open-multi-agent-kit 1.0.0 → 1.2.2

package/dist/core/verified-run/run-publish.js

@@ -0,0 +1,210 @@
+import { realpathSync } from "node:fs";
+import { acquireSessionOwnerLeaseSync } from "../session-owner-lease.js";
+import { openRunAuthority } from "./authority-runtime.js";
+import { loadCandidate } from "./candidate.js";
+import { GitOperationBudget } from "./git-execution.js";
+import { assertGitWorkspaceRoot, casRef, GitRefCasError, OMK_ACCEPTED_REF, objectExists, repoObjectFormat, resolveRef, sealCandidateCommit, zeroOid, } from "./git-plumbing.js";
+import { journalPath, VerifiedRunJournal } from "./journal.js";
+import { assertPublishable } from "./publish-preflight.js";
+import { assertPublishEffectStart } from "./publish-start.js";
+import { requireRunJournal } from "./recovery-command.js";
+import { digestObject, VerifiedRunError } from "./storage.js";
+export { OMK_ACCEPTED_REF };
+export { publishPolicyDigest } from "./publish-preflight.js";
+function openPublishIntents(journal) {
+    return journal.records.flatMap(({ event }) => (event.kind === "publish_intent" ? [event] : []));
+}
+function terminalFor(journal, commandId) {
+    return journal.records.some(({ event }) => (event.kind === "published" || event.kind === "publish_failed") && event.commandId === commandId);
+}
+export function publishDisposition(journal, command) {
+    const first = journal.records[0]?.event;
+    if (first?.kind !== "created" ||
+        first.contract.runId !== command.runId ||
+        digestObject(first.contract) !== command.contractDigest)
+        throw new VerifiedRunError("command_conflict");
+    if (first.command.commandId === command.commandId)
+        throw new VerifiedRunError("command_conflict");
+    const own = openPublishIntents(journal).find((event) => event.commandId === command.commandId);
+    if (own) {
+        if (own.candidateDigest !== command.candidateDigest ||
+            own.parentOid !== command.parentOid ||
+            own.receiptDigest !== command.receiptDigest ||
+            own.policyDigest !== command.policyDigest)
+            throw new VerifiedRunError("command_conflict");
+        return terminalFor(journal, command.commandId) ? "completed" : "resume";
+    }
+    if (command.expectedRevision !== journal.state.revision || command.expectedGeneration !== journal.state.generation)
+        throw new VerifiedRunError("stale_revision");
+    if (journal.state.publication === "intent")
+        throw new VerifiedRunError("reconciliation_required");
+    if (journal.state.publication === "accepted")
+        throw new VerifiedRunError("already_published");
+    return "new";
+}
+export function publishVerifiedRun(runPath, command, options = {}) {
+    const initial = requireRunJournal(runPath);
+    if (publishDisposition(initial, command) === "completed")
+        return initial.state;
+    if (options.signal?.aborted)
+        throw new VerifiedRunError("cancelled");
+    const owner = acquireSessionOwnerLeaseSync(journalPath(runPath));
+    let opened = null;
+    try {
+        const snapshot = requireRunJournal(runPath);
+        if (publishDisposition(snapshot, command) === "completed")
+            return snapshot.state;
+        if (!options.authority)
+            opened = openRunAuthority(runPath);
+        const authority = options.authority ?? opened;
+        if (!authority)
+            throw new VerifiedRunError("authority");
+        const journal = new VerifiedRunJournal(runPath, owner);
+        return executePublish(runPath, snapshot, journal, command, options, authority);
+    }
+    finally {
+        try {
+            opened?.store.release();
+        }
+        finally {
+            owner.release();
+        }
+    }
+}
+export function recordPublished(journal, command, candidateOid) {
+    return journal.append({
+        kind: "published",
+        commandId: command.commandId,
+        candidateOid,
+        previousOid: command.parentOid,
+    });
+}
+function executePublish(runPath, snapshot, journal, command, options, authority) {
+    const budget = new GitOperationBudget({ signal: options.signal, timeoutMs: options.timeoutMs ?? 60_000 });
+    budget.remaining();
+    const { contract, state } = assertPublishable(snapshot, command, runPath);
+    const repoRoot = realpathSync(contract.workspace.root);
+    assertGitWorkspaceRoot(repoRoot, budget);
+    const zero = zeroOid(repoObjectFormat(repoRoot, budget));
+    if (command.parentOid.length !== zero.length)
+        throw new VerifiedRunError("invalid_binding");
+    const resumed = state.publication === "intent" && state.publicationCommandId === command.commandId;
+    // Recovery observes the existing ref; it does not restart a terminal/unknown effect.
+    if (resumed) {
+        const sealed = state.publicationCandidateOid;
+        if (!sealed)
+            throw new VerifiedRunError("invalid_binding");
+        const observed = resolveRef(repoRoot, OMK_ACCEPTED_REF, budget);
+        if (observed === sealed && objectExists(repoRoot, sealed, budget))
+            return recordPublished(journal, command, sealed);
+        if ((observed ?? zero) !== command.parentOid)
+            return journal.append({
+                kind: "publish_failed",
+                commandId: command.commandId,
+                code: "reconciliation-required",
+            });
+    }
+    budget.remaining();
+    const refClaims = [
+        {
+            namespace: "git-ref",
+            instanceId: "verified-run",
+            canonicalKey: `omk-accepted-ref/${digestObject(repoRoot).slice(0, 16)}`,
+            access: "write",
+            generation: String(state.generation),
+        },
+    ];
+    const admission = authority.store.acquire({
+        sessionId: authority.sessionId,
+        incarnation: authority.incarnation,
+        commandId: command.commandId,
+        intentDigest: digestObject({
+            candidateDigest: command.candidateDigest,
+            parentOid: command.parentOid,
+            receiptDigest: command.receiptDigest,
+            policyDigest: command.policyDigest,
+            targetRef: OMK_ACCEPTED_REF,
+        }),
+        claims: refClaims,
+        now: Date.now(),
+        ttl: 60_000,
+    });
+    if (admission.status !== "granted")
+        throw new VerifiedRunError("authority_blocked");
+    const token = admission.token;
+    // Failure here must not settle somebody else's running/quarantined grant.
+    assertPublishEffectStart(authority.store, token, refClaims, admission.duplicate);
+    let uncertain = false;
+    try {
+        budget.remaining();
+        const candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);
+        const candidateOid = sealCandidateCommit(repoRoot, {
+            manifest: candidate.manifest,
+            contents: candidate.contents,
+            parentOid: command.parentOid,
+            zeroOid: zero,
+            runId: contract.runId,
+            candidateDigest: state.candidateDigest,
+            receiptDigest: state.receiptDigest,
+        }, budget);
+        if (resumed) {
+            if (state.publicationCandidateOid !== candidateOid)
+                throw new VerifiedRunError("invalid_binding");
+        }
+        else {
+            journal.append({
+                kind: "publish_intent",
+                commandId: command.commandId,
+                candidateDigest: state.candidateDigest,
+                candidateOid,
+                parentOid: command.parentOid,
+                targetRef: OMK_ACCEPTED_REF,
+                receiptDigest: state.receiptDigest,
+                policyDigest: command.policyDigest,
+                generation: state.generation,
+            });
+        }
+        const observed = resolveRef(repoRoot, OMK_ACCEPTED_REF, budget);
+        if (observed === candidateOid && objectExists(repoRoot, candidateOid, budget))
+            return recordPublished(journal, command, candidateOid);
+        if ((observed ?? zero) !== command.parentOid)
+            return journal.append({
+                kind: "publish_failed",
+                commandId: command.commandId,
+                code: resumed ? "reconciliation-required" : "stale-parent",
+            });
+        budget.remaining();
+        if (!authority.store.effectAuthorized(token, refClaims))
+            throw new VerifiedRunError("authority");
+        try {
+            casRef(repoRoot, OMK_ACCEPTED_REF, candidateOid, command.parentOid, budget);
+        }
+        catch (error) {
+            if (!(error instanceof GitRefCasError))
+                throw error;
+            const recoveryBudget = new GitOperationBudget({ timeoutMs: 5_000 });
+            const after = resolveRef(repoRoot, OMK_ACCEPTED_REF, recoveryBudget);
+            if (after === candidateOid && objectExists(repoRoot, candidateOid, recoveryBudget))
+                return recordPublished(journal, command, candidateOid);
+            return journal.append({
+                kind: "publish_failed",
+                commandId: command.commandId,
+                code: after === observed ? "ref-rejected" : resumed ? "reconciliation-required" : "stale-parent",
+            });
+        }
+        // Once CAS succeeded, cancellation must not undo the committed publication.
+        options.afterCas?.();
+        return recordPublished(journal, command, candidateOid);
+    }
+    catch (error) {
+        uncertain = error instanceof VerifiedRunError && error.code === "git_outcome_unknown";
+        throw error;
+    }
+    finally {
+        if (uncertain)
+            authority.store.cancel(token);
+        else
+            authority.store.confirmTerminated(token);
+    }
+}
+//# sourceMappingURL=run-publish.js.map

package/dist/core/verified-run/run-publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-publish.js","sourceRoot":"","sources":["../../../src/core/verified-run/run-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACN,sBAAsB,EACtB,MAAM,EACN,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,OAAO,GACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAwB,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D,SAAS,kBAAkB,CAAC,OAAwB,EAA4B;IAC/E,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CAChG;AACD,SAAS,WAAW,CAAC,OAAwB,EAAE,SAAiB,EAAW;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAC1B,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAC/G,CAAC;AAAA,CACF;AACD,MAAM,UAAU,kBAAkB,CACjC,OAAwB,EACxB,OAA0B,EACO;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACxC,IACC,KAAK,EAAE,IAAI,KAAK,SAAS;QACzB,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;QACtC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,cAAc;QAEvD,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/F,IAAI,GAAG,EAAE,CAAC;QACT,IACC,GAAG,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;YAC/C,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YACnC,GAAG,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;YAC3C,GAAG,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;YAEzC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAChD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,KAAK,CAAC,UAAU;QACjH,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AAAA,CACb;AAWD,MAAM,UAAU,kBAAkB,CACjC,OAAe,EACf,OAA0B,EAC1B,OAAO,GAAmB,EAAE,EACZ;IAChB,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,4BAA4B,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC9C,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChF,CAAC;YAAS,CAAC;QACV,IAAI,CAAC;YACJ,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACV,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;AAAA,CACD;AAED,MAAM,UAAU,eAAe,CAC9B,OAA2B,EAC3B,OAA0B,EAC1B,YAAoB,EACJ;IAChB,OAAO,OAAO,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY;QACZ,WAAW,EAAE,OAAO,CAAC,SAAS;KAC9B,CAAC,CAAC;AAAA,CACH;AAED,SAAS,cAAc,CACtB,OAAe,EACf,QAAyB,EACzB,OAA2B,EAC3B,OAA0B,EAC1B,OAAuB,EACvB,SAAuB,EACP;IAChB,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;IAC1G,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,oBAAoB,KAAK,OAAO,CAAC,SAAS,CAAC;IACnG,qFAAqF;IACrF,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YAChE,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,SAAS;YAC3C,OAAO,OAAO,CAAC,MAAM,CAAC;gBACrB,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,yBAAyB;aAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG;QACjB;YACC,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,cAAc;YAC1B,YAAY,EAAE,oBAAoB,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACvE,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;SACpC;KACD,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,YAAY,CAAC;YAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,gBAAgB;SAC3B,CAAC;QACF,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QACf,GAAG,EAAE,MAAM;KACX,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,0EAA0E;IAC1E,wBAAwB,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACjF,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACJ,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjF,MAAM,YAAY,GAAG,mBAAmB,CACvC,QAAQ,EACR;YACC,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa;SAClC,EACD,MAAM,CACN,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,uBAAuB,KAAK,YAAY;gBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACnG,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,gBAAgB;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,UAAU,EAAE,KAAK,CAAC,UAAU;aAC5B,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,YAAY,IAAI,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC;YAC5E,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,SAAS;YAC3C,OAAO,OAAO,CAAC,MAAM,CAAC;gBACrB,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc;aAC1D,CAAC,CAAC;QACJ,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjG,IAAI,CAAC;YACJ,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;gBAAE,MAAM,KAAK,CAAC;YACpD,MAAM,cAAc,GAAG,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;YACrE,IAAI,KAAK,KAAK,YAAY,IAAI,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,CAAC;gBACjF,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YACxD,OAAO,OAAO,CAAC,MAAM,CAAC;gBACrB,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc;aAChG,CAAC,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACrB,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,GAAG,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC;QACtF,MAAM,KAAK,CAAC;IACb,CAAC;YAAS,CAAC;QACV,IAAI,SAAS;YAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;YACxC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AAAA,CACD","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport type { RunPublishCommand } from \"omk-protocol\";\nimport { acquireSessionOwnerLeaseSync } from \"../session-owner-lease.ts\";\nimport { openRunAuthority, type RunAuthority } from \"./authority-runtime.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { GitOperationBudget } from \"./git-execution.ts\";\nimport {\n\tassertGitWorkspaceRoot,\n\tcasRef,\n\tGitRefCasError,\n\tOMK_ACCEPTED_REF,\n\tobjectExists,\n\trepoObjectFormat,\n\tresolveRef,\n\tsealCandidateCommit,\n\tzeroOid,\n} from \"./git-plumbing.ts\";\nimport { type JournalSnapshot, journalPath, VerifiedRunJournal } from \"./journal.ts\";\nimport { assertPublishable } from \"./publish-preflight.ts\";\nimport { assertPublishEffectStart } from \"./publish-start.ts\";\nimport { requireRunJournal } from \"./recovery-command.ts\";\nimport type { RunEvent, RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\nexport { OMK_ACCEPTED_REF };\nexport { publishPolicyDigest } from \"./publish-preflight.ts\";\n\ntype PublishIntent = Extract<RunEvent, { kind: \"publish_intent\" }>;\nfunction openPublishIntents(journal: JournalSnapshot): readonly PublishIntent[] {\n\treturn journal.records.flatMap(({ event }) => (event.kind === \"publish_intent\" ? [event] : []));\n}\nfunction terminalFor(journal: JournalSnapshot, commandId: string): boolean {\n\treturn journal.records.some(\n\t\t({ event }) => (event.kind === \"published\" || event.kind === \"publish_failed\") && event.commandId === commandId,\n\t);\n}\nexport function publishDisposition(\n\tjournal: JournalSnapshot,\n\tcommand: RunPublishCommand,\n): \"completed\" | \"resume\" | \"new\" {\n\tconst first = journal.records[0]?.event;\n\tif (\n\t\tfirst?.kind !== \"created\" ||\n\t\tfirst.contract.runId !== command.runId ||\n\t\tdigestObject(first.contract) !== command.contractDigest\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (first.command.commandId === command.commandId) throw new VerifiedRunError(\"command_conflict\");\n\tconst own = openPublishIntents(journal).find((event) => event.commandId === command.commandId);\n\tif (own) {\n\t\tif (\n\t\t\town.candidateDigest !== command.candidateDigest ||\n\t\t\town.parentOid !== command.parentOid ||\n\t\t\town.receiptDigest !== command.receiptDigest ||\n\t\t\town.policyDigest !== command.policyDigest\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"command_conflict\");\n\t\treturn terminalFor(journal, command.commandId) ? \"completed\" : \"resume\";\n\t}\n\tif (command.expectedRevision !== journal.state.revision || command.expectedGeneration !== journal.state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (journal.state.publication === \"intent\") throw new VerifiedRunError(\"reconciliation_required\");\n\tif (journal.state.publication === \"accepted\") throw new VerifiedRunError(\"already_published\");\n\treturn \"new\";\n}\n\nexport interface PublishOptions {\n\t/** Fault injection after a successful CAS, before the result record. */\n\treadonly afterCas?: () => void;\n\treadonly signal?: AbortSignal;\n\t/** One monotonic deadline shared by all Git writes, never replenished per file. */\n\treadonly timeoutMs?: number;\n\treadonly authority?: RunAuthority;\n}\n\nexport function publishVerifiedRun(\n\trunPath: string,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions = {},\n): RunProjection {\n\tconst initial = requireRunJournal(runPath);\n\tif (publishDisposition(initial, command) === \"completed\") return initial.state;\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tconst owner = acquireSessionOwnerLeaseSync(journalPath(runPath));\n\tlet opened: RunAuthority | null = null;\n\ttry {\n\t\tconst snapshot = requireRunJournal(runPath);\n\t\tif (publishDisposition(snapshot, command) === \"completed\") return snapshot.state;\n\t\tif (!options.authority) opened = openRunAuthority(runPath);\n\t\tconst authority = options.authority ?? opened;\n\t\tif (!authority) throw new VerifiedRunError(\"authority\");\n\t\tconst journal = new VerifiedRunJournal(runPath, owner);\n\t\treturn executePublish(runPath, snapshot, journal, command, options, authority);\n\t} finally {\n\t\ttry {\n\t\t\topened?.store.release();\n\t\t} finally {\n\t\t\towner.release();\n\t\t}\n\t}\n}\n\nexport function recordPublished(\n\tjournal: VerifiedRunJournal,\n\tcommand: RunPublishCommand,\n\tcandidateOid: string,\n): RunProjection {\n\treturn journal.append({\n\t\tkind: \"published\",\n\t\tcommandId: command.commandId,\n\t\tcandidateOid,\n\t\tpreviousOid: command.parentOid,\n\t});\n}\n\nfunction executePublish(\n\trunPath: string,\n\tsnapshot: JournalSnapshot,\n\tjournal: VerifiedRunJournal,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions,\n\tauthority: RunAuthority,\n): RunProjection {\n\tconst budget = new GitOperationBudget({ signal: options.signal, timeoutMs: options.timeoutMs ?? 60_000 });\n\tbudget.remaining();\n\tconst { contract, state } = assertPublishable(snapshot, command, runPath);\n\tconst repoRoot = realpathSync(contract.workspace.root);\n\tassertGitWorkspaceRoot(repoRoot, budget);\n\tconst zero = zeroOid(repoObjectFormat(repoRoot, budget));\n\tif (command.parentOid.length !== zero.length) throw new VerifiedRunError(\"invalid_binding\");\n\tconst resumed = state.publication === \"intent\" && state.publicationCommandId === command.commandId;\n\t// Recovery observes the existing ref; it does not restart a terminal/unknown effect.\n\tif (resumed) {\n\t\tconst sealed = state.publicationCandidateOid;\n\t\tif (!sealed) throw new VerifiedRunError(\"invalid_binding\");\n\t\tconst observed = resolveRef(repoRoot, OMK_ACCEPTED_REF, budget);\n\t\tif (observed === sealed && objectExists(repoRoot, sealed, budget))\n\t\t\treturn recordPublished(journal, command, sealed);\n\t\tif ((observed ?? zero) !== command.parentOid)\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: \"reconciliation-required\",\n\t\t\t});\n\t}\n\tbudget.remaining();\n\tconst refClaims = [\n\t\t{\n\t\t\tnamespace: \"git-ref\",\n\t\t\tinstanceId: \"verified-run\",\n\t\t\tcanonicalKey: `omk-accepted-ref/${digestObject(repoRoot).slice(0, 16)}`,\n\t\t\taccess: \"write\",\n\t\t\tgeneration: String(state.generation),\n\t\t},\n\t];\n\tconst admission = authority.store.acquire({\n\t\tsessionId: authority.sessionId,\n\t\tincarnation: authority.incarnation,\n\t\tcommandId: command.commandId,\n\t\tintentDigest: digestObject({\n\t\t\tcandidateDigest: command.candidateDigest,\n\t\t\tparentOid: command.parentOid,\n\t\t\treceiptDigest: command.receiptDigest,\n\t\t\tpolicyDigest: command.policyDigest,\n\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t}),\n\t\tclaims: refClaims,\n\t\tnow: Date.now(),\n\t\tttl: 60_000,\n\t});\n\tif (admission.status !== \"granted\") throw new VerifiedRunError(\"authority_blocked\");\n\tconst token = admission.token;\n\t// Failure here must not settle somebody else's running/quarantined grant.\n\tassertPublishEffectStart(authority.store, token, refClaims, admission.duplicate);\n\tlet uncertain = false;\n\ttry {\n\t\tbudget.remaining();\n\t\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\t\tconst candidateOid = sealCandidateCommit(\n\t\t\trepoRoot,\n\t\t\t{\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t\tcontents: candidate.contents,\n\t\t\t\tparentOid: command.parentOid,\n\t\t\t\tzeroOid: zero,\n\t\t\t\trunId: contract.runId,\n\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t},\n\t\t\tbudget,\n\t\t);\n\t\tif (resumed) {\n\t\t\tif (state.publicationCandidateOid !== candidateOid) throw new VerifiedRunError(\"invalid_binding\");\n\t\t} else {\n\t\t\tjournal.append({\n\t\t\t\tkind: \"publish_intent\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\tcandidateOid,\n\t\t\t\tparentOid: command.parentOid,\n\t\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t\tpolicyDigest: command.policyDigest,\n\t\t\t\tgeneration: state.generation,\n\t\t\t});\n\t\t}\n\t\tconst observed = resolveRef(repoRoot, OMK_ACCEPTED_REF, budget);\n\t\tif (observed === candidateOid && objectExists(repoRoot, candidateOid, budget))\n\t\t\treturn recordPublished(journal, command, candidateOid);\n\t\tif ((observed ?? zero) !== command.parentOid)\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: resumed ? \"reconciliation-required\" : \"stale-parent\",\n\t\t\t});\n\t\tbudget.remaining();\n\t\tif (!authority.store.effectAuthorized(token, refClaims)) throw new VerifiedRunError(\"authority\");\n\t\ttry {\n\t\t\tcasRef(repoRoot, OMK_ACCEPTED_REF, candidateOid, command.parentOid, budget);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof GitRefCasError)) throw error;\n\t\t\tconst recoveryBudget = new GitOperationBudget({ timeoutMs: 5_000 });\n\t\t\tconst after = resolveRef(repoRoot, OMK_ACCEPTED_REF, recoveryBudget);\n\t\t\tif (after === candidateOid && objectExists(repoRoot, candidateOid, recoveryBudget))\n\t\t\t\treturn recordPublished(journal, command, candidateOid);\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: after === observed ? \"ref-rejected\" : resumed ? \"reconciliation-required\" : \"stale-parent\",\n\t\t\t});\n\t\t}\n\t\t// Once CAS succeeded, cancellation must not undo the committed publication.\n\t\toptions.afterCas?.();\n\t\treturn recordPublished(journal, command, candidateOid);\n\t} catch (error) {\n\t\tuncertain = error instanceof VerifiedRunError && error.code === \"git_outcome_unknown\";\n\t\tthrow error;\n\t} finally {\n\t\tif (uncertain) authority.store.cancel(token);\n\t\telse authority.store.confirmTerminated(token);\n\t}\n}\n"]}

package/dist/core/verified-run/run-status-owned.d.ts

@@ -0,0 +1,4 @@
+import type { AuthorityStatus, RunStatus } from "./run-status.ts";
+/** A published ref and a terminated execution owner are independent observations. */
+export declare function withOwnedGitStatus(status: RunStatus, authority: AuthorityStatus): RunStatus;
+//# sourceMappingURL=run-status-owned.d.ts.map

package/dist/core/verified-run/run-status-owned.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-status-owned.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/run-status-owned.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAElE,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,GAAG,SAAS,CAY3F","sourcesContent":["import type { AuthorityStatus, RunStatus } from \"./run-status.ts\";\n\n/** A published ref and a terminated execution owner are independent observations. */\nexport function withOwnedGitStatus(status: RunStatus, authority: AuthorityStatus): RunStatus {\n\tconst pending = authority.blockingGrants.filter(\n\t\t(grant) => grant.sessionId === status.runId && grant.claims.some((claim) => claim.namespace === \"git-ref\"),\n\t).length;\n\tif (pending === 0) return status;\n\treturn Object.freeze({\n\t\t...status,\n\t\tcleanSuccess: false,\n\t\tterminal: false,\n\t\tpendingEffects: status.pendingEffects + pending,\n\t\tunresolved: Object.freeze([...new Set([...status.unresolved, \"pending_effects\" as const])]),\n\t});\n}\n"]}

package/dist/core/verified-run/run-status-owned.js

@@ -0,0 +1,14 @@
+/** A published ref and a terminated execution owner are independent observations. */
+export function withOwnedGitStatus(status, authority) {
+    const pending = authority.blockingGrants.filter((grant) => grant.sessionId === status.runId && grant.claims.some((claim) => claim.namespace === "git-ref")).length;
+    if (pending === 0)
+        return status;
+    return Object.freeze({
+        ...status,
+        cleanSuccess: false,
+        terminal: false,
+        pendingEffects: status.pendingEffects + pending,
+        unresolved: Object.freeze([...new Set([...status.unresolved, "pending_effects"])]),
+    });
+}
+//# sourceMappingURL=run-status-owned.js.map

package/dist/core/verified-run/run-status-owned.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-status-owned.js","sourceRoot":"","sources":["../../../src/core/verified-run/run-status-owned.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,SAA0B,EAAa;IAC5F,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,MAAM,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAC1G,CAAC,MAAM,CAAC;IACT,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,MAAM;QACT,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO;QAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,iBAA0B,CAAC,CAAC,CAAC,CAAC;KAC3F,CAAC,CAAC;AAAA,CACH","sourcesContent":["import type { AuthorityStatus, RunStatus } from \"./run-status.ts\";\n\n/** A published ref and a terminated execution owner are independent observations. */\nexport function withOwnedGitStatus(status: RunStatus, authority: AuthorityStatus): RunStatus {\n\tconst pending = authority.blockingGrants.filter(\n\t\t(grant) => grant.sessionId === status.runId && grant.claims.some((claim) => claim.namespace === \"git-ref\"),\n\t).length;\n\tif (pending === 0) return status;\n\treturn Object.freeze({\n\t\t...status,\n\t\tcleanSuccess: false,\n\t\tterminal: false,\n\t\tpendingEffects: status.pendingEffects + pending,\n\t\tunresolved: Object.freeze([...new Set([...status.unresolved, \"pending_effects\" as const])]),\n\t});\n}\n"]}

package/dist/core/verified-run/run-status.d.ts

@@ -0,0 +1,133 @@
+import type { AuthorityEvent, AuthorityGrantRecord, AuthorityProjection } from "./authority-events.ts";
+import type { RunProjection } from "./run-types.ts";
+/**
+ * Derived lifecycle/recovery status surfaces (WP06).
+ *
+ * Everything here is a pure function of the replayed journals: the run
+ * projection and the authority projection/records are the single source of
+ * truth, and this module never invents parallel status strings — `lifecycle`
+ * and `completion` are named projections of the same facts the axes already
+ * report (`execution`, `settlement`, `verification`, `application`,
+ * `publication`, `failure`, grant states and transition events).
+ *
+ * Separations the surface guarantees (docs/03, docs/12 WP06):
+ *   - cancellation requested vs terminated: an authority grant that got
+ *     `cancel-requested` with a live effect stays `quarantined` and keeps its
+ *     claims until `termination-observed` witnesses it;
+ *   - prompt settled vs verified vs published: `completion` is a three-tier
+ *     ladder (`prompt_settled` < `verification_passed` < `published`) derived
+ *     from candidate/receipt/publication facts, never from prose;
+ *   - accepted vs published: `lifecycle: "accepted"` is the verified,
+ *     publishable state; `published` requires the CAS result record;
+ *   - recovery/unknown states vs clean success: `cleanSuccess` is true only
+ *     for a terminal run with an empty `unresolved` list — quarantine,
+ *     unverified termination, a refused or half-published outbox entry and a
+ *     violated check set all stay visible instead of collapsing into success.
+ */
+/** Single-token lifecycle derived from the run axes; snake_case matches the projection vocabulary. */
+export type RunLifecycle = "queued" | "running" | "verifying" | "resuming" | "blocked" | "accepted" | "published" | "violated" | "cancelled" | "failed" | "quarantined";
+/** User-visible completion ladder: prompt-settled < verification-passed < published (docs/03 §10). */
+export type RunCompletion = "none" | "prompt_settled" | "verification_passed" | "published";
+/** Machine-collected open concerns; a clean terminal run carries none. */
+export type RunUnresolved = "pending_effects" | "verification_pending" | "verification_violated" | "publication_intent" | "publication_refused" | "publication_reconciliation_required";
+export interface RunRecoveryCommand {
+    /** The recovery CLI verb to run. */
+    readonly command: "resume" | "retry_tasks" | "restart_writer" | "publish";
+    /** Exact target identity the command must name. */
+    readonly runId: string;
+    readonly revision: number;
+    readonly generation: number;
+    /** Scope: candidate/base digests or task ids the command binds. */
+    readonly scope: {
+        readonly candidateDigest?: string;
+        readonly baseDigest?: string;
+        readonly taskIds?: readonly string[];
+    };
+    /**
+     * Projection-level eligibility only — deadline, clock and namespace
+     * readiness are host-checked by `inspectRecovery`/`inspectWriterRecovery`/
+     * `inspectTaskRecovery`; this hint never claims the command will succeed.
+     */
+    readonly advisory: true;
+}
+export interface RunStatus {
+    readonly runId: string;
+    readonly revision: number;
+    readonly generation: number;
+    readonly lifecycle: RunLifecycle;
+    readonly completion: RunCompletion;
+    /** True only for a terminal run that reached verification_passed/published with zero unresolved concerns. */
+    readonly cleanSuccess: boolean;
+    readonly terminal: boolean;
+    readonly unresolved: readonly RunUnresolved[];
+    /** Verbatim axes, same strings the journal projection computes. */
+    readonly execution: RunProjection["execution"];
+    readonly settlement: RunProjection["settlement"];
+    readonly verification: RunProjection["verification"];
+    readonly application: RunProjection["application"];
+    readonly publication: {
+        readonly state: RunProjection["publication"];
+        readonly commandId: string | null;
+        readonly candidateOid: string | null;
+        readonly ref: string | null;
+        readonly failure: string | null;
+    };
+    /** Failure code as recorded (`descendant_escape`, `termination_unverified`, `cancelled`, …). */
+    readonly cause: string | null;
+    readonly pendingEffects: number;
+    readonly writerOpen: boolean;
+    readonly recovery: RunProjection["lastRecovery"];
+    readonly recoveryCommands: readonly RunRecoveryCommand[];
+}
+/** Derive the status view; pure projection truth in, status out, no I/O. */
+export declare function deriveRunStatus(state: RunProjection): RunStatus;
+export type AuthorityGrantCause = "cancel_requested" | "authorization_expired" | "restart_unreconciled" | "unwitnessed";
+export interface AuthorityGrantStatus {
+    readonly grantSequence: string;
+    readonly sessionId: string;
+    readonly sessionIncarnation: string;
+    readonly authorityEpoch: string;
+    readonly commandId: string;
+    readonly intentDigest: string;
+    /** Verbatim grant state — the authority projection's own vocabulary. */
+    readonly state: AuthorityGrantRecord["state"];
+    readonly effectLive: boolean;
+    /** Claims this grant still holds — what it blocks, with exact scope. */
+    readonly claims: readonly {
+        readonly namespace: string;
+        readonly instanceId: string;
+        readonly canonicalKey: string;
+        readonly access: string;
+        readonly generation: string;
+    }[];
+    readonly weight: number;
+    readonly dispatchId: string | null;
+    readonly authorizationDeadline: number;
+    /** Why the grant is in this state; null when records were not supplied. */
+    readonly cause: AuthorityGrantCause | null;
+    /**
+     * Cancellation requested vs terminated: true only when a
+     * `termination-observed` record witnessed this exact grant.
+     */
+    readonly terminationWitnessed: boolean;
+}
+export interface AuthorityStatus {
+    readonly epoch: string | null;
+    readonly reconciledEpoch: string | null;
+    readonly pendingReconcile: boolean;
+    /** Grants still holding claims — what is blocking new admission. */
+    readonly blockingGrants: readonly AuthorityGrantStatus[];
+    readonly settledGrantCount: number;
+    readonly tombstoneCount: number;
+    readonly incarnations: readonly {
+        readonly sessionId: string;
+        readonly incarnation: string;
+    }[];
+}
+/**
+ * Derive the authority status from the committed projection; pass the journal
+ * records' events so quarantine/cancel causes stay distinguishable — the
+ * projection alone intentionally does not restate them.
+ */
+export declare function deriveAuthorityStatus(projection: AuthorityProjection, events?: readonly AuthorityEvent[]): AuthorityStatus;
+//# sourceMappingURL=run-status.d.ts.map

package/dist/core/verified-run/run-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-status.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/run-status.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,sGAAsG;AACtG,MAAM,MAAM,YAAY,GACrB,QAAQ,GACR,SAAS,GACT,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,QAAQ,GACR,aAAa,CAAC;AAEjB,uGAAsG;AACtG,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,gBAAgB,GAAG,qBAAqB,GAAG,WAAW,CAAC;AAE5F,0EAA0E;AAC1E,MAAM,MAAM,aAAa,GACtB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,oBAAoB,GACpB,qBAAqB,GACrB,qCAAqC,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IAClC,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAC1E,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,6GAA6G;IAC7G,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,kGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACzD;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,CA8D/D;AAkED,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAExH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0EAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,0EAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,sEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,GAAE,SAAS,cAAc,EAAO,GACpC,eAAe,CA+DjB","sourcesContent":["import { MAX_VERIFIED_RUN_GENERATIONS } from \"omk-protocol\";\nimport { SETTLED_EFFECT_STATES } from \"../../coordination/types.ts\";\nimport type { AuthorityEvent, AuthorityGrantRecord, AuthorityProjection } from \"./authority-events.ts\";\nimport { authorityPendingReconcile } from \"./authority-events.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\n\n/**\n * Derived lifecycle/recovery status surfaces (WP06).\n *\n * Everything here is a pure function of the replayed journals: the run\n * projection and the authority projection/records are the single source of\n * truth, and this module never invents parallel status strings — `lifecycle`\n * and `completion` are named projections of the same facts the axes already\n * report (`execution`, `settlement`, `verification`, `application`,\n * `publication`, `failure`, grant states and transition events).\n *\n * Separations the surface guarantees (docs/03, docs/12 WP06):\n *   - cancellation requested vs terminated: an authority grant that got\n *     `cancel-requested` with a live effect stays `quarantined` and keeps its\n *     claims until `termination-observed` witnesses it;\n *   - prompt settled vs verified vs published: `completion` is a three-tier\n *     ladder (`prompt_settled` < `verification_passed` < `published`) derived\n *     from candidate/receipt/publication facts, never from prose;\n *   - accepted vs published: `lifecycle: \"accepted\"` is the verified,\n *     publishable state; `published` requires the CAS result record;\n *   - recovery/unknown states vs clean success: `cleanSuccess` is true only\n *     for a terminal run with an empty `unresolved` list — quarantine,\n *     unverified termination, a refused or half-published outbox entry and a\n *     violated check set all stay visible instead of collapsing into success.\n */\n\n/** Single-token lifecycle derived from the run axes; snake_case matches the projection vocabulary. */\nexport type RunLifecycle =\n\t| \"queued\"\n\t| \"running\"\n\t| \"verifying\"\n\t| \"resuming\"\n\t| \"blocked\"\n\t| \"accepted\"\n\t| \"published\"\n\t| \"violated\"\n\t| \"cancelled\"\n\t| \"failed\"\n\t| \"quarantined\";\n\n/** User-visible completion ladder: prompt-settled < verification-passed < published (docs/03 §10). */\nexport type RunCompletion = \"none\" | \"prompt_settled\" | \"verification_passed\" | \"published\";\n\n/** Machine-collected open concerns; a clean terminal run carries none. */\nexport type RunUnresolved =\n\t| \"pending_effects\"\n\t| \"verification_pending\"\n\t| \"verification_violated\"\n\t| \"publication_intent\"\n\t| \"publication_refused\"\n\t| \"publication_reconciliation_required\";\n\nexport interface RunRecoveryCommand {\n\t/** The recovery CLI verb to run. */\n\treadonly command: \"resume\" | \"retry_tasks\" | \"restart_writer\" | \"publish\";\n\t/** Exact target identity the command must name. */\n\treadonly runId: string;\n\treadonly revision: number;\n\treadonly generation: number;\n\t/** Scope: candidate/base digests or task ids the command binds. */\n\treadonly scope: {\n\t\treadonly candidateDigest?: string;\n\t\treadonly baseDigest?: string;\n\t\treadonly taskIds?: readonly string[];\n\t};\n\t/**\n\t * Projection-level eligibility only — deadline, clock and namespace\n\t * readiness are host-checked by `inspectRecovery`/`inspectWriterRecovery`/\n\t * `inspectTaskRecovery`; this hint never claims the command will succeed.\n\t */\n\treadonly advisory: true;\n}\n\nexport interface RunStatus {\n\treadonly runId: string;\n\treadonly revision: number;\n\treadonly generation: number;\n\treadonly lifecycle: RunLifecycle;\n\treadonly completion: RunCompletion;\n\t/** True only for a terminal run that reached verification_passed/published with zero unresolved concerns. */\n\treadonly cleanSuccess: boolean;\n\treadonly terminal: boolean;\n\treadonly unresolved: readonly RunUnresolved[];\n\t/** Verbatim axes, same strings the journal projection computes. */\n\treadonly execution: RunProjection[\"execution\"];\n\treadonly settlement: RunProjection[\"settlement\"];\n\treadonly verification: RunProjection[\"verification\"];\n\treadonly application: RunProjection[\"application\"];\n\treadonly publication: {\n\t\treadonly state: RunProjection[\"publication\"];\n\t\treadonly commandId: string | null;\n\t\treadonly candidateOid: string | null;\n\t\treadonly ref: string | null;\n\t\treadonly failure: string | null;\n\t};\n\t/** Failure code as recorded (`descendant_escape`, `termination_unverified`, `cancelled`, …). */\n\treadonly cause: string | null;\n\treadonly pendingEffects: number;\n\treadonly writerOpen: boolean;\n\treadonly recovery: RunProjection[\"lastRecovery\"];\n\treadonly recoveryCommands: readonly RunRecoveryCommand[];\n}\n\n/** Derive the status view; pure projection truth in, status out, no I/O. */\nexport function deriveRunStatus(state: RunProjection): RunStatus {\n\tconst unresolved: RunUnresolved[] = [];\n\tif (state.activeExecutionIds.length > 0 || state.writerOpen) unresolved.push(\"pending_effects\");\n\tif (state.candidateDigest && !state.receiptDigest && state.execution !== \"failed\" && state.execution !== \"ready\")\n\t\tunresolved.push(\"verification_pending\");\n\tif (state.verification === \"violated\") unresolved.push(\"verification_violated\");\n\tif (state.publication === \"intent\") unresolved.push(\"publication_intent\");\n\tif (state.publication === \"failed\") unresolved.push(\"publication_refused\");\n\tif (state.publication === \"reconciliation_required\") unresolved.push(\"publication_reconciliation_required\");\n\n\tconst completion: RunCompletion =\n\t\tstate.publication === \"accepted\"\n\t\t\t? \"published\"\n\t\t\t: state.verification === \"verified\"\n\t\t\t\t? \"verification_passed\"\n\t\t\t\t: state.candidateDigest\n\t\t\t\t\t? \"prompt_settled\"\n\t\t\t\t\t: \"none\";\n\n\tconst terminal = state.execution === \"succeeded\" || state.execution === \"failed\";\n\tlet lifecycle: RunLifecycle;\n\tif (state.settlement === \"quarantined\") lifecycle = \"quarantined\";\n\telse if (state.execution === \"ready\") lifecycle = \"queued\";\n\telse if (state.execution === \"running\") {\n\t\tif (state.lastRecovery && state.lastRecovery.generation === state.generation) lifecycle = \"resuming\";\n\t\telse if (state.candidateDigest && !state.receiptDigest) lifecycle = \"verifying\";\n\t\telse lifecycle = \"running\";\n\t} else if (state.execution === \"paused\") lifecycle = \"blocked\";\n\telse if (state.execution === \"failed\") lifecycle = state.failure === \"cancelled\" ? \"cancelled\" : \"failed\";\n\telse if (state.verification === \"verified\") lifecycle = state.publication === \"accepted\" ? \"published\" : \"accepted\";\n\telse lifecycle = \"violated\";\n\n\treturn Object.freeze({\n\t\trunId: state.runId,\n\t\trevision: state.revision,\n\t\tgeneration: state.generation,\n\t\tlifecycle,\n\t\tcompletion,\n\t\t// Clean success means the verification ladder actually climbed: a\n\t\t// terminal cancel/failure/violation, or a verified run with an open\n\t\t// publish outbox, never reports clean.\n\t\tcleanSuccess:\n\t\t\tterminal && unresolved.length === 0 && (completion === \"verification_passed\" || completion === \"published\"),\n\t\tterminal,\n\t\tunresolved: Object.freeze(unresolved),\n\t\texecution: state.execution,\n\t\tsettlement: state.settlement,\n\t\tverification: state.verification,\n\t\tapplication: state.application,\n\t\tpublication: Object.freeze({\n\t\t\tstate: state.publication,\n\t\t\tcommandId: state.publicationCommandId,\n\t\t\tcandidateOid: state.publicationCandidateOid,\n\t\t\tref: state.publicationRef,\n\t\t\tfailure: state.publicationFailure,\n\t\t}),\n\t\tcause: state.failure,\n\t\tpendingEffects: state.activeExecutionIds.length,\n\t\twriterOpen: state.writerOpen,\n\t\trecovery: state.lastRecovery,\n\t\trecoveryCommands: Object.freeze(recoveryCommands(state)),\n\t});\n}\n\nfunction recoveryCommands(state: RunProjection): RunRecoveryCommand[] {\n\tconst commands: RunRecoveryCommand[] = [];\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) return commands;\n\tconst base = { runId: state.runId, revision: state.revision, generation: state.generation } as const;\n\t// A frozen candidate can be re-verified under a new generation (resume gate\n\t// mirrors `assertCandidateRecoverable`: candidate, no receipt, not failed).\n\tif (\n\t\tstate.candidateDigest &&\n\t\t!state.receiptDigest &&\n\t\t!state.writerOpen &&\n\t\tstate.execution !== \"failed\" &&\n\t\tstate.execution !== \"ready\"\n\t) {\n\t\tcommands.push({\n\t\t\t...base,\n\t\t\tcommand: \"resume\",\n\t\t\tscope: { candidateDigest: state.candidateDigest },\n\t\t\tadvisory: true,\n\t\t});\n\t}\n\t// DAG tasks can be retried from the input checkpoint (retry gate mirrors\n\t// `commandDisposition`: input checkpoint present, tasks exist).\n\tif (state.inputDigest && state.tasks.length > 0) {\n\t\tconst failed = state.tasks\n\t\t\t.filter((task) => task.status === \"failed\" || (task.status === \"pending\" && task.attempt > 0))\n\t\t\t.map((task) => task.taskId);\n\t\tif (failed.length > 0) {\n\t\t\tcommands.push({\n\t\t\t\t...base,\n\t\t\t\tcommand: \"retry_tasks\",\n\t\t\t\tscope: { baseDigest: state.inputDigest, taskIds: Object.freeze(failed) },\n\t\t\t\tadvisory: true,\n\t\t\t});\n\t\t}\n\t}\n\t// A writer that never produced a candidate restarts from the input\n\t// checkpoint (non-DAG profiles only; DAG recovery is retry_tasks).\n\tif (state.inputDigest && !state.candidateDigest && state.tasks.length === 0 && state.execution !== \"ready\") {\n\t\tcommands.push({\n\t\t\t...base,\n\t\t\tcommand: \"restart_writer\",\n\t\t\tscope: { baseDigest: state.inputDigest },\n\t\t\tadvisory: true,\n\t\t});\n\t}\n\t// The publish outbox: a verified, settled run can publish; a refused or\n\t// half-published intent is re-driven by the same command identity.\n\tif (\n\t\tstate.application === \"candidate_ready\" &&\n\t\tstate.settlement === \"settled\" &&\n\t\tstate.receiptDigest &&\n\t\tstate.candidateDigest &&\n\t\t(state.publication === \"none\" || state.publication === \"failed\" || state.publication === \"intent\")\n\t) {\n\t\tcommands.push({\n\t\t\t...base,\n\t\t\tcommand: \"publish\",\n\t\t\tscope: { candidateDigest: state.candidateDigest },\n\t\t\tadvisory: true,\n\t\t});\n\t}\n\treturn commands;\n}\n\nexport type AuthorityGrantCause = \"cancel_requested\" | \"authorization_expired\" | \"restart_unreconciled\" | \"unwitnessed\";\n\nexport interface AuthorityGrantStatus {\n\treadonly grantSequence: string;\n\treadonly sessionId: string;\n\treadonly sessionIncarnation: string;\n\treadonly authorityEpoch: string;\n\treadonly commandId: string;\n\treadonly intentDigest: string;\n\t/** Verbatim grant state — the authority projection's own vocabulary. */\n\treadonly state: AuthorityGrantRecord[\"state\"];\n\treadonly effectLive: boolean;\n\t/** Claims this grant still holds — what it blocks, with exact scope. */\n\treadonly claims: readonly {\n\t\treadonly namespace: string;\n\t\treadonly instanceId: string;\n\t\treadonly canonicalKey: string;\n\t\treadonly access: string;\n\t\treadonly generation: string;\n\t}[];\n\treadonly weight: number;\n\treadonly dispatchId: string | null;\n\treadonly authorizationDeadline: number;\n\t/** Why the grant is in this state; null when records were not supplied. */\n\treadonly cause: AuthorityGrantCause | null;\n\t/**\n\t * Cancellation requested vs terminated: true only when a\n\t * `termination-observed` record witnessed this exact grant.\n\t */\n\treadonly terminationWitnessed: boolean;\n}\n\nexport interface AuthorityStatus {\n\treadonly epoch: string | null;\n\treadonly reconciledEpoch: string | null;\n\treadonly pendingReconcile: boolean;\n\t/** Grants still holding claims — what is blocking new admission. */\n\treadonly blockingGrants: readonly AuthorityGrantStatus[];\n\treadonly settledGrantCount: number;\n\treadonly tombstoneCount: number;\n\treadonly incarnations: readonly { readonly sessionId: string; readonly incarnation: string }[];\n}\n\n/**\n * Derive the authority status from the committed projection; pass the journal\n * records' events so quarantine/cancel causes stay distinguishable — the\n * projection alone intentionally does not restate them.\n */\nexport function deriveAuthorityStatus(\n\tprojection: AuthorityProjection,\n\tevents: readonly AuthorityEvent[] = [],\n): AuthorityStatus {\n\tconst transitionOf = (grantSequence: string): AuthorityGrantCause | null => {\n\t\tfor (let index = events.length - 1; index >= 0; index--) {\n\t\t\tconst event = events[index]!;\n\t\t\tif (event.kind === \"cancel-requested\" && event.grantSequence === grantSequence) return \"cancel_requested\";\n\t\t\tif (event.kind === \"authorization-expired\" && event.grantSequence === grantSequence)\n\t\t\t\treturn \"authorization_expired\";\n\t\t\tif (event.kind === \"quarantined\" && event.grantSequence === grantSequence) return \"restart_unreconciled\";\n\t\t\tif (\n\t\t\t\tevent.kind === \"authority-epoch-advanced\" &&\n\t\t\t\tevent.transitions.some((transition) => transition.grantSequence === grantSequence)\n\t\t\t)\n\t\t\t\treturn \"restart_unreconciled\";\n\t\t}\n\t\treturn null;\n\t};\n\tconst witnessed = new Set(\n\t\tevents.flatMap((event) => (event.kind === \"termination-observed\" ? [event.grantSequence] : [])),\n\t);\n\tconst grants = [...projection.grants.values()];\n\tconst blocking = grants.filter((grant) => !SETTLED_EFFECT_STATES.has(grant.state));\n\treturn Object.freeze({\n\t\tepoch: projection.epoch,\n\t\treconciledEpoch: projection.reconciledEpoch,\n\t\tpendingReconcile: authorityPendingReconcile(projection),\n\t\tblockingGrants: Object.freeze(\n\t\t\tblocking.map((grant) =>\n\t\t\t\tObject.freeze({\n\t\t\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\t\t\tsessionId: grant.token.sessionId,\n\t\t\t\t\tsessionIncarnation: grant.token.sessionIncarnation,\n\t\t\t\t\tauthorityEpoch: grant.token.authorityEpoch,\n\t\t\t\t\tcommandId: grant.commandId,\n\t\t\t\t\tintentDigest: grant.intentDigest,\n\t\t\t\t\tstate: grant.state,\n\t\t\t\t\teffectLive: grant.effectLive,\n\t\t\t\t\tclaims: Object.freeze(\n\t\t\t\t\t\tgrant.claims.map((claim) =>\n\t\t\t\t\t\t\tObject.freeze({\n\t\t\t\t\t\t\t\tnamespace: claim.namespace,\n\t\t\t\t\t\t\t\tinstanceId: claim.instanceId,\n\t\t\t\t\t\t\t\tcanonicalKey: claim.canonicalKey,\n\t\t\t\t\t\t\t\taccess: claim.access,\n\t\t\t\t\t\t\t\tgeneration: claim.generation,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t\tweight: grant.weight,\n\t\t\t\t\tdispatchId: grant.dispatchId,\n\t\t\t\t\tauthorizationDeadline: grant.token.authorizationDeadline,\n\t\t\t\t\tcause: grant.state === \"quarantined\" ? (transitionOf(grant.token.grantSequence) ?? \"unwitnessed\") : null,\n\t\t\t\t\tterminationWitnessed: witnessed.has(grant.token.grantSequence),\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t\tsettledGrantCount: grants.length - blocking.length,\n\t\ttombstoneCount: projection.tombstones.size,\n\t\tincarnations: Object.freeze(\n\t\t\t[...projection.incarnations.entries()].map(([sessionId, incarnation]) =>\n\t\t\t\tObject.freeze({ sessionId, incarnation }),\n\t\t\t),\n\t\t),\n\t});\n}\n"]}