weir-harness 1.2.2 → 2.0.0

package/src/edit-lock/binding-machine.js

@@ -1,312 +0,0 @@
-/** Per-agent binding state machine (change edit-lock-deepening, design D3):
- * setupAgentOnce / setupAgent / retryBinding / disposeAgent / startupFailure /
- * dispositionFor and the closure state they share, extracted from the
- * composition (index.js), which now keeps pure wiring: tool registration, the
- * pre-execute guard, HTTP endpoints, the /edit-lock command, drivers and event
- * listeners. The move is mechanical — no logic changed; every container keeps
- * exactly the lifetime it had in the mount closure.
- *
- * Lifetime table (itemized BEFORE the move; the move changed nothing in it):
- *
- *   state               lifetime       home after the move
- *   ------------------  -------------  --------------------------------------
- *   settled             cross-mount    sharedDomainRegistryFor entry (existing
- *                       precedent, with recoveryNotices); INJECTED, not owned
- *   writeScopes         host-lifetime  writeScopesFor(host) store, surviving a
- *                       preset rebind; INJECTED — the preset-rebind survival
- *                       semantics and the `ctx.root ?? ctx` host key are
- *                       unchanged
- *   disposedAgents      per-mount      this module (WeakSet)
- *   startFailures       per-mount      this module (WeakMap)
- *   bindingFailures     per-mount      this module (WeakMap)
- *   setupInFlight       per-mount      this module (WeakMap)
- *   boundAgents         per-mount      this module (Map by session id)
- *   dispositions        per-mount      this module (Map by session id; the
- *                       latest incarnation stays joinable after synchronous
- *                       cleanup)
- *   agentDispositions   per-mount      this module (WeakMap)
- *   disposalTasks       per-mount      this module (WeakMap)
- *   pendingAutoResume   per-mount      composition turn wiring; INJECTED (a
- *                       successful retry clears an armed auto-resume)
- *   delegateResumes     per-mount      composition delegate-lifecycle wiring;
- *                       INJECTED (a fresh bind replays a pending resume)
- *   turnClassifications per-mount      composition turn/end listener; INJECTED
- *                       (dispose awaits the durable classification first)
- *   replyTools          per-mount      composition negotiation wiring;
- *                       INJECTED (dispose retires the reply tool)
- *   expiry              per-mount      composition retention-timer wiring;
- *                       INJECTED (dispose clears the timer)
- *
- * Cross-mount state rides the EXISTING sharedDomainRegistryFor entry — no new
- * cross-mount container is introduced. Mount-generation flags arrive as
- * getters (isClosed/platformFailure) so the machine reads the live value.
- * @param {{
- *   ctx: any, sessionOf: (agent: any) => string | undefined, GUARDED_TOOLS: readonly string[],
- *   options: any, registry: any, settled: WeakMap<object, any>, writeScopes: WeakMap<object, import('./write-scopes.js').WriteScopeEntry>,
- *   domainOf: (agent: any) => Promise<any>, servingRuntime: (sessionId: string) => any,
- *   ownAgent: (agent: any) => boolean, installWriteScope: (agent: any) => import('./write-scopes.js').WriteScopeEntry,
- *   evidence: any, audit: (session: any, type: any, data: any, options?: any) => void, deliverLocal: (agent: any, text: string, wake?: boolean) => void,
- *   pendingAutoResume: WeakMap<object, boolean>, delegateResumes: Map<string, any>, turnClassifications: WeakMap<object, Promise<unknown>>,
- *   replyTools: WeakMap<object, {dispose: () => void, stale: boolean}>, expiry: WeakMap<object, {timer?: any}>, settle: any,
- *   isClosed: () => boolean, platformFailure: () => any,
- * }} deps
- */
-import { AUDIT_TYPES } from '../shared/audit.js'
-import { disposeWriteScope } from './write-scopes.js'
-
-/** In-session binding-failure notice copy (change edit-lock-binding-transfer,
- * design D4): the transferable class (same-process idle holder) is a calm
- * self-heal announcement rather than an editing-disabled alarm and never
- * carries the raw holder classification or the reservation warning; a mid-turn
- * holder names the real state and the retry moment. Template layer stays
- * English (AGENTS §3.7). @param {string} reason @param {any} failure */
-function bindingFailureNotice(reason, failure) {
-  if (failure?.code === 'binding-duplicate' && failure.holderKind === 'transferable') {
-    return "Edit Lock: this session's editing authority is held by an inactive attachment of this same session; it transfers automatically when you send a message."
-  }
-  if (failure?.code === 'binding-duplicate' && failure.holderKind === 'serving') {
-    return "Edit Lock: this session is being edited in another attachment right now; managed file editing stays unavailable until that turn finishes. Do not retry the failed edit; use /edit-lock retry (or the panel's Retry connection) once it finishes — retry does not Continue editing."
-  }
-  return `Edit Lock could not start this session's edit domain (${reason}); managed file editing is temporarily unavailable. ${failure?.code === 'binding-duplicate' ? 'Do not retry the failed edit: the binding is retried automatically when the user next sends a message, after which editing works normally. Never remove a live publisher reservation.' : 'Inspect Edit Lock maintenance before continuing.'}`
-}
-
-export function createBindingMachine(deps) {
-  const {
-    ctx, sessionOf, GUARDED_TOOLS, options, registry, settled, writeScopes,
-    domainOf, servingRuntime, ownAgent, installWriteScope,
-    evidence, audit, deliverLocal,
-    pendingAutoResume, delegateResumes, turnClassifications, replyTools, expiry, settle,
-    isClosed, platformFailure,
-  } = deps
-  /** Agents disposed in this mount; their undispatched sweep work cancels.
-   * @type {WeakSet<object>} */
-  const disposedAgents = new WeakSet()
-  /** Why registration failed for an agent, for the panel. @type {WeakMap<object, string>} */
-  const startFailures = new WeakMap()
-  /** Publisher-classified failures, never inferred from text. @type {WeakMap<object, any>} */
-  const bindingFailures = new WeakMap()
-  /** In-flight setup per agent, shared by every entry point (creation,
-   * preset-switch, catch-up, lazy re-bind) so concurrent callers can never
-   * double-register. @type {WeakMap<object, Promise<void>>} */
-  const setupInFlight = new WeakMap()
-  const boundAgents = new Map()
-  // Keep the latest incarnation joinable even after synchronous binding cleanup.
-  // Exact-handle waiters retain their own record when a session activates again.
-  const dispositions = new Map()
-  const agentDispositions = new WeakMap()
-  const disposalTasks = new WeakMap()
-
-  function dispositionFor(agent) {
-    let record = agentDispositions.get(agent)
-    if (!record) {
-      record = Promise.withResolvers()
-      record.promise.catch(() => {}) // emit initiators have no awaiting caller
-      agentDispositions.set(agent, record)
-      dispositions.set(agent.id, record)
-    }
-    return record
-  }
-
-  /** Only this live Agent's diagnostic; no domain reads or startup side effects. @param {any} agent */
-  function startupFailure(agent) {
-    const platform = platformFailure()
-    if (platform) return { state: 'unavailable', reason: platform.message, bindingFailure: null }
-    if (!agent || settled.has(agent) || !startFailures.has(agent)) return null
-    let eligible = false
-    try {
-      const serving = servingRuntime(agent.id)
-      eligible = !isClosed() && !disposedAgents.has(agent) && ownAgent(agent)
-        && (serving === agent
-          // The registry names ANOTHER live local agent — the dual-agent defect
-          // this change heals (edit-lock-binding-transfer). The recorded
-          // duplicate-binding failure is still THIS agent's honest panel state:
-          // show it, with its Retry action, instead of hiding behind the ghost's
-          // healthy binding. An empty registry stays hidden (unattestable).
-          || (serving !== undefined && bindingFailures.get(agent)?.code === 'binding-duplicate'))
-    } catch { /* no trusted live identity */ }
-    if (!eligible) return null
-    const failure = bindingFailures.get(agent)
-    return { state: 'unavailable', reason: startFailures.get(agent),
-      bindingFailure: failure ? { ...failure, inFlight: setupInFlight.has(agent) } : null }
-  }
-
-  /** Per-agent Edit Lock setup, shared by the creation listener, the
-   * preset-switch re-bind, the late-mount catch-up and the guard/acquire lazy
-   * re-bind, so the paths can never diverge. Root selection and successful
-   * startup are separate: explicit binding retry reuses the existing scope
-   * and root, while ordinary entry points never repeat a failed startup.
-   * @param {any} agent @param {boolean} [retry] @param {boolean} [transfer]
-   * transfer (change edit-lock-binding-transfer) marks the driving-ingress
-   * transfer admission: the domain's transferStart re-adjudicates holder
-   * idleness at execution, and the post-bind registry-identity check is
-   * skipped because the registry legitimately still names the idle holder. */
-  async function setupAgentOnce(agent, retry = false, transfer = false) {
-    if (isClosed() || settled.has(agent)) return
-    // No writer scope, root resolution, directory, reservation or session
-    // authority may be installed when the mount preflight failed.
-    if (platformFailure()) return
-    if (!registry.rootOf(agent)) try {
-      // A previous generation's managed write survives in the agent's own
-      // scope layer (a preset rebind never disposes own-layer registrations);
-      // retire it first or the scope registry throws duplicate-registration
-      // and the re-bind dies here (design D3).
-      disposeWriteScope(writeScopes, agent)
-      writeScopes.set(agent, installWriteScope(agent))
-      registry.bind(agent, options.fixed?.root ?? agent?.session?.header?.cwd)
-    } catch (error) {
-      // The denial itself must never escape: restrict() throws on names the
-      // agent's composition does not know, and an escape from this setup path
-      // is fiber-fatal during a reload (2026-10-05 host crash). Deny only the
-      // guarded tools the agent actually has.
-      try {
-        const known = GUARDED_TOOLS.filter(name => ctx.tools?.get?.(name, agent) !== undefined)
-        if (known.length > 0) agent?.ctx?.tools?.restrict?.({ deny: [...known] })
-      } catch { /* the denial is best-effort; the records below are the visible account */ }
-      // Failure visibility (design D4): the same reason lands in the panel
-      // state, the maintenance evidence, an in-session notice and the durable
-      // audit; the warn stays as the host ring-buffer copy.
-      const reason = String(/** @type {any} */ (error)?.message ?? error)
-      startFailures.set(agent, reason)
-      try { evidence?.recordSessionFailure?.(sessionOf(agent), reason) } catch { /* reporting only */ }
-      audit(agent?.session ?? null, AUDIT_TYPES.editLockMaintenance, { kind: 'setup-failed', sessionId: sessionOf(agent) ?? null, reason })
-      try { deliverLocal(agent, `Edit Lock is unavailable for this session (${reason}); managed file editing is disabled and the failed edit must not be retried. This failure is not repaired automatically: the user can restart DeepSeek Harness or start a new conversation.`) } catch { /* the audit record is the durable account */ }
-      ctx.logger?.warn?.(`edit lock scope failed; edit tools denied: ${reason}`)
-      return
-    }
-    try {
-      const domain = await domainOf(agent)
-      if (transfer) await domain.transferStart(agent)
-      else if (retry) await domain.retryStart(agent)
-      else await domain.start(agent)
-      if (isClosed() || disposedAgents.has(agent) || (retry && (!ownAgent(agent) || (!transfer && servingRuntime(agent.id) !== agent)))) {
-        await domain.forget(agent)
-        throw new Error('Edit Lock mount changed during binding')
-      }
-      startFailures.delete(agent)
-      bindingFailures.delete(agent)
-      try { evidence?.clearSessionFailure?.(sessionOf(agent)) } catch { /* reporting cannot undo a successful bind */ }
-      // A genuine message from a turn that ran while binding was unavailable
-      // is not a Continue receipt for a later injected wake after connection retry.
-      if (retry) pendingAutoResume.delete(agent)
-      settled.set(agent, domain)
-      boundAgents.set(agent.id, agent)
-      dispositionFor(agent)
-      if (!retry) await delegateResumes.get(agent.id)?.resume(agent, domain)
-    } catch (error) {
-      // Kept so the panel can say WHY editing is unavailable instead of
-      // showing "starting" forever; the notice aligns this catch with the
-      // write-scope failure above.
-      const reason = String(/** @type {any} */ (error)?.message ?? error)
-      startFailures.set(agent, reason)
-      const failure = /** @type {any} */ (error)?.bindingFailure
-      if (failure?.code === 'binding-duplicate') bindingFailures.set(agent, failure)
-      else bindingFailures.delete(agent)
-      try { evidence?.recordSessionFailure?.(sessionOf(agent), reason) } catch { /* reporting only */ }
-      try { deliverLocal(agent, bindingFailureNotice(reason, failure)) } catch { /* the panel record remains */ }
-      ctx.logger?.warn?.(`edit lock registration failed for ${sessionOf(agent)}: ${reason}`)
-    }
-  }
-  /** Concurrent entry points (agent/created, preset-switch, lazy re-bind)
-   * share one in-flight setup per agent; a completed setup short-circuits on
-   * the root binding. @param {any} agent @returns {Promise<void>} */
-  function setupAgent(agent) {
-    const pending = setupInFlight.get(agent)
-    if (pending) return pending
-    if (isClosed() || settled.has(agent) || registry.rootOf(agent)) return Promise.resolve()
-    const inner = setupAgentOnce(agent)
-    const task = inner.finally(() => { if (setupInFlight.get(agent) === task) setupInFlight.delete(agent) })
-    setupInFlight.set(agent, task)
-    return task
-  }
-  /** Trusted driving ingresses only: the explicit /edit-lock retry (and panel
-   * action), the message-armed pre-step retry, and the write-guard lazy
-   * re-bind. Same Agent/root/mount; no writer reinstallation. Every attempt
-   * past the eligibility gate is audited — a silently swallowed refusal is a
-   * defect (change edit-lock-binding-transfer, design D3/D5).
-   * @param {any} agent @param {'command' | 'message' | 'write-guard'} [via] */
-  async function retryBinding(agent, via = 'command') {
-    if (isClosed() || disposedAgents.has(agent) || !ownAgent(agent)) throw new Error('Edit Lock retry requires the current live Agent of this mount')
-    if (!registry.rootOf(agent) || bindingFailures.get(agent)?.code !== 'binding-duplicate') throw new Error('Edit Lock startup failure is not eligible for binding retry')
-    const cause = bindingFailures.get(agent)
-    const sessionId = sessionOf(agent) ?? null
-    const root = registry.rootOf(agent) ?? undefined
-    /** @param {string} result @param {Record<string, unknown>} [extra] */
-    const record = (result, extra = {}) => audit(agent?.session ?? null, AUDIT_TYPES.editLockMaintenance, {
-      kind: 'binding-transfer', sessionId, code: cause?.code ?? 'binding-duplicate', result, ...extra,
-    }, { root })
-    // Attestation trichotomy (design D5): the registry naming THIS claimant
-    // keeps the existing superseded rebind; naming ANOTHER live local agent
-    // routes to the transfer admission (holder idleness is re-adjudicated at
-    // execution, publisher-side); an unavailable or empty registry stays
-    // fail-closed — the holder cannot be attested.
-    let serving
-    try { serving = servingRuntime(agent.id) } catch { serving = undefined }
-    if (serving === undefined) {
-      const error = new Error('Edit Lock binding retry refused: the agent registry is unavailable or names no live agent for this session, so the holder cannot be attested. The recorded cause stays; a later retry remains possible.')
-      record('refused', { reason: 'registry-unattestable', detail: error.message })
-      throw error
-    }
-    const transfer = serving !== agent
-    try {
-      let task = setupInFlight.get(agent)
-      if (!task) {
-        const inner = setupAgentOnce(agent, true, transfer)
-        task = inner.finally(() => { if (setupInFlight.get(agent) === task) setupInFlight.delete(agent) })
-        setupInFlight.set(agent, task)
-      }
-      await task
-    } catch (error) {
-      record('refused', { reason: /** @type {any} */ (error)?.bindingFailure?.holderKind ?? 'retry-refused', detail: String(/** @type {any} */ (error)?.message ?? error) })
-      throw error
-    }
-    const failure = startFailures.get(agent)
-    if (failure || !settled.has(agent)) {
-      // setupAgentOnce records instead of rethrowing: the refusal's holder
-      // class comes from the freshly re-recorded structured failure.
-      const error = new Error(failure ?? 'Edit Lock binding remains unavailable')
-      record('refused', { reason: bindingFailures.get(agent)?.holderKind ?? 'binding-unavailable', detail: error.message })
-      throw error
-    }
-    if (transfer) {
-      record('transferred', { holder: cause?.holderKind ?? null })
-    } else if (via === 'message') {
-      // The message-armed superseded success keeps its established audit shape
-      // (pinned by the editlock-binding-auto-retry integration scenario).
-      audit(agent?.session ?? null, AUDIT_TYPES.editLockMaintenance, {
-        kind: 'binding-auto-retry', sessionId, code: cause?.code ?? 'binding-duplicate', result: 'recovered',
-      }, { root })
-    }
-    return 'Edit Lock connection recovered. Editing remains interrupted; use Continue editing when ready. No failed edit was replayed.'
-  }
-  function disposeAgent(agent) {
-    if (disposedAgents.has(agent)) return disposalTasks.get(agent) ?? Promise.resolve()
-    if (boundAgents.get(agent.id) === agent) boundAgents.delete(agent.id)
-    // Undispatched sweep work armed by this agent cancels here (an in-flight
-    // authority transaction is never cancelled or reinterpreted).
-    disposedAgents.add(agent)
-    // The managed write lives on the agent's own scope layer, which dies with
-    // the agent: retire the host-lifetime registration here (design D3).
-    disposeWriteScope(writeScopes, agent)
-    replyTools.get(agent)?.dispose()
-    replyTools.delete(agent)
-    const timer = expiry.get(agent)?.timer
-    if (timer) clearTimeout(timer)
-    expiry.delete(agent)
-    settle.settled(agent)
-    const domain = settled.get(agent)
-    settled.delete(agent)
-    // The emit hook must cancel timers/scopes/sweeps synchronously. Only the
-    // final authority disposal waits for durable abnormal classification.
-    const record = dispositionFor(agent)
-    const task = Promise.resolve(turnClassifications.get(agent)).then(() => domain?.dispose(agent))
-    task.then(record.resolve, record.reject)
-    disposalTasks.set(agent, record.promise)
-    return record.promise
-  }
-
-  return {
-    disposedAgents, startFailures, bindingFailures, setupInFlight,
-    boundAgents, dispositions, agentDispositions,
-    setupAgent, retryBinding, disposeAgent, startupFailure,
-  }
-}

package/src/edit-lock/call-context.js

@@ -1,65 +0,0 @@
-import { isAbsolute } from 'node:path'
-import { canonicalRequestData } from './request-data.js'
-
-/** Private process-local association, not a durable authority ledger.
- * Only a trusted manager may bind calls; consumers must still authenticate the
- * captured execution against current durable authority before every mutation. */
-export function createCallContexts() {
-  /** @typedef {{execution: import('./state.js').Execution, cwd: string, effectivePolicy: any, callId: string, signal: AbortSignal}} Context */
-  /** @type {WeakMap<object, {context: Context, closed: boolean, abort: () => void, detach: () => void}>} */
-  const calls = new WeakMap()
-  /** @param {object} call */
-  function entry(call) {
-    const value = calls.get(call)
-    if (!value) throw new Error('unknown call')
-    if (value.closed) throw new Error('closed call')
-    return value
-  }
-  /** @param {any} data */
-  function freeze(data) {
-    if (data && typeof data === 'object') {
-      for (const value of Object.values(data)) freeze(value)
-      Object.freeze(data)
-    }
-    return data
-  }
-  return Object.freeze({
-    /** @param {import('./state.js').Execution} execution
-     * @param {{signal: AbortSignal, cwd: string, effectivePolicy: unknown, callId: string}} options
-     * @param {(execution: import('./state.js').Execution) => void} onAbort */
-    bind(execution, { signal, cwd, effectivePolicy, callId }, onAbort) {
-      if (!isAbsolute(cwd) || cwd.includes('\0') || typeof callId !== 'string' || !callId.trim()) throw new Error('invalid call context')
-      const captured = freeze(JSON.parse(canonicalRequestData({ execution, cwd, effectivePolicy, callId })))
-      const controller = new AbortController()
-      const call = Object.freeze({})
-      let notified = false
-      const abort = () => {
-        if (notified) return
-        notified = true
-        try { onAbort(captured.execution) } finally { controller.abort() }
-      }
-      calls.set(call, { context: Object.freeze({ ...captured, signal: controller.signal }), closed: false, abort,
-        detach: () => signal.removeEventListener('abort', abort) })
-      signal.addEventListener('abort', abort, { once: true })
-      if (signal.aborted) abort()
-      return call
-    },
-    /** @param {object} call */
-    inspect(call) { return entry(call).context },
-    /** @param {object} call */
-    requireLive(call) {
-      const context = entry(call).context
-      if (context.signal.aborted) throw new Error('call aborted')
-      return context
-    },
-    /** Trusted manager revocation shares the host-abort denial path.
-     * @param {object} call */
-    revoke(call) { entry(call).abort() },
-    /** @param {object} call */
-    close(call) {
-      const value = entry(call)
-      value.closed = true
-      value.detach()
-    },
-  })
-}

package/src/edit-lock/derived-facts.js

@@ -1,67 +0,0 @@
-/** Ledger derived facts (change edit-lock-deepening, design D1): the three
- * derivation rules an authority image supports — epoch-scoped revocation
- * (`revokedOwner`), read-time hold settlement (`settleHoldFacts`) and the
- * administrative disposition lookup (`dispositionFor`) — in ONE pure home,
- * shared by the manager status path, the kernel's settleHold, the cold view
- * and the maintenance inspector. Pure: no IO, no clock, no ctx, no imports.
- *
- * Each rule takes a `partial` option for the cold read (buildColdView): the
- * panel is deliberately more tolerant than the kernel — a partial image (a
- * missing collection, a malformed row) degrades to "not revoked / no hold"
- * instead of throwing on data the kernel would already have rejected at parse
- * time. The strict default is byte-identical to the kernel/ledger rules the
- * call sites previously inlined or imported. */
-
-/**
- * Epoch-scoped revocation: a disposition revokes its owner's execution
- * authority exactly at the recorded revokedEpoch; the owner stays revoked
- * while its recorded epoch is within it, and a trusted resume advancing the
- * epoch past every revokedEpoch ends the revoked state without any ledger
- * change (append-only: dispositions are never removed or altered). Extracted
- * from admin-ledger.js; the cold view applied the same rule inline.
- * @param {any} state the authority image (or the in-memory status state)
- * @param {string} owner
- * @param {{ partial?: boolean }} [options] partial tolerates a partial image:
- *   missing collections read as empty and malformed rows are skipped; the
- *   strict default trusts the validated image.
- */
-export function revokedOwner(state, owner, { partial = false } = {}) {
-  if (partial) {
-    const sessions = Array.isArray(state?.sessions) ? state.sessions : []
-    const session = sessions.find(row => row?.sessionId === owner) ?? null
-    if (session == null) return false
-    const ledger = Array.isArray(state?.adminRecoveries) ? state.adminRecoveries : []
-    return ledger.some(row => row?.owner === owner && Number.isSafeInteger(row?.revokedEpoch) && session.executionEpoch <= row.revokedEpoch)
-  }
-  const session = state.sessions?.find(s => s.sessionId === owner)
-  if (!session) return false
-  return state.adminRecoveries?.some(row => row.owner === owner && session.executionEpoch <= row.revokedEpoch) === true
-}
-
-/**
- * Read-time retention settlement (design D5), byte-identical to the kernel's
- * settleHold rule it was extracted from (state.js): a hold counts only while
- * the session owns a lock, and the remaining budget is computed against the
- * read instant, so a missed expiry timer can never leave stale ownership
- * behind a status read. The caller keeps its container lookup and its empty
- * case (the kernel's zero row vs the cold view's null): `held` is the
- * session's PRESENT hold row, `owns` whether the session owns any lock, `now`
- * the read instant.
- * @param {string} sessionId @param {any} held @param {boolean} owns @param {number} now
- * @param {{ partial?: boolean }} [options] partial keeps the cold path's
- *   defensive tolerance of a partial image: an undefined holdUntil reads as no
- *   expiry and only a literal `holding === true` counts.
- */
-export function settleHoldFacts(sessionId, held, owns, now, { partial = false } = {}) {
-  const until = held.holdUntil
-  const remainingMs = (partial ? until == null : until === null) ? 0 : Math.max(0, until - now)
-  const holding = (partial ? held.holding === true : held.holding) && owns
-  return { sessionId, held: holding, expired: holding && until !== null && remainingMs === 0,
-    holdUntil: until, remainingMs, holdCumulativeMs: held.holdCumulativeMs }
-}
-
-/**
- * The administrative disposition covering one operation, if any. Extracted
- * verbatim from admin-ledger.js; the maintenance inspector's inline copy was
- * identical (inspect.js). @param {any} state @param {any} op */
-export const dispositionFor = (state, op) => state.adminRecoveries?.find(row => row.owner === op.sessionId && row.operations.some(item => item.operationId === op.operationId))

package/src/edit-lock/domain.js

@@ -1,165 +0,0 @@
-/** One interface for the publisher-local and remote-client compositions.
- * Every method is trusted host ingress; only `service` reaches tools. */
-
-/** @param {ReturnType<typeof import('./lifecycle.js').createEditLockLifecycle>} lifecycle
- * @param {{close: () => Promise<void>, startLocal?: (agent: object, retry?: boolean) => Promise<any>} | undefined} endpoint */
-export function localDomain(lifecycle, endpoint) {
-  return Object.freeze({
-    mode: 'publisher',
-    service: lifecycle.service,
-    /** @param {object} agent */
-    start: agent => endpoint?.startLocal ? endpoint.startLocal(agent) : lifecycle.start(agent),
-    /** Trusted binding retry; binds a revoked session as interrupted without
-     * restoring authority (the trusted resume path does that). @param {object} agent */
-    retryStart: async agent => {
-      lifecycle.assertStartable(agent)
-      return endpoint?.startLocal ? endpoint.startLocal(agent, true) : lifecycle.start(agent)
-    },
-    /** Trusted binding transfer (change edit-lock-binding-transfer): the
-     * explicit driving-ingress counterpart of retryStart — the holder-side
-     * admission (local, registry-named, provably idle holder) is re-adjudicated
-     * at execution and refuses exactly like start() otherwise. @param {object} agent */
-    transferStart: async agent => {
-      lifecycle.assertStartable(agent)
-      return endpoint?.startLocal ? endpoint.startLocal(agent, true, true) : lifecycle.transferStart(agent)
-    },
-    /** Synchronous admission fence for an aborted turn. @param {object} agent */
-    latch: agent => { lifecycle.stop(agent).catch(() => {}) },
-    /** @param {object} agent */
-    stop: async agent => { await lifecycle.stop(agent); return lifecycle.status(agent) },
-    /** @param {object} agent */
-    dispose: agent => lifecycle.dispose(agent),
-    /** Revoke and remove all ingress, retaining locks. @param {object} agent */
-    forget: agent => lifecycle.forget(agent),
-    /** @param {object} agent @param {string} requestId */
-    resume: (agent, requestId) => lifecycle.resume(agent, requestId),
-    /** @param {object} agent @param {string} resourceId */
-    confirm: async (agent, resourceId) => { await lifecycle.confirm(agent, resourceId); return lifecycle.status(agent) },
-    /** @param {object} agent */
-    status: async agent => lifecycle.status(agent),
-    /** @param {object} _agent */
-    locks: async _agent => lifecycle.locks(),
-    /** @param {object} _agent @param {string} resourceId @param {number} generation */
-    unlock: (_agent, resourceId, generation) => lifecycle.unlock(resourceId, generation),
-    /** Online administrative recovery, executed publisher-side. The trigger
-     * session is audit metadata supplied by the trusted caller, never read
-     * from the request payload.
-     * @param {object} _agent @param {any} input @param {string | null} [trigger] */
-    adminRecover: (_agent, input, trigger) => lifecycle.adminRecoverOnline(input, trigger ?? null),
-    /** Detached stale-lock sweep trigger; the scan runs publisher-side.
-     * @param {object} _agent @param {string | null} [triggerSessionId] */
-    sweepStale: (_agent, triggerSessionId) => lifecycle.sweepStale(triggerSessionId ?? null),
-    /** @param {object} agent @param {string} reason */
-    classifyAbnormal: (agent, reason) => lifecycle.classifyAbnormal(agent, reason),
-    /** @param {object} agent */
-    recoveryUsage: async agent => lifecycle.recoveryUsage(agent),
-    /** @param {object} agent @param {any} delta */
-    chargeRecovery: (agent, delta) => lifecycle.chargeRecovery(agent, delta),
-    /** @param {object} agent @param {number} minutes */
-    pause: (agent, minutes) => lifecycle.pause(agent, minutes),
-    /** @param {object} agent @param {number} ms @param {{singleMaxMs: number, cumulativeMaxMs: number}} caps */
-    hold: (agent, ms, caps) => lifecycle.hold(agent, ms, caps),
-    /** The holder started a new turn: every held lock leaves holding at once.
-     * @param {object} agent */
-    turnStarted: agent => lifecycle.turnStarted(agent),
-    /** Release this session's active locks at their current generation, the
-     * disposition used when a finished turn's locks were never settled.
-     * @param {object} agent */
-    releaseHeld: agent => lifecycle.settleExpired(agent, true),
-    /** Read-time settlement plus the release half of an elapsed period. Also the
-     * trigger for the expiry timer. @param {object} agent */
-    settleExpired: (agent, idle) => lifecycle.settleExpired(agent, false, idle),
-    /** @param {object} agent */
-    retention: agent => lifecycle.retention(agent),
-    blocks(agent) { try { return lifecycle.status(agent).state !== 'active' } catch { return true } },
-    async close() {
-      // Seal remote admission and revoke its channels before local shutdown.
-      try { await endpoint?.close() } finally { await lifecycle.close() }
-    },
-  })
-}
-
-/** @param {ReturnType<typeof import('./remote.js').createRemoteEditLockDomain>} remote */
-export function remoteDomain(remote) {
-  /** @param {string} kind */
-  const forward = kind => (/** @type {any} */ exec, /** @type {unknown} */ request) =>
-    remote.call(exec.agent, kind, request, exec.signal, kind === 'publish' || kind === 'batch' ? exec.callId : undefined)
-  return Object.freeze({
-    mode: 'client',
-    service: Object.freeze({
-      publish: forward('publish'), publishBatch: forward('batch'), acquire: forward('acquire'), release: forward('release'),
-      locks: (/** @type {any} */ exec) => remote.call(exec.agent, 'locks'), trySteal: forward('trySteal'), reply: forward('reply'),
-    }),
-    /** @param {object} agent */
-    start: async agent => (await remote.channelFor(agent)).state,
-    /** @param {object} agent */
-    retryStart: async agent => (await remote.channelFor(agent, true)).state,
-    /** The wire retry flag carries the transfer admission to the publisher
-     * (its lifecycle re-adjudicates holder idleness); the client adds nothing. */
-    /** @param {object} agent */
-    transferStart: async agent => (await remote.channelFor(agent, true)).state,
-    /** @param {object} agent */
-    forget: async agent => { try { await remote.call(agent, 'stop') } finally { remote.drop(agent) } },
-    /** Closing the channel makes the publisher revoke on EOF. @param {object} agent */
-    latch: agent => remote.drop(agent),
-    /** Awaits the publisher's durable revocation. @param {object} agent */
-    stop: async agent => { const status = await remote.call(agent, 'stop'); remote.setState(agent, 'stopped'); return status },
-    /** @param {object} agent */
-    dispose: async agent => {
-      // The publisher releases this agent's active locks and acknowledges with
-      // the response; the channel close below is the transport-level fallback
-      // (EOF also revokes). An unacknowledged disposition must reach the
-      // awaiting caller: this method rejects with the request's own failure
-      // while the channel is still dropped exactly once.
-      try { await remote.call(agent, 'dispose') } finally { remote.drop(agent) }
-    },
-    /** @param {object} agent @param {string} requestId */
-    resume: async (agent, requestId) => {
-      const status = await remote.call(agent, 'resume', { requestId })
-      remote.setState(agent, status.state)
-      return status
-    },
-    /** @param {object} agent @param {string} resourceId */
-    confirm: (agent, resourceId) => remote.call(agent, 'confirm', { resourceId }),
-    /** @param {object} agent */
-    status: agent => remote.call(agent, 'status'),
-    /** @param {object} agent */
-    locks: agent => remote.call(agent, 'allLocks'),
-    /** @param {object} agent @param {string} resourceId @param {number} generation */
-    unlock: (agent, resourceId, generation) => remote.call(agent, 'unlock', { resourceId, generation }),
-    /** Forward the operator's recovery request through this agent's channel;
-     * the publisher executes the same transaction and takes the trigger
-     * identity from the channel, never from the payload.
-     * @param {object} agent @param {any} input */
-    adminRecover: (agent, input) => remote.call(agent, 'adminRecover', input),
-    /** The publisher performs the scan (it shares the filesystem); a client
-     * process only triggers it through the channel. @param {object} agent
-     * @param {string | null} [triggerSessionId] */
-    sweepStale: (agent, triggerSessionId) => remote.call(agent, 'staleSweep', { trigger: triggerSessionId ?? agent?.id ?? null }),
-    /** @param {object} agent @param {string} reason */
-    classifyAbnormal: async (agent, reason) => {
-      const marked = await remote.call(agent, 'classifyAbnormal', { reason })
-      if (marked.length) remote.setState(agent, 'recovering')
-      return marked
-    },
-    /** @param {object} agent */
-    recoveryUsage: agent => remote.call(agent, 'recoveryUsage'),
-    /** @param {object} agent @param {any} delta */
-    chargeRecovery: (agent, delta) => remote.call(agent, 'chargeRecovery', delta),
-    pause: (agent, minutes) => remote.call(agent, 'pause', { minutes }),
-    /** @param {object} agent @param {number} ms @param {{singleMaxMs: number, cumulativeMaxMs: number}} caps */
-    hold: (agent, ms, caps) => remote.call(agent, 'hold', { ms, singleMaxMs: caps.singleMaxMs, cumulativeMaxMs: caps.cumulativeMaxMs }),
-    /** @param {object} agent */
-    turnStarted: agent => remote.call(agent, 'turnStarted'),
-    /** @param {object} agent */
-    releaseHeld: agent => remote.call(agent, 'releaseHeld'),
-    /** @param {object} agent */
-    /** @param {object} agent @param {boolean} [idle] */
-    settleExpired: (agent, idle) => remote.call(agent, 'settleExpired', { idle: idle ?? /** @type {any} */ (agent)?.status === 'idle' }),
-    /** @param {object} agent */
-    retention: agent => remote.call(agent, 'retention'),
-    /** @param {object} agent */
-    blocks: agent => remote.state(agent) !== 'active',
-    async close() { remote.close() },
-  })
-}