taskflow-mcp-core 0.3.0-beta.1.1 → 1.0.0

package/dist/control/errors.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Unified 0.3-C error envelope (P4). `ControlError` is the runtime shape;
+ * `toEnvelope()` produces the closed wire ErrorEnvelope. Custom bare codes are
+ * forbidden — only the closed TF_* set (schema/transport.ts) is used.
+ */
+import { type ControlErrorCode, type ErrorEnvelope, type RecoveryAction, type SideEffects } from "./schema/transport.ts";
+export { CONTROL_ERROR_CODES } from "./schema/transport.ts";
+export type { ControlErrorCode, ErrorEnvelope } from "./schema/transport.ts";
+export interface ControlErrorOptions {
+    recoveryAction?: RecoveryAction;
+    sideEffects?: SideEffects;
+    commandId?: string;
+    commitSeq?: number;
+    controlDomainId?: string;
+    projectId?: string;
+    cause?: unknown;
+}
+export declare class ControlError extends Error {
+    readonly code: ControlErrorCode;
+    readonly recoveryAction: RecoveryAction;
+    readonly sideEffects: SideEffects;
+    readonly commandId?: string;
+    readonly commitSeq?: number;
+    readonly controlDomainId?: string;
+    readonly projectId?: string;
+    constructor(code: ControlErrorCode, message: string, options?: ControlErrorOptions);
+    toEnvelope(): ErrorEnvelope;
+}
+/** Convenience builder for protocol/negotiation failures. */
+export declare function protocolError(message: string, options?: ControlErrorOptions): ControlError;
+/**
+ * P4 normative pin: TF_RECONCILE_REQUIRED is always `operator` + `unknown` and
+ * status RPCs return a normal snapshot, never a transport-level failure.
+ */
+export declare function reconcileRequired(message: string, options?: Omit<ControlErrorOptions, "recoveryAction" | "sideEffects">): ControlError;
+/** Fail-closed helper for bootstrap/singleton failures (P13). */
+export declare function bootstrapFailed(message: string, options?: ControlErrorOptions): ControlError;
+/** Assert a value is a closed wire code (guards against bare custom codes). */
+export declare function assertClosedControlCode(code: string): asserts code is ControlErrorCode;
+/** Map any thrown value to a closed wire ErrorEnvelope (P4). */
+export declare function errorToEnvelope(error: unknown): ErrorEnvelope;
+/** Rehydrate a ControlError from a wire ErrorEnvelope (transport layer). */
+export declare function errorFromEnvelope(envelope: ErrorEnvelope): ControlError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/control/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../taskflow-control/src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IACnC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAQD,qBAAa,YAAa,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,YAAY,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,EAUrF;IAED,UAAU,IAAI,aAAa,CAW1B;CACD;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAE9F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,GAAG,aAAa,CAAM,GAAG,YAAY,CAM1I;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAEhG;AAED,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAItF;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAS7D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,aAAa,GAAG,YAAY,CASvE"}

package/dist/control/errors.js

@@ -0,0 +1,93 @@
+/**
+ * Unified 0.3-C error envelope (P4). `ControlError` is the runtime shape;
+ * `toEnvelope()` produces the closed wire ErrorEnvelope. Custom bare codes are
+ * forbidden — only the closed TF_* set (schema/transport.ts) is used.
+ */
+import { CONTROL_ERROR_CODES, } from "./schema/transport.js";
+export { CONTROL_ERROR_CODES } from "./schema/transport.js";
+/** P4 default mapping: most wire errors are command-level with no side effects. */
+const DEFAULT_RECOVERY = {
+    recoveryAction: "none",
+    sideEffects: "none",
+};
+export class ControlError extends Error {
+    code;
+    recoveryAction;
+    sideEffects;
+    commandId;
+    commitSeq;
+    controlDomainId;
+    projectId;
+    constructor(code, message, options = {}) {
+        super(message, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = "ControlError";
+        this.code = code;
+        this.recoveryAction = options.recoveryAction ?? DEFAULT_RECOVERY.recoveryAction;
+        this.sideEffects = options.sideEffects ?? DEFAULT_RECOVERY.sideEffects;
+        this.commandId = options.commandId;
+        this.commitSeq = options.commitSeq;
+        this.controlDomainId = options.controlDomainId;
+        this.projectId = options.projectId;
+    }
+    toEnvelope() {
+        return {
+            code: this.code,
+            message: this.message,
+            recoveryAction: this.recoveryAction,
+            sideEffects: this.sideEffects,
+            ...(this.commandId !== undefined ? { commandId: this.commandId } : {}),
+            ...(this.commitSeq !== undefined ? { commitSeq: this.commitSeq } : {}),
+            ...(this.controlDomainId !== undefined ? { controlDomainId: this.controlDomainId } : {}),
+            ...(this.projectId !== undefined ? { projectId: this.projectId } : {}),
+        };
+    }
+}
+/** Convenience builder for protocol/negotiation failures. */
+export function protocolError(message, options = {}) {
+    return new ControlError("TF_PROTOCOL_INCOMPATIBLE", message, options);
+}
+/**
+ * P4 normative pin: TF_RECONCILE_REQUIRED is always `operator` + `unknown` and
+ * status RPCs return a normal snapshot, never a transport-level failure.
+ */
+export function reconcileRequired(message, options = {}) {
+    return new ControlError("TF_RECONCILE_REQUIRED", message, {
+        ...options,
+        recoveryAction: "operator",
+        sideEffects: "unknown",
+    });
+}
+/** Fail-closed helper for bootstrap/singleton failures (P13). */
+export function bootstrapFailed(message, options = {}) {
+    return new ControlError("TF_BOOTSTRAP_FAILED", message, options);
+}
+/** Assert a value is a closed wire code (guards against bare custom codes). */
+export function assertClosedControlCode(code) {
+    if (!CONTROL_ERROR_CODES.includes(code)) {
+        throw new Error(`TF_COMMAND_FAILED: not a closed 0.3-C wire error code: ${code}`);
+    }
+}
+/** Map any thrown value to a closed wire ErrorEnvelope (P4). */
+export function errorToEnvelope(error) {
+    if (error instanceof ControlError)
+        return error.toEnvelope();
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+        code: "TF_COMMAND_FAILED",
+        message,
+        recoveryAction: "retry-new-command",
+        sideEffects: "none",
+    };
+}
+/** Rehydrate a ControlError from a wire ErrorEnvelope (transport layer). */
+export function errorFromEnvelope(envelope) {
+    return new ControlError(envelope.code, envelope.message, {
+        recoveryAction: envelope.recoveryAction,
+        sideEffects: envelope.sideEffects,
+        ...(envelope.commandId !== undefined ? { commandId: envelope.commandId } : {}),
+        ...(envelope.commitSeq !== undefined ? { commitSeq: envelope.commitSeq } : {}),
+        ...(envelope.controlDomainId !== undefined ? { controlDomainId: envelope.controlDomainId } : {}),
+        ...(envelope.projectId !== undefined ? { projectId: envelope.projectId } : {}),
+    });
+}
+//# sourceMappingURL=errors.js.map

package/dist/control/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../taskflow-control/src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACN,mBAAmB,GAKnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAa5D,mFAAmF;AACnF,MAAM,gBAAgB,GAAiE;IACtF,cAAc,EAAE,MAAM;IACtB,WAAW,EAAE,MAAM;CACnB,CAAC;AAEF,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC7B,IAAI,CAAmB;IACvB,cAAc,CAAiB;IAC/B,WAAW,CAAc;IACzB,SAAS,CAAU;IACnB,SAAS,CAAU;IACnB,eAAe,CAAU;IACzB,SAAS,CAAU;IAE5B,YAAY,IAAsB,EAAE,OAAe,EAAE,OAAO,GAAwB,EAAE;QACrF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,gBAAgB,CAAC,cAAc,CAAC;QAChF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,WAAW,CAAC;QACvE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,CAAC;IAED,UAAU;QACT,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;IACH,CAAC;CACD;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAO,GAAwB,EAAE;IAC/E,OAAO,IAAI,YAAY,CAAC,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAO,GAAgE,EAAE;IAC3H,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,OAAO,EAAE;QACzD,GAAG,OAAO;QACV,cAAc,EAAE,UAAU;QAC1B,WAAW,EAAE,SAAS;KACtB,CAAC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAAO,GAAwB,EAAE;IACjF,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;AACF,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,OAAO;QACP,cAAc,EAAE,mBAAmB;QACnC,WAAW,EAAE,MAAM;KACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,QAAuB;IACxD,OAAO,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE;QACxD,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;AACJ,CAAC"}

package/dist/control/hello.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Hello-before-RPC negotiation gate (P4 / RFC §18).
+ *
+ * The first message on any control channel MUST be a NegotiationHandshake.
+ * No RPC is dispatched before a successful hello. Failures:
+ * - protocolMajor mismatch → TF_PROTOCOL_INCOMPATIBLE
+ * - no overlapping supported schema → TF_SCHEMA_UNSUPPORTED
+ * - unmet requiredFeatures (either direction) → TF_FEATURE_REQUIRED
+ *
+ * Compatible clients then exchange their supported read/write schema lists;
+ * an unknown schema on a later message → TF_SCHEMA_UNSUPPORTED (never silent
+ * reparse — wire-freeze rule 4).
+ */
+import { ControlError } from "./errors.ts";
+import { type NegotiationHandshake } from "./schema/transport.ts";
+export type HelloVerdict = {
+    ok: true;
+    serverHello: NegotiationHandshake;
+} | {
+    ok: false;
+    error: ControlError;
+};
+export interface HelloGateOptions {
+    /** Features the server requires a client to offer. */
+    requiredFeatures?: readonly string[];
+    /** Extra schemas the server accepts beyond its declared list. */
+    extraReadSchemas?: readonly string[];
+}
+export interface HelloGate {
+    /** True once a client has passed the handshake; RPCs before this are rejected. */
+    readonly greeted: boolean;
+    /** The server's own handshake (sent back on success). */
+    readonly serverHello: NegotiationHandshake;
+    hello(clientHello: unknown): HelloVerdict;
+}
+export declare function createHelloGate(serverHello: NegotiationHandshake, options?: HelloGateOptions): HelloGate;
+/** Rejection for any RPC attempted before a successful hello. */
+export declare function helloRequiredError(): ControlError;
+//# sourceMappingURL=hello.d.ts.map

package/dist/control/hello.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hello.d.ts","sourceRoot":"","sources":["../../../taskflow-control/src/hello.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAiB,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAA8C,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,MAAM,MAAM,YAAY,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,oBAAoB,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,gBAAgB;IAChC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACzB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,KAAK,CAAC,WAAW,EAAE,OAAO,GAAG,YAAY,CAAC;CAC1C;AAED,wBAAgB,eAAe,CAC9B,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,gBAAqB,GAC5B,SAAS,CAyEX;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD"}

package/dist/control/hello.js

@@ -0,0 +1,80 @@
+/**
+ * Hello-before-RPC negotiation gate (P4 / RFC §18).
+ *
+ * The first message on any control channel MUST be a NegotiationHandshake.
+ * No RPC is dispatched before a successful hello. Failures:
+ * - protocolMajor mismatch → TF_PROTOCOL_INCOMPATIBLE
+ * - no overlapping supported schema → TF_SCHEMA_UNSUPPORTED
+ * - unmet requiredFeatures (either direction) → TF_FEATURE_REQUIRED
+ *
+ * Compatible clients then exchange their supported read/write schema lists;
+ * an unknown schema on a later message → TF_SCHEMA_UNSUPPORTED (never silent
+ * reparse — wire-freeze rule 4).
+ */
+import { Value } from "typebox/value";
+import { protocolError, ControlError } from "./errors.js";
+import { NegotiationHandshakeSchema, PROTOCOL_MAJOR } from "./schema/transport.js";
+export function createHelloGate(serverHello, options = {}) {
+    const requiredFeatures = [...(options.requiredFeatures ?? [])];
+    let greeted = false;
+    const validate = (clientHello) => {
+        if (typeof clientHello !== "object" || clientHello === null || Array.isArray(clientHello)) {
+            return { ok: false, error: protocolError("hello must be a NegotiationHandshake object") };
+        }
+        const hello = clientHello;
+        if (typeof hello.protocolMajor !== "number" || hello.protocolMajor !== PROTOCOL_MAJOR) {
+            return {
+                ok: false,
+                error: protocolError(`protocolMajor ${JSON.stringify(hello.protocolMajor)} is incompatible; expected ${PROTOCOL_MAJOR}`),
+            };
+        }
+        // Validate the complete wire shape before iterating feature lists or
+        // trusting schema/build metadata supplied by another process.
+        if (!Value.Check(NegotiationHandshakeSchema, clientHello)) {
+            return { ok: false, error: protocolError("hello must match NegotiationHandshake") };
+        }
+        const serverRead = new Set([...serverHello.supportedReadSchemas, ...(options.extraReadSchemas ?? [])]);
+        const schemaOverlap = hello.supportedReadSchemas.some((schema) => serverRead.has(schema));
+        if (!schemaOverlap) {
+            return {
+                ok: false,
+                error: new ControlError("TF_SCHEMA_UNSUPPORTED", `no overlapping supported read schema (client: ${hello.supportedReadSchemas.join(",")})`, { recoveryAction: "refresh", sideEffects: "none" }),
+            };
+        }
+        const clientRequired = hello.requiredFeatures ?? [];
+        for (const feature of clientRequired) {
+            if (!(serverHello.offeredFeatures ?? []).includes(feature)) {
+                return {
+                    ok: false,
+                    error: new ControlError("TF_FEATURE_REQUIRED", `client requires feature ${JSON.stringify(feature)} which this control does not offer`, { recoveryAction: "refresh", sideEffects: "none" }),
+                };
+            }
+        }
+        for (const feature of requiredFeatures) {
+            if (!(hello.offeredFeatures ?? []).includes(feature)) {
+                return {
+                    ok: false,
+                    error: new ControlError("TF_FEATURE_REQUIRED", `control requires feature ${JSON.stringify(feature)} which the client does not offer`, { recoveryAction: "refresh", sideEffects: "none" }),
+                };
+            }
+        }
+        return { ok: true, serverHello };
+    };
+    return {
+        get greeted() {
+            return greeted;
+        },
+        serverHello,
+        hello(clientHello) {
+            const verdict = validate(clientHello);
+            if (verdict.ok)
+                greeted = true;
+            return verdict;
+        },
+    };
+}
+/** Rejection for any RPC attempted before a successful hello. */
+export function helloRequiredError() {
+    return protocolError("hello must precede any RPC on this control channel");
+}
+//# sourceMappingURL=hello.js.map

package/dist/control/hello.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hello.js","sourceRoot":"","sources":["../../../taskflow-control/src/hello.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAA6B,MAAM,uBAAuB,CAAC;AAqB9G,MAAM,UAAU,eAAe,CAC9B,WAAiC,EACjC,OAAO,GAAqB,EAAE;IAE9B,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,QAAQ,GAAG,CAAC,WAAoB,EAAgB,EAAE;QACvD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,6CAA6C,CAAC,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,WAAmC,CAAC;QAClD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YACvF,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,aAAa,CACnB,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,8BAA8B,cAAc,EAAE,CAClG;aACD,CAAC;QACH,CAAC;QACD,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,0BAA0B,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,uCAAuC,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvG,MAAM,aAAa,GAAG,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,IAAI,YAAY,CACtB,uBAAuB,EACvB,iDAAiD,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACxF,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAClD;aACD,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACpD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,IAAI,YAAY,CACtB,qBAAqB,EACrB,2BAA2B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,oCAAoC,EACtF,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAClD;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,IAAI,YAAY,CACtB,qBAAqB,EACrB,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kCAAkC,EACrF,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAClD;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO;QACN,IAAI,OAAO;YACV,OAAO,OAAO,CAAC;QAChB,CAAC;QACD,WAAW;QACX,KAAK,CAAC,WAAoB;YACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,EAAE;gBAAE,OAAO,GAAG,IAAI,CAAC;YAC/B,OAAO,OAAO,CAAC;QAChB,CAAC;KACD,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kBAAkB;IACjC,OAAO,aAAa,CAAC,oDAAoD,CAAC,CAAC;AAC5E,CAAC"}

package/dist/control/host-runtime.d.ts

@@ -0,0 +1,32 @@
+import { ProjectRegistry, type ProjectMount } from "./project-registry.ts";
+import { type AuthorizationAuthority, type VerifiedContext } from "./authorization.ts";
+import { UserCoordinatorStore } from "./store/coordinator-store.ts";
+import { RuntimeTeExecutionProvider } from "./runtime-provider.ts";
+import type { CoordinatorLease } from "./schema/coordinator.ts";
+import type { EvidenceStore, TerminalEvidenceObservation } from "./store/evidence-store.ts";
+export interface HostRuntimeOptions {
+    registry: ProjectRegistry;
+    authorization: AuthorizationAuthority;
+    provider: RuntimeTeExecutionProvider;
+    controlHome: string;
+    epoch: () => number;
+    holderId: () => string;
+    liveLease: () => CoordinatorLease | null;
+    maxActiveRuns?: number;
+    durableApprovalAvailable?: (context: VerifiedContext) => boolean;
+    evidenceFactory?: (mount: ProjectMount, verify: HostRuntime["verifyTerminal"]) => EvidenceStore | Promise<EvidenceStore>;
+}
+export declare class HostRuntime {
+    #private;
+    readonly options: HostRuntimeOptions;
+    readonly coordinator: UserCoordinatorStore<VerifiedContext>;
+    constructor(options: HostRuntimeOptions);
+    initialize(): Promise<void>;
+    close(): void;
+    dispatch(context: VerifiedContext, method: string, raw: unknown): Promise<unknown>;
+    verifyTerminal(project: {
+        projectId: string;
+        controlDomainId: string;
+    }, runId: string, eventId: string): Promise<TerminalEvidenceObservation>;
+}
+//# sourceMappingURL=host-runtime.d.ts.map

package/dist/control/host-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-runtime.d.ts","sourceRoot":"","sources":["../../../taskflow-control/src/host-runtime.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,KAAK,sBAAsB,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAUnE,OAAO,KAAK,EAAE,gBAAgB,EAA0B,MAAM,yBAAyB,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAI5F,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,eAAe,CAAC;IAAC,aAAa,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,0BAA0B,CAAC;IACvG,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;IAC3G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAC,eAAe,KAAG,OAAO,CAAC;IAC9D,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzH;AAMD,qBAAa,WAAW;;IACvB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAO5D,YAAY,OAAO,EAAE,kBAAkB,EA0BtC;IACK,UAAU,kBAA2C;IAC3D,KAAK,SAAqD;IAUpD,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAqEvF;IA4OK,cAAc,CAAC,OAAO,EAAE;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAE,OAAO,CAAC,2BAA2B,CAAC,CAU/I;CACD"}