readonly string[],\n\tunknownDependents: readonly string[] = [],\n): Set<string> {\n\tconst affected = new Set<string>([...changed, ...unknownDependents]);\n\tfor (;;) {\n\t\tlet grew = false;\n\t\tfor (const [node, deps] of Object.entries(dependencies)) {\n\t\t\tif (affected.has(node)) continue;\n\t\t\tif (deps.some((dep) => affected.has(dep))) {\n\t\t\t\taffected.add(node);\n\t\t\t\tgrew = true;\n\t\t\t}\n\t\t}\n\t\tif (!grew) return affected;\n\t}\n}\n\n/**\n * Requests admissible right now, in queue order.\n *\n * A request is admitted only when it conflicts neither with the active claims\n * nor with any earlier waiting request. Accumulating earlier claims — whether\n * or not they were admitted — is what stops a stream of later readers from\n * starving an older writer. Capacity fairness is not modelled here.\n */\nexport function admissibleFrontier(waiting: readonly WaitingRequest[], active: readonly ResourceClaim[]): string[] {\n\tconst chosen: string[] = [];\n\tconst reserved: ResourceClaim[] = [...active];\n\tconst earlier: ResourceClaim[] = [];\n\tfor (const request of waiting) {\n\t\tif (!claimSetsConflict(request.claims, reserved) && !claimSetsConflict(request.claims, earlier)) {\n\t\t\tchosen.push(request.requestId);\n\t\t\treserved.push(...request.claims);\n\t\t}\n\t\tearlier.push(...request.claims);\n\t}\n\treturn chosen;\n}\n"]}

package/dist/coordination/awareness.js

@@ -0,0 +1,55 @@
+/**
+ * Change awareness: what a change invalidates, and who may proceed next.
+ *
+ * Both functions are deliberately conservative. Invalidation treats an
+ * unmapped dependent as affected, because "we have no edge for it" is not
+ * evidence that it is unaffected. Frontier admission lets an unrelated
+ * follower pass a blocked leader, but never lets a later request that
+ * conflicts with an older waiting one jump ahead of it.
+ */
+import { claimSetsConflict } from "./resource.js";
+/**
+ * Transitive closure over reverse dependencies.
+ *
+ * `unknownDependents` are nodes whose dependencies could not be resolved; they
+ * join the affected set rather than being assumed safe. Reaching a fixpoint
+ * terminates on cycles because the set only grows and is bounded by the graph.
+ */
+export function invalidate(dependencies, changed, unknownDependents = []) {
+    const affected = new Set([...changed, ...unknownDependents]);
+    for (;;) {
+        let grew = false;
+        for (const [node, deps] of Object.entries(dependencies)) {
+            if (affected.has(node))
+                continue;
+            if (deps.some((dep) => affected.has(dep))) {
+                affected.add(node);
+                grew = true;
+            }
+        }
+        if (!grew)
+            return affected;
+    }
+}
+/**
+ * Requests admissible right now, in queue order.
+ *
+ * A request is admitted only when it conflicts neither with the active claims
+ * nor with any earlier waiting request. Accumulating earlier claims — whether
+ * or not they were admitted — is what stops a stream of later readers from
+ * starving an older writer. Capacity fairness is not modelled here.
+ */
+export function admissibleFrontier(waiting, active) {
+    const chosen = [];
+    const reserved = [...active];
+    const earlier = [];
+    for (const request of waiting) {
+        if (!claimSetsConflict(request.claims, reserved) && !claimSetsConflict(request.claims, earlier)) {
+            chosen.push(request.requestId);
+            reserved.push(...request.claims);
+        }
+        earlier.push(...request.claims);
+    }
+    return chosen;
+}
+//# sourceMappingURL=awareness.js.map

package/dist/coordination/awareness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awareness.js","sourceRoot":"","sources":["../../src/coordination/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAQlD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACzB,YAAyD,EACzD,OAA0B,EAC1B,iBAAiB,GAAsB,EAAE,EAC3B;IACd,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC;QACT,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,GAAG,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;IAC5B,CAAC;AAAA,CACD;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC,EAAE,MAAgC,EAAY;IAClH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAoB,CAAC,GAAG,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACjG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd","sourcesContent":["/**\n * Change awareness: what a change invalidates, and who may proceed next.\n *\n * Both functions are deliberately conservative. Invalidation treats an\n * unmapped dependent as affected, because \"we have no edge for it\" is not\n * evidence that it is unaffected. Frontier admission lets an unrelated\n * follower pass a blocked leader, but never lets a later request that\n * conflicts with an older waiting one jump ahead of it.\n */\n\nimport { claimSetsConflict } from \"./resource.ts\";\nimport type { ResourceClaim } from \"./types.ts\";\n\nexport interface WaitingRequest {\n\treadonly requestId: string;\n\treadonly claims: readonly ResourceClaim[];\n}\n\n/**\n * Transitive closure over reverse dependencies.\n *\n * `unknownDependents` are nodes whose dependencies could not be resolved; they\n * join the affected set rather than being assumed safe. Reaching a fixpoint\n * terminates on cycles because the set only grows and is bounded by the graph.\n */\nexport function invalidate(\n\tdependencies: Readonly<Record<string, readonly string[]>>,\n\tchanged: readonly string[],\n\tunknownDependents: readonly string[] = [],\n): Set<string> {\n\tconst affected = new Set<string>([...changed, ...unknownDependents]);\n\tfor (;;) {\n\t\tlet grew = false;\n\t\tfor (const [node, deps] of Object.entries(dependencies)) {\n\t\t\tif (affected.has(node)) continue;\n\t\t\tif (deps.some((dep) => affected.has(dep))) {\n\t\t\t\taffected.add(node);\n\t\t\t\tgrew = true;\n\t\t\t}\n\t\t}\n\t\tif (!grew) return affected;\n\t}\n}\n\n/**\n * Requests admissible right now, in queue order.\n *\n * A request is admitted only when it conflicts neither with the active claims\n * nor with any earlier waiting request. Accumulating earlier claims — whether\n * or not they were admitted — is what stops a stream of later readers from\n * starving an older writer. Capacity fairness is not modelled here.\n */\nexport function admissibleFrontier(waiting: readonly WaitingRequest[], active: readonly ResourceClaim[]): string[] {\n\tconst chosen: string[] = [];\n\tconst reserved: ResourceClaim[] = [...active];\n\tconst earlier: ResourceClaim[] = [];\n\tfor (const request of waiting) {\n\t\tif (!claimSetsConflict(request.claims, reserved) && !claimSetsConflict(request.claims, earlier)) {\n\t\t\tchosen.push(request.requestId);\n\t\t\treserved.push(...request.claims);\n\t\t}\n\t\tearlier.push(...request.claims);\n\t}\n\treturn chosen;\n}\n"]}

package/dist/coordination/broker.d.ts

@@ -0,0 +1,79 @@
+/**
+ * In-process admission broker for parallel sessions.
+ *
+ * Safety property: a grant that may still own a live external effect keeps
+ * holding its claims. Expiry, cancellation and authority restart are
+ * authorization events; only a trusted supervisor reporting termination frees
+ * the claims. Treating a lapsed deadline as "the effect stopped" is exactly how
+ * two sessions end up writing the same path.
+ *
+ * Bounded reference semantics: a single trusted state machine, canonical claim
+ * keys, and every shared effect crossing this broker. No IPC, no OS fencing,
+ * no persistence — those belong to the supervisor this broker reports to.
+ */
+import type { EffectState, GrantToken, ResourceClaim, Sequence } from "./types.ts";
+export interface AdmissionBrokerOptions {
+    /** Total admissible weight of concurrently active grants. */
+    readonly capacity: number;
+}
+export interface AcquireInput {
+    readonly sessionId: string;
+    readonly incarnation: Sequence | string;
+    readonly claims: readonly ResourceClaim[];
+    readonly now: number;
+    readonly ttl: number;
+    readonly weight?: number;
+}
+export interface StartInput {
+    readonly token: GrantToken;
+    readonly now: number;
+    /** Claims the operation actually resolved to after approval hooks. */
+    readonly actualClaims: readonly ResourceClaim[];
+}
+export declare class AdmissionBroker {
+    private readonly capacity;
+    private authorityEpoch;
+    private grantCounter;
+    private readonly incarnations;
+    private readonly grants;
+    constructor(options: AdmissionBrokerOptions);
+    /**
+     * Announce a session incarnation. Re-registering does not free the previous
+     * incarnation's grants: a restarted session cannot assume its predecessor's
+     * effects stopped.
+     */
+    register(sessionId: string): Sequence;
+    /** Grants still holding their claims, including quarantined ones. */
+    private activeGrants;
+    acquire(input: AcquireInput): GrantToken | null;
+    /** Resolve a token that is still authoritative for new action. */
+    private authoritative;
+    /** Resolve a token for settlement only; accepts superseded epochs. */
+    private settleable;
+    /**
+     * Bind an effect to its reservation. The actual claims must equal the
+     * reserved set exactly — an approval hook that widened scope has to be
+     * re-admitted, not silently allowed to run under the old grant.
+     */
+    start(input: StartInput): boolean;
+    /**
+     * Apply lapsed authorization deadlines. A reservation that never started is
+     * released; a running effect is quarantined and keeps its claims.
+     */
+    expire(now: number): void;
+    /** Withdraw authorization. Requested cancellation is not observed termination. */
+    cancel(token: GrantToken): boolean;
+    /**
+     * Trusted supervisor event: this exact effect is gone. Accepted for
+     * superseded epochs so a restarted authority can still settle what the
+     * previous one started, never to authorize new work.
+     */
+    confirmTerminated(token: GrantToken): boolean;
+    /** Fence the authority. Live effects stay quarantined until confirmed. */
+    restart(): void;
+    stateOf(token: GrantToken): EffectState | undefined;
+    claimsOf(token: GrantToken): readonly ResourceClaim[];
+    /** Invariant: active grants fit capacity and never pairwise conflict. */
+    isSafe(): boolean;
+}
+//# sourceMappingURL=broker.d.ts.map

package/dist/coordination/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../src/coordination/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAYnF,MAAM,WAAW,sBAAsB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,SAAS,aAAa,EAAE,CAAC;CAChD;AAQD,qBAAa,eAAe;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,cAAc,CAA2B;IACjD,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAEnD,YAAY,OAAO,EAAE,sBAAsB,EAG1C;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAOpC;IAED,qEAAqE;IACrE,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,UAAU,GAAG,IAAI,CA0C9C;IAED,kEAAkE;IAClE,OAAO,CAAC,aAAa;IASrB,sEAAsE;IACtE,OAAO,CAAC,UAAU;IAMlB;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAWhC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOxB;IAED,kFAAkF;IAClF,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAKjC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAM5C;IAED,0EAA0E;IAC1E,OAAO,IAAI,IAAI,CAKd;IAED,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAGlD;IAED,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,aAAa,EAAE,CAGpD;IAED,yEAAyE;IACzE,MAAM,IAAI,OAAO,CAShB;CACD","sourcesContent":["/**\n * In-process admission broker for parallel sessions.\n *\n * Safety property: a grant that may still own a live external effect keeps\n * holding its claims. Expiry, cancellation and authority restart are\n * authorization events; only a trusted supervisor reporting termination frees\n * the claims. Treating a lapsed deadline as \"the effect stopped\" is exactly how\n * two sessions end up writing the same path.\n *\n * Bounded reference semantics: a single trusted state machine, canonical claim\n * keys, and every shared effect crossing this broker. No IPC, no OS fencing,\n * no persistence — those belong to the supervisor this broker reports to.\n */\n\nimport { canonicalClaim, claimSetsConflict, sameClaimSet } from \"./resource.ts\";\nimport type { EffectState, GrantToken, ResourceClaim, Sequence } from \"./types.ts\";\nimport { nextSequence, SETTLED_EFFECT_STATES, sequence } from \"./types.ts\";\n\ninterface Grant {\n\treadonly token: GrantToken;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly weight: number;\n\tstate: EffectState;\n\t/** True once an external effect may exist. Never inferred from the clock. */\n\teffectLive: boolean;\n}\n\nexport interface AdmissionBrokerOptions {\n\t/** Total admissible weight of concurrently active grants. */\n\treadonly capacity: number;\n}\n\nexport interface AcquireInput {\n\treadonly sessionId: string;\n\treadonly incarnation: Sequence | string;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly now: number;\n\treadonly ttl: number;\n\treadonly weight?: number;\n}\n\nexport interface StartInput {\n\treadonly token: GrantToken;\n\treadonly now: number;\n\t/** Claims the operation actually resolved to after approval hooks. */\n\treadonly actualClaims: readonly ResourceClaim[];\n}\n\nfunction assertNonNegativeInteger(value: number, label: string): void {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n\t\tthrow new TypeError(`${label} must be a nonnegative safe integer`);\n\t}\n}\n\nexport class AdmissionBroker {\n\tprivate readonly capacity: number;\n\tprivate authorityEpoch: Sequence = sequence(\"1\");\n\tprivate grantCounter: Sequence = sequence(\"0\");\n\tprivate readonly incarnations = new Map<string, Sequence>();\n\tprivate readonly grants = new Map<string, Grant>();\n\n\tconstructor(options: AdmissionBrokerOptions) {\n\t\tassertNonNegativeInteger(options.capacity, \"capacity\");\n\t\tthis.capacity = options.capacity;\n\t}\n\n\t/**\n\t * Announce a session incarnation. Re-registering does not free the previous\n\t * incarnation's grants: a restarted session cannot assume its predecessor's\n\t * effects stopped.\n\t */\n\tregister(sessionId: string): Sequence {\n\t\tif (typeof sessionId !== \"string\" || sessionId.length === 0) {\n\t\t\tthrow new TypeError(\"sessionId must be a non-empty string\");\n\t\t}\n\t\tconst next = nextSequence(this.incarnations.get(sessionId) ?? sequence(\"0\"));\n\t\tthis.incarnations.set(sessionId, next);\n\t\treturn next;\n\t}\n\n\t/** Grants still holding their claims, including quarantined ones. */\n\tprivate activeGrants(): Grant[] {\n\t\treturn [...this.grants.values()].filter((g) => !SETTLED_EFFECT_STATES.has(g.state));\n\t}\n\n\tacquire(input: AcquireInput): GrantToken | null {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst weight = input.weight ?? 1;\n\t\tassertNonNegativeInteger(weight, \"weight\");\n\t\tif (!Number.isSafeInteger(input.ttl) || input.ttl <= 0) {\n\t\t\tthrow new TypeError(\"ttl must be a positive safe integer\");\n\t\t}\n\t\tconst authorizationDeadline = input.now + input.ttl;\n\t\tif (!Number.isSafeInteger(authorizationDeadline)) throw new RangeError(\"authorization deadline overflow\");\n\t\tconst incarnation = sequence(input.incarnation);\n\t\tif (this.incarnations.get(input.sessionId) !== incarnation) {\n\t\t\tthrow new TypeError(\"stale session incarnation\");\n\t\t}\n\t\tif (!Array.isArray(input.claims) || input.claims.length === 0) {\n\t\t\tthrow new TypeError(\"an unknown scope must not be admitted as an empty scope\");\n\t\t}\n\t\t// Take owned, validated snapshots before any state mutation.\n\t\tconst claims = Array.from(input.claims, (claim) => canonicalClaim(claim));\n\n\t\t// Settle lapsed authorizations first; this never evicts a live effect.\n\t\tthis.expire(input.now);\n\t\tconst active = this.activeGrants();\n\t\tconst used = active.reduce((sum, g) => sum + g.weight, 0);\n\t\tif (weight > this.capacity - used) return null;\n\t\tif (active.some((g) => claimSetsConflict(claims, g.claims))) return null;\n\n\t\tthis.grantCounter = nextSequence(this.grantCounter);\n\t\tconst token: GrantToken = Object.freeze({\n\t\t\tauthorityEpoch: this.authorityEpoch,\n\t\t\tgrantSequence: this.grantCounter,\n\t\t\tsessionId: input.sessionId,\n\t\t\tsessionIncarnation: incarnation,\n\t\t\tauthorizationDeadline,\n\t\t});\n\t\tthis.grants.set(token.grantSequence, {\n\t\t\ttoken,\n\t\t\tclaims: Object.freeze(claims),\n\t\t\tweight,\n\t\t\tstate: \"reserved\",\n\t\t\teffectLive: false,\n\t\t});\n\t\treturn token;\n\t}\n\n\t/** Resolve a token that is still authoritative for new action. */\n\tprivate authoritative(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\tif (token.authorityEpoch !== this.authorityEpoch) return undefined;\n\t\tif (this.incarnations.get(token.sessionId) !== token.sessionIncarnation) return undefined;\n\t\tif (SETTLED_EFFECT_STATES.has(grant.state)) return undefined;\n\t\treturn grant;\n\t}\n\n\t/** Resolve a token for settlement only; accepts superseded epochs. */\n\tprivate settleable(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\treturn SETTLED_EFFECT_STATES.has(grant.state) ? undefined : grant;\n\t}\n\n\t/**\n\t * Bind an effect to its reservation. The actual claims must equal the\n\t * reserved set exactly — an approval hook that widened scope has to be\n\t * re-admitted, not silently allowed to run under the old grant.\n\t */\n\tstart(input: StartInput): boolean {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst grant = this.authoritative(input.token);\n\t\tif (grant === undefined || grant.state !== \"reserved\") return false;\n\t\tif (input.now >= grant.token.authorizationDeadline) return false;\n\t\tif (!Array.isArray(input.actualClaims)) throw new TypeError(\"actualClaims must be an array\");\n\t\tconst actualClaims = Array.from(input.actualClaims, (claim) => canonicalClaim(claim));\n\t\tif (!sameClaimSet(actualClaims, grant.claims)) return false;\n\t\tgrant.state = \"running\";\n\t\tgrant.effectLive = true;\n\t\treturn true;\n\t}\n\n\t/**\n\t * Apply lapsed authorization deadlines. A reservation that never started is\n\t * released; a running effect is quarantined and keeps its claims.\n\t */\n\texpire(now: number): void {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tif (now >= grant.token.authorizationDeadline) {\n\t\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t\t}\n\t\t}\n\t}\n\n\t/** Withdraw authorization. Requested cancellation is not observed termination. */\n\tcancel(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\treturn true;\n\t}\n\n\t/**\n\t * Trusted supervisor event: this exact effect is gone. Accepted for\n\t * superseded epochs so a restarted authority can still settle what the\n\t * previous one started, never to authorize new work.\n\t */\n\tconfirmTerminated(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.effectLive = false;\n\t\tgrant.state = \"terminated\";\n\t\treturn true;\n\t}\n\n\t/** Fence the authority. Live effects stay quarantined until confirmed. */\n\trestart(): void {\n\t\tthis.authorityEpoch = nextSequence(this.authorityEpoch);\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t}\n\t}\n\n\tstateOf(token: GrantToken): EffectState | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.state : undefined;\n\t}\n\n\tclaimsOf(token: GrantToken): readonly ResourceClaim[] {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.claims : [];\n\t}\n\n\t/** Invariant: active grants fit capacity and never pairwise conflict. */\n\tisSafe(): boolean {\n\t\tconst active = this.activeGrants();\n\t\tif (active.reduce((sum, g) => sum + g.weight, 0) > this.capacity) return false;\n\t\tfor (const [index, grant] of active.entries()) {\n\t\t\tfor (const other of active.slice(index + 1)) {\n\t\t\t\tif (claimSetsConflict(grant.claims, other.claims)) return false;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n}\n\nfunction sameToken(a: GrantToken, b: GrantToken): boolean {\n\treturn (\n\t\ta.authorityEpoch === b.authorityEpoch &&\n\t\ta.grantSequence === b.grantSequence &&\n\t\ta.sessionId === b.sessionId &&\n\t\ta.sessionIncarnation === b.sessionIncarnation &&\n\t\ta.authorizationDeadline === b.authorizationDeadline\n\t);\n}\n"]}

package/dist/coordination/broker.js

@@ -0,0 +1,202 @@
+/**
+ * In-process admission broker for parallel sessions.
+ *
+ * Safety property: a grant that may still own a live external effect keeps
+ * holding its claims. Expiry, cancellation and authority restart are
+ * authorization events; only a trusted supervisor reporting termination frees
+ * the claims. Treating a lapsed deadline as "the effect stopped" is exactly how
+ * two sessions end up writing the same path.
+ *
+ * Bounded reference semantics: a single trusted state machine, canonical claim
+ * keys, and every shared effect crossing this broker. No IPC, no OS fencing,
+ * no persistence — those belong to the supervisor this broker reports to.
+ */
+import { canonicalClaim, claimSetsConflict, sameClaimSet } from "./resource.js";
+import { nextSequence, SETTLED_EFFECT_STATES, sequence } from "./types.js";
+function assertNonNegativeInteger(value, label) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+        throw new TypeError(`${label} must be a nonnegative safe integer`);
+    }
+}
+export class AdmissionBroker {
+    capacity;
+    authorityEpoch = sequence("1");
+    grantCounter = sequence("0");
+    incarnations = new Map();
+    grants = new Map();
+    constructor(options) {
+        assertNonNegativeInteger(options.capacity, "capacity");
+        this.capacity = options.capacity;
+    }
+    /**
+     * Announce a session incarnation. Re-registering does not free the previous
+     * incarnation's grants: a restarted session cannot assume its predecessor's
+     * effects stopped.
+     */
+    register(sessionId) {
+        if (typeof sessionId !== "string" || sessionId.length === 0) {
+            throw new TypeError("sessionId must be a non-empty string");
+        }
+        const next = nextSequence(this.incarnations.get(sessionId) ?? sequence("0"));
+        this.incarnations.set(sessionId, next);
+        return next;
+    }
+    /** Grants still holding their claims, including quarantined ones. */
+    activeGrants() {
+        return [...this.grants.values()].filter((g) => !SETTLED_EFFECT_STATES.has(g.state));
+    }
+    acquire(input) {
+        assertNonNegativeInteger(input.now, "now");
+        const weight = input.weight ?? 1;
+        assertNonNegativeInteger(weight, "weight");
+        if (!Number.isSafeInteger(input.ttl) || input.ttl <= 0) {
+            throw new TypeError("ttl must be a positive safe integer");
+        }
+        const authorizationDeadline = input.now + input.ttl;
+        if (!Number.isSafeInteger(authorizationDeadline))
+            throw new RangeError("authorization deadline overflow");
+        const incarnation = sequence(input.incarnation);
+        if (this.incarnations.get(input.sessionId) !== incarnation) {
+            throw new TypeError("stale session incarnation");
+        }
+        if (!Array.isArray(input.claims) || input.claims.length === 0) {
+            throw new TypeError("an unknown scope must not be admitted as an empty scope");
+        }
+        // Take owned, validated snapshots before any state mutation.
+        const claims = Array.from(input.claims, (claim) => canonicalClaim(claim));
+        // Settle lapsed authorizations first; this never evicts a live effect.
+        this.expire(input.now);
+        const active = this.activeGrants();
+        const used = active.reduce((sum, g) => sum + g.weight, 0);
+        if (weight > this.capacity - used)
+            return null;
+        if (active.some((g) => claimSetsConflict(claims, g.claims)))
+            return null;
+        this.grantCounter = nextSequence(this.grantCounter);
+        const token = Object.freeze({
+            authorityEpoch: this.authorityEpoch,
+            grantSequence: this.grantCounter,
+            sessionId: input.sessionId,
+            sessionIncarnation: incarnation,
+            authorizationDeadline,
+        });
+        this.grants.set(token.grantSequence, {
+            token,
+            claims: Object.freeze(claims),
+            weight,
+            state: "reserved",
+            effectLive: false,
+        });
+        return token;
+    }
+    /** Resolve a token that is still authoritative for new action. */
+    authoritative(token) {
+        const grant = this.grants.get(token.grantSequence);
+        if (grant === undefined || !sameToken(grant.token, token))
+            return undefined;
+        if (token.authorityEpoch !== this.authorityEpoch)
+            return undefined;
+        if (this.incarnations.get(token.sessionId) !== token.sessionIncarnation)
+            return undefined;
+        if (SETTLED_EFFECT_STATES.has(grant.state))
+            return undefined;
+        return grant;
+    }
+    /** Resolve a token for settlement only; accepts superseded epochs. */
+    settleable(token) {
+        const grant = this.grants.get(token.grantSequence);
+        if (grant === undefined || !sameToken(grant.token, token))
+            return undefined;
+        return SETTLED_EFFECT_STATES.has(grant.state) ? undefined : grant;
+    }
+    /**
+     * Bind an effect to its reservation. The actual claims must equal the
+     * reserved set exactly — an approval hook that widened scope has to be
+     * re-admitted, not silently allowed to run under the old grant.
+     */
+    start(input) {
+        assertNonNegativeInteger(input.now, "now");
+        const grant = this.authoritative(input.token);
+        if (grant === undefined || grant.state !== "reserved")
+            return false;
+        if (input.now >= grant.token.authorizationDeadline)
+            return false;
+        if (!Array.isArray(input.actualClaims))
+            throw new TypeError("actualClaims must be an array");
+        const actualClaims = Array.from(input.actualClaims, (claim) => canonicalClaim(claim));
+        if (!sameClaimSet(actualClaims, grant.claims))
+            return false;
+        grant.state = "running";
+        grant.effectLive = true;
+        return true;
+    }
+    /**
+     * Apply lapsed authorization deadlines. A reservation that never started is
+     * released; a running effect is quarantined and keeps its claims.
+     */
+    expire(now) {
+        assertNonNegativeInteger(now, "now");
+        for (const grant of this.activeGrants()) {
+            if (now >= grant.token.authorizationDeadline) {
+                grant.state = grant.effectLive ? "quarantined" : "cancelled";
+            }
+        }
+    }
+    /** Withdraw authorization. Requested cancellation is not observed termination. */
+    cancel(token) {
+        const grant = this.settleable(token);
+        if (grant === undefined)
+            return false;
+        grant.state = grant.effectLive ? "quarantined" : "cancelled";
+        return true;
+    }
+    /**
+     * Trusted supervisor event: this exact effect is gone. Accepted for
+     * superseded epochs so a restarted authority can still settle what the
+     * previous one started, never to authorize new work.
+     */
+    confirmTerminated(token) {
+        const grant = this.settleable(token);
+        if (grant === undefined)
+            return false;
+        grant.effectLive = false;
+        grant.state = "terminated";
+        return true;
+    }
+    /** Fence the authority. Live effects stay quarantined until confirmed. */
+    restart() {
+        this.authorityEpoch = nextSequence(this.authorityEpoch);
+        for (const grant of this.activeGrants()) {
+            grant.state = grant.effectLive ? "quarantined" : "cancelled";
+        }
+    }
+    stateOf(token) {
+        const grant = this.grants.get(token.grantSequence);
+        return grant !== undefined && sameToken(grant.token, token) ? grant.state : undefined;
+    }
+    claimsOf(token) {
+        const grant = this.grants.get(token.grantSequence);
+        return grant !== undefined && sameToken(grant.token, token) ? grant.claims : [];
+    }
+    /** Invariant: active grants fit capacity and never pairwise conflict. */
+    isSafe() {
+        const active = this.activeGrants();
+        if (active.reduce((sum, g) => sum + g.weight, 0) > this.capacity)
+            return false;
+        for (const [index, grant] of active.entries()) {
+            for (const other of active.slice(index + 1)) {
+                if (claimSetsConflict(grant.claims, other.claims))
+                    return false;
+            }
+        }
+        return true;
+    }
+}
+function sameToken(a, b) {
+    return (a.authorityEpoch === b.authorityEpoch &&
+        a.grantSequence === b.grantSequence &&
+        a.sessionId === b.sessionId &&
+        a.sessionIncarnation === b.sessionIncarnation &&
+        a.authorizationDeadline === b.authorizationDeadline);
+}
+//# sourceMappingURL=broker.js.map

package/dist/coordination/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/coordination/broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgC3E,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa,EAAQ;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACpE,CAAC;AAAA,CACD;AAED,MAAM,OAAO,eAAe;IACV,QAAQ,CAAS;IAC1B,cAAc,GAAa,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,YAAY,GAAa,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEnD,YAAY,OAA+B,EAAE;QAC5C,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAA,CACjC;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAAiB,EAAY;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,qEAAqE;IAC7D,YAAY,GAAY;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAAA,CACpF;IAED,OAAO,CAAC,KAAmB,EAAqB;QAC/C,wBAAwB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,qBAAqB,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,iCAAiC,CAAC,CAAC;QAC1G,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,WAAW,EAAE,CAAC;YAC5D,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QAChF,CAAC;QACD,6DAA6D;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1E,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,KAAK,GAAe,MAAM,CAAC,MAAM,CAAC;YACvC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,kBAAkB,EAAE,WAAW;YAC/B,qBAAqB;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE;YACpC,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7B,MAAM;YACN,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IAAA,CACb;IAED,kEAAkE;IAC1D,aAAa,CAAC,KAAiB,EAAqB;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QACnE,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,kBAAkB;YAAE,OAAO,SAAS,CAAC;QAC1F,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7D,OAAO,KAAK,CAAC;IAAA,CACb;IAED,sEAAsE;IAC9D,UAAU,CAAC,KAAiB,EAAqB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAAA,CAClE;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAiB,EAAW;QACjC,wBAAwB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,qBAAqB;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC7F,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QACxB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IAAA,CACZ;IAED;;;OAGG;IACH,MAAM,CAAC,GAAW,EAAQ;QACzB,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;gBAC9C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;YAC9D,CAAC;QACF,CAAC;IAAA,CACD;IAED,kFAAkF;IAClF,MAAM,CAAC,KAAiB,EAAW;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7D,OAAO,IAAI,CAAC;IAAA,CACZ;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAiB,EAAW;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;QACzB,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC;QAC3B,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,0EAA0E;IAC1E,OAAO,GAAS;QACf,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAC9D,CAAC;IAAA,CACD;IAED,OAAO,CAAC,KAAiB,EAA2B;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CACtF;IAED,QAAQ,CAAC,KAAiB,EAA4B;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAChF;IAED,yEAAyE;IACzE,MAAM,GAAY;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/E,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC7C,IAAI,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC;YACjE,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IAAA,CACZ;CACD;AAED,SAAS,SAAS,CAAC,CAAa,EAAE,CAAa,EAAW;IACzD,OAAO,CACN,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc;QACrC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QACnC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,kBAAkB;QAC7C,CAAC,CAAC,qBAAqB,KAAK,CAAC,CAAC,qBAAqB,CACnD,CAAC;AAAA,CACF","sourcesContent":["/**\n * In-process admission broker for parallel sessions.\n *\n * Safety property: a grant that may still own a live external effect keeps\n * holding its claims. Expiry, cancellation and authority restart are\n * authorization events; only a trusted supervisor reporting termination frees\n * the claims. Treating a lapsed deadline as \"the effect stopped\" is exactly how\n * two sessions end up writing the same path.\n *\n * Bounded reference semantics: a single trusted state machine, canonical claim\n * keys, and every shared effect crossing this broker. No IPC, no OS fencing,\n * no persistence — those belong to the supervisor this broker reports to.\n */\n\nimport { canonicalClaim, claimSetsConflict, sameClaimSet } from \"./resource.ts\";\nimport type { EffectState, GrantToken, ResourceClaim, Sequence } from \"./types.ts\";\nimport { nextSequence, SETTLED_EFFECT_STATES, sequence } from \"./types.ts\";\n\ninterface Grant {\n\treadonly token: GrantToken;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly weight: number;\n\tstate: EffectState;\n\t/** True once an external effect may exist. Never inferred from the clock. */\n\teffectLive: boolean;\n}\n\nexport interface AdmissionBrokerOptions {\n\t/** Total admissible weight of concurrently active grants. */\n\treadonly capacity: number;\n}\n\nexport interface AcquireInput {\n\treadonly sessionId: string;\n\treadonly incarnation: Sequence | string;\n\treadonly claims: readonly ResourceClaim[];\n\treadonly now: number;\n\treadonly ttl: number;\n\treadonly weight?: number;\n}\n\nexport interface StartInput {\n\treadonly token: GrantToken;\n\treadonly now: number;\n\t/** Claims the operation actually resolved to after approval hooks. */\n\treadonly actualClaims: readonly ResourceClaim[];\n}\n\nfunction assertNonNegativeInteger(value: number, label: string): void {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n\t\tthrow new TypeError(`${label} must be a nonnegative safe integer`);\n\t}\n}\n\nexport class AdmissionBroker {\n\tprivate readonly capacity: number;\n\tprivate authorityEpoch: Sequence = sequence(\"1\");\n\tprivate grantCounter: Sequence = sequence(\"0\");\n\tprivate readonly incarnations = new Map<string, Sequence>();\n\tprivate readonly grants = new Map<string, Grant>();\n\n\tconstructor(options: AdmissionBrokerOptions) {\n\t\tassertNonNegativeInteger(options.capacity, \"capacity\");\n\t\tthis.capacity = options.capacity;\n\t}\n\n\t/**\n\t * Announce a session incarnation. Re-registering does not free the previous\n\t * incarnation's grants: a restarted session cannot assume its predecessor's\n\t * effects stopped.\n\t */\n\tregister(sessionId: string): Sequence {\n\t\tif (typeof sessionId !== \"string\" || sessionId.length === 0) {\n\t\t\tthrow new TypeError(\"sessionId must be a non-empty string\");\n\t\t}\n\t\tconst next = nextSequence(this.incarnations.get(sessionId) ?? sequence(\"0\"));\n\t\tthis.incarnations.set(sessionId, next);\n\t\treturn next;\n\t}\n\n\t/** Grants still holding their claims, including quarantined ones. */\n\tprivate activeGrants(): Grant[] {\n\t\treturn [...this.grants.values()].filter((g) => !SETTLED_EFFECT_STATES.has(g.state));\n\t}\n\n\tacquire(input: AcquireInput): GrantToken | null {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst weight = input.weight ?? 1;\n\t\tassertNonNegativeInteger(weight, \"weight\");\n\t\tif (!Number.isSafeInteger(input.ttl) || input.ttl <= 0) {\n\t\t\tthrow new TypeError(\"ttl must be a positive safe integer\");\n\t\t}\n\t\tconst authorizationDeadline = input.now + input.ttl;\n\t\tif (!Number.isSafeInteger(authorizationDeadline)) throw new RangeError(\"authorization deadline overflow\");\n\t\tconst incarnation = sequence(input.incarnation);\n\t\tif (this.incarnations.get(input.sessionId) !== incarnation) {\n\t\t\tthrow new TypeError(\"stale session incarnation\");\n\t\t}\n\t\tif (!Array.isArray(input.claims) || input.claims.length === 0) {\n\t\t\tthrow new TypeError(\"an unknown scope must not be admitted as an empty scope\");\n\t\t}\n\t\t// Take owned, validated snapshots before any state mutation.\n\t\tconst claims = Array.from(input.claims, (claim) => canonicalClaim(claim));\n\n\t\t// Settle lapsed authorizations first; this never evicts a live effect.\n\t\tthis.expire(input.now);\n\t\tconst active = this.activeGrants();\n\t\tconst used = active.reduce((sum, g) => sum + g.weight, 0);\n\t\tif (weight > this.capacity - used) return null;\n\t\tif (active.some((g) => claimSetsConflict(claims, g.claims))) return null;\n\n\t\tthis.grantCounter = nextSequence(this.grantCounter);\n\t\tconst token: GrantToken = Object.freeze({\n\t\t\tauthorityEpoch: this.authorityEpoch,\n\t\t\tgrantSequence: this.grantCounter,\n\t\t\tsessionId: input.sessionId,\n\t\t\tsessionIncarnation: incarnation,\n\t\t\tauthorizationDeadline,\n\t\t});\n\t\tthis.grants.set(token.grantSequence, {\n\t\t\ttoken,\n\t\t\tclaims: Object.freeze(claims),\n\t\t\tweight,\n\t\t\tstate: \"reserved\",\n\t\t\teffectLive: false,\n\t\t});\n\t\treturn token;\n\t}\n\n\t/** Resolve a token that is still authoritative for new action. */\n\tprivate authoritative(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\tif (token.authorityEpoch !== this.authorityEpoch) return undefined;\n\t\tif (this.incarnations.get(token.sessionId) !== token.sessionIncarnation) return undefined;\n\t\tif (SETTLED_EFFECT_STATES.has(grant.state)) return undefined;\n\t\treturn grant;\n\t}\n\n\t/** Resolve a token for settlement only; accepts superseded epochs. */\n\tprivate settleable(token: GrantToken): Grant | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\tif (grant === undefined || !sameToken(grant.token, token)) return undefined;\n\t\treturn SETTLED_EFFECT_STATES.has(grant.state) ? undefined : grant;\n\t}\n\n\t/**\n\t * Bind an effect to its reservation. The actual claims must equal the\n\t * reserved set exactly — an approval hook that widened scope has to be\n\t * re-admitted, not silently allowed to run under the old grant.\n\t */\n\tstart(input: StartInput): boolean {\n\t\tassertNonNegativeInteger(input.now, \"now\");\n\t\tconst grant = this.authoritative(input.token);\n\t\tif (grant === undefined || grant.state !== \"reserved\") return false;\n\t\tif (input.now >= grant.token.authorizationDeadline) return false;\n\t\tif (!Array.isArray(input.actualClaims)) throw new TypeError(\"actualClaims must be an array\");\n\t\tconst actualClaims = Array.from(input.actualClaims, (claim) => canonicalClaim(claim));\n\t\tif (!sameClaimSet(actualClaims, grant.claims)) return false;\n\t\tgrant.state = \"running\";\n\t\tgrant.effectLive = true;\n\t\treturn true;\n\t}\n\n\t/**\n\t * Apply lapsed authorization deadlines. A reservation that never started is\n\t * released; a running effect is quarantined and keeps its claims.\n\t */\n\texpire(now: number): void {\n\t\tassertNonNegativeInteger(now, \"now\");\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tif (now >= grant.token.authorizationDeadline) {\n\t\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t\t}\n\t\t}\n\t}\n\n\t/** Withdraw authorization. Requested cancellation is not observed termination. */\n\tcancel(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\treturn true;\n\t}\n\n\t/**\n\t * Trusted supervisor event: this exact effect is gone. Accepted for\n\t * superseded epochs so a restarted authority can still settle what the\n\t * previous one started, never to authorize new work.\n\t */\n\tconfirmTerminated(token: GrantToken): boolean {\n\t\tconst grant = this.settleable(token);\n\t\tif (grant === undefined) return false;\n\t\tgrant.effectLive = false;\n\t\tgrant.state = \"terminated\";\n\t\treturn true;\n\t}\n\n\t/** Fence the authority. Live effects stay quarantined until confirmed. */\n\trestart(): void {\n\t\tthis.authorityEpoch = nextSequence(this.authorityEpoch);\n\t\tfor (const grant of this.activeGrants()) {\n\t\t\tgrant.state = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t}\n\t}\n\n\tstateOf(token: GrantToken): EffectState | undefined {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.state : undefined;\n\t}\n\n\tclaimsOf(token: GrantToken): readonly ResourceClaim[] {\n\t\tconst grant = this.grants.get(token.grantSequence);\n\t\treturn grant !== undefined && sameToken(grant.token, token) ? grant.claims : [];\n\t}\n\n\t/** Invariant: active grants fit capacity and never pairwise conflict. */\n\tisSafe(): boolean {\n\t\tconst active = this.activeGrants();\n\t\tif (active.reduce((sum, g) => sum + g.weight, 0) > this.capacity) return false;\n\t\tfor (const [index, grant] of active.entries()) {\n\t\t\tfor (const other of active.slice(index + 1)) {\n\t\t\t\tif (claimSetsConflict(grant.claims, other.claims)) return false;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n}\n\nfunction sameToken(a: GrantToken, b: GrantToken): boolean {\n\treturn (\n\t\ta.authorityEpoch === b.authorityEpoch &&\n\t\ta.grantSequence === b.grantSequence &&\n\t\ta.sessionId === b.sessionId &&\n\t\ta.sessionIncarnation === b.sessionIncarnation &&\n\t\ta.authorizationDeadline === b.authorizationDeadline\n\t);\n}\n"]}

package/dist/coordination/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Parallel-session coordination kernel.
+ *
+ * Pure, deterministic, bounded. Implements the P0 shared by the 2026-09-20
+ * coordination design and the Jev audit: bind admission to actual claims, and
+ * keep a possibly-live effect's claims held until termination is observed.
+ * No IPC, no process control, no persistence.
+ */
+export * from "./awareness.ts";
+export * from "./broker.ts";
+export * from "./integration.ts";
+export * from "./operation.ts";
+export * from "./resource.ts";
+export * from "./session.ts";
+export * from "./types.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/coordination/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/coordination/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC","sourcesContent":["/**\n * Parallel-session coordination kernel.\n *\n * Pure, deterministic, bounded. Implements the P0 shared by the 2026-09-20\n * coordination design and the Jev audit: bind admission to actual claims, and\n * keep a possibly-live effect's claims held until termination is observed.\n * No IPC, no process control, no persistence.\n */\nexport * from \"./awareness.ts\";\nexport * from \"./broker.ts\";\nexport * from \"./integration.ts\";\nexport * from \"./operation.ts\";\nexport * from \"./resource.ts\";\nexport * from \"./session.ts\";\nexport * from \"./types.ts\";\n"]}

package/dist/coordination/index.js

@@ -0,0 +1,16 @@
+/**
+ * Parallel-session coordination kernel.
+ *
+ * Pure, deterministic, bounded. Implements the P0 shared by the 2026-09-20
+ * coordination design and the Jev audit: bind admission to actual claims, and
+ * keep a possibly-live effect's claims held until termination is observed.
+ * No IPC, no process control, no persistence.
+ */
+export * from "./awareness.js";
+export * from "./broker.js";
+export * from "./integration.js";
+export * from "./operation.js";
+export * from "./resource.js";
+export * from "./session.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map