stitchkit 0.93.0 → 0.94.1

package/dist/application/events.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { type ObservabilityDrainBound } from '../internal/observability-sink.js';
+import { type ObservabilityDrainBound } from '../observability/bounded-sink.js';
 import type { ObservabilitySinkStatus } from '../observability/status.js';
 import { type ApplicationSnapshot } from './schemas.js';
 export declare const ApplicationLifecycleEventSchema: z.ZodReadonly<z.ZodObject<{

package/dist/application/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/application/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,WAAW,CAAC;AAEnB,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAa/B,CAAC;AACd,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,mBAAmB,GAC5B,yBAAyB,CAY3B;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,KAAK,EAAE,yBAAyB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,CAAC,OAAO,EAAE;QACpB,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,yBAAyB,CAAC;KACnC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC7C,iFAAiF;IACjF,KAAK,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,SAAS,IAAI,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC1E;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CActB"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/application/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,WAAW,CAAC;AAEnB,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAa/B,CAAC;AACd,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,mBAAmB,GAC5B,yBAAyB,CAY3B;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,KAAK,EAAE,yBAAyB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,CAAC,OAAO,EAAE;QACpB,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,yBAAyB,CAAC;KACnC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC7C,iFAAiF;IACjF,KAAK,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,SAAS,IAAI,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC1E;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CActB"}

package/dist/application/file-state-store.d.ts

@@ -0,0 +1,23 @@
+import type { z } from 'zod';
+import type { StateStore } from './state-store.js';
+export interface FileStateStoreCorruption {
+    readonly path: string;
+    readonly error: unknown;
+}
+export interface FileStateStoreOptions<TState> {
+    readonly schema: z.ZodType<TState>;
+    /** `throw` is the safe default. `empty` is appropriate for reconstructable ledgers. */
+    readonly corrupt?: 'throw' | 'empty';
+    readonly onCorrupt?: (failure: FileStateStoreCorruption) => void | Promise<void>;
+    readonly lockTimeoutMs?: number;
+    readonly staleLockMs?: number;
+    readonly retryMs?: number;
+}
+/**
+ * A versioned JSON state store with one cross-process atomic update boundary.
+ *
+ * The lock is an exclusive file, not an in-memory mutex. Writes use a unique
+ * temporary file in the destination directory followed by an atomic rename.
+ */
+export declare function createFileStateStore<TState>(path: string, options: FileStateStoreOptions<TState>): StateStore<TState>;
+//# sourceMappingURL=file-state-store.d.ts.map

package/dist/application/file-state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-state-store.d.ts","sourceRoot":"","sources":["../../src/application/file-state-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,eAAe,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB,CAAC,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAqID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EACzC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,GACrC,UAAU,CAAC,MAAM,CAAC,CAuIpB"}

package/dist/application/health.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { ApplicationHandle } from './kernel.js';
+import type { ApplicationHandle } from './kernel-contract.js';
 export declare const ApplicationHealthHandlerOptionsSchema: z.ZodObject<{
     kind: z.ZodEnum<{
         liveness: "liveness";

package/dist/application/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/application/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAGlD,eAAO,MAAM,qCAAqC;;;;;;iBAGhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,qCAAqC,CAC7C,CAAC;AAEF,eAAO,MAAM,2CAA2C;;iBAEtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC7C,wEAAwE;IACxE,MAAM,IAAI,QAAQ,CAAC;IACnB,SAAS,IAAI,QAAQ,CAAC;IACtB,QAAQ,IAAI,QAAQ,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,EACnD,OAAO,EAAE,+BAA+B,GACvC,MAAM,QAAQ,CAahB;AAED,+FAA+F;AAC/F,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,EACnD,OAAO,GAAE,qCAA0C,GAClD,8BAA8B,CAahC"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/application/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,eAAO,MAAM,qCAAqC;;;;;;iBAGhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,qCAAqC,CAC7C,CAAC;AAEF,eAAO,MAAM,2CAA2C;;iBAEtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC7C,wEAAwE;IACxE,MAAM,IAAI,QAAQ,CAAC;IACnB,SAAS,IAAI,QAAQ,CAAC;IACtB,QAAQ,IAAI,QAAQ,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,EACnD,OAAO,EAAE,+BAA+B,GACvC,MAAM,QAAQ,CAahB;AAED,+FAA+F;AAC/F,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,EACnD,OAAO,GAAE,qCAA0C,GAClD,8BAA8B,CAahC"}

package/dist/application/kernel-admission.d.ts

@@ -0,0 +1,8 @@
+import { type ApplicationOperationLease } from './kernel-contract.js';
+import { type KernelState } from './kernel-state.js';
+/** Admit one operation, or refuse it while the application is not accepting. */
+export declare function acquire(state: KernelState): ApplicationOperationLease | null;
+export declare function run<T>(state: KernelState, work: () => T | Promise<T>): Promise<T>;
+/** Resolves once every admitted operation has released its lease. */
+export declare function waitForPending(state: KernelState): Promise<void>;
+//# sourceMappingURL=kernel-admission.d.ts.map

package/dist/application/kernel-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-admission.d.ts","sourceRoot":"","sources":["../../src/application/kernel-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAW,KAAK,WAAW,EAAW,MAAM,gBAAgB,CAAC;AAEpE,gFAAgF;AAChF,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,yBAAyB,GAAG,IAAI,CAsB5E;AAED,wBAAsB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAQvF;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhE"}

package/dist/application/kernel-contract.d.ts

@@ -0,0 +1,142 @@
+import { z } from 'zod';
+import { AppError } from '../contract/errors.js';
+import type { ManagedResource } from './resource.js';
+import type { ApplicationResourceShutdown, ApplicationShutdownResult, ApplicationSnapshot } from './schemas.js';
+/** The phase a managed resource failed in — the vocabulary of `failures`. */
+export type ApplicationResourcePhase = ApplicationResourceShutdown['failures'][number];
+/** One resource failure with the cause the phase label cannot carry. */
+export interface ApplicationResourceFailure {
+    readonly resourceId: string;
+    readonly phase: ApplicationResourcePhase;
+    /** The value the resource actually threw or rejected with. */
+    readonly error: unknown;
+}
+/**
+ * The budgets an application shutdown accepts.
+ *
+ * The same two names the server and the agent runtime use, and only those:
+ * `retryAfterSeconds` is an HTTP response concern that belongs to the managed
+ * server resource, and accepting it here typed and validated an option nothing
+ * in the kernel ever read.
+ */
+export declare const ApplicationShutdownOptionsSchema: z.ZodObject<{
+    gracePeriodMs: z.ZodDefault<z.ZodNumber>;
+    forceTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    signal: z.ZodOptional<z.ZodCustom<AbortSignal, AbortSignal>>;
+}, z.core.$strip>;
+export type ApplicationShutdownOptions = z.input<typeof ApplicationShutdownOptionsSchema>;
+/**
+ * The budget this application spends on stopping — and the one thing a failed
+ * startup's rollback had no way to know.
+ *
+ * A rollback happens inside `start()`, so there is no call for a caller to pass
+ * options to. The budget therefore has to be declared where the application is,
+ * and once it is declared there it is also the sensible default for
+ * `shutdown()` with no options: one number for "how long this application may
+ * take to stop", not two that can disagree.
+ *
+ * `signal` is deliberately absent. A budget is a property of the application; a
+ * signal belongs to the one call that carries it.
+ */
+export declare const ApplicationShutdownBudgetSchema: z.ZodObject<{
+    gracePeriodMs: z.ZodDefault<z.ZodNumber>;
+    forceTimeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type ApplicationShutdownBudget = z.input<typeof ApplicationShutdownBudgetSchema>;
+export interface ApplicationConfig {
+    readonly id: string;
+    readonly resources?: readonly ManagedResource[];
+    /**
+     * How long stopping may take — for `shutdown()` called with no options, and
+     * for the rollback of a failed `start()`, which has no other way to be told.
+     */
+    readonly shutdown?: ApplicationShutdownBudget;
+    readonly onSnapshot?: (snapshot: ApplicationSnapshot) => void | Promise<void>;
+    /**
+     * Observe why a phase failed.
+     *
+     * `ApplicationResourceShutdown.failures` names the phase and nothing else, so
+     * an operator reading it learns that `drain` failed and has no way to learn
+     * why. The published response stays a verdict — this is the internal half of
+     * the same rule: outward a generic answer, inward everything.
+     *
+     * Called for every failure of a resource's OWN code, in every phase:
+     * `start`, `ready`, `completion`, `admission`, `drain`, `close` — including
+     * the `close` that runs while rolling a failed startup back — and `force`.
+     * It is NOT called for the kernel's own interruption of a startup that a
+     * shutdown overtook: nothing failed there, and reporting it would bury the
+     * one failure that did.
+     *
+     * A throwing observer cannot break the lifecycle it observes, and neither can
+     * a REJECTING one: an `async` observer type-checks against a `void` return,
+     * and its rejected promise is invisible to a synchronous `try/catch` around
+     * the call. Returning a promise is therefore part of the signature, and the
+     * kernel isolates it — it does not await it, so an observer cannot slow a
+     * shutdown down either.
+     */
+    readonly onResourceFailure?: (failure: ApplicationResourceFailure) => void | Promise<void>;
+}
+export interface ApplicationOperationLease {
+    readonly released: boolean;
+    release(): void;
+}
+export interface ApplicationAdmission {
+    acquire(): ApplicationOperationLease | null;
+    run<T>(work: () => T | Promise<T>): Promise<T>;
+}
+export declare const ApplicationRestartInputSchema: z.ZodReadonly<z.ZodObject<{
+    resourceId: z.ZodString;
+    gracePeriodMs: z.ZodOptional<z.ZodNumber>;
+    forceTimeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>>;
+export type ApplicationRestartInput = z.infer<typeof ApplicationRestartInputSchema>;
+export declare const ApplicationRestartOutcomeSchema: z.ZodEnum<{
+    failed: "failed";
+    refused: "refused";
+    restarted: "restarted";
+}>;
+export type ApplicationRestartOutcome = z.infer<typeof ApplicationRestartOutcomeSchema>;
+export declare const ApplicationRestartResultSchema: z.ZodReadonly<z.ZodObject<{
+    resourceId: z.ZodString;
+    affected: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    outcome: z.ZodEnum<{
+        failed: "failed";
+        refused: "refused";
+        restarted: "restarted";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+    durationMs: z.ZodNumber;
+}, z.core.$strict>>;
+export type ApplicationRestartResult = z.infer<typeof ApplicationRestartResultSchema>;
+export interface ApplicationHandle {
+    readonly id: string;
+    readonly admission: ApplicationAdmission;
+    start(): Promise<ApplicationSnapshot>;
+    getSnapshot(): ApplicationSnapshot;
+    subscribe(listener: (snapshot: ApplicationSnapshot) => void): () => void;
+    shutdown(options?: ApplicationShutdownOptions): Promise<ApplicationShutdownResult>;
+    /**
+     * Replace one resource and everything that depends on it, leaving the rest of
+     * the graph running and the process epoch unchanged.
+     *
+     * Serialised against itself and refused during shutdown: two restarts of
+     * overlapping subtrees, or a restart racing the way down, are the two ways to
+     * end up with two live generations of one resource — which is the failure this
+     * exists to make impossible, not merely unlikely.
+     */
+    restart(input: ApplicationRestartInput): Promise<ApplicationRestartResult>;
+}
+/**
+ * An `AppError`, not an `Error` with a `code` field on it.
+ *
+ * The difference is the whole point of the class: `normalizeError` starts with
+ * `AppError.is(err)`, and a plain `Error` — however carefully it names its own
+ * code — falls through to the generic branch and reaches the caller as
+ * `INTERNAL_SERVER_ERROR` / 500. So the declared 503 never left the process,
+ * `createErrorHook({ unmappedCode })` never saw the code, and a registry entry
+ * proved only that the code existed, never that it travelled.
+ */
+export declare class ApplicationAdmissionError extends AppError<'APPLICATION_NOT_ACCEPTING'> {
+    constructor();
+}
+//# sourceMappingURL=kernel-contract.d.ts.map

package/dist/application/kernel-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-contract.d.ts","sourceRoot":"","sources":["../../src/application/kernel-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,WAAW,CAAC;AAEnB,6EAA6E;AAC7E,MAAM,MAAM,wBAAwB,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvF,wEAAwE;AACxE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,IAAI,yBAAyB,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChD;AAED,eAAO,MAAM,6BAA6B;;;;mBAe7B,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;EAA6C,CAAC;AAC1F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;mBAmB9B,CAAC;AACd,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,WAAW,IAAI,mBAAmB,CAAC;IACnC,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACnF;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC5E;AAED;;;;;;;;;GASG;AACH,qBAAa,yBAA0B,SAAQ,QAAQ,CAAC,2BAA2B,CAAC;IAClF,cAGC;CACF"}

package/dist/application/kernel-resource-context.d.ts

@@ -0,0 +1,24 @@
+import { type KernelState, type ResourceRecord } from './kernel-state.js';
+import type { ManagedResourceContext } from './resource.js';
+/** The context one resource is handed for one phase — its window onto the graph. */
+export declare function contextFor(state: KernelState, record: ResourceRecord, options?: {
+    signal?: AbortSignal;
+    deadlineAt?: number;
+    forceDeadlineAt?: number;
+}): ManagedResourceContext;
+/**
+ * A long-lived resource that ended AFTER it was ready.
+ *
+ * `failure` used to be a boolean, and the value the resource rejected with —
+ * in scope at the call site — was dropped on the floor. So a poller, a queue
+ * consumer or a bot that died an hour after `start()` recorded the phase and
+ * nothing else, while the documented contract said every failure of a
+ * resource's own code reports its cause. The phase label is the half an
+ * operator already has; the cause is the half they need.
+ *
+ * `undefined` means the resource simply finished, which is not a failure.
+ */
+export declare function markLateCompletion(state: KernelState, record: ResourceRecord, failure?: {
+    error: unknown;
+}): void;
+//# sourceMappingURL=kernel-resource-context.d.ts.map

package/dist/application/kernel-resource-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-resource-context.d.ts","sourceRoot":"","sources":["../../src/application/kernel-resource-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAEhB,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAEV,sBAAsB,EAEvB,MAAM,YAAY,CAAC;AAEpB,oFAAoF;AACpF,wBAAgB,UAAU,CACxB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAO,GACpF,sBAAsB,CAmDxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAC3B,IAAI,CAYN"}

package/dist/application/kernel-restart.d.ts

@@ -0,0 +1,5 @@
+import { type ApplicationRestartInput, type ApplicationRestartResult } from './kernel-contract.js';
+import { type KernelState } from './kernel-state.js';
+/** `restart()`: one subtree replacement, serialised behind any in flight. */
+export declare function restart(state: KernelState, input: ApplicationRestartInput): Promise<ApplicationRestartResult>;
+//# sourceMappingURL=kernel-restart.d.ts.map

package/dist/application/kernel-restart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-restart.d.ts","sourceRoot":"","sources":["../../src/application/kernel-restart.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,KAAK,WAAW,EAA+C,MAAM,gBAAgB,CAAC;AAkL/F,6EAA6E;AAC7E,wBAAgB,OAAO,CACrB,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAUnC"}

package/dist/application/kernel-rollback.d.ts

@@ -0,0 +1,4 @@
+import { type KernelState } from './kernel-state.js';
+/** Close every resource a failed startup attempted, within the declared budget. */
+export declare function closeAttempted(state: KernelState): Promise<unknown[]>;
+//# sourceMappingURL=kernel-rollback.d.ts.map

package/dist/application/kernel-rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-rollback.d.ts","sourceRoot":"","sources":["../../src/application/kernel-rollback.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,WAAW,EAAyC,MAAM,gBAAgB,CAAC;AAEzF,mFAAmF;AACnF,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CA4C3E"}

package/dist/application/kernel-shutdown.d.ts

@@ -0,0 +1,6 @@
+import { type ApplicationShutdownOptions } from './kernel-contract.js';
+import { type KernelState } from './kernel-state.js';
+import { type ApplicationShutdownResult } from './schemas.js';
+/** `shutdown()`: one bounded way down per application, shared by every caller. */
+export declare function shutdown(state: KernelState, options?: ApplicationShutdownOptions): Promise<ApplicationShutdownResult>;
+//# sourceMappingURL=kernel-shutdown.d.ts.map

package/dist/application/kernel-shutdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-shutdown.d.ts","sourceRoot":"","sources":["../../src/application/kernel-shutdown.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,WAAW,EAMjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,yBAAyB,EAAmC,MAAM,WAAW,CAAC;AAkS5F,kFAAkF;AAClF,wBAAgB,QAAQ,CACtB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,CAAC,CAqBpC"}

package/dist/application/kernel-start.d.ts

@@ -0,0 +1,20 @@
+import type { ResolvedManagedResource } from './graph.js';
+import { type KernelState } from './kernel-state.js';
+import type { ApplicationSnapshot } from './schemas.js';
+/**
+ * Start these resources, in order.
+ *
+ * Extracted so a subtree restart runs the SAME code as a full startup
+ * rather than a second copy of it. Only two things differ between the two
+ * callers: which resources are being started, and whose abort signal ends
+ * the attempt. Everything a resource can do on the way up — publish a value
+ * before readiness, settle its completion first, report its own health —
+ * is behaviour a restart has to reproduce exactly, and the only way to be
+ * sure it does is for there to be one implementation.
+ */
+export declare function startEach(state: KernelState, entries: readonly ResolvedManagedResource[], signal: AbortSignal): Promise<void>;
+/** Activate these resources, in order. Same reasoning as `startEach`. */
+export declare function activateEach(state: KernelState, entries: readonly ResolvedManagedResource[], signal: AbortSignal): Promise<void>;
+/** `start()`: one attempt per application, shared by every caller. */
+export declare function start(state: KernelState): Promise<ApplicationSnapshot>;
+//# sourceMappingURL=kernel-start.d.ts.map

package/dist/application/kernel-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-start.d.ts","sourceRoot":"","sources":["../../src/application/kernel-start.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAGvD,OAAO,EAIL,KAAK,WAAW,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,SAAS,uBAAuB,EAAE,EAC3C,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CA8Gf;AAED,yEAAyE;AACzE,wBAAsB,YAAY,CAChC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,SAAS,uBAAuB,EAAE,EAC3C,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CA+Df;AAkFD,sEAAsE;AACtE,wBAAgB,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWtE"}

package/dist/application/kernel-state.d.ts

@@ -0,0 +1,116 @@
+import type { z } from 'zod';
+import { type ResolvedManagedResource } from './graph.js';
+import { type ApplicationConfig, type ApplicationResourcePhase, ApplicationShutdownBudgetSchema } from './kernel-contract.js';
+import type { ManagedResourceStartResult } from './resource.js';
+import { type ApplicationHealth, type ApplicationLifecycle, type ApplicationShutdownResult, type ApplicationSnapshot, type ManagedResourceState } from './schemas.js';
+export interface ResourceRecord {
+    readonly entry: ResolvedManagedResource;
+    state: ManagedResourceState;
+    health: ApplicationHealth;
+    /**
+     * Whether the resource itself has said something about its health.
+     *
+     * Becoming ready used to assign `healthy` unconditionally, which threw away
+     * whatever `reportHealth` had been told during `start`. It was hard to notice
+     * because the guide's own minimal example reports `healthy` — the same value
+     * that overwrote it — so the example appeared to work and taught the habit.
+     * For a resource that starts DEGRADED on purpose (up, but still dialling
+     * something external) the report vanished and the resource looked healthy
+     * from outside: an API that accepts a value and silently discards it, which
+     * is the worst shape a failure can take.
+     */
+    healthReported: boolean;
+    /**
+     * Whether this resource was healthy at any point.
+     *
+     * The discriminator the two refusal messages need, and neither
+     * `healthReported` nor "health before activation" is it: both are true of a
+     * database that started fine and then dropped, and of a resource that
+     * deliberately started degraded. Telling the first "put it behind
+     * `required: false`" is the worst possible advice, and telling the second it
+     * "lost readiness" points at something that never happened.
+     */
+    everHealthy: boolean;
+    attempted: boolean;
+    activated: boolean;
+    closeInvoked: boolean;
+    closed: boolean;
+    runtime?: ManagedResourceStartResult;
+    failures: ApplicationResourcePhase[];
+}
+/**
+ * Everything one application's phases share, as one explicit object.
+ *
+ * The kernel was a single closure whose phases reached this state through
+ * captured `let` bindings; the phases now live in their own modules and are
+ * handed this object instead, so what each phase reads and writes is visible
+ * in its signature rather than implied by lexical scope.
+ */
+export interface KernelState {
+    readonly id: string;
+    readonly config: ApplicationConfig;
+    /** Start order: topological, so a dependant follows everything it depends on. */
+    readonly ordered: readonly ResolvedManagedResource[];
+    /** Stop order: `ordered`, reversed. */
+    readonly reverse: readonly ResolvedManagedResource[];
+    readonly shutdownBudget: z.output<typeof ApplicationShutdownBudgetSchema>;
+    /**
+     * What each resource handed to its dependants, kept for the application's
+     * whole life rather than only until readiness: a dependant may still need the
+     * handle it was given while it drains, and dropping it at the end of startup
+     * would make `use()` work in `start` and fail in `close`.
+     */
+    readonly published: Map<string, unknown>;
+    readonly records: Map<string, ResourceRecord>;
+    readonly epoch: string;
+    readonly listeners: Set<(snapshot: ApplicationSnapshot) => void>;
+    readonly lifetimeAbort: AbortController;
+    readonly startupAbort: AbortController;
+    lifecycle: ApplicationLifecycle;
+    revision: number;
+    changedAt: string;
+    accepting: boolean;
+    accepted: number;
+    completed: number;
+    pending: number;
+    startPromise: Promise<ApplicationSnapshot> | undefined;
+    shutdownPromise: Promise<ApplicationShutdownResult> | undefined;
+    shutdownRequested: boolean;
+    activationComplete: boolean;
+    readonly pendingWaiters: Set<() => void>;
+    /** The subtree a restart is replacing right now — empty between restarts. */
+    restartingIds: readonly string[];
+    /** The tail of the restart queue; each restart waits for the one before it. */
+    restarting: Promise<unknown>;
+}
+export declare class ResourceCompletionBeforeReadyError extends Error {
+    constructor(resourceId: string, cause?: unknown);
+}
+/**
+ * The kernel interrupting its own startup because a shutdown overtook it.
+ *
+ * Distinguished from a resource's error by type rather than by message, so the
+ * failure observer can stay silent for it: nothing failed here, and reporting
+ * it would bury the one failure that did. Everything else thrown out of a
+ * startup phase is the resource's own and is reported.
+ */
+export declare class ApplicationStartupInterruptedError extends Error {
+    constructor();
+}
+export declare function isStartResult(value: unknown): value is ManagedResourceStartResult;
+export declare function untilDeadline<T>(work: Promise<T>, signal: AbortSignal): Promise<{
+    settled: true;
+    value?: T;
+    error?: unknown;
+} | {
+    settled: false;
+}>;
+/** Registration: resolve the graph and give every resource its record. */
+export declare function createKernelState(config: ApplicationConfig): KernelState;
+/** The record of a resource the graph registered; its absence is a kernel bug. */
+export declare function recordOf(state: KernelState, resourceId: string): ResourceRecord;
+export declare function reportFailure(state: KernelState, resourceId: string, phase: ApplicationResourcePhase, error: unknown): void;
+export declare function isReady(state: KernelState): boolean;
+export declare function snapshot(state: KernelState): ApplicationSnapshot;
+export declare function publish(state: KernelState): void;
+//# sourceMappingURL=kernel-state.d.ts.map

package/dist/application/kernel-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-state.d.ts","sourceRoot":"","sources":["../../src/application/kernel-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,KAAK,uBAAuB,EAAwB,MAAM,SAAS,CAAC;AAC7E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,+BAA+B,EAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EAC1B,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACrD,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,SAAS,EAAE,oBAAoB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACvD,eAAe,EAAE,OAAO,CAAC,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACzC,6EAA6E;IAC7E,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,+EAA+E;IAC/E,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9B;AAED,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,YAAY,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAK9C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,cAGC;CACF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAEjF;AASD,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAS7E;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAiDxE;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,CAI/E;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,wBAAwB,EAC/B,KAAK,EAAE,OAAO,GACb,IAAI,CAcN;AAgBD,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAQnD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB,CA6BhE;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAmBhD"}

package/dist/application/kernel.d.ts

@@ -1,144 +1,13 @@
-import { z } from 'zod';
-import { AppError } from '../contract/errors.js';
-import type { ManagedResource } from './resource.js';
-import { type ApplicationResourceShutdown, type ApplicationShutdownResult, type ApplicationSnapshot } from './schemas.js';
-/** The phase a managed resource failed in — the vocabulary of `failures`. */
-export type ApplicationResourcePhase = ApplicationResourceShutdown['failures'][number];
-/** One resource failure with the cause the phase label cannot carry. */
-export interface ApplicationResourceFailure {
-    readonly resourceId: string;
-    readonly phase: ApplicationResourcePhase;
-    /** The value the resource actually threw or rejected with. */
-    readonly error: unknown;
-}
+import type { ApplicationConfig, ApplicationHandle } from './kernel-contract.js';
 /**
- * The budgets an application shutdown accepts.
- *
- * The same two names the server and the agent runtime use, and only those:
- * `retryAfterSeconds` is an HTTP response concern that belongs to the managed
- * server resource, and accepting it here typed and validated an option nothing
- * in the kernel ever read.
- */
-export declare const ApplicationShutdownOptionsSchema: z.ZodObject<{
-    gracePeriodMs: z.ZodDefault<z.ZodNumber>;
-    forceTimeoutMs: z.ZodDefault<z.ZodNumber>;
-    signal: z.ZodOptional<z.ZodCustom<AbortSignal, AbortSignal>>;
-}, z.core.$strip>;
-export type ApplicationShutdownOptions = z.input<typeof ApplicationShutdownOptionsSchema>;
-/**
- * The budget this application spends on stopping — and the one thing a failed
- * startup's rollback had no way to know.
- *
- * A rollback happens inside `start()`, so there is no call for a caller to pass
- * options to. The budget therefore has to be declared where the application is,
- * and once it is declared there it is also the sensible default for
- * `shutdown()` with no options: one number for "how long this application may
- * take to stop", not two that can disagree.
- *
- * `signal` is deliberately absent. A budget is a property of the application; a
- * signal belongs to the one call that carries it.
- */
-export declare const ApplicationShutdownBudgetSchema: z.ZodObject<{
-    gracePeriodMs: z.ZodDefault<z.ZodNumber>;
-    forceTimeoutMs: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
-export type ApplicationShutdownBudget = z.input<typeof ApplicationShutdownBudgetSchema>;
-export interface ApplicationConfig {
-    readonly id: string;
-    readonly resources?: readonly ManagedResource[];
-    /**
-     * How long stopping may take — for `shutdown()` called with no options, and
-     * for the rollback of a failed `start()`, which has no other way to be told.
-     */
-    readonly shutdown?: ApplicationShutdownBudget;
-    readonly onSnapshot?: (snapshot: ApplicationSnapshot) => void | Promise<void>;
-    /**
-     * Observe why a phase failed.
-     *
-     * `ApplicationResourceShutdown.failures` names the phase and nothing else, so
-     * an operator reading it learns that `drain` failed and has no way to learn
-     * why. The published response stays a verdict — this is the internal half of
-     * the same rule: outward a generic answer, inward everything.
-     *
-     * Called for every failure of a resource's OWN code, in every phase:
-     * `start`, `ready`, `completion`, `admission`, `drain`, `close` — including
-     * the `close` that runs while rolling a failed startup back — and `force`.
-     * It is NOT called for the kernel's own interruption of a startup that a
-     * shutdown overtook: nothing failed there, and reporting it would bury the
-     * one failure that did.
-     *
-     * A throwing observer cannot break the lifecycle it observes, and neither can
-     * a REJECTING one: an `async` observer type-checks against a `void` return,
-     * and its rejected promise is invisible to a synchronous `try/catch` around
-     * the call. Returning a promise is therefore part of the signature, and the
-     * kernel isolates it — it does not await it, so an observer cannot slow a
-     * shutdown down either.
-     */
-    readonly onResourceFailure?: (failure: ApplicationResourceFailure) => void | Promise<void>;
-}
-export interface ApplicationOperationLease {
-    readonly released: boolean;
-    release(): void;
-}
-export interface ApplicationAdmission {
-    acquire(): ApplicationOperationLease | null;
-    run<T>(work: () => T | Promise<T>): Promise<T>;
-}
-export declare const ApplicationRestartInputSchema: z.ZodReadonly<z.ZodObject<{
-    resourceId: z.ZodString;
-    gracePeriodMs: z.ZodOptional<z.ZodNumber>;
-    forceTimeoutMs: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>>;
-export type ApplicationRestartInput = z.infer<typeof ApplicationRestartInputSchema>;
-export declare const ApplicationRestartOutcomeSchema: z.ZodEnum<{
-    failed: "failed";
-    refused: "refused";
-    restarted: "restarted";
-}>;
-export type ApplicationRestartOutcome = z.infer<typeof ApplicationRestartOutcomeSchema>;
-export declare const ApplicationRestartResultSchema: z.ZodReadonly<z.ZodObject<{
-    resourceId: z.ZodString;
-    affected: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-    outcome: z.ZodEnum<{
-        failed: "failed";
-        refused: "refused";
-        restarted: "restarted";
-    }>;
-    reason: z.ZodOptional<z.ZodString>;
-    durationMs: z.ZodNumber;
-}, z.core.$strict>>;
-export type ApplicationRestartResult = z.infer<typeof ApplicationRestartResultSchema>;
-export interface ApplicationHandle {
-    readonly id: string;
-    readonly admission: ApplicationAdmission;
-    start(): Promise<ApplicationSnapshot>;
-    getSnapshot(): ApplicationSnapshot;
-    subscribe(listener: (snapshot: ApplicationSnapshot) => void): () => void;
-    shutdown(options?: ApplicationShutdownOptions): Promise<ApplicationShutdownResult>;
-    /**
-     * Replace one resource and everything that depends on it, leaving the rest of
-     * the graph running and the process epoch unchanged.
-     *
-     * Serialised against itself and refused during shutdown: two restarts of
-     * overlapping subtrees, or a restart racing the way down, are the two ways to
-     * end up with two live generations of one resource — which is the failure this
-     * exists to make impossible, not merely unlikely.
-     */
-    restart(input: ApplicationRestartInput): Promise<ApplicationRestartResult>;
-}
-/**
- * An `AppError`, not an `Error` with a `code` field on it.
- *
- * The difference is the whole point of the class: `normalizeError` starts with
- * `AppError.is(err)`, and a plain `Error` — however carefully it names its own
- * code — falls through to the generic branch and reaches the caller as
- * `INTERNAL_SERVER_ERROR` / 500. So the declared 503 never left the process,
- * `createErrorHook({ unmappedCode })` never saw the code, and a registry entry
- * proved only that the code existed, never that it travelled.
+ * Compose process-local resources into one deterministic application lifetime.
+ *
+ * The phases of that lifetime each live in their own module and share one
+ * explicit `KernelState`: registration and the resource graph
+ * (`kernel-state`), start and activation with the rollback of a failed start
+ * (`kernel-start`, `kernel-rollback`), operation admission
+ * (`kernel-admission`), subtree restart (`kernel-restart`) and the bounded
+ * shutdown (`kernel-shutdown`). This function only wires them to the handle.
  */
-export declare class ApplicationAdmissionError extends AppError<'APPLICATION_NOT_ACCEPTING'> {
-    constructor();
-}
-/** Compose process-local resources into one deterministic application lifetime. */
 export declare function createApplication(config: ApplicationConfig): ApplicationHandle;
 //# sourceMappingURL=kernel.d.ts.map

package/dist/application/kernel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel.d.ts","sourceRoot":"","sources":["../../src/application/kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,KAAK,EACV,eAAe,EAIhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAE9B,KAAK,mBAAmB,EAGzB,MAAM,WAAW,CAAC;AAEnB,6EAA6E;AAC7E,MAAM,MAAM,wBAAwB,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AA8DvF,wEAAwE;AACxE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,IAAI,yBAAyB,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChD;AAED,eAAO,MAAM,6BAA6B;;;;mBAe7B,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;EAA6C,CAAC;AAC1F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;mBAmB9B,CAAC;AACd,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,WAAW,IAAI,mBAAmB,CAAC;IACnC,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACnF;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC5E;AAED;;;;;;;;;GASG;AACH,qBAAa,yBAA0B,SAAQ,QAAQ,CAAC,2BAA2B,CAAC;IAClF,cAGC;CACF;AA2BD,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAyiC9E"}
+{"version":3,"file":"kernel.d.ts","sourceRoot":"","sources":["../../src/application/kernel.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM9E;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAkB9E"}

package/dist/application/latest-sink.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { type ObservabilityDrainBound } from '../internal/observability-sink.js';
+import { type ObservabilityDrainBound } from '../observability/bounded-sink.js';
 export declare const ApplicationSnapshotSinkStatusSchema: z.ZodReadonly<z.ZodObject<{
     accepting: z.ZodBoolean;
     received: z.ZodNumber;

package/dist/application/latest-sink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"latest-sink.d.ts","sourceRoot":"","sources":["../../src/application/latest-sink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,gCAAgC,CAAC;AAKxC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;mBAenC,CAAC;AACd,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAEF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B,CAAC,SAAS;IACrD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,6BAA6B,CAC5C,SAAS,SAAS,6BAA6B;IAE/C,KAAK,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,WAAW,CAAC,CAAC,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,uBAAuB,CAAC,SAAS,SAAS,6BAA6B;IACtF,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC;IACtC,SAAS,IAAI,6BAA6B,CAAC;IAC3C;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAChF;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,SAAS,6BAA6B,EAC3F,MAAM,EAAE,6BAA6B,CAAC,SAAS,CAAC,GAC/C,uBAAuB,CAAC,SAAS,CAAC,CAoHpC"}
+{"version":3,"file":"latest-sink.d.ts","sourceRoot":"","sources":["../../src/application/latest-sink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,+BAA+B,CAAC;AAIvC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;mBAenC,CAAC;AACd,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAEF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B,CAAC,SAAS;IACrD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,6BAA6B,CAC5C,SAAS,SAAS,6BAA6B;IAE/C,KAAK,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,WAAW,CAAC,CAAC,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,uBAAuB,CAAC,SAAS,SAAS,6BAA6B;IACtF,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC;IACtC,SAAS,IAAI,6BAA6B,CAAC;IAC3C;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAChF;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,SAAS,6BAA6B,EAC3F,MAAM,EAAE,6BAA6B,CAAC,SAAS,CAAC,GAC/C,uBAAuB,CAAC,SAAS,CAAC,CAoHpC"}