open-multi-agent-kit 1.2.0 → 1.2.2

package/dist/core/verified-run/authority-journal.js

@@ -0,0 +1,83 @@
+import { canonicalJson } from "../run-journal.js";
+import { AuthorityStoreError } from "./authority-errors.js";
+import { applyAuthorityEvents, parseAuthorityEvent, projectAuthority, } from "./authority-events.js";
+import { digestObject } from "./storage.js";
+export const GENESIS_PREVIOUS = "0".repeat(64);
+export function materializeRecord(seq, previous, event) {
+    const material = { version: 1, seq, previous, event };
+    return Object.freeze({ ...material, hash: digestObject(material) });
+}
+export function recordLine(record) {
+    return `${canonicalJson(record)}\n`;
+}
+/** Inode/head fencing is checked by the owner before offering a prefix. */
+export function parseCommitted(bytes, prefix) {
+    if (prefix && (bytes.length < prefix.bytes.length || !prefix.bytes.equals(bytes.subarray(0, prefix.bytes.length))))
+        prefix = undefined;
+    if (prefix && bytes.length === prefix.bytes.length)
+        return { ...prefix, replay: { parsedRecords: 0, reusedPrefixRecords: prefix.records.length } };
+    if (!bytes.length)
+        return {
+            lastSeq: 0,
+            lastHash: GENESIS_PREVIOUS,
+            records: Object.freeze([]),
+            events: Object.freeze([]),
+            state: projectAuthority([]),
+            bytes: Buffer.alloc(0),
+            replay: { parsedRecords: 0, reusedPrefixRecords: 0 },
+        };
+    if (bytes.at(-1) !== 10)
+        throw new AuthorityStoreError("corrupt");
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(prefix?.bytes.length ?? 0));
+    }
+    catch {
+        throw new AuthorityStoreError("corrupt");
+    }
+    const lines = text.slice(0, -1).split("\n");
+    let seed;
+    let previous = prefix?.lastHash ?? GENESIS_PREVIOUS;
+    let expectedSeq = (prefix?.lastSeq ?? 0) + 1;
+    let lastSeq = prefix?.lastSeq ?? 0;
+    const events = [];
+    const records = [];
+    for (const [index, line] of lines.entries()) {
+        let raw;
+        try {
+            raw = JSON.parse(line);
+        }
+        catch {
+            throw new AuthorityStoreError("corrupt");
+        }
+        if (typeof raw !== "object" || raw === null || !("event" in raw))
+            throw new AuthorityStoreError("corrupt");
+        const event = parseAuthorityEvent(raw.event);
+        const record = event.kind === "authority-snapshot"
+            ? materializeRecord(event.archivedThroughSequence + 1, event.continuesHash, event)
+            : materializeRecord(expectedSeq, previous, event);
+        if (canonicalJson(raw) !== canonicalJson(record))
+            throw new AuthorityStoreError("corrupt");
+        if (event.kind === "authority-snapshot") {
+            if (index !== 0 || (prefix && prefix.records.length > 0))
+                throw new AuthorityStoreError("corrupt");
+            seed = event.state;
+        }
+        else
+            events.push(event);
+        records.push(record);
+        previous = record.hash;
+        lastSeq = record.seq;
+        expectedSeq = record.seq + 1;
+    }
+    return {
+        lastSeq,
+        lastHash: previous,
+        records: Object.freeze(prefix ? [...prefix.records, ...records] : records),
+        events: Object.freeze(prefix ? [...prefix.events, ...events] : events),
+        state: prefix && !seed ? applyAuthorityEvents(prefix.state, events) : projectAuthority(events, seed),
+        bytes: Buffer.from(bytes),
+        replay: { parsedRecords: records.length, reusedPrefixRecords: prefix?.records.length ?? 0 },
+    };
+}
+//# sourceMappingURL=authority-journal.js.map

package/dist/core/verified-run/authority-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-journal.js","sourceRoot":"","sources":["../../../src/core/verified-run/authority-journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAIN,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAkB/C,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAgB,EAAE,KAAqB,EAAmB;IACxG,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAAA,CACpE;AACD,MAAM,UAAU,UAAU,CAAC,MAAuB,EAAU;IAC3D,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC;AAAA,CACpC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAwB,EAAmB;IACxF,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjH,MAAM,GAAG,SAAS,CAAC;IACpB,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;QACjD,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAChG,IAAI,CAAC,KAAK,CAAC,MAAM;QAChB,OAAO;YACN,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtB,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE;SACpD,CAAC;IACH,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,IAAwC,CAAC;IAC7C,IAAI,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IACpD,IAAI,WAAW,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GACX,KAAK,CAAC,IAAI,KAAK,oBAAoB;YAClC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC;YAClF,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACzC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACnG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACpB,CAAC;;YAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;QACrB,WAAW,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO;QACN,OAAO;QACP,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACtE,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC;QACpG,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE;KAC3F,CAAC;AAAA,CACF","sourcesContent":["import { canonicalJson } from \"../run-journal.ts\";\nimport { AuthorityStoreError } from \"./authority-errors.ts\";\nimport {\n\ttype AuthorityEvent,\n\ttype AuthorityProjection,\n\ttype AuthoritySnapshotState,\n\tapplyAuthorityEvents,\n\tparseAuthorityEvent,\n\tprojectAuthority,\n} from \"./authority-events.ts\";\nimport { digestObject } from \"./storage.ts\";\n\nexport const GENESIS_PREVIOUS = \"0\".repeat(64);\nexport interface AuthorityRecord {\n\treadonly version: 1;\n\treadonly seq: number;\n\treadonly previous: string;\n\treadonly event: AuthorityEvent;\n\treadonly hash: string;\n}\nexport interface ParsedAuthority {\n\treadonly lastSeq: number;\n\treadonly lastHash: string;\n\treadonly records: readonly AuthorityRecord[];\n\treadonly events: readonly AuthorityEvent[];\n\treadonly state: AuthorityProjection;\n\t/** Private copy; reuse requires byte equality, not just mtime, size or inode. */\n\treadonly bytes: Buffer;\n\treadonly replay: { readonly parsedRecords: number; readonly reusedPrefixRecords: number };\n}\nexport function materializeRecord(seq: number, previous: string, event: AuthorityEvent): AuthorityRecord {\n\tconst material = { version: 1 as const, seq, previous, event };\n\treturn Object.freeze({ ...material, hash: digestObject(material) });\n}\nexport function recordLine(record: AuthorityRecord): string {\n\treturn `${canonicalJson(record)}\\n`;\n}\n\n/** Inode/head fencing is checked by the owner before offering a prefix. */\nexport function parseCommitted(bytes: Buffer, prefix?: ParsedAuthority): ParsedAuthority {\n\tif (prefix && (bytes.length < prefix.bytes.length || !prefix.bytes.equals(bytes.subarray(0, prefix.bytes.length))))\n\t\tprefix = undefined;\n\tif (prefix && bytes.length === prefix.bytes.length)\n\t\treturn { ...prefix, replay: { parsedRecords: 0, reusedPrefixRecords: prefix.records.length } };\n\tif (!bytes.length)\n\t\treturn {\n\t\t\tlastSeq: 0,\n\t\t\tlastHash: GENESIS_PREVIOUS,\n\t\t\trecords: Object.freeze([]),\n\t\t\tevents: Object.freeze([]),\n\t\t\tstate: projectAuthority([]),\n\t\t\tbytes: Buffer.alloc(0),\n\t\t\treplay: { parsedRecords: 0, reusedPrefixRecords: 0 },\n\t\t};\n\tif (bytes.at(-1) !== 10) throw new AuthorityStoreError(\"corrupt\");\n\tlet text: string;\n\ttry {\n\t\ttext = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes.subarray(prefix?.bytes.length ?? 0));\n\t} catch {\n\t\tthrow new AuthorityStoreError(\"corrupt\");\n\t}\n\tconst lines = text.slice(0, -1).split(\"\\n\");\n\tlet seed: AuthoritySnapshotState | undefined;\n\tlet previous = prefix?.lastHash ?? GENESIS_PREVIOUS;\n\tlet expectedSeq = (prefix?.lastSeq ?? 0) + 1;\n\tlet lastSeq = prefix?.lastSeq ?? 0;\n\tconst events: AuthorityEvent[] = [];\n\tconst records: AuthorityRecord[] = [];\n\tfor (const [index, line] of lines.entries()) {\n\t\tlet raw: unknown;\n\t\ttry {\n\t\t\traw = JSON.parse(line);\n\t\t} catch {\n\t\t\tthrow new AuthorityStoreError(\"corrupt\");\n\t\t}\n\t\tif (typeof raw !== \"object\" || raw === null || !(\"event\" in raw)) throw new AuthorityStoreError(\"corrupt\");\n\t\tconst event = parseAuthorityEvent(raw.event);\n\t\tconst record =\n\t\t\tevent.kind === \"authority-snapshot\"\n\t\t\t\t? materializeRecord(event.archivedThroughSequence + 1, event.continuesHash, event)\n\t\t\t\t: materializeRecord(expectedSeq, previous, event);\n\t\tif (canonicalJson(raw) !== canonicalJson(record)) throw new AuthorityStoreError(\"corrupt\");\n\t\tif (event.kind === \"authority-snapshot\") {\n\t\t\tif (index !== 0 || (prefix && prefix.records.length > 0)) throw new AuthorityStoreError(\"corrupt\");\n\t\t\tseed = event.state;\n\t\t} else events.push(event);\n\t\trecords.push(record);\n\t\tprevious = record.hash;\n\t\tlastSeq = record.seq;\n\t\texpectedSeq = record.seq + 1;\n\t}\n\treturn {\n\t\tlastSeq,\n\t\tlastHash: previous,\n\t\trecords: Object.freeze(prefix ? [...prefix.records, ...records] : records),\n\t\tevents: Object.freeze(prefix ? [...prefix.events, ...events] : events),\n\t\tstate: prefix && !seed ? applyAuthorityEvents(prefix.state, events) : projectAuthority(events, seed),\n\t\tbytes: Buffer.from(bytes),\n\t\treplay: { parsedRecords: records.length, reusedPrefixRecords: prefix?.records.length ?? 0 },\n\t};\n}\n"]}

package/dist/core/verified-run/authority-meaning.d.ts

@@ -0,0 +1,13 @@
+import { type GrantToken, type ResourceClaim, type Sequence } from "../../coordination/types.ts";
+import type { AuthorityEvent, AuthorityGrantRecord, AuthorityProjection } from "./authority-events.ts";
+export declare function assertSameCommandMeaning(grant: AuthorityGrantRecord, request: {
+    intentDigest: string;
+    sessionId: string;
+    incarnation: Sequence;
+    claims: readonly ResourceClaim[];
+    weight: number;
+}): void;
+export declare function sameGrantToken(left: GrantToken, right: GrantToken): boolean;
+export declare function expiryEvents(state: AuthorityProjection, now: number, epoch: Sequence): AuthorityEvent[];
+export declare function authorizationStillOpen(now: number, deadline: number): boolean;
+//# sourceMappingURL=authority-meaning.d.ts.map

package/dist/core/verified-run/authority-meaning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-meaning.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/authority-meaning.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAyB,KAAK,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAExH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEvG,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE;IACR,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,QAAQ,CAAC;IACtB,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CACf,GACC,IAAI,CASN;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAQ3E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,cAAc,EAAE,CAavG;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI7E","sourcesContent":["import { sameClaimSet } from \"../../coordination/resource.ts\";\nimport { type GrantToken, type ResourceClaim, SETTLED_EFFECT_STATES, type Sequence } from \"../../coordination/types.ts\";\nimport { AuthorityStoreError } from \"./authority-errors.ts\";\nimport type { AuthorityEvent, AuthorityGrantRecord, AuthorityProjection } from \"./authority-events.ts\";\n\nexport function assertSameCommandMeaning(\n\tgrant: AuthorityGrantRecord,\n\trequest: {\n\t\tintentDigest: string;\n\t\tsessionId: string;\n\t\tincarnation: Sequence;\n\t\tclaims: readonly ResourceClaim[];\n\t\tweight: number;\n\t},\n): void {\n\tif (\n\t\tgrant.intentDigest !== request.intentDigest ||\n\t\tgrant.token.sessionId !== request.sessionId ||\n\t\tgrant.token.sessionIncarnation !== request.incarnation ||\n\t\t!sameClaimSet([...grant.claims], [...request.claims]) ||\n\t\tgrant.weight !== request.weight\n\t)\n\t\tthrow new AuthorityStoreError(\"command_conflict\");\n}\n\nexport function sameGrantToken(left: GrantToken, right: GrantToken): boolean {\n\treturn (\n\t\tleft.authorityEpoch === right.authorityEpoch &&\n\t\tleft.grantSequence === right.grantSequence &&\n\t\tleft.sessionId === right.sessionId &&\n\t\tleft.sessionIncarnation === right.sessionIncarnation &&\n\t\tleft.authorizationDeadline === right.authorizationDeadline\n\t);\n}\n\nexport function expiryEvents(state: AuthorityProjection, now: number, epoch: Sequence): AuthorityEvent[] {\n\tconst expired: AuthorityEvent[] = [];\n\tfor (const grant of state.grants.values()) {\n\t\tif (SETTLED_EFFECT_STATES.has(grant.state) || grant.state === \"quarantined\") continue;\n\t\tif (now < grant.token.authorizationDeadline) continue;\n\t\texpired.push({\n\t\t\tkind: \"authorization-expired\",\n\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\tauthorityEpoch: epoch,\n\t\t\toutcome: grant.effectLive ? \"quarantined\" : \"cancelled\",\n\t\t});\n\t}\n\treturn expired;\n}\n\nexport function authorizationStillOpen(now: number, deadline: number): boolean {\n\tif (typeof now !== \"number\" || !Number.isSafeInteger(now) || now < 0)\n\t\tthrow new TypeError(\"now must be a nonnegative safe integer\");\n\treturn now < deadline;\n}\n"]}

package/dist/core/verified-run/authority-meaning.js

@@ -0,0 +1,40 @@
+import { sameClaimSet } from "../../coordination/resource.js";
+import { SETTLED_EFFECT_STATES } from "../../coordination/types.js";
+import { AuthorityStoreError } from "./authority-errors.js";
+export function assertSameCommandMeaning(grant, request) {
+    if (grant.intentDigest !== request.intentDigest ||
+        grant.token.sessionId !== request.sessionId ||
+        grant.token.sessionIncarnation !== request.incarnation ||
+        !sameClaimSet([...grant.claims], [...request.claims]) ||
+        grant.weight !== request.weight)
+        throw new AuthorityStoreError("command_conflict");
+}
+export function sameGrantToken(left, right) {
+    return (left.authorityEpoch === right.authorityEpoch &&
+        left.grantSequence === right.grantSequence &&
+        left.sessionId === right.sessionId &&
+        left.sessionIncarnation === right.sessionIncarnation &&
+        left.authorizationDeadline === right.authorizationDeadline);
+}
+export function expiryEvents(state, now, epoch) {
+    const expired = [];
+    for (const grant of state.grants.values()) {
+        if (SETTLED_EFFECT_STATES.has(grant.state) || grant.state === "quarantined")
+            continue;
+        if (now < grant.token.authorizationDeadline)
+            continue;
+        expired.push({
+            kind: "authorization-expired",
+            grantSequence: grant.token.grantSequence,
+            authorityEpoch: epoch,
+            outcome: grant.effectLive ? "quarantined" : "cancelled",
+        });
+    }
+    return expired;
+}
+export function authorizationStillOpen(now, deadline) {
+    if (typeof now !== "number" || !Number.isSafeInteger(now) || now < 0)
+        throw new TypeError("now must be a nonnegative safe integer");
+    return now < deadline;
+}
+//# sourceMappingURL=authority-meaning.js.map

package/dist/core/verified-run/authority-meaning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-meaning.js","sourceRoot":"","sources":["../../../src/core/verified-run/authority-meaning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAuC,qBAAqB,EAAiB,MAAM,6BAA6B,CAAC;AACxH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,MAAM,UAAU,wBAAwB,CACvC,KAA2B,EAC3B,OAMC,EACM;IACP,IACC,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;QAC3C,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAC3C,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,OAAO,CAAC,WAAW;QACtD,CAAC,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAE/B,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;AAAA,CACnD;AAED,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,KAAiB,EAAW;IAC5E,OAAO,CACN,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC5C,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAC1C,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;QACpD,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC,qBAAqB,CAC1D,CAAC;AAAA,CACF;AAED,MAAM,UAAU,YAAY,CAAC,KAA0B,EAAE,GAAW,EAAE,KAAe,EAAoB;IACxG,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa;YAAE,SAAS;QACtF,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB;YAAE,SAAS;QACtD,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,cAAc,EAAE,KAAK;YACrB,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;SACvD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,QAAgB,EAAW;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAC/D,OAAO,GAAG,GAAG,QAAQ,CAAC;AAAA,CACtB","sourcesContent":["import { sameClaimSet } from \"../../coordination/resource.ts\";\nimport { type GrantToken, type ResourceClaim, SETTLED_EFFECT_STATES, type Sequence } from \"../../coordination/types.ts\";\nimport { AuthorityStoreError } from \"./authority-errors.ts\";\nimport type { AuthorityEvent, AuthorityGrantRecord, AuthorityProjection } from \"./authority-events.ts\";\n\nexport function assertSameCommandMeaning(\n\tgrant: AuthorityGrantRecord,\n\trequest: {\n\t\tintentDigest: string;\n\t\tsessionId: string;\n\t\tincarnation: Sequence;\n\t\tclaims: readonly ResourceClaim[];\n\t\tweight: number;\n\t},\n): void {\n\tif (\n\t\tgrant.intentDigest !== request.intentDigest ||\n\t\tgrant.token.sessionId !== request.sessionId ||\n\t\tgrant.token.sessionIncarnation !== request.incarnation ||\n\t\t!sameClaimSet([...grant.claims], [...request.claims]) ||\n\t\tgrant.weight !== request.weight\n\t)\n\t\tthrow new AuthorityStoreError(\"command_conflict\");\n}\n\nexport function sameGrantToken(left: GrantToken, right: GrantToken): boolean {\n\treturn (\n\t\tleft.authorityEpoch === right.authorityEpoch &&\n\t\tleft.grantSequence === right.grantSequence &&\n\t\tleft.sessionId === right.sessionId &&\n\t\tleft.sessionIncarnation === right.sessionIncarnation &&\n\t\tleft.authorizationDeadline === right.authorizationDeadline\n\t);\n}\n\nexport function expiryEvents(state: AuthorityProjection, now: number, epoch: Sequence): AuthorityEvent[] {\n\tconst expired: AuthorityEvent[] = [];\n\tfor (const grant of state.grants.values()) {\n\t\tif (SETTLED_EFFECT_STATES.has(grant.state) || grant.state === \"quarantined\") continue;\n\t\tif (now < grant.token.authorizationDeadline) continue;\n\t\texpired.push({\n\t\t\tkind: \"authorization-expired\",\n\t\t\tgrantSequence: grant.token.grantSequence,\n\t\t\tauthorityEpoch: epoch,\n\t\t\toutcome: grant.effectLive ? \"quarantined\" : \"cancelled\",\n\t\t});\n\t}\n\treturn expired;\n}\n\nexport function authorizationStillOpen(now: number, deadline: number): boolean {\n\tif (typeof now !== \"number\" || !Number.isSafeInteger(now) || now < 0)\n\t\tthrow new TypeError(\"now must be a nonnegative safe integer\");\n\treturn now < deadline;\n}\n"]}

package/dist/core/verified-run/authority-runtime.d.ts

@@ -0,0 +1,82 @@
+import type { Sequence } from "../../coordination/types.ts";
+import type { AuthorityGrantRecord } from "./authority-events.ts";
+import { type AuthorityJournalInspection, type AuthorityProbe, AuthorityStore, type AuthorityStoreHooks } from "./authority-store.ts";
+import { type AuthorityStatus } from "./run-status.ts";
+/**
+ * Runtime bridge between the verified-run execution path and the durable
+ * `AuthorityStore` (WP03 §8 wiring).
+ *
+ * `RunAuthority` is the handle the dispatch boundary needs: the open store
+ * plus the session identity grants are minted under. `openRunAuthorityStore`
+ * is the restart boundary — it advances (or adopts) the durable epoch and
+ * finishes reconciliation before any new dispatch may be admitted. The
+ * `RunAuthorityPool` keeps one open store per coordinator while work is in
+ * flight, because the `"authority"` scope lease is fail-fast: two
+ * `AuthorityStore.open` calls on the same state root can never coexist, and a
+ * synchronous lock wait cannot be used inside one process.
+ */
+/**
+ * Reconcile probe for the verified-run boundary. A recorded
+ * `NamespaceIdentity` is probed against the real execution boundary. A
+ * missing identity is not a termination witness: a lost writer lease does
+ * not prove a Git child or hook has exited, and the ref outbox is not that
+ * proof either. Those grants stay `"unknown"` until a supervisor witness
+ * settles them (F07).
+ */
+export declare function runAuthorityProbe(grant: AuthorityGrantRecord): ReturnType<AuthorityProbe>;
+/** Total admissible weight of concurrently unsettled grants for one state root. */
+export declare const RUN_AUTHORITY_CAPACITY = 16;
+export interface OpenRunAuthorityStoreOptions {
+    readonly capacity?: number;
+    readonly hooks?: AuthorityStoreHooks;
+    readonly probe?: AuthorityProbe;
+}
+/**
+ * Open the state root's authority store and reconcile it before returning.
+ * The caller owns the store and must `release()` it; `acquire` stays refused
+ * (`reconcile_pending`) until this function has run.
+ */
+export declare function openRunAuthorityStore(runPath: string, options?: OpenRunAuthorityStoreOptions): AuthorityStore;
+/** Handle the dispatch boundary records through. */
+export interface RunAuthority {
+    readonly store: AuthorityStore;
+    readonly sessionId: string;
+    readonly incarnation: Sequence;
+}
+/** Read-only view of the durable authority store under a state root. */
+export interface AuthorityStoreView {
+    readonly path: string;
+    readonly status: AuthorityStatus;
+    readonly records: AuthorityJournalInspection["records"];
+}
+/**
+ * The durable authority store under this state root: which grant holds
+ * which claims, why it is quarantined, and whether termination was
+ * witnessed. Read-only; a missing store reads as an empty projection.
+ */
+export declare function inspectRunAuthority(stateRoot: string): AuthorityStoreView;
+/** Standalone open+reconcile+register for entry points without a pool (publish, tests). */
+export declare function openRunAuthority(runPath: string, options?: OpenRunAuthorityStoreOptions): RunAuthority;
+/**
+ * One open store per coordinator, ref-counted across in-flight operations.
+ * The authority lease is fail-fast and cross-process, so a coordinator-level
+ * pool is what lets concurrent operations share the single-writer boundary:
+ * the first operation opens (restart reconcile runs there), the last one
+ * releases. Session incarnations are registered once per run id per open
+ * lifetime — a later operation under a new epoch re-registers and fences the
+ * previous incarnation's tokens.
+ */
+export declare class RunAuthorityPool {
+    private readonly options;
+    private tail;
+    private store;
+    private users;
+    private readonly incarnations;
+    constructor(options?: OpenRunAuthorityStoreOptions);
+    private step;
+    private enter;
+    private exit;
+    /** Run `work` while holding one shared store slot; the slot releases when every user exits. */
+    run<T>(runPath: string, sessionId: string, work: (authority: RunAuthority) => T | Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=authority-runtime.d.ts.map

package/dist/core/verified-run/authority-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-runtime.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/authority-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACN,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,mBAAmB,EAExB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,iBAAiB,CAAC;AAG9E;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,UAAU,CAAC,cAAc,CAAC,CAGzF;AAED,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,4BAAiC,GAAG,cAAc,CAoBjH;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;CAC/B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAWzE;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,4BAAiC,GAAG,YAAY,CAgB1G;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,IAAI,CAAoC;IAChD,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAE5D,YAAY,OAAO,GAAE,4BAAiC,EAErD;IAED,OAAO,CAAC,IAAI;YASE,KAAK;YA+BL,IAAI;IAYlB,+FAA+F;IACzF,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAO9G;CACD","sourcesContent":["import { basename, dirname, resolve } from \"node:path\";\nimport type { Sequence } from \"../../coordination/types.ts\";\nimport type { AuthorityGrantRecord } from \"./authority-events.ts\";\nimport {\n\ttype AuthorityJournalInspection,\n\ttype AuthorityProbe,\n\tAuthorityStore,\n\ttype AuthorityStoreHooks,\n\tauthorityStorePath,\n} from \"./authority-store.ts\";\nimport { type AuthorityStatus, deriveAuthorityStatus } from \"./run-status.ts\";\nimport { probeOwnedNamespace } from \"./supervisor-adapter.ts\";\n\n/**\n * Runtime bridge between the verified-run execution path and the durable\n * `AuthorityStore` (WP03 §8 wiring).\n *\n * `RunAuthority` is the handle the dispatch boundary needs: the open store\n * plus the session identity grants are minted under. `openRunAuthorityStore`\n * is the restart boundary — it advances (or adopts) the durable epoch and\n * finishes reconciliation before any new dispatch may be admitted. The\n * `RunAuthorityPool` keeps one open store per coordinator while work is in\n * flight, because the `\"authority\"` scope lease is fail-fast: two\n * `AuthorityStore.open` calls on the same state root can never coexist, and a\n * synchronous lock wait cannot be used inside one process.\n */\n\n/**\n * Reconcile probe for the verified-run boundary. A recorded\n * `NamespaceIdentity` is probed against the real execution boundary. A\n * missing identity is not a termination witness: a lost writer lease does\n * not prove a Git child or hook has exited, and the ref outbox is not that\n * proof either. Those grants stay `\"unknown\"` until a supervisor witness\n * settles them (F07).\n */\nexport function runAuthorityProbe(grant: AuthorityGrantRecord): ReturnType<AuthorityProbe> {\n\tif (!grant.identity) return \"unknown\";\n\treturn probeOwnedNamespace(grant.identity);\n}\n\n/** Total admissible weight of concurrently unsettled grants for one state root. */\nexport const RUN_AUTHORITY_CAPACITY = 16;\n\nexport interface OpenRunAuthorityStoreOptions {\n\treadonly capacity?: number;\n\treadonly hooks?: AuthorityStoreHooks;\n\treadonly probe?: AuthorityProbe;\n}\n\n/**\n * Open the state root's authority store and reconcile it before returning.\n * The caller owns the store and must `release()` it; `acquire` stays refused\n * (`reconcile_pending`) until this function has run.\n */\nexport function openRunAuthorityStore(runPath: string, options: OpenRunAuthorityStoreOptions = {}): AuthorityStore {\n\tconst store = AuthorityStore.open(authorityStorePath(dirname(runPath)), {\n\t\tcapacity: options.capacity ?? RUN_AUTHORITY_CAPACITY,\n\t\tprobe: options.probe ?? runAuthorityProbe,\n\t\t...(options.hooks ? { hooks: options.hooks } : {}),\n\t});\n\ttry {\n\t\tstore.reconcile();\n\t} catch (error) {\n\t\ttry {\n\t\t\tstore.release();\n\t\t} catch (releaseError) {\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))],\n\t\t\t\t\"Authority store reconcile cleanup failed\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n\treturn store;\n}\n\n/** Handle the dispatch boundary records through. */\nexport interface RunAuthority {\n\treadonly store: AuthorityStore;\n\treadonly sessionId: string;\n\treadonly incarnation: Sequence;\n}\n\n/** Read-only view of the durable authority store under a state root. */\nexport interface AuthorityStoreView {\n\treadonly path: string;\n\treadonly status: AuthorityStatus;\n\treadonly records: AuthorityJournalInspection[\"records\"];\n}\n\n/**\n * The durable authority store under this state root: which grant holds\n * which claims, why it is quarantined, and whether termination was\n * witnessed. Read-only; a missing store reads as an empty projection.\n */\nexport function inspectRunAuthority(stateRoot: string): AuthorityStoreView {\n\tconst path = authorityStorePath(resolve(stateRoot));\n\tconst inspection = AuthorityStore.inspectJournal(path);\n\treturn Object.freeze({\n\t\tpath,\n\t\tstatus: deriveAuthorityStatus(\n\t\t\tinspection.state,\n\t\t\tinspection.records.map((record) => record.event),\n\t\t),\n\t\trecords: inspection.records,\n\t});\n}\n\n/** Standalone open+reconcile+register for entry points without a pool (publish, tests). */\nexport function openRunAuthority(runPath: string, options: OpenRunAuthorityStoreOptions = {}): RunAuthority {\n\tconst store = openRunAuthorityStore(runPath, options);\n\tconst sessionId = basename(runPath);\n\ttry {\n\t\treturn Object.freeze({ store, sessionId, incarnation: store.register(sessionId) });\n\t} catch (error) {\n\t\ttry {\n\t\t\tstore.release();\n\t\t} catch (releaseError) {\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))],\n\t\t\t\t\"Authority session cleanup failed\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * One open store per coordinator, ref-counted across in-flight operations.\n * The authority lease is fail-fast and cross-process, so a coordinator-level\n * pool is what lets concurrent operations share the single-writer boundary:\n * the first operation opens (restart reconcile runs there), the last one\n * releases. Session incarnations are registered once per run id per open\n * lifetime — a later operation under a new epoch re-registers and fences the\n * previous incarnation's tokens.\n */\nexport class RunAuthorityPool {\n\tprivate readonly options: OpenRunAuthorityStoreOptions;\n\tprivate tail: Promise<void> = Promise.resolve();\n\tprivate store: AuthorityStore | null = null;\n\tprivate users = 0;\n\tprivate readonly incarnations = new Map<string, Sequence>();\n\n\tconstructor(options: OpenRunAuthorityStoreOptions = {}) {\n\t\tthis.options = options;\n\t}\n\n\tprivate step<T>(fn: () => T): Promise<T> {\n\t\tconst run = this.tail.then(fn);\n\t\tthis.tail = run.then(\n\t\t\t() => {},\n\t\t\t() => {},\n\t\t);\n\t\treturn run;\n\t}\n\n\tprivate async enter(runPath: string, sessionId: string): Promise<RunAuthority> {\n\t\treturn this.step(() => {\n\t\t\tif (this.users === 0) {\n\t\t\t\tthis.store = openRunAuthorityStore(runPath, this.options);\n\t\t\t\tthis.incarnations.clear();\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tlet incarnation = this.incarnations.get(sessionId);\n\t\t\t\tif (!incarnation) {\n\t\t\t\t\tif (!this.store) throw new Error(\"authority store missing\");\n\t\t\t\t\tincarnation = this.store.register(sessionId);\n\t\t\t\t\tthis.incarnations.set(sessionId, incarnation);\n\t\t\t\t}\n\t\t\t\tconst store = this.store;\n\t\t\t\tif (!store) throw new Error(\"authority store missing\");\n\t\t\t\tthis.users += 1;\n\t\t\t\treturn { store, sessionId, incarnation };\n\t\t\t} catch (error) {\n\t\t\t\tif (this.users === 0 && this.store) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tthis.store.release();\n\t\t\t\t\t} finally {\n\t\t\t\t\t\tthis.store = null;\n\t\t\t\t\t\tthis.incarnations.clear();\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate async exit(): Promise<void> {\n\t\tawait this.step(() => {\n\t\t\tif (this.users > 0) this.users -= 1;\n\t\t\tif (this.users === 0 && this.store) {\n\t\t\t\tconst store = this.store;\n\t\t\t\tthis.store = null;\n\t\t\t\tthis.incarnations.clear();\n\t\t\t\tstore.release();\n\t\t\t}\n\t\t});\n\t}\n\n\t/** Run `work` while holding one shared store slot; the slot releases when every user exits. */\n\tasync run<T>(runPath: string, sessionId: string, work: (authority: RunAuthority) => T | Promise<T>): Promise<T> {\n\t\tconst authority = await this.enter(runPath, sessionId);\n\t\ttry {\n\t\t\treturn await work(authority);\n\t\t} finally {\n\t\t\tawait this.exit();\n\t\t}\n\t}\n}\n"]}

package/dist/core/verified-run/authority-runtime.js

@@ -0,0 +1,169 @@
+import { basename, dirname, resolve } from "node:path";
+import { AuthorityStore, authorityStorePath, } from "./authority-store.js";
+import { deriveAuthorityStatus } from "./run-status.js";
+import { probeOwnedNamespace } from "./supervisor-adapter.js";
+/**
+ * Runtime bridge between the verified-run execution path and the durable
+ * `AuthorityStore` (WP03 §8 wiring).
+ *
+ * `RunAuthority` is the handle the dispatch boundary needs: the open store
+ * plus the session identity grants are minted under. `openRunAuthorityStore`
+ * is the restart boundary — it advances (or adopts) the durable epoch and
+ * finishes reconciliation before any new dispatch may be admitted. The
+ * `RunAuthorityPool` keeps one open store per coordinator while work is in
+ * flight, because the `"authority"` scope lease is fail-fast: two
+ * `AuthorityStore.open` calls on the same state root can never coexist, and a
+ * synchronous lock wait cannot be used inside one process.
+ */
+/**
+ * Reconcile probe for the verified-run boundary. A recorded
+ * `NamespaceIdentity` is probed against the real execution boundary. A
+ * missing identity is not a termination witness: a lost writer lease does
+ * not prove a Git child or hook has exited, and the ref outbox is not that
+ * proof either. Those grants stay `"unknown"` until a supervisor witness
+ * settles them (F07).
+ */
+export function runAuthorityProbe(grant) {
+    if (!grant.identity)
+        return "unknown";
+    return probeOwnedNamespace(grant.identity);
+}
+/** Total admissible weight of concurrently unsettled grants for one state root. */
+export const RUN_AUTHORITY_CAPACITY = 16;
+/**
+ * Open the state root's authority store and reconcile it before returning.
+ * The caller owns the store and must `release()` it; `acquire` stays refused
+ * (`reconcile_pending`) until this function has run.
+ */
+export function openRunAuthorityStore(runPath, options = {}) {
+    const store = AuthorityStore.open(authorityStorePath(dirname(runPath)), {
+        capacity: options.capacity ?? RUN_AUTHORITY_CAPACITY,
+        probe: options.probe ?? runAuthorityProbe,
+        ...(options.hooks ? { hooks: options.hooks } : {}),
+    });
+    try {
+        store.reconcile();
+    }
+    catch (error) {
+        try {
+            store.release();
+        }
+        catch (releaseError) {
+            throw new AggregateError([error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))], "Authority store reconcile cleanup failed");
+        }
+        throw error;
+    }
+    return store;
+}
+/**
+ * The durable authority store under this state root: which grant holds
+ * which claims, why it is quarantined, and whether termination was
+ * witnessed. Read-only; a missing store reads as an empty projection.
+ */
+export function inspectRunAuthority(stateRoot) {
+    const path = authorityStorePath(resolve(stateRoot));
+    const inspection = AuthorityStore.inspectJournal(path);
+    return Object.freeze({
+        path,
+        status: deriveAuthorityStatus(inspection.state, inspection.records.map((record) => record.event)),
+        records: inspection.records,
+    });
+}
+/** Standalone open+reconcile+register for entry points without a pool (publish, tests). */
+export function openRunAuthority(runPath, options = {}) {
+    const store = openRunAuthorityStore(runPath, options);
+    const sessionId = basename(runPath);
+    try {
+        return Object.freeze({ store, sessionId, incarnation: store.register(sessionId) });
+    }
+    catch (error) {
+        try {
+            store.release();
+        }
+        catch (releaseError) {
+            throw new AggregateError([error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))], "Authority session cleanup failed");
+        }
+        throw error;
+    }
+}
+/**
+ * One open store per coordinator, ref-counted across in-flight operations.
+ * The authority lease is fail-fast and cross-process, so a coordinator-level
+ * pool is what lets concurrent operations share the single-writer boundary:
+ * the first operation opens (restart reconcile runs there), the last one
+ * releases. Session incarnations are registered once per run id per open
+ * lifetime — a later operation under a new epoch re-registers and fences the
+ * previous incarnation's tokens.
+ */
+export class RunAuthorityPool {
+    options;
+    tail = Promise.resolve();
+    store = null;
+    users = 0;
+    incarnations = new Map();
+    constructor(options = {}) {
+        this.options = options;
+    }
+    step(fn) {
+        const run = this.tail.then(fn);
+        this.tail = run.then(() => { }, () => { });
+        return run;
+    }
+    async enter(runPath, sessionId) {
+        return this.step(() => {
+            if (this.users === 0) {
+                this.store = openRunAuthorityStore(runPath, this.options);
+                this.incarnations.clear();
+            }
+            try {
+                let incarnation = this.incarnations.get(sessionId);
+                if (!incarnation) {
+                    if (!this.store)
+                        throw new Error("authority store missing");
+                    incarnation = this.store.register(sessionId);
+                    this.incarnations.set(sessionId, incarnation);
+                }
+                const store = this.store;
+                if (!store)
+                    throw new Error("authority store missing");
+                this.users += 1;
+                return { store, sessionId, incarnation };
+            }
+            catch (error) {
+                if (this.users === 0 && this.store) {
+                    try {
+                        this.store.release();
+                    }
+                    finally {
+                        this.store = null;
+                        this.incarnations.clear();
+                    }
+                }
+                throw error;
+            }
+        });
+    }
+    async exit() {
+        await this.step(() => {
+            if (this.users > 0)
+                this.users -= 1;
+            if (this.users === 0 && this.store) {
+                const store = this.store;
+                this.store = null;
+                this.incarnations.clear();
+                store.release();
+            }
+        });
+    }
+    /** Run `work` while holding one shared store slot; the slot releases when every user exits. */
+    async run(runPath, sessionId, work) {
+        const authority = await this.enter(runPath, sessionId);
+        try {
+            return await work(authority);
+        }
+        finally {
+            await this.exit();
+        }
+    }
+}
+//# sourceMappingURL=authority-runtime.js.map

package/dist/core/verified-run/authority-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-runtime.js","sourceRoot":"","sources":["../../../src/core/verified-run/authority-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAGN,cAAc,EAEd,kBAAkB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAwB,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA2B,EAA8B;IAC1F,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAAA,CAC3C;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAQzC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,OAAO,GAAiC,EAAE,EAAkB;IAClH,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE;QACvE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,sBAAsB;QACpD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,iBAAiB;QACzC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC;QACJ,KAAK,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACJ,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CACvB,CAAC,KAAK,EAAE,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EACvF,0CAA0C,CAC1C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAgBD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAsB;IAC1E,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI;QACJ,MAAM,EAAE,qBAAqB,CAC5B,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChD;QACD,OAAO,EAAE,UAAU,CAAC,OAAO;KAC3B,CAAC,CAAC;AAAA,CACH;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAO,GAAiC,EAAE,EAAgB;IAC3G,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACJ,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CACvB,CAAC,KAAK,EAAE,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EACvF,kCAAkC,CAClC,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IACX,OAAO,CAA+B;IAC/C,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACxC,KAAK,GAA0B,IAAI,CAAC;IACpC,KAAK,GAAG,CAAC,CAAC;IACD,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE5D,YAAY,OAAO,GAAiC,EAAE,EAAE;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAAA,CACvB;IAEO,IAAI,CAAI,EAAW,EAAc;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CACnB,GAAG,EAAE,CAAC,EAAC,CAAC,EACR,GAAG,EAAE,CAAC,EAAC,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC;IAAA,CACX;IAEO,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,SAAiB,EAAyB;QAC9E,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1D,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC;gBACJ,IAAI,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,IAAI,CAAC,WAAW,EAAE,CAAC;oBAClB,IAAI,CAAC,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBAC5D,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBAC7C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC/C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACzB,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;gBACvD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACpC,IAAI,CAAC;wBACJ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACtB,CAAC;4BAAS,CAAC;wBACV,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;wBAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBAC3B,CAAC;gBACF,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QAAA,CACD,CAAC,CAAC;IAAA,CACH;IAEO,KAAK,CAAC,IAAI,GAAkB;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBAC1B,KAAK,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;QAAA,CACD,CAAC,CAAC;IAAA,CACH;IAED,+FAA+F;IAC/F,KAAK,CAAC,GAAG,CAAI,OAAe,EAAE,SAAiB,EAAE,IAAiD,EAAc;QAC/G,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACV,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;IAAA,CACD;CACD","sourcesContent":["import { basename, dirname, resolve } from \"node:path\";\nimport type { Sequence } from \"../../coordination/types.ts\";\nimport type { AuthorityGrantRecord } from \"./authority-events.ts\";\nimport {\n\ttype AuthorityJournalInspection,\n\ttype AuthorityProbe,\n\tAuthorityStore,\n\ttype AuthorityStoreHooks,\n\tauthorityStorePath,\n} from \"./authority-store.ts\";\nimport { type AuthorityStatus, deriveAuthorityStatus } from \"./run-status.ts\";\nimport { probeOwnedNamespace } from \"./supervisor-adapter.ts\";\n\n/**\n * Runtime bridge between the verified-run execution path and the durable\n * `AuthorityStore` (WP03 §8 wiring).\n *\n * `RunAuthority` is the handle the dispatch boundary needs: the open store\n * plus the session identity grants are minted under. `openRunAuthorityStore`\n * is the restart boundary — it advances (or adopts) the durable epoch and\n * finishes reconciliation before any new dispatch may be admitted. The\n * `RunAuthorityPool` keeps one open store per coordinator while work is in\n * flight, because the `\"authority\"` scope lease is fail-fast: two\n * `AuthorityStore.open` calls on the same state root can never coexist, and a\n * synchronous lock wait cannot be used inside one process.\n */\n\n/**\n * Reconcile probe for the verified-run boundary. A recorded\n * `NamespaceIdentity` is probed against the real execution boundary. A\n * missing identity is not a termination witness: a lost writer lease does\n * not prove a Git child or hook has exited, and the ref outbox is not that\n * proof either. Those grants stay `\"unknown\"` until a supervisor witness\n * settles them (F07).\n */\nexport function runAuthorityProbe(grant: AuthorityGrantRecord): ReturnType<AuthorityProbe> {\n\tif (!grant.identity) return \"unknown\";\n\treturn probeOwnedNamespace(grant.identity);\n}\n\n/** Total admissible weight of concurrently unsettled grants for one state root. */\nexport const RUN_AUTHORITY_CAPACITY = 16;\n\nexport interface OpenRunAuthorityStoreOptions {\n\treadonly capacity?: number;\n\treadonly hooks?: AuthorityStoreHooks;\n\treadonly probe?: AuthorityProbe;\n}\n\n/**\n * Open the state root's authority store and reconcile it before returning.\n * The caller owns the store and must `release()` it; `acquire` stays refused\n * (`reconcile_pending`) until this function has run.\n */\nexport function openRunAuthorityStore(runPath: string, options: OpenRunAuthorityStoreOptions = {}): AuthorityStore {\n\tconst store = AuthorityStore.open(authorityStorePath(dirname(runPath)), {\n\t\tcapacity: options.capacity ?? RUN_AUTHORITY_CAPACITY,\n\t\tprobe: options.probe ?? runAuthorityProbe,\n\t\t...(options.hooks ? { hooks: options.hooks } : {}),\n\t});\n\ttry {\n\t\tstore.reconcile();\n\t} catch (error) {\n\t\ttry {\n\t\t\tstore.release();\n\t\t} catch (releaseError) {\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))],\n\t\t\t\t\"Authority store reconcile cleanup failed\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n\treturn store;\n}\n\n/** Handle the dispatch boundary records through. */\nexport interface RunAuthority {\n\treadonly store: AuthorityStore;\n\treadonly sessionId: string;\n\treadonly incarnation: Sequence;\n}\n\n/** Read-only view of the durable authority store under a state root. */\nexport interface AuthorityStoreView {\n\treadonly path: string;\n\treadonly status: AuthorityStatus;\n\treadonly records: AuthorityJournalInspection[\"records\"];\n}\n\n/**\n * The durable authority store under this state root: which grant holds\n * which claims, why it is quarantined, and whether termination was\n * witnessed. Read-only; a missing store reads as an empty projection.\n */\nexport function inspectRunAuthority(stateRoot: string): AuthorityStoreView {\n\tconst path = authorityStorePath(resolve(stateRoot));\n\tconst inspection = AuthorityStore.inspectJournal(path);\n\treturn Object.freeze({\n\t\tpath,\n\t\tstatus: deriveAuthorityStatus(\n\t\t\tinspection.state,\n\t\t\tinspection.records.map((record) => record.event),\n\t\t),\n\t\trecords: inspection.records,\n\t});\n}\n\n/** Standalone open+reconcile+register for entry points without a pool (publish, tests). */\nexport function openRunAuthority(runPath: string, options: OpenRunAuthorityStoreOptions = {}): RunAuthority {\n\tconst store = openRunAuthorityStore(runPath, options);\n\tconst sessionId = basename(runPath);\n\ttry {\n\t\treturn Object.freeze({ store, sessionId, incarnation: store.register(sessionId) });\n\t} catch (error) {\n\t\ttry {\n\t\t\tstore.release();\n\t\t} catch (releaseError) {\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, releaseError instanceof Error ? releaseError : new Error(String(releaseError))],\n\t\t\t\t\"Authority session cleanup failed\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * One open store per coordinator, ref-counted across in-flight operations.\n * The authority lease is fail-fast and cross-process, so a coordinator-level\n * pool is what lets concurrent operations share the single-writer boundary:\n * the first operation opens (restart reconcile runs there), the last one\n * releases. Session incarnations are registered once per run id per open\n * lifetime — a later operation under a new epoch re-registers and fences the\n * previous incarnation's tokens.\n */\nexport class RunAuthorityPool {\n\tprivate readonly options: OpenRunAuthorityStoreOptions;\n\tprivate tail: Promise<void> = Promise.resolve();\n\tprivate store: AuthorityStore | null = null;\n\tprivate users = 0;\n\tprivate readonly incarnations = new Map<string, Sequence>();\n\n\tconstructor(options: OpenRunAuthorityStoreOptions = {}) {\n\t\tthis.options = options;\n\t}\n\n\tprivate step<T>(fn: () => T): Promise<T> {\n\t\tconst run = this.tail.then(fn);\n\t\tthis.tail = run.then(\n\t\t\t() => {},\n\t\t\t() => {},\n\t\t);\n\t\treturn run;\n\t}\n\n\tprivate async enter(runPath: string, sessionId: string): Promise<RunAuthority> {\n\t\treturn this.step(() => {\n\t\t\tif (this.users === 0) {\n\t\t\t\tthis.store = openRunAuthorityStore(runPath, this.options);\n\t\t\t\tthis.incarnations.clear();\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tlet incarnation = this.incarnations.get(sessionId);\n\t\t\t\tif (!incarnation) {\n\t\t\t\t\tif (!this.store) throw new Error(\"authority store missing\");\n\t\t\t\t\tincarnation = this.store.register(sessionId);\n\t\t\t\t\tthis.incarnations.set(sessionId, incarnation);\n\t\t\t\t}\n\t\t\t\tconst store = this.store;\n\t\t\t\tif (!store) throw new Error(\"authority store missing\");\n\t\t\t\tthis.users += 1;\n\t\t\t\treturn { store, sessionId, incarnation };\n\t\t\t} catch (error) {\n\t\t\t\tif (this.users === 0 && this.store) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tthis.store.release();\n\t\t\t\t\t} finally {\n\t\t\t\t\t\tthis.store = null;\n\t\t\t\t\t\tthis.incarnations.clear();\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate async exit(): Promise<void> {\n\t\tawait this.step(() => {\n\t\t\tif (this.users > 0) this.users -= 1;\n\t\t\tif (this.users === 0 && this.store) {\n\t\t\t\tconst store = this.store;\n\t\t\t\tthis.store = null;\n\t\t\t\tthis.incarnations.clear();\n\t\t\t\tstore.release();\n\t\t\t}\n\t\t});\n\t}\n\n\t/** Run `work` while holding one shared store slot; the slot releases when every user exits. */\n\tasync run<T>(runPath: string, sessionId: string, work: (authority: RunAuthority) => T | Promise<T>): Promise<T> {\n\t\tconst authority = await this.enter(runPath, sessionId);\n\t\ttry {\n\t\t\treturn await work(authority);\n\t\t} finally {\n\t\t\tawait this.exit();\n\t\t}\n\t}\n}\n"]}