open-multi-agent-kit 1.2.0 → 1.2.2

package/dist/core/verified-run/authority-events.d.ts

@@ -0,0 +1,126 @@
+import { type EffectState, type GrantToken, type ResourceClaim, type Sequence } from "../../coordination/types.ts";
+import type { NamespaceIdentity } from "./namespace-identity.ts";
+/**
+ * Durable authority event contract (WP03).
+ *
+ * Mirrors `schemas/supervisor-event.schema.json` plus the review-required
+ * extensions: `authority-epoch-advanced` (S4), `authorization-expired` (S5),
+ * `session-registered` (S2), `result-retained` (S3 tombstone), and
+ * `authority-snapshot` (GC archive boundary, §7). Quarantine reasons are
+ * carried on the transition event that caused them — `cancel-requested` /
+ * `authorization-expired` / `authority-epoch-advanced` transitions — so a
+ * replay can distinguish cancel from expiry from restart (S5).
+ */
+export interface AuthorityEpochTransition {
+    readonly grantSequence: Sequence;
+    readonly outcome: "cancelled" | "quarantined";
+}
+export interface AuthorityGrantRecord {
+    readonly token: GrantToken;
+    /** Idempotency key supplied by the caller; unique across grants and tombstones. */
+    readonly commandId: string;
+    readonly intentDigest: string;
+    /** Reserved claims (S6: distinct from `actualClaims` bound at effect-started). */
+    readonly claims: readonly ResourceClaim[];
+    readonly weight: number;
+    readonly state: EffectState;
+    readonly effectLive: boolean;
+    readonly dispatchId: string | null;
+    readonly actualClaims: readonly ResourceClaim[] | null;
+    readonly identity: NamespaceIdentity | null;
+}
+export interface AuthorityTombstone {
+    readonly commandId: string;
+    readonly grantSequence: Sequence;
+    readonly resultDigest: string;
+    readonly retainedAtMs: number;
+    readonly expiresAtMs: number;
+}
+export interface AuthoritySnapshotState {
+    readonly epoch: Sequence;
+    readonly reconciledEpoch: Sequence | null;
+    readonly incarnations: readonly {
+        readonly sessionId: string;
+        readonly incarnation: Sequence;
+    }[];
+    readonly grantCounter: Sequence;
+    readonly grants: readonly AuthorityGrantRecord[];
+    readonly tombstones: readonly AuthorityTombstone[];
+}
+export type AuthorityEvent = {
+    readonly kind: "authority-epoch-advanced";
+    readonly authorityEpoch: Sequence;
+    readonly writerId: string;
+    readonly transitions: readonly AuthorityEpochTransition[];
+} | {
+    readonly kind: "authority-reconciled";
+    readonly authorityEpoch: Sequence;
+} | {
+    readonly kind: "session-registered";
+    readonly sessionId: string;
+    readonly incarnation: Sequence;
+} | {
+    readonly kind: "grant-reserved";
+    readonly grant: AuthorityGrantRecord;
+} | {
+    readonly kind: "dispatch-intent";
+    readonly grantSequence: Sequence;
+    readonly authorityEpoch: Sequence;
+    readonly dispatchId: string;
+} | {
+    readonly kind: "effect-started";
+    readonly grantSequence: Sequence;
+    readonly authorityEpoch: Sequence;
+    readonly actualClaims: readonly ResourceClaim[];
+    readonly identity?: NamespaceIdentity;
+} | {
+    readonly kind: "cancel-requested";
+    readonly grantSequence: Sequence;
+    readonly authorityEpoch: Sequence;
+    readonly outcome: "cancelled" | "quarantined";
+} | {
+    readonly kind: "authorization-expired";
+    readonly grantSequence: Sequence;
+    readonly authorityEpoch: Sequence;
+    readonly outcome: "cancelled" | "quarantined";
+} | {
+    readonly kind: "quarantined";
+    readonly grantSequence: Sequence;
+    readonly authorityEpoch: Sequence;
+    readonly reason: "restart";
+} | {
+    readonly kind: "termination-observed";
+    readonly grantSequence: Sequence;
+    readonly authorityEpoch: Sequence;
+} | {
+    readonly kind: "result-retained";
+    readonly commandId: string;
+    readonly grantSequence: Sequence;
+    readonly resultDigest: string;
+    readonly retainedAtMs: number;
+    readonly expiresAtMs: number;
+} | {
+    readonly kind: "authority-snapshot";
+    readonly archivedThroughSequence: number;
+    readonly continuesHash: string;
+    readonly state: AuthoritySnapshotState;
+};
+export interface AuthorityProjection {
+    readonly epoch: Sequence | null;
+    readonly reconciledEpoch: Sequence | null;
+    readonly incarnations: ReadonlyMap<string, Sequence>;
+    readonly grantCounter: Sequence;
+    readonly grants: ReadonlyMap<Sequence, AuthorityGrantRecord>;
+    readonly tombstones: ReadonlyMap<string, AuthorityTombstone>;
+}
+/** A restart that bumped the epoch but never finished reconciliation stays pending. */
+export declare function authorityPendingReconcile(state: AuthorityProjection): boolean;
+export declare function parseAuthorityEvent(raw: unknown): AuthorityEvent;
+/** Deterministic replay over a seeded (post-snapshot) state. */
+export declare function projectAuthority(events: readonly AuthorityEvent[], seed?: AuthoritySnapshotState): AuthorityProjection;
+/** Grants still holding claims — quarantined included (broker parity). */
+export declare function activeAuthorityGrants(state: AuthorityProjection): readonly AuthorityGrantRecord[];
+/** Apply additional events to an existing projection (commit-time validation replay). */
+export declare function applyAuthorityEvents(base: AuthorityProjection, events: readonly AuthorityEvent[]): AuthorityProjection;
+export declare function snapshotFromProjection(state: AuthorityProjection): AuthoritySnapshotState;
+//# sourceMappingURL=authority-events.d.ts.map

package/dist/core/verified-run/authority-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-events.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/authority-events.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,EAElB,KAAK,QAAQ,EAEb,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAIjE;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAA;KAAE,EAAE,CAAC;IACjG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACnD;AAED,MAAM,MAAM,cAAc,GACvB;IACA,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACzD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAA;CAAE,GACnG;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GACzE;IACA,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC3B,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,aAAa,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACrC,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,CAAC;CAC7C,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,CAAC;CAC7C,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC1B,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;CACjC,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC5B,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEL,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC7D;AAWD,uFAAuF;AACvF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAE7E;AA8ID,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAsFhE;AAwKD,gEAAgE;AAChE,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,IAAI,CAAC,EAAE,sBAAsB,GAC3B,mBAAmB,CA2BrB;AAED,4EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,oBAAoB,EAAE,CAEjG;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,SAAS,cAAc,EAAE,GAC/B,mBAAmB,CAkBrB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,sBAAsB,CAYzF","sourcesContent":["import { canonicalClaim, claimSetsConflict, type ResourceClaimInput } from \"../../coordination/resource.ts\";\nimport {\n\ttype EffectState,\n\ttype GrantToken,\n\ttype ResourceClaim,\n\tSETTLED_EFFECT_STATES,\n\ttype Sequence,\n\tsequence,\n} from \"../../coordination/types.ts\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { parseNamespaceIdentity } from \"./namespace-identity.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\n/**\n * Durable authority event contract (WP03).\n *\n * Mirrors `schemas/supervisor-event.schema.json` plus the review-required\n * extensions: `authority-epoch-advanced` (S4), `authorization-expired` (S5),\n * `session-registered` (S2), `result-retained` (S3 tombstone), and\n * `authority-snapshot` (GC archive boundary, §7). Quarantine reasons are\n * carried on the transition event that caused them — `cancel-requested` /\n * `authorization-expired` / `authority-epoch-advanced` transitions — so a\n * replay can distinguish cancel from expiry from restart (S5).\n */\n\nexport interface AuthorityEpochTransition {\n\treadonly grantSequence: Sequence;\n\treadonly outcome: \"cancelled\" | \"quarantined\";\n}\n\nexport interface AuthorityGrantRecord {\n\treadonly token: GrantToken;\n\t/** Idempotency key supplied by the caller; unique across grants and tombstones. */\n\treadonly commandId: string;\n\treadonly intentDigest: string;\n\t/** Reserved claims (S6: distinct from `actualClaims` bound at effect-started). */\n\treadonly claims: readonly ResourceClaim[];\n\treadonly weight: number;\n\treadonly state: EffectState;\n\treadonly effectLive: boolean;\n\treadonly dispatchId: string | null;\n\treadonly actualClaims: readonly ResourceClaim[] | null;\n\treadonly identity: NamespaceIdentity | null;\n}\n\nexport interface AuthorityTombstone {\n\treadonly commandId: string;\n\treadonly grantSequence: Sequence;\n\treadonly resultDigest: string;\n\treadonly retainedAtMs: number;\n\treadonly expiresAtMs: number;\n}\n\nexport interface AuthoritySnapshotState {\n\treadonly epoch: Sequence;\n\treadonly reconciledEpoch: Sequence | null;\n\treadonly incarnations: readonly { readonly sessionId: string; readonly incarnation: Sequence }[];\n\treadonly grantCounter: Sequence;\n\treadonly grants: readonly AuthorityGrantRecord[];\n\treadonly tombstones: readonly AuthorityTombstone[];\n}\n\nexport type AuthorityEvent =\n\t| {\n\t\t\treadonly kind: \"authority-epoch-advanced\";\n\t\t\treadonly authorityEpoch: Sequence;\n\t\t\treadonly writerId: string;\n\t\t\treadonly transitions: readonly AuthorityEpochTransition[];\n\t  }\n\t| { readonly kind: \"authority-reconciled\"; readonly authorityEpoch: Sequence }\n\t| { readonly kind: \"session-registered\"; readonly sessionId: string; readonly incarnation: Sequence }\n\t| { readonly kind: \"grant-reserved\"; readonly grant: AuthorityGrantRecord }\n\t| {\n\t\t\treadonly kind: \"dispatch-intent\";\n\t\t\treadonly grantSequence: Sequence;\n\t\t\treadonly authorityEpoch: Sequence;\n\t\t\treadonly dispatchId: string;\n\t  }\n\t| {\n\t\t\treadonly kind: \"effect-started\";\n\t\t\treadonly grantSequence: Sequence;\n\t\t\treadonly authorityEpoch: Sequence;\n\t\t\treadonly actualClaims: readonly ResourceClaim[];\n\t\t\treadonly identity?: NamespaceIdentity;\n\t  }\n\t| {\n\t\t\treadonly kind: \"cancel-requested\";\n\t\t\treadonly grantSequence: Sequence;\n\t\t\treadonly authorityEpoch: Sequence;\n\t\t\treadonly outcome: \"cancelled\" | \"quarantined\";\n\t  }\n\t| {\n\t\t\treadonly kind: \"authorization-expired\";\n\t\t\treadonly grantSequence: Sequence;\n\t\t\treadonly authorityEpoch: Sequence;\n\t\t\treadonly outcome: \"cancelled\" | \"quarantined\";\n\t  }\n\t| {\n\t\t\treadonly kind: \"quarantined\";\n\t\t\treadonly grantSequence: Sequence;\n\t\t\treadonly authorityEpoch: Sequence;\n\t\t\treadonly reason: \"restart\";\n\t  }\n\t| {\n\t\t\treadonly kind: \"termination-observed\";\n\t\t\treadonly grantSequence: Sequence;\n\t\t\treadonly authorityEpoch: Sequence;\n\t  }\n\t| {\n\t\t\treadonly kind: \"result-retained\";\n\t\t\treadonly commandId: string;\n\t\t\treadonly grantSequence: Sequence;\n\t\t\treadonly resultDigest: string;\n\t\t\treadonly retainedAtMs: number;\n\t\t\treadonly expiresAtMs: number;\n\t  }\n\t| {\n\t\t\treadonly kind: \"authority-snapshot\";\n\t\t\treadonly archivedThroughSequence: number;\n\t\t\treadonly continuesHash: string;\n\t\t\treadonly state: AuthoritySnapshotState;\n\t  };\n\nexport interface AuthorityProjection {\n\treadonly epoch: Sequence | null;\n\treadonly reconciledEpoch: Sequence | null;\n\treadonly incarnations: ReadonlyMap<string, Sequence>;\n\treadonly grantCounter: Sequence;\n\treadonly grants: ReadonlyMap<Sequence, AuthorityGrantRecord>;\n\treadonly tombstones: ReadonlyMap<string, AuthorityTombstone>;\n}\n\ninterface MutableAuthorityProjection {\n\tepoch: Sequence | null;\n\treconciledEpoch: Sequence | null;\n\tincarnations: Map<string, Sequence>;\n\tgrantCounter: Sequence;\n\tgrants: Map<Sequence, AuthorityGrantRecord>;\n\ttombstones: Map<string, AuthorityTombstone>;\n}\n\n/** A restart that bumped the epoch but never finished reconciliation stays pending. */\nexport function authorityPendingReconcile(state: AuthorityProjection): boolean {\n\treturn state.reconciledEpoch !== state.epoch;\n}\n\nfunction text(value: unknown): string {\n\tif (typeof value !== \"string\" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)) throw new VerifiedRunError(\"integrity\");\n\treturn value;\n}\n\n/** bootId:pid style writer labels — looser than `text` but still bounded and printable. */\nfunction writerLabel(value: unknown): string {\n\tif (typeof value !== \"string\" || !/^[A-Za-z0-9_.:-]{1,160}$/.test(value)) throw new VerifiedRunError(\"integrity\");\n\treturn value;\n}\n\nfunction digest(value: unknown): string {\n\tconst result = text(value);\n\tif (!/^[a-f0-9]{64}$/.test(result)) throw new VerifiedRunError(\"integrity\");\n\treturn result;\n}\n\nfunction integer(value: unknown): number {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) throw new VerifiedRunError(\"integrity\");\n\treturn value;\n}\n\nfunction seq(value: unknown): Sequence {\n\ttry {\n\t\treturn sequence(value);\n\t} catch {\n\t\tthrow new VerifiedRunError(\"integrity\");\n\t}\n}\n\nfunction nextSeq(value: Sequence): Sequence {\n\treturn sequence(String(BigInt(value) + 1n));\n}\n\nfunction claim(raw: unknown): ResourceClaim {\n\tif (typeof raw !== \"object\" || raw === null) throw new VerifiedRunError(\"integrity\");\n\tconst value: Record<string, unknown> = Object.fromEntries(Object.entries(raw));\n\ttry {\n\t\treturn canonicalClaim(value as unknown as ResourceClaimInput);\n\t} catch {\n\t\tthrow new VerifiedRunError(\"integrity\");\n\t}\n}\n\nfunction claimList(raw: unknown, limit = 256): readonly ResourceClaim[] {\n\tif (!Array.isArray(raw) || raw.length === 0 || raw.length > limit) throw new VerifiedRunError(\"integrity\");\n\treturn Object.freeze(raw.map(claim));\n}\n\nfunction token(raw: unknown): GrantToken {\n\tif (typeof raw !== \"object\" || raw === null) throw new VerifiedRunError(\"integrity\");\n\tconst value: Record<string, unknown> = Object.fromEntries(Object.entries(raw));\n\treturn Object.freeze({\n\t\tauthorityEpoch: seq(value.authorityEpoch),\n\t\tgrantSequence: seq(value.grantSequence),\n\t\tsessionId: text(value.sessionId),\n\t\tsessionIncarnation: seq(value.sessionIncarnation),\n\t\tauthorizationDeadline: integer(value.authorizationDeadline),\n\t});\n}\n\nconst GRANT_STATES: ReadonlySet<string> = new Set([\n\t\"reserved\",\n\t\"starting\",\n\t\"running\",\n\t\"terminating\",\n\t\"quarantined\",\n\t\"terminated\",\n\t\"cancelled\",\n]);\n\nfunction grantRecord(raw: unknown): AuthorityGrantRecord {\n\tif (typeof raw !== \"object\" || raw === null) throw new VerifiedRunError(\"integrity\");\n\tconst value: Record<string, unknown> = Object.fromEntries(Object.entries(raw));\n\tif (typeof value.state !== \"string\" || !GRANT_STATES.has(value.state)) throw new VerifiedRunError(\"integrity\");\n\tif (typeof value.effectLive !== \"boolean\") throw new VerifiedRunError(\"integrity\");\n\tif (SETTLED_EFFECT_STATES.has(value.state as EffectState) && value.effectLive)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tif (value.state === \"quarantined\" && !value.effectLive) throw new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\ttoken: token(value.token),\n\t\tcommandId: text(value.commandId),\n\t\tintentDigest: digest(value.intentDigest),\n\t\tclaims: claimList(value.claims),\n\t\tweight: integer(value.weight),\n\t\tstate: value.state as EffectState,\n\t\teffectLive: value.effectLive,\n\t\tdispatchId: value.dispatchId === null ? null : text(value.dispatchId),\n\t\tactualClaims: value.actualClaims === null ? null : claimList(value.actualClaims),\n\t\tidentity: value.identity === null ? null : parseNamespaceIdentity(value.identity),\n\t});\n}\n\nfunction tombstone(raw: unknown): AuthorityTombstone {\n\tif (typeof raw !== \"object\" || raw === null) throw new VerifiedRunError(\"integrity\");\n\tconst value: Record<string, unknown> = Object.fromEntries(Object.entries(raw));\n\tconst retainedAtMs = integer(value.retainedAtMs);\n\tconst expiresAtMs = integer(value.expiresAtMs);\n\tif (expiresAtMs <= retainedAtMs) throw new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\tcommandId: text(value.commandId),\n\t\tgrantSequence: seq(value.grantSequence),\n\t\tresultDigest: digest(value.resultDigest),\n\t\tretainedAtMs,\n\t\texpiresAtMs,\n\t});\n}\n\nfunction snapshotState(raw: unknown): AuthoritySnapshotState {\n\tif (typeof raw !== \"object\" || raw === null) throw new VerifiedRunError(\"integrity\");\n\tconst value: Record<string, unknown> = Object.fromEntries(Object.entries(raw));\n\tif (!Array.isArray(value.incarnations) || !Array.isArray(value.grants) || !Array.isArray(value.tombstones))\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst grants = value.grants.map(grantRecord);\n\tconst tombstones = value.tombstones.map(tombstone);\n\tconst sequences = new Set(grants.map((grant) => grant.token.grantSequence));\n\tif (sequences.size !== grants.length) throw new VerifiedRunError(\"integrity\");\n\t// grant commandIds are unique among grants; tombstone commandIds among\n\t// tombstones; a tombstone always references a retained grant (GC drops the\n\t// expired tombstone+grant pair together).\n\tif (new Set(grants.map((grant) => grant.commandId)).size !== grants.length) throw new VerifiedRunError(\"integrity\");\n\tif (new Set(tombstones.map((stone) => stone.commandId)).size !== tombstones.length)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tfor (const stone of tombstones) if (!sequences.has(stone.grantSequence)) throw new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\tepoch: seq(value.epoch),\n\t\treconciledEpoch: value.reconciledEpoch === null ? null : seq(value.reconciledEpoch),\n\t\tincarnations: Object.freeze(\n\t\t\tvalue.incarnations.map((entry: unknown) => {\n\t\t\t\tif (typeof entry !== \"object\" || entry === null) throw new VerifiedRunError(\"integrity\");\n\t\t\t\tconst item: Record<string, unknown> = Object.fromEntries(Object.entries(entry));\n\t\t\t\treturn Object.freeze({ sessionId: text(item.sessionId), incarnation: seq(item.incarnation) });\n\t\t\t}),\n\t\t),\n\t\tgrantCounter: seq(value.grantCounter),\n\t\tgrants: Object.freeze(grants),\n\t\ttombstones: Object.freeze(tombstones),\n\t});\n}\n\nexport function parseAuthorityEvent(raw: unknown): AuthorityEvent {\n\tif (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) throw new VerifiedRunError(\"integrity\");\n\tconst value: Record<string, unknown> = Object.fromEntries(Object.entries(raw));\n\tswitch (value.kind) {\n\t\tcase \"authority-epoch-advanced\": {\n\t\t\tif (!Array.isArray(value.transitions) || value.transitions.length > 4096)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tconst transitions = value.transitions.map((entry: unknown) => {\n\t\t\t\tif (typeof entry !== \"object\" || entry === null) throw new VerifiedRunError(\"integrity\");\n\t\t\t\tconst item: Record<string, unknown> = Object.fromEntries(Object.entries(entry));\n\t\t\t\tif (item.outcome !== \"cancelled\" && item.outcome !== \"quarantined\") throw new VerifiedRunError(\"integrity\");\n\t\t\t\treturn Object.freeze({ grantSequence: seq(item.grantSequence), outcome: item.outcome });\n\t\t\t});\n\t\t\tconst seen = new Set(transitions.map((entry) => entry.grantSequence));\n\t\t\tif (seen.size !== transitions.length) throw new VerifiedRunError(\"integrity\");\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tauthorityEpoch: seq(value.authorityEpoch),\n\t\t\t\twriterId: writerLabel(value.writerId),\n\t\t\t\ttransitions: Object.freeze(transitions),\n\t\t\t};\n\t\t}\n\t\tcase \"authority-reconciled\":\n\t\t\treturn { kind: value.kind, authorityEpoch: seq(value.authorityEpoch) };\n\t\tcase \"session-registered\":\n\t\t\treturn { kind: value.kind, sessionId: text(value.sessionId), incarnation: seq(value.incarnation) };\n\t\tcase \"grant-reserved\":\n\t\t\treturn { kind: value.kind, grant: grantRecord(value.grant) };\n\t\tcase \"dispatch-intent\":\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tgrantSequence: seq(value.grantSequence),\n\t\t\t\tauthorityEpoch: seq(value.authorityEpoch),\n\t\t\t\tdispatchId: text(value.dispatchId),\n\t\t\t};\n\t\tcase \"effect-started\":\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tgrantSequence: seq(value.grantSequence),\n\t\t\t\tauthorityEpoch: seq(value.authorityEpoch),\n\t\t\t\tactualClaims: claimList(value.actualClaims),\n\t\t\t\t...(value.identity === undefined ? {} : { identity: parseNamespaceIdentity(value.identity) }),\n\t\t\t};\n\t\tcase \"cancel-requested\":\n\t\tcase \"authorization-expired\": {\n\t\t\tif (value.outcome !== \"cancelled\" && value.outcome !== \"quarantined\") throw new VerifiedRunError(\"integrity\");\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tgrantSequence: seq(value.grantSequence),\n\t\t\t\tauthorityEpoch: seq(value.authorityEpoch),\n\t\t\t\toutcome: value.outcome,\n\t\t\t};\n\t\t}\n\t\tcase \"quarantined\":\n\t\t\tif (value.reason !== \"restart\") throw new VerifiedRunError(\"integrity\");\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tgrantSequence: seq(value.grantSequence),\n\t\t\t\tauthorityEpoch: seq(value.authorityEpoch),\n\t\t\t\treason: value.reason,\n\t\t\t};\n\t\tcase \"termination-observed\":\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tgrantSequence: seq(value.grantSequence),\n\t\t\t\tauthorityEpoch: seq(value.authorityEpoch),\n\t\t\t};\n\t\tcase \"result-retained\":\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tcommandId: text(value.commandId),\n\t\t\t\tgrantSequence: seq(value.grantSequence),\n\t\t\t\tresultDigest: digest(value.resultDigest),\n\t\t\t\tretainedAtMs: integer(value.retainedAtMs),\n\t\t\t\texpiresAtMs: integer(value.expiresAtMs),\n\t\t\t};\n\t\tcase \"authority-snapshot\":\n\t\t\treturn {\n\t\t\t\tkind: value.kind,\n\t\t\t\tarchivedThroughSequence: integer(value.archivedThroughSequence),\n\t\t\t\tcontinuesHash: digest(value.continuesHash),\n\t\t\t\tstate: snapshotState(value.state),\n\t\t\t};\n\t\tdefault:\n\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t}\n}\n\nfunction reduceAuthorityEvent(state: MutableAuthorityProjection, event: AuthorityEvent): void {\n\tswitch (event.kind) {\n\t\tcase \"authority-epoch-advanced\": {\n\t\t\t// An epoch may only advance once the previous epoch reconciled. The\n\t\t\t// transition set must cover every unsettled grant exactly once (S4).\n\t\t\tif (authorityPendingReconcile(state)) throw new VerifiedRunError(\"integrity\");\n\t\t\tconst expected = nextSeq(state.epoch ?? sequence(\"0\"));\n\t\t\tif (event.authorityEpoch !== expected) throw new VerifiedRunError(\"integrity\");\n\t\t\tconst unsettled = new Set(\n\t\t\t\t[...state.grants.values()]\n\t\t\t\t\t.filter((grant) => !SETTLED_EFFECT_STATES.has(grant.state))\n\t\t\t\t\t.map((grant) => grant.token.grantSequence),\n\t\t\t);\n\t\t\tfor (const transition of event.transitions) {\n\t\t\t\tconst grant = state.grants.get(transition.grantSequence);\n\t\t\t\tif (!grant || !unsettled.has(transition.grantSequence)) throw new VerifiedRunError(\"integrity\");\n\t\t\t\tconst outcome = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t\t\tif (transition.outcome !== outcome) throw new VerifiedRunError(\"integrity\");\n\t\t\t\tstate.grants.set(transition.grantSequence, { ...grant, state: transition.outcome });\n\t\t\t\tunsettled.delete(transition.grantSequence);\n\t\t\t}\n\t\t\tif (unsettled.size !== 0) throw new VerifiedRunError(\"integrity\");\n\t\t\tstate.epoch = event.authorityEpoch;\n\t\t\tbreak;\n\t\t}\n\t\tcase \"authority-reconciled\": {\n\t\t\tif (state.epoch === null || event.authorityEpoch !== state.epoch) throw new VerifiedRunError(\"integrity\");\n\t\t\tif (!authorityPendingReconcile(state)) throw new VerifiedRunError(\"integrity\");\n\t\t\tfor (const grant of state.grants.values())\n\t\t\t\tif (!SETTLED_EFFECT_STATES.has(grant.state) && grant.state !== \"quarantined\")\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tstate.reconciledEpoch = event.authorityEpoch;\n\t\t\tbreak;\n\t\t}\n\t\tcase \"session-registered\": {\n\t\t\tconst current = state.incarnations.get(event.sessionId);\n\t\t\tconst expected = current === undefined ? sequence(\"1\") : nextSeq(current);\n\t\t\tif (event.incarnation !== expected) throw new VerifiedRunError(\"integrity\");\n\t\t\tstate.incarnations.set(event.sessionId, event.incarnation);\n\t\t\tbreak;\n\t\t}\n\t\tcase \"grant-reserved\": {\n\t\t\tconst grant = event.grant;\n\t\t\tif (authorityPendingReconcile(state) || state.epoch === null) throw new VerifiedRunError(\"integrity\");\n\t\t\tif (\n\t\t\t\tgrant.state !== \"reserved\" ||\n\t\t\t\tgrant.effectLive ||\n\t\t\t\tgrant.dispatchId !== null ||\n\t\t\t\tgrant.actualClaims !== null ||\n\t\t\t\tgrant.identity !== null ||\n\t\t\t\tgrant.token.authorityEpoch !== state.epoch ||\n\t\t\t\tstate.incarnations.get(grant.token.sessionId) !== grant.token.sessionIncarnation ||\n\t\t\t\tgrant.token.grantSequence !== nextSeq(state.grantCounter) ||\n\t\t\t\tstate.grants.has(grant.token.grantSequence) ||\n\t\t\t\tstate.tombstones.has(grant.commandId) ||\n\t\t\t\t[...state.grants.values()].some((other) => other.commandId === grant.commandId) ||\n\t\t\t\t[...state.grants.values()].some(\n\t\t\t\t\t(other) =>\n\t\t\t\t\t\t!SETTLED_EFFECT_STATES.has(other.state) && claimSetsConflict([...grant.claims], [...other.claims]),\n\t\t\t\t)\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tstate.grants.set(grant.token.grantSequence, grant);\n\t\t\tstate.grantCounter = grant.token.grantSequence;\n\t\t\tbreak;\n\t\t}\n\t\tcase \"dispatch-intent\": {\n\t\t\tconst grant = state.grants.get(event.grantSequence);\n\t\t\tif (\n\t\t\t\t!grant ||\n\t\t\t\tgrant.state !== \"reserved\" ||\n\t\t\t\tgrant.token.authorityEpoch !== event.authorityEpoch ||\n\t\t\t\tevent.authorityEpoch !== state.epoch ||\n\t\t\t\t[...state.grants.values()].some((other) => other.dispatchId === event.dispatchId)\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t// A committed intent may already have spawned: the effect is possibly\n\t\t\t// live until a termination witness says otherwise (docs/04 uncertainty\n\t\t\t// window), so effectLive is set here, not at effect-started.\n\t\t\tstate.grants.set(event.grantSequence, {\n\t\t\t\t...grant,\n\t\t\t\tstate: \"starting\",\n\t\t\t\teffectLive: true,\n\t\t\t\tdispatchId: event.dispatchId,\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t\tcase \"effect-started\": {\n\t\t\tconst grant = state.grants.get(event.grantSequence);\n\t\t\tif (!grant || (grant.state !== \"reserved\" && grant.state !== \"starting\"))\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (event.authorityEpoch !== state.epoch || grant.token.authorityEpoch !== event.authorityEpoch)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (event.identity !== undefined) {\n\t\t\t\tfor (const other of state.grants.values()) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tother.token.grantSequence !== event.grantSequence &&\n\t\t\t\t\t\t!SETTLED_EFFECT_STATES.has(other.state) &&\n\t\t\t\t\t\tother.identity &&\n\t\t\t\t\t\tother.identity.namespace === event.identity.namespace &&\n\t\t\t\t\t\tother.identity.pid === event.identity.pid &&\n\t\t\t\t\t\tother.identity.startTicks === event.identity.startTicks &&\n\t\t\t\t\t\tother.identity.bootId === event.identity.bootId\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t}\n\t\t\t}\n\t\t\tstate.grants.set(event.grantSequence, {\n\t\t\t\t...grant,\n\t\t\t\tstate: \"running\",\n\t\t\t\teffectLive: true,\n\t\t\t\tactualClaims: event.actualClaims,\n\t\t\t\tidentity: event.identity ?? grant.identity,\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t\tcase \"cancel-requested\":\n\t\tcase \"authorization-expired\":\n\t\tcase \"quarantined\": {\n\t\t\tconst grant = state.grants.get(event.grantSequence);\n\t\t\tif (!grant || SETTLED_EFFECT_STATES.has(grant.state)) throw new VerifiedRunError(\"integrity\");\n\t\t\tif (event.authorityEpoch !== state.epoch) throw new VerifiedRunError(\"integrity\");\n\t\t\tif (event.kind === \"quarantined\") {\n\t\t\t\tif (!grant.effectLive || grant.state === \"quarantined\") throw new VerifiedRunError(\"integrity\");\n\t\t\t\tstate.grants.set(event.grantSequence, { ...grant, state: \"quarantined\" });\n\t\t\t} else {\n\t\t\t\tconst outcome = grant.effectLive ? \"quarantined\" : \"cancelled\";\n\t\t\t\tif (event.outcome !== outcome) throw new VerifiedRunError(\"integrity\");\n\t\t\t\tstate.grants.set(event.grantSequence, { ...grant, state: event.outcome });\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tcase \"termination-observed\": {\n\t\t\tconst grant = state.grants.get(event.grantSequence);\n\t\t\tif (!grant || SETTLED_EFFECT_STATES.has(grant.state)) throw new VerifiedRunError(\"integrity\");\n\t\t\tstate.grants.set(event.grantSequence, { ...grant, effectLive: false, state: \"terminated\" });\n\t\t\tbreak;\n\t\t}\n\t\tcase \"result-retained\": {\n\t\t\tconst grant = state.grants.get(event.grantSequence);\n\t\t\tif (!grant || grant.commandId !== event.commandId) throw new VerifiedRunError(\"integrity\");\n\t\t\tif (event.expiresAtMs <= event.retainedAtMs || state.tombstones.has(event.commandId))\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tstate.tombstones.set(\n\t\t\t\tevent.commandId,\n\t\t\t\tObject.freeze({\n\t\t\t\t\tcommandId: event.commandId,\n\t\t\t\t\tgrantSequence: event.grantSequence,\n\t\t\t\t\tresultDigest: event.resultDigest,\n\t\t\t\t\tretainedAtMs: event.retainedAtMs,\n\t\t\t\t\texpiresAtMs: event.expiresAtMs,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tbreak;\n\t\t}\n\t\tcase \"authority-snapshot\":\n\t\t\t// Snapshots are archive boundaries, not stream events; the loader seeds\n\t\t\t// from them directly and rejects them mid-stream.\n\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n\n/** Deterministic replay over a seeded (post-snapshot) state. */\nexport function projectAuthority(\n\tevents: readonly AuthorityEvent[],\n\tseed?: AuthoritySnapshotState,\n): AuthorityProjection {\n\tconst state: MutableAuthorityProjection = seed\n\t\t? {\n\t\t\t\tepoch: seed.epoch,\n\t\t\t\treconciledEpoch: seed.reconciledEpoch,\n\t\t\t\tincarnations: new Map(seed.incarnations.map((entry) => [entry.sessionId, entry.incarnation])),\n\t\t\t\tgrantCounter: seed.grantCounter,\n\t\t\t\tgrants: new Map(seed.grants.map((grant) => [grant.token.grantSequence, grant])),\n\t\t\t\ttombstones: new Map(seed.tombstones.map((stone) => [stone.commandId, stone])),\n\t\t\t}\n\t\t: {\n\t\t\t\tepoch: null,\n\t\t\t\treconciledEpoch: null,\n\t\t\t\tincarnations: new Map(),\n\t\t\t\tgrantCounter: sequence(\"0\"),\n\t\t\t\tgrants: new Map(),\n\t\t\t\ttombstones: new Map(),\n\t\t\t};\n\tfor (const event of events) reduceAuthorityEvent(state, event);\n\treturn Object.freeze({\n\t\tepoch: state.epoch,\n\t\treconciledEpoch: state.reconciledEpoch,\n\t\tincarnations: state.incarnations,\n\t\tgrantCounter: state.grantCounter,\n\t\tgrants: state.grants,\n\t\ttombstones: state.tombstones,\n\t});\n}\n\n/** Grants still holding claims — quarantined included (broker parity). */\nexport function activeAuthorityGrants(state: AuthorityProjection): readonly AuthorityGrantRecord[] {\n\treturn [...state.grants.values()].filter((grant) => !SETTLED_EFFECT_STATES.has(grant.state));\n}\n\n/** Apply additional events to an existing projection (commit-time validation replay). */\nexport function applyAuthorityEvents(\n\tbase: AuthorityProjection,\n\tevents: readonly AuthorityEvent[],\n): AuthorityProjection {\n\tconst state: MutableAuthorityProjection = {\n\t\tepoch: base.epoch,\n\t\treconciledEpoch: base.reconciledEpoch,\n\t\tincarnations: new Map(base.incarnations),\n\t\tgrantCounter: base.grantCounter,\n\t\tgrants: new Map(base.grants),\n\t\ttombstones: new Map(base.tombstones),\n\t};\n\tfor (const event of events) reduceAuthorityEvent(state, event);\n\treturn Object.freeze({\n\t\tepoch: state.epoch,\n\t\treconciledEpoch: state.reconciledEpoch,\n\t\tincarnations: state.incarnations,\n\t\tgrantCounter: state.grantCounter,\n\t\tgrants: state.grants,\n\t\ttombstones: state.tombstones,\n\t});\n}\n\nexport function snapshotFromProjection(state: AuthorityProjection): AuthoritySnapshotState {\n\tif (state.epoch === null) throw new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\tepoch: state.epoch,\n\t\treconciledEpoch: state.reconciledEpoch,\n\t\tincarnations: Object.freeze(\n\t\t\t[...state.incarnations.entries()].map(([sessionId, incarnation]) => Object.freeze({ sessionId, incarnation })),\n\t\t),\n\t\tgrantCounter: state.grantCounter,\n\t\tgrants: Object.freeze([...state.grants.values()]),\n\t\ttombstones: Object.freeze([...state.tombstones.values()]),\n\t});\n}\n"]}