pi-daddy 0.28.0 → 0.32.0

package/dist/lease-helper.js

@@ -1,94 +0,0 @@
-/**
- * **The lock helper: a separate program, and the parent's side of its pipes.**
- *
- * Split out of `workspace-lease.ts` because `test/file-size.test.ts` refused that file — at 405 lines on the
- * ADR-0035 branch when PR #14 merged into it, and at 435 here once R-152's guards landed. Both branches take
- * the same seam so they converge rather than diverge, and the cap has never been raised: `delegate.ts` was
- * split at 413 the same way (rule: when a guard fails, obey it).
- *
- * The seam is not arbitrary. Everything here concerns the process that HOLDS the kernel lock — the source it
- * runs, the readiness token it prints, and the parent-side handles that keep it referenced.
- * `workspace-lease.ts` keeps the lease lifecycle that talks to it.
- */
-export const LEASE_READY = "PI_DADDY_LEASE_READY";
-// The lock holder also owns crash cleanup for the governed child. If the parent dies, stdin closes;
-// the helper signals the attached process, or closes the herdr tab, before releasing flock. A raw
-// descendant deliberately detached by bash remains ADR-0012's OS-containment boundary, not a lease
-// guarantee. The process branch SIGTERMs, escalates to SIGKILL at +500ms, and releases at +750ms
-// WITHOUT confirming death (R-101). The herdr branch retries `tab close` a BOUNDED number of times
-// and then releases anyway, leaving a marker file: an unreleasable lock strands a worktree forever
-// with no in-product recovery, which is strictly worse than a recorded failure to close (R-102).
-//
-// **Each attempt is bounded in WALL CLOCK, not just in count (R-146).** `execFile` with no `timeout`
-// never calls back if `herdr` accepts the close and does not answer, so the retry counter never
-// decrements, `giveUp` never runs and no marker is written — the lock is held forever. That was masked
-// while the parent could not exit, because the operator saw a hung `pi` instead; measured with a `herdr`
-// that sleeps, the parent then exited in 82ms and left a silent strand, which is R-102's rejected outcome
-// reached quietly. A bound on retries is not a bound on time.
-export const HELPER_SOURCE = `
-import { execFile } from "node:child_process";
-import { writeFileSync } from "node:fs";
-let clean=false, target=null, buffered="";
-process.stdout.write(${JSON.stringify(`${LEASE_READY}:`)}+process.pid+"\\n");
-process.stdin.setEncoding("utf8");
-process.stdin.on("data",chunk=>{buffered+=chunk;for(;;){const i=buffered.indexOf("\\n");if(i<0)break;const line=buffered.slice(0,i);buffered=buffered.slice(i+1);try{const value=JSON.parse(line);if(value.release)clean=true;else if(value.process_pid)target={process_pid:value.process_pid};else if(value.herdr_tab)target={herdr_tab:value.herdr_tab};}catch{}}});
-process.stdin.on("end",()=>{if(clean||!target)return process.exit(0);if(target.process_pid){try{process.kill(target.process_pid,"SIGTERM")}catch{return process.exit(0)}setTimeout(()=>{try{process.kill(target.process_pid,"SIGKILL")}catch{}},500);return setTimeout(()=>process.exit(0),750);}let left=Number(process.env.PI_DADDY_LEASE_CLOSE_ATTEMPTS||10);const giveUp=last=>{try{if(process.env.PI_DADDY_LEASE_MARKER)writeFileSync(process.env.PI_DADDY_LEASE_MARKER,JSON.stringify({reason:last&&(last.killed||last.signal==="SIGKILL")?"herdr-close-timeout":"herdr-close-failed",herdr_tab:target.herdr_tab})+"\\n")}catch{}process.exit(0)};const close=()=>execFile("herdr",["tab","close",target.herdr_tab],{timeout:Number(process.env.PI_DADDY_LEASE_CLOSE_TIMEOUT_MS||15000),killSignal:"SIGKILL"},error=>{if(!error)return process.exit(0);if(--left<=0)return giveUp(error);setTimeout(close,1000)});close();});
-process.stdin.resume();`;
-/**
- * `unref` the parent's end of one of the helper's pipes.
- *
- * A spawned pipe is a `net.Socket`, which has `unref`; `ChildProcess.stdin` is typed `Writable`, which does
- * not. Hence the narrow cast. The optional call is **defensive, not load-bearing** — the holder is spawned at
- * exactly one site with three pipes, so none of these is ever `null`, and an earlier version of this comment
- * claimed otherwise by citing a `stdio: "ignore"` caller that does not exist.
- *
- * Only `stdout` and `stderr` are unref'ed. `stdin` was too, until a line-by-line reversion showed the suite
- * stayed green without it — an unforced line inside the fix that exists to be forced, which is exactly the
- * shape R-122 was about.
- */
-export const unrefStream = (stream) => {
-    stream?.unref?.();
-};
-/**
- * The bounds on the helper's `herdr tab close` attempts live here, with the attempts they bound — moved out of
- * `workspace-lease.ts` when the line ceiling refused it at 402 lines, once both this branch's ADR-0035 work and
- * `main`'s R-152 guards had landed in it. Third time that guard has fired on this file and third time the
- * answer was a seam rather than a bigger cap.
- */
-/**
- * **A bound that is not a bound throws, and it throws a `RangeError` (R-146, R-152).**
- *
- * Both ends fail, in opposite directions and both silently:
- *
- *  - `0` reads as "no limit" and Node agrees — `execFile` treats `timeout: 0` as *no* timeout (measured: the
- *    callback for a 3s sleep arrives at 3004ms with no error), reinstating the unbounded hang the bound exists
- *    to prevent. Negatives behave identically.
- *  - anything above `2^31 - 1` truncates: `setTimeout` warns `TimeoutOverflowWarning … set to 1`, so
- *    `Number.MAX_SAFE_INTEGER` — the plausible "effectively no limit" sentinel, given the argument about `0`
- *    — SIGKILLs every `herdr tab close` after 1ms, before herdr can act. Measured: callback at 3ms.
- *
- * **Not a `GovernanceRefusal`.** It was one, carrying `WORKSPACE_LEASE_STALE`, which everywhere else in this
- * package means *the lease went stale or was lost* — so an ADR-0034 controller switching on codes (the reason
- * codes exist, R-103) would classify a permanent caller bug as transient and retry a call that can never
- * succeed. A refusal is a governance outcome that gets ledgered; a bad argument is neither.
- *
- * Checked for read leases too, which the first version did not: it sat below the read-lease early return, so a
- * controller smoke-testing its configuration against a read lease got a false all-clear.
- */
-export const assertCloseBounds = (input) => {
-    const MAX_TIMER = 2_147_483_647;
-    for (const [name, value, ceiling] of [
-        ["herdrCloseTimeoutMs", input.herdrCloseTimeoutMs, MAX_TIMER],
-        ["herdrCloseAttempts", input.herdrCloseAttempts, Number.MAX_SAFE_INTEGER],
-    ]) {
-        if (value === undefined)
-            continue;
-        if (!Number.isInteger(value) || value < 1 || value > ceiling) {
-            throw new RangeError(`${name} must be a whole number between 1 and ${ceiling}, not ${String(value)}. Zero and negatives ` +
-                `are not "no limit" but no bound at all, a value past ${MAX_TIMER} truncates to 1ms, and a ` +
-                `fractional count is not a count — this bound exists so a hung herdr cannot hold the writer lock ` +
-                `forever (R-146).`);
-        }
-    }
-};
-//# sourceMappingURL=lease-helper.js.map

package/dist/lease-helper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lease-helper.js","sourceRoot":"","sources":["../src/lease-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAClD,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,EAAE;AACF,qGAAqG;AACrG,gGAAgG;AAChG,uGAAuG;AACvG,yGAAyG;AACzG,0GAA0G;AAC1G,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG;;;;uBAIN,IAAI,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,CAAC;;;;wBAIhC,CAAC;AAEzB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAe,EAAQ,EAAE;IAClD,MAAwC,EAAE,KAAK,EAAE,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAoE,EAAQ,EAAE;IAC9G,MAAM,SAAS,GAAG,aAAa,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnC,CAAC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,EAAE,SAAS,CAAC;QAC7D,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC;KACjE,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,yCAAyC,OAAO,SAAS,MAAM,CAAC,KAAK,CAAC,uBAAuB;gBAClG,wDAAwD,SAAS,2BAA2B;gBAC5F,kGAAkG;gBAClG,kBAAkB,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/lease-record.d.ts

@@ -1,90 +0,0 @@
-import type { ValidatedWorkspace, WorkspaceAccess } from "./workspace.ts";
-export interface LeaseMetadata {
-    version: 1;
-    state: "active" | "released";
-    token: string;
-    owner_id: string;
-    workspace_id: string;
-    root: string;
-    pid: number;
-    acquired_at: string;
-    released_at?: string;
-    release_reason?: string;
-}
-export interface WorkspaceLease {
-    workspace: ValidatedWorkspace;
-    access: WorkspaceAccess;
-    ownerId: string;
-    /**
-     * `true` only when the kernel lock was free but metadata said the prior owner never released.
-     * `"unknown"` when the prior owner's record could not be read at all — that is not evidence of a
-     * clean handover and must not be recorded as one (R-100).
-     */
-    recovered: boolean | "unknown";
-    /** Attach the governed resource so parent death cleans it before the kernel lock is released. */
-    attachProcess(pid: number): void;
-    attachHerdrTab(tabId: string): void;
-    /** Resolves only when the kernel-lock helper exits before explicit release. */
-    lost: Promise<Error>;
-    /**
-     * NEVER throws. A cleanup function that can throw destroys its caller's return value — a completed
-     * child's entire output was discarded this way (R-99) — so the outcome is a VALUE the caller records:
-     *   `"released"`            the kernel lock was handed back and the handover recorded;
-     *   `"released-unrecorded"` the lock was handed back but the record failed, so the NEXT owner will
-     *                           report a recovery that did not happen unless this is ledgered;
-     *   `"lost"`                the helper was already gone, so this owner never released anything.
-     */
-    release(reason?: string): Promise<LeaseReleaseOutcome>;
-    /**
-     * Record that this lease is being kept deliberately, WITHOUT releasing the kernel lock.
-     *
-     * Needed because a retained lease never calls `release()`, so the metadata stays `state: "active"` and
-     * whoever acquires next reports `recovered: true` — blaming a crash on a known-good path.
-     */
-    /**
-     * Record that the lease is being KEPT rather than handed back, and answer what actually happened — the
-     * caller ledgers this word (R-152). It is not always `retained`: a helper that has already died makes the
-     * fact `lost`, and a lease already settled by `release()` keeps the outcome it had.
-     */
-    markRetained(reason?: string): Promise<LeaseReleaseOutcome>;
-    /** Reads the give-up marker the helper leaves when it could not close a herdr writer tab. */
-    readCloseFailure(): Promise<{
-        reason: string;
-        herdr_tab?: string;
-    } | null>;
-}
-/**
- * What a release actually did. Six members rather than three, because the first version conflated facts
- * that call for different responses — and one of them is an alarm:
- *   `released`             the lock went back and THIS owner wrote its own handover;
- *   `released-unrecorded`  the lock went back and the record does not say so, so the next owner will report
- *                          a recovery that never happened unless the caller ledgers this. **The alarm.**
- *   `released-superseded`  the lock went back and a successor already owns the metadata, so we correctly
- *                          declined to overwrite it. Healthy, and previously indistinguishable from the
- *                          alarm above;
- *   `not-held`             a read lease, which never took a kernel lock — recording it as `released`
- *                          overstated how many handovers the kernel performed, which is R-105 on the
- *                          release side of the same defect;
- *   `lost`                 the helper was already gone; this owner released nothing.
- */
-export type LeaseReleaseOutcome = "released" | "released-unrecorded" | "released-superseded" | "not-held" | "lost"
-/**
- * The lease was RETAINED and is therefore already settled — `release()` after `markRetained()` answers
- * this instead of running the clean handshake (R-146). It was previously expressible only as the
- * `| "retained"` bolted onto two signatures, which is why `release()` could not say it and claimed
- * `released` instead: a clean handover for a lease kept precisely because a pane would not close.
- */
- | "retained";
-export declare function leasePaths(leaseDir: string, root: string): {
-    lock: string;
-    metadata: string;
-    marker: string;
-};
-export declare function atomicMetadata(path: string, value: LeaseMetadata): Promise<void>;
-/**
- * `null` means no prior owner was recorded. `"malformed"` means a record exists and cannot be read,
- * which is strictly LESS evidence than a readable "active" one and must never read as a clean handover
- * (R-100). Absent and unreadable are different facts; conflating them silently erases a real recovery.
- */
-export declare function readMetadata(path: string): Promise<LeaseMetadata | null | "malformed">;
-//# sourceMappingURL=lease-record.d.ts.map

package/dist/lease-record.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lease-record.d.ts","sourceRoot":"","sources":["../src/lease-record.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,iGAAiG;IACjG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,+EAA+E;IAC/E,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvD;;;;;OAKG;IACH;;;;OAIG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,6FAA6F;IAC7F,gBAAgB,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,qBAAqB,GACrB,qBAAqB,GACrB,UAAU,GACV,MAAM;AACR;;;;;GAKG;GACD,UAAU,CAAC;AAEf,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;EAQxD;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,GAAG,WAAW,CAAC,CAgB5F"}

package/dist/lease-record.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lease-record.js","sourceRoot":"","sources":["../src/lease-record.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoFjC,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,IAAY;IACvD,2FAA2F;IAC3F,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,GAAG,oBAAoB,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,KAAoB;IACrE,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IAC1D,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IAClF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACxD,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC;QAC7C,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,WAAW,CAAC;QAC/E,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC;QACxE,OAAO,KAAsB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/ledger-append.d.ts

@@ -1,15 +0,0 @@
-import { type FileHandle } from "node:fs/promises";
-import { type WorkDestination } from "./work-ledger-destination.ts";
-/** Bounded descriptor read, including one detection byte; never trust a pre-read size alone. */
-export declare function readWorkBytes(handle: FileHandle): Promise<Buffer>;
-/** A secondary filesystem close failure must not replace a primary content/capacity refusal. */
-export declare function closeWorkHandle(handle: FileHandle, failed: boolean): Promise<void>;
-/** Shared existing-producer persistence. Serialization and each caller's exception policy remain
- * outside this function. The private destination facts select v4 protection, never ambient defaults. */
-export declare function appendLedgerLine(options: {
-    readonly path: string;
-}, line: string, destination?: WorkDestination, once?: {
-    eventId: string;
-    digest: string;
-}): Promise<void>;
-//# sourceMappingURL=ledger-append.d.ts.map

package/dist/ledger-append.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger-append.d.ts","sourceRoot":"","sources":["../src/ledger-append.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI5E,OAAO,EAAuC,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAKzG,gGAAgG;AAChG,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAUvE;AACD,gGAAgG;AAChG,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxF;AAED;wGACwG;AACxG,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CjL"}

package/dist/ledger-append.js

@@ -1,94 +0,0 @@
-import { appendFile, mkdir, open } from "node:fs/promises";
-import { constants } from "node:fs";
-import { dirname } from "node:path";
-import { withFileLock } from "./file-lock.js";
-import { recheckWorkDestination, workFsError } from "./work-ledger-destination.js";
-import { WORK_TEXT_BYTES, WORK_RECORDS } from "./work-ledger-json.js";
-import { WorkInputError } from "./work-ledger-types.js";
-import { parseWorkLedgerText } from "./work-ledger.js";
-/** Bounded descriptor read, including one detection byte; never trust a pre-read size alone. */
-export async function readWorkBytes(handle) {
-    const chunks = [];
-    let total = 0;
-    for (;;) {
-        const chunk = Buffer.alloc(Math.min(64 * 1024, WORK_TEXT_BYTES + 1 - total));
-        const { bytesRead } = await handle.read(chunk, 0, chunk.length, total);
-        if (bytesRead === 0)
-            return Buffer.concat(chunks, total);
-        total += bytesRead;
-        if (total > WORK_TEXT_BYTES)
-            throw new WorkInputError("WORK_LIMIT_EXCEEDED");
-        chunks.push(chunk.subarray(0, bytesRead));
-    }
-}
-/** A secondary filesystem close failure must not replace a primary content/capacity refusal. */
-export async function closeWorkHandle(handle, failed) {
-    try {
-        await handle.close();
-    }
-    catch (error) {
-        if (!failed || !workFsError(error))
-            throw error;
-    }
-}
-/** Shared existing-producer persistence. Serialization and each caller's exception policy remain
- * outside this function. The private destination facts select v4 protection, never ambient defaults. */
-export async function appendLedgerLine(options, line, destination, once) {
-    await mkdir(dirname(options.path), { recursive: true });
-    if (!destination) {
-        // Retain even legacy path-property evaluation timing across waits; only v4 owns detached inputs.
-        await withFileLock(options.path, "grant ledger", () => appendFile(options.path, line, { encoding: "utf8", flag: "a" }));
-        return;
-    }
-    const path = destination.path;
-    await recheckWorkDestination(destination);
-    await withFileLock(path, "work ledger", async () => {
-        await recheckWorkDestination(destination);
-        let handle;
-        try {
-            handle = await open(path, constants.O_RDWR | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
-        }
-        catch (error) {
-            // A newly proven alias/unsafe kind retains its classification rather than becoming generic I/O.
-            if (workFsError(error))
-                await recheckWorkDestination(destination);
-            throw error;
-        }
-        let failed = false;
-        try {
-            await recheckWorkDestination(destination, handle);
-            const bytes = await readWorkBytes(handle);
-            const ingestion = parseWorkLedgerText(bytes.toString("utf8"));
-            if (!ingestion.complete)
-                throw new WorkInputError(ingestion.errors[0].code);
-            if (bytes.length && bytes[bytes.length - 1] !== 10)
-                throw new WorkInputError("WORK_JSON_INVALID");
-            if (once) {
-                const sameId = ingestion.events.filter(e => e.eventId === once.eventId);
-                if (sameId.some(e => e.digest !== once.digest))
-                    throw new WorkInputError("WORK_DIGEST_MISMATCH");
-                if (sameId.length) {
-                    await handle.sync();
-                    return;
-                } // Reconcile an earlier complete but unacknowledged append.
-            }
-            if (bytes.length + Buffer.byteLength(line, "utf8") > WORK_TEXT_BYTES || ingestion.events.length + 1 > WORK_RECORDS) {
-                throw new WorkInputError("WORK_LIMIT_EXCEEDED");
-            }
-            await recheckWorkDestination(destination, handle);
-            // Same descriptor, same non-expiring lock, O_APPEND. A failed write may leave partial bytes;
-            // preserve them and fail closed. Never truncate, repair or reserialize existing deliveries.
-            await handle.writeFile(line, "utf8");
-            if (once)
-                await handle.sync(); // New application seam requires durable append before controller receipt.
-        }
-        catch (error) {
-            failed = true;
-            throw error;
-        }
-        finally {
-            await closeWorkHandle(handle, failed);
-        }
-    }, { staleRecovery: "disabled" });
-}
-//# sourceMappingURL=ledger-append.js.map

package/dist/ledger-append.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger-append.js","sourceRoot":"","sources":["../src/ledger-append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAwB,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAC3C,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QAC7E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,KAAK,IAAI,SAAS,CAAC;QACnB,IAAI,KAAK,GAAG,eAAe;YAAE,MAAM,IAAI,cAAc,CAAC,qBAAqB,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AACD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB,EAAE,MAAe;IACvE,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC7B,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;AACpE,CAAC;AAED;wGACwG;AACxG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAkC,EAAE,IAAY,EAAE,WAA6B,EAAE,IAA0C;IAChK,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iGAAiG;QACjG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;IAC9B,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC5I,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gGAAgG;YAChG,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,MAAM,IAAI,cAAc,CAAC,mBAAmB,CAAC,CAAC;YAClG,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;gBACxE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,cAAc,CAAC,sBAAsB,CAAC,CAAC;gBACjG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC,CAAC,2DAA2D;YACjH,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,eAAe,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,YAAY,EAAE,CAAC;gBACnH,MAAM,IAAI,cAAc,CAAC,qBAAqB,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAClD,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI;gBAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,0EAA0E;QAC3G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;gBACvC,CAAC;YAAC,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;IACpD,CAAC,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;AACpC,CAAC"}

package/dist/ledger-events.d.ts

@@ -1,131 +0,0 @@
-/**
- * The v3 runtime-event half of the ledger: workspace leases, child lifecycle and check receipts, with
- * their builders. Split out of `./ledger.ts` only to stay under the 400-line module ceiling this
- * project enforces mechanically; `./ledger.ts` re-exports everything here, so "the ledger module"
- * remains one import.
- */
-import { LEDGER_VERSION, type LedgerEventBase, type GrantRecord } from "./ledger.ts";
-import type { ExecutorKind } from "./executor.ts";
-import type { CorrelationMetadata } from "./correlation.ts";
-import type { StructuredRefusal } from "./refusals.ts";
-import type { WorkflowFactEvent } from "./workflow-facts.ts";
-export declare const WORKSPACE_ACCESSES: readonly ["read", "write"];
-export type WorkspaceAccess = typeof WORKSPACE_ACCESSES[number];
-export declare const WORKSPACE_RECOVERY_VALUES: readonly [false, true, "unknown"];
-export type WorkspaceRecovery = typeof WORKSPACE_RECOVERY_VALUES[number];
-export declare const CHILD_LIFECYCLE_STATES: readonly ["starting", "running", "completed", "failed"];
-export type ChildLifecycleState = typeof CHILD_LIFECYCLE_STATES[number];
-/** The complete Node signal vocabulary accepted by a v3 child-lifecycle event. */
-export declare const CHILD_PROCESS_SIGNALS: readonly ["SIGABRT", "SIGALRM", "SIGBUS", "SIGCHLD", "SIGCONT", "SIGFPE", "SIGHUP", "SIGILL", "SIGINT", "SIGIO", "SIGIOT", "SIGKILL", "SIGPIPE", "SIGPOLL", "SIGPROF", "SIGPWR", "SIGQUIT", "SIGSEGV", "SIGSTKFLT", "SIGSTOP", "SIGSYS", "SIGTERM", "SIGTRAP", "SIGTSTP", "SIGTTIN", "SIGTTOU", "SIGUNUSED", "SIGURG", "SIGUSR1", "SIGUSR2", "SIGVTALRM", "SIGWINCH", "SIGXCPU", "SIGXFSZ", "SIGBREAK", "SIGLOST", "SIGINFO"];
-export type ChildProcessSignal = typeof CHILD_PROCESS_SIGNALS[number];
-/**
- * `released` is a handover this owner performed. FOUR members were added by the 0.18.0 review pass, and
- * they were not all previously recorded the same way — `uncontended` was recorded as an *acquisition*, and
- * `lost` was recorded as nothing at all, because the old `release()` threw before the append ran:
- *   `lost`     the kernel lock went away under a live governed writer — NOT the same fact as a user
- *              cancelling, which is what it used to be indistinguishable from (R-103);
- *   `retained` the lease was deliberately kept because a herdr writer tab would not close, so the
- *              successor's `recovered: true` would otherwise blame a healthy path (R-104);
- *   `uncontended` a read lease took no kernel lock at all, so counting it as an acquisition
- *              overstated how many exclusions the kernel actually performed (R-105).
- */
-export declare const WORKSPACE_LEASE_OUTCOMES: readonly ["acquired", "uncontended", "refused", "released", "released-unrecorded", "lost", "retained", "timeout", "recovered"];
-export type WorkspaceLeaseOutcome = typeof WORKSPACE_LEASE_OUTCOMES[number];
-export interface WorkspaceLeaseEvent extends LedgerEventBase {
-    ledgerVersion: typeof LEDGER_VERSION;
-    event: "workspace_lease";
-    executionId: string;
-    parentExecutionId: string | null;
-    childId: string;
-    workspaceId: string;
-    root: string;
-    access: WorkspaceAccess;
-    outcome: WorkspaceLeaseOutcome;
-    /** `"unknown"` when the prior owner's record was unreadable — not evidence of a clean handover. */
-    recovered?: WorkspaceRecovery;
-    releaseReason?: string;
-    refusal?: StructuredRefusal;
-}
-export interface ChildLifecycleEvent extends LedgerEventBase {
-    ledgerVersion: typeof LEDGER_VERSION;
-    event: "child_lifecycle";
-    executionId: string;
-    parentExecutionId: string | null;
-    childId: string;
-    state: ChildLifecycleState;
-    executor: ExecutorKind;
-    /** Bound after which a non-terminal start is known to be incomplete. */
-    deadlineAt?: string;
-    /** Herdr runtime identity is observational and never an enforcement boundary. */
-    herdrPaneId?: string;
-    herdrAgentName?: string;
-    exitCode?: number | null;
-    signal?: ChildProcessSignal | null;
-    timedOut?: true;
-    aborted?: true;
-    truncated?: true;
-    reason?: string;
-}
-export interface CheckReceiptLedgerEvent extends LedgerEventBase {
-    ledgerVersion: typeof LEDGER_VERSION;
-    event: "check_receipt";
-    executionId: string;
-    parentExecutionId: string | null;
-    childId: string;
-    receiptId: string;
-    workspaceId: string;
-    checkId: string;
-    treeSha: string;
-}
-export type CapabilityDecisionEvent = GrantRecord & {
-    ledgerVersion: typeof LEDGER_VERSION;
-    event: "capability_decision";
-    executionId: string;
-    parentExecutionId: string | null;
-    taskDigest: string;
-};
-export type RuntimeLedgerEvent = CapabilityDecisionEvent | WorkspaceLeaseEvent | ChildLifecycleEvent | CheckReceiptLedgerEvent | WorkflowFactEvent;
-export declare function buildWorkspaceLeaseEvent(args: {
-    executionId: string;
-    parentExecutionId: string | null;
-    childId: string;
-    workspaceId: string;
-    root: string;
-    access: WorkspaceAccess;
-    outcome: WorkspaceLeaseOutcome;
-    recovered?: WorkspaceRecovery;
-    releaseReason?: string;
-    refusal?: StructuredRefusal;
-    correlation?: CorrelationMetadata;
-    now: Date;
-}): WorkspaceLeaseEvent;
-export declare function buildCheckReceiptLedgerEvent(args: {
-    executionId: string;
-    parentExecutionId: string | null;
-    childId: string;
-    receiptId: string;
-    workspaceId: string;
-    checkId: string;
-    treeSha: string;
-    correlation?: CorrelationMetadata;
-    now: Date;
-}): CheckReceiptLedgerEvent;
-export declare function buildChildLifecycleEvent(args: {
-    executionId: string;
-    parentExecutionId: string | null;
-    childId: string;
-    state: ChildLifecycleState;
-    executor: ExecutorKind;
-    deadlineAt?: string;
-    herdrPaneId?: string;
-    herdrAgentName?: string;
-    exitCode?: number | null;
-    signal?: ChildProcessSignal | null;
-    timedOut?: boolean;
-    aborted?: boolean;
-    truncated?: boolean;
-    reason?: string;
-    correlation?: CorrelationMetadata;
-    now: Date;
-}): ChildLifecycleEvent;
-//# sourceMappingURL=ledger-events.d.ts.map

package/dist/ledger-events.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger-events.d.ts","sourceRoot":"","sources":["../src/ledger-events.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,eAAO,MAAM,kBAAkB,4BAA6B,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAEhE,eAAO,MAAM,yBAAyB,mCAAoC,CAAC;AAC3E,MAAM,MAAM,iBAAiB,GAAG,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,sBAAsB,yDAA0D,CAAC;AAC9F,MAAM,MAAM,mBAAmB,GAAG,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAExE,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,+ZAKY,CAAC;AAC/C,MAAM,MAAM,kBAAkB,GAAG,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,gIAG3B,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAE5E,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,aAAa,EAAE,OAAO,cAAc,CAAC;IACrC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,mGAAmG;IACnG,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,aAAa,EAAE,OAAO,cAAc,CAAC;IACrC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,aAAa,EAAE,OAAO,cAAc,CAAC;IACrC,KAAK,EAAE,eAAe,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG;IAClD,aAAa,EAAE,OAAO,cAAc,CAAC;IACrC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,uBAAuB,GACvB,mBAAmB,GACnB,mBAAmB,GACnB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,mBAAmB,CAsBtB;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,uBAAuB,CAkB1B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,mBAAmB,CAsBtB"}

package/dist/ledger-events.js

@@ -1,107 +0,0 @@
-/**
- * The v3 runtime-event half of the ledger: workspace leases, child lifecycle and check receipts, with
- * their builders. Split out of `./ledger.ts` only to stay under the 400-line module ceiling this
- * project enforces mechanically; `./ledger.ts` re-exports everything here, so "the ledger module"
- * remains one import.
- */
-import { LEDGER_VERSION } from "./ledger.js";
-import { assertExecutionId } from "./execution-id.js";
-import { assertLedgerV3Wire } from "./ledger-v3-validation.js";
-export const WORKSPACE_ACCESSES = ["read", "write"];
-export const WORKSPACE_RECOVERY_VALUES = [false, true, "unknown"];
-export const CHILD_LIFECYCLE_STATES = ["starting", "running", "completed", "failed"];
-/** The complete Node signal vocabulary accepted by a v3 child-lifecycle event. */
-export const CHILD_PROCESS_SIGNALS = [
-    "SIGABRT", "SIGALRM", "SIGBUS", "SIGCHLD", "SIGCONT", "SIGFPE", "SIGHUP", "SIGILL", "SIGINT", "SIGIO",
-    "SIGIOT", "SIGKILL", "SIGPIPE", "SIGPOLL", "SIGPROF", "SIGPWR", "SIGQUIT", "SIGSEGV", "SIGSTKFLT",
-    "SIGSTOP", "SIGSYS", "SIGTERM", "SIGTRAP", "SIGTSTP", "SIGTTIN", "SIGTTOU", "SIGUNUSED", "SIGURG",
-    "SIGUSR1", "SIGUSR2", "SIGVTALRM", "SIGWINCH", "SIGXCPU", "SIGXFSZ", "SIGBREAK", "SIGLOST", "SIGINFO",
-];
-/**
- * `released` is a handover this owner performed. FOUR members were added by the 0.18.0 review pass, and
- * they were not all previously recorded the same way — `uncontended` was recorded as an *acquisition*, and
- * `lost` was recorded as nothing at all, because the old `release()` threw before the append ran:
- *   `lost`     the kernel lock went away under a live governed writer — NOT the same fact as a user
- *              cancelling, which is what it used to be indistinguishable from (R-103);
- *   `retained` the lease was deliberately kept because a herdr writer tab would not close, so the
- *              successor's `recovered: true` would otherwise blame a healthy path (R-104);
- *   `uncontended` a read lease took no kernel lock at all, so counting it as an acquisition
- *              overstated how many exclusions the kernel actually performed (R-105).
- */
-export const WORKSPACE_LEASE_OUTCOMES = [
-    "acquired", "uncontended", "refused", "released", "released-unrecorded", "lost", "retained", "timeout",
-    "recovered",
-];
-export function buildWorkspaceLeaseEvent(args) {
-    assertEventIdentity(args);
-    return assertLedgerV3Wire({
-        ledgerVersion: LEDGER_VERSION,
-        event: "workspace_lease",
-        ts: args.now.toISOString(),
-        executionId: args.executionId,
-        parentExecutionId: args.parentExecutionId,
-        childId: args.childId,
-        workspaceId: args.workspaceId,
-        root: args.root,
-        access: args.access,
-        outcome: args.outcome,
-        // `!== undefined`, not truthiness. `recovered: false` — a POSITIVE assertion that the predecessor
-        // handed over cleanly — was dropped while the truthy `"unknown"` survived, so absence meant both
-        // "clean" and "never supplied". R-100's whole argument is that absence of evidence is not evidence,
-        // and this was the one line discarding the evidence.
-        ...(args.recovered !== undefined ? { recovered: args.recovered } : {}),
-        ...(args.releaseReason ? { releaseReason: args.releaseReason } : {}),
-        ...(args.refusal ? { refusal: structuredClone(args.refusal) } : {}),
-        ...(args.correlation ? { correlation: structuredClone(args.correlation) } : {}),
-    });
-}
-export function buildCheckReceiptLedgerEvent(args) {
-    assertEventIdentity(args);
-    if (!/^[a-f0-9]{64}$/i.test(args.receiptId)) {
-        throw new TypeError("receiptId must be a SHA-256 hex digest");
-    }
-    return assertLedgerV3Wire({
-        ledgerVersion: LEDGER_VERSION,
-        event: "check_receipt",
-        ts: args.now.toISOString(),
-        executionId: args.executionId,
-        parentExecutionId: args.parentExecutionId,
-        childId: args.childId,
-        receiptId: args.receiptId,
-        workspaceId: args.workspaceId,
-        checkId: args.checkId,
-        treeSha: args.treeSha,
-        ...(args.correlation ? { correlation: structuredClone(args.correlation) } : {}),
-    });
-}
-export function buildChildLifecycleEvent(args) {
-    assertEventIdentity(args);
-    return assertLedgerV3Wire({
-        ledgerVersion: LEDGER_VERSION,
-        event: "child_lifecycle",
-        ts: args.now.toISOString(),
-        executionId: args.executionId,
-        parentExecutionId: args.parentExecutionId,
-        childId: args.childId,
-        state: args.state,
-        executor: args.executor,
-        ...(args.deadlineAt ? { deadlineAt: args.deadlineAt } : {}),
-        ...(args.herdrPaneId ? { herdrPaneId: args.herdrPaneId } : {}),
-        ...(args.herdrAgentName ? { herdrAgentName: args.herdrAgentName } : {}),
-        ...(args.exitCode !== undefined ? { exitCode: args.exitCode } : {}),
-        ...(args.signal !== undefined ? { signal: args.signal } : {}),
-        ...(args.timedOut ? { timedOut: true } : {}),
-        ...(args.aborted ? { aborted: true } : {}),
-        ...(args.truncated ? { truncated: true } : {}),
-        ...(args.reason ? { reason: args.reason } : {}),
-        ...(args.correlation ? { correlation: structuredClone(args.correlation) } : {}),
-    });
-}
-function assertEventIdentity(args) {
-    assertExecutionId(args.executionId);
-    if (args.parentExecutionId !== null)
-        assertExecutionId(args.parentExecutionId, "parentExecutionId");
-    if (args.parentExecutionId === args.executionId)
-        throw new TypeError("an execution cannot be its own parent");
-}
-//# sourceMappingURL=ledger-events.js.map

package/dist/ledger-events.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger-events.js","sourceRoot":"","sources":["../src/ledger-events.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAA0C,MAAM,aAAa,CAAC;AAIrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAG7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAU,CAAC;AAG3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAG9F,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACrG,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW;IACjG,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ;IACjG,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS;CACzD,CAAC;AAG/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS;IACtG,WAAW;CACH,CAAC;AAmEX,MAAM,UAAU,wBAAwB,CAAC,IAaxC;IACC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,kBAAkB,CAAC;QACxB,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE,iBAAiB;QACxB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,kGAAkG;QAClG,iGAAiG;QACjG,oGAAoG;QACpG,qDAAqD;QACrD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAU5C;IACC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,kBAAkB,CAAC;QACxB,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE,eAAe;QACtB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAiBxC;IACC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,kBAAkB,CAAC;QACxB,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE,iBAAiB;QACxB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA+D;IAC1F,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;QAAE,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;AAChH,CAAC"}

package/dist/ledger-identifiers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger-identifiers.d.ts","sourceRoot":"","sources":["../src/ledger-identifiers.ts"],"names":[],"mappings":"AAKA,2GAA2G;AAC3G,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEzE;AAED,8FAA8F;AAC9F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE7E;AAED,0GAA0G;AAC1G,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAI5E"}

package/dist/ledger-identifiers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger-identifiers.js","sourceRoot":"","sources":["../src/ledger-identifiers.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG,0CAA0C,CAAC;AACtE,MAAM,sBAAsB,GAAG,0CAA0C,CAAC;AAC1E,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAClE,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAU,CAAC;AAEzF,2GAA2G;AAC3G,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC"}