@aldus-runtime/file-store 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,21 @@
+Aldus
+Copyright 2026 Jam Chen
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this software except in compliance with the License. You may obtain a copy of
+the License in the LICENSE file distributed with this software, or at:
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Aldus is currently owned as personal work and has not been assigned to a
+separate legal entity. If ownership is transferred, this file and the related
+copyright statements will be updated at that time.
+
+No third-party code is bundled, inlined, or vendored into any published Aldus
+package. Dependencies are resolved at install time and reach the consumer under
+their own licenses, from their own publishers. The dependency audit is recorded
+in THIRD-PARTY-NOTICES.md.
+
+This NOTICE file exists by the project's choice rather than by obligation:
+Apache-2.0 section 4(d) governs the preservation of a NOTICE file when the work
+already carries one, and does not itself require that one be created.

package/dist/atomic.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Crash-safe file primitives.
+ *
+ * Architecture contract §19.1 requires "recovery from partial success" and "recovery from
+ * interrupted writes" (§22 WP-02). The failure this module exists to prevent is concrete: an
+ * operator's machine sleeps, a process is killed, or a container is evicted midway through
+ * rewriting `run.json`, and the next read finds a half-written file where the Run's state used
+ * to be. Contract §3.4 makes files authoritative, so a truncated manifest is not an
+ * inconvenience — it is the loss of the only authoritative record.
+ *
+ * The durability sequence is write-to-temp, fsync the file, rename, fsync the directory. Each
+ * step is load-bearing:
+ *
+ * - **Temp file in the same directory.** `rename` is only atomic within a filesystem. A temp
+ *   file in `os.tmpdir()` may be on a different device, which silently degrades the rename into
+ *   a copy — exactly the non-atomic write this is meant to avoid.
+ * - **fsync the file** before renaming, or the rename can be durable while the contents are not,
+ *   leaving a correctly named empty file after a power loss.
+ * - **fsync the directory** after renaming, or the rename itself may not survive a crash.
+ */
+/** Injection point for the durability sequence, so tests can interrupt it at a chosen step. */
+export interface AtomicWriteHooks {
+    /** Invoked after the temp file is written and synced, before the rename. */
+    beforeRename?: (temporaryPath: string) => void | Promise<void>;
+}
+/** Options for {@link writeFileAtomic}. */
+export interface AtomicWriteOptions {
+    /** Test seam; unused in production paths. */
+    hooks?: AtomicWriteHooks;
+}
+/**
+ * Write `contents` to `path` so that a reader sees either the previous bytes or the new bytes,
+ * never a mixture.
+ *
+ * Parent directories are created as needed. The temp file is removed if any step fails, so an
+ * interrupted write leaves no debris for the next reader to mistake for real state.
+ */
+export declare function writeFileAtomic(path: string, contents: string, options?: AtomicWriteOptions): Promise<void>;
+/**
+ * Append a single line to a file, creating it if absent, and sync before returning.
+ *
+ * Used for the append-only event log (contract §6.4). `O_APPEND` makes each write land at the
+ * current end of file even with concurrent writers, so an interleaved append can never overwrite
+ * another writer's bytes — it can only ever be interleaved *between* lines, or torn at the tail
+ * if the process dies mid-write. {@link readJsonLines} handles the torn tail.
+ */
+export declare function appendLineSynced(path: string, line: string): Promise<void>;
+/** Read a file, returning `undefined` rather than throwing when it does not exist. */
+export declare function readFileOrUndefined(path: string): Promise<string | undefined>;
+/** True if `error` is a Node `ENOENT`. */
+export declare function isNotFound(error: unknown): boolean;
+/** True if `error` is a Node `EEXIST`, i.e. an `O_EXCL` create lost the race. */
+export declare function isAlreadyExists(error: unknown): boolean;
+/**
+ * Create a file only if it does not already exist, returning `false` if it did.
+ *
+ * `O_CREAT | O_EXCL` is the primitive the lock is built on: the check and the create are one
+ * syscall, so two processes racing cannot both believe they created it.
+ */
+export declare function createExclusive(path: string, contents: string): Promise<boolean>;
+/** Overwrite a file in place without the rename dance. Used for lock heartbeats only. */
+export declare function overwrite(path: string, contents: string): Promise<void>;
+/** Remove a file, tolerating its absence. */
+export declare function removeIfPresent(path: string): Promise<void>;
+//# sourceMappingURL=atomic.d.ts.map

package/dist/atomic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic.d.ts","sourceRoot":"","sources":["../src/atomic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAID;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED,sFAAsF;AACtF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAOnF;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBtF;AAED,yFAAyF;AACzF,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,6CAA6C;AAC7C,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjE"}

package/dist/atomic.js

@@ -0,0 +1,160 @@
+/**
+ * Crash-safe file primitives.
+ *
+ * Architecture contract §19.1 requires "recovery from partial success" and "recovery from
+ * interrupted writes" (§22 WP-02). The failure this module exists to prevent is concrete: an
+ * operator's machine sleeps, a process is killed, or a container is evicted midway through
+ * rewriting `run.json`, and the next read finds a half-written file where the Run's state used
+ * to be. Contract §3.4 makes files authoritative, so a truncated manifest is not an
+ * inconvenience — it is the loss of the only authoritative record.
+ *
+ * The durability sequence is write-to-temp, fsync the file, rename, fsync the directory. Each
+ * step is load-bearing:
+ *
+ * - **Temp file in the same directory.** `rename` is only atomic within a filesystem. A temp
+ *   file in `os.tmpdir()` may be on a different device, which silently degrades the rename into
+ *   a copy — exactly the non-atomic write this is meant to avoid.
+ * - **fsync the file** before renaming, or the rename can be durable while the contents are not,
+ *   leaving a correctly named empty file after a power loss.
+ * - **fsync the directory** after renaming, or the rename itself may not survive a crash.
+ */
+import { constants as fsConstants } from "node:fs";
+import { mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+let temporaryCounter = 0;
+/**
+ * Write `contents` to `path` so that a reader sees either the previous bytes or the new bytes,
+ * never a mixture.
+ *
+ * Parent directories are created as needed. The temp file is removed if any step fails, so an
+ * interrupted write leaves no debris for the next reader to mistake for real state.
+ */
+export async function writeFileAtomic(path, contents, options = {}) {
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true });
+    // Same directory, therefore same filesystem, therefore a genuinely atomic rename. The counter
+    // plus pid keeps two writers in one process from colliding on the temp name.
+    temporaryCounter += 1;
+    const temporaryPath = join(directory, `.${basenameOf(path)}.${process.pid}.${temporaryCounter}.tmp`);
+    try {
+        const handle = await open(temporaryPath, "w");
+        try {
+            await handle.writeFile(contents, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await options.hooks?.beforeRename?.(temporaryPath);
+        await rename(temporaryPath, path);
+        await syncDirectory(directory);
+    }
+    catch (error) {
+        await unlink(temporaryPath).catch(() => undefined);
+        throw error;
+    }
+}
+/**
+ * Append a single line to a file, creating it if absent, and sync before returning.
+ *
+ * Used for the append-only event log (contract §6.4). `O_APPEND` makes each write land at the
+ * current end of file even with concurrent writers, so an interleaved append can never overwrite
+ * another writer's bytes — it can only ever be interleaved *between* lines, or torn at the tail
+ * if the process dies mid-write. {@link readJsonLines} handles the torn tail.
+ */
+export async function appendLineSynced(path, line) {
+    await mkdir(dirname(path), { recursive: true });
+    const handle = await open(path, "a");
+    try {
+        await handle.writeFile(`${line}\n`, "utf8");
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Read a file, returning `undefined` rather than throwing when it does not exist. */
+export async function readFileOrUndefined(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return undefined;
+        throw error;
+    }
+}
+/** True if `error` is a Node `ENOENT`. */
+export function isNotFound(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+/** True if `error` is a Node `EEXIST`, i.e. an `O_EXCL` create lost the race. */
+export function isAlreadyExists(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
+/**
+ * Create a file only if it does not already exist, returning `false` if it did.
+ *
+ * `O_CREAT | O_EXCL` is the primitive the lock is built on: the check and the create are one
+ * syscall, so two processes racing cannot both believe they created it.
+ */
+export async function createExclusive(path, contents) {
+    await mkdir(dirname(path), { recursive: true });
+    try {
+        const handle = await open(path, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY);
+        try {
+            await handle.writeFile(contents, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        return true;
+    }
+    catch (error) {
+        if (isAlreadyExists(error))
+            return false;
+        throw error;
+    }
+}
+/** Overwrite a file in place without the rename dance. Used for lock heartbeats only. */
+export async function overwrite(path, contents) {
+    await writeFile(path, contents, "utf8");
+}
+/** Remove a file, tolerating its absence. */
+export async function removeIfPresent(path) {
+    try {
+        await unlink(path);
+    }
+    catch (error) {
+        if (!isNotFound(error))
+            throw error;
+    }
+}
+/**
+ * fsync a directory so that a rename within it survives a crash.
+ *
+ * Not portable: some platforms refuse to open a directory for the purpose. A failure here means
+ * the rename may not be durable across a power loss, which is strictly weaker than the
+ * within-process atomicity the rename already guarantees — so it is tolerated rather than
+ * escalated into a failed write.
+ */
+async function syncDirectory(directory) {
+    try {
+        const handle = await open(directory, "r");
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        // Best effort by design; see the doc comment.
+    }
+}
+function basenameOf(path) {
+    const index = Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"));
+    return index === -1 ? path : path.slice(index + 1);
+}
+//# sourceMappingURL=atomic.js.map

package/dist/atomic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic.js","sourceRoot":"","sources":["../src/atomic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAc1C,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,QAAgB,EAChB,OAAO,GAAuB,EAAE;IAEhC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,8FAA8F;IAC9F,6EAA6E;IAC7E,gBAAgB,IAAI,CAAC,CAAC;IACtB,MAAM,aAAa,GAAG,IAAI,CACxB,SAAS,EACT,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,MAAM,CAC9D,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY;IAC/D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACnG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,IAAI,EACJ,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,CAChE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC5D,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/collections.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Per-run collection files (contract §7: `artifacts.json`, `approvals.json`, `costs.json`,
+ * `release.json`).
+ *
+ * Each holds a JSON array of records that each carry their own `schemaVersion`, so the array
+ * itself needs no envelope. Appending writes back the **raw** parsed array with one element
+ * added, which preserves unknown properties on every existing element for free — there is no
+ * merge to get wrong, because nothing already stored is ever re-serialised from a validated
+ * value (ADR-0004 decision 3).
+ */
+import { type SchemaTypeFor, type VersionedSchemaName } from "@aldus-runtime/core";
+import { type AtomicWriteOptions } from "./atomic.js";
+/** A collection read: validated records plus the raw array they were parsed from. */
+export interface StoredCollection<T> {
+    values: T[];
+    raw: unknown[];
+}
+/**
+ * Read and validate a collection file.
+ *
+ * An absent file reads as an empty collection: a Run that has produced no artifacts yet is an
+ * ordinary state (contract §6.2 `created`), not a missing record.
+ */
+export declare function readCollection<N extends VersionedSchemaName>(path: string, schema: N): Promise<StoredCollection<SchemaTypeFor<N>>>;
+/** Append one record to a collection file, preserving every existing element byte for byte. */
+export declare function appendToCollection<N extends VersionedSchemaName>(path: string, schema: N, record: SchemaTypeFor<N>, options?: AtomicWriteOptions): Promise<void>;
+//# sourceMappingURL=collections.d.ts.map

package/dist/collections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../src/collections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAI3E,qFAAqF;AACrF,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,EAAE,CAAC;IACZ,GAAG,EAAE,OAAO,EAAE,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,CAAC,SAAS,mBAAmB,EAChE,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,GACR,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CA6C7C;AAED,+FAA+F;AAC/F,wBAAsB,kBAAkB,CAAC,CAAC,SAAS,mBAAmB,EACpE,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/collections.js

@@ -0,0 +1,58 @@
+/**
+ * Per-run collection files (contract §7: `artifacts.json`, `approvals.json`, `costs.json`,
+ * `release.json`).
+ *
+ * Each holds a JSON array of records that each carry their own `schemaVersion`, so the array
+ * itself needs no envelope. Appending writes back the **raw** parsed array with one element
+ * added, which preserves unknown properties on every existing element for free — there is no
+ * merge to get wrong, because nothing already stored is ever re-serialised from a validated
+ * value (ADR-0004 decision 3).
+ */
+import { validateRecord, fromStructuredError, } from "@aldus-runtime/core";
+import { readFileOrUndefined } from "./atomic.js";
+import { writeDocument } from "./document.js";
+import { FileStoreErrorCodes, fileStoreError } from "./errors.js";
+/**
+ * Read and validate a collection file.
+ *
+ * An absent file reads as an empty collection: a Run that has produced no artifacts yet is an
+ * ordinary state (contract §6.2 `created`), not a missing record.
+ */
+export async function readCollection(path, schema) {
+    const contents = await readFileOrUndefined(path);
+    if (contents === undefined || contents.trim().length === 0)
+        return { values: [], raw: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(contents);
+    }
+    catch {
+        throw fileStoreError(FileStoreErrorCodes.RECORD_MALFORMED, `The stored ${schema} collection is not valid JSON. Atomic writes make a torn file ` +
+            "impossible, so this means the file was edited or replaced by something other than the store.", { category: "io", retryable: false, details: { path, schema, byteLength: contents.length } });
+    }
+    if (!Array.isArray(parsed)) {
+        throw fileStoreError(FileStoreErrorCodes.RECORD_MALFORMED, `The stored ${schema} collection is valid JSON but not an array.`, { category: "io", retryable: false, details: { path, schema } });
+    }
+    const values = [];
+    for (let index = 0; index < parsed.length; index += 1) {
+        const result = validateRecord(schema, parsed[index]);
+        if (!result.ok) {
+            const error = fromStructuredError(result.error);
+            // Name the offending index. Without it, a 200-element artifacts file reports "one of these
+            // is wrong" and leaves an operator to bisect by hand.
+            throw fileStoreError(FileStoreErrorCodes.RECORD_MALFORMED, `Element ${index} of the stored ${schema} collection is not a valid ${schema}: ${error.message}`, {
+                category: "io",
+                retryable: false,
+                details: { path, schema, index },
+            });
+        }
+        values.push(result.value);
+    }
+    return { values, raw: parsed };
+}
+/** Append one record to a collection file, preserving every existing element byte for byte. */
+export async function appendToCollection(path, schema, record, options = {}) {
+    const existing = await readCollection(path, schema);
+    await writeDocument(path, [...existing.raw, record], options);
+}
+//# sourceMappingURL=collections.js.map

package/dist/collections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections.js","sourceRoot":"","sources":["../src/collections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAA2B,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQlE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,MAAS;IAET,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE3F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,cAAc,CAClB,mBAAmB,CAAC,gBAAgB,EACpC,cAAc,MAAM,gEAAgE;YAClF,8FAA8F,EAChG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,cAAc,CAClB,mBAAmB,CAAC,gBAAgB,EACpC,cAAc,MAAM,6CAA6C,EACjE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,2FAA2F;YAC3F,sDAAsD;YACtD,MAAM,cAAc,CAClB,mBAAmB,CAAC,gBAAgB,EACpC,WAAW,KAAK,kBAAkB,MAAM,8BAA8B,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,EAChG;gBACE,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;aACjC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,MAAS,EACT,MAAwB,EACxB,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC"}

package/dist/document.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Validated JSON documents with forward-compatible round-tripping.
+ *
+ * ADR-0004 decision 3 is a MUST on this package: a store MUST preserve unknown properties across
+ * a read-modify-write. The hazard it addresses is quiet. Zod strips unknown properties on parse
+ * (ADR-0002 decision 7), so an older build that reads a manifest written by a newer minor
+ * version, changes one field, and writes it back would delete the newer version's data without
+ * any error, any warning, or any way to notice afterwards.
+ *
+ * A Git-tracked `.aldus/` shared between machines on different builds makes that an ordinary
+ * situation, not an edge case (contract §5.1, §7). So every read keeps the raw parsed JSON
+ * beside the validated value, and every update merges the caller's changes back over the raw.
+ */
+import { type SchemaCompatibility, type SchemaTypeFor, type VersionedSchemaName } from "@aldus-runtime/core";
+import { type AtomicWriteOptions } from "./atomic.js";
+/** A record as it exists on disk: validated, plus the bytes it was validated from. */
+export interface StoredDocument<T> {
+    /** The validated record. Unknown properties are absent, as Zod strips them. */
+    value: T;
+    /** The parsed JSON exactly as stored, including properties this build does not know about. */
+    raw: Record<string, unknown>;
+    /** How the stored `schemaVersion` relates to this build (ADR-0003). */
+    compatibility: SchemaCompatibility;
+}
+/**
+ * Read and validate a versioned record.
+ *
+ * Returns `undefined` when the file does not exist — an absent record is an ordinary state, not
+ * a failure, and a store that threw here would make "does this run exist?" an exception-handling
+ * exercise.
+ *
+ * @throws {AldusError} `ALDUS_RECORD_MALFORMED` if the bytes are not JSON,
+ * `ALDUS_SCHEMA_VERSION_UNSUPPORTED` if the major version is unreadable, or
+ * `ALDUS_SCHEMA_VALIDATION_FAILED` if the record does not satisfy its schema.
+ */
+export declare function readDocument<N extends VersionedSchemaName>(path: string, schema: N): Promise<StoredDocument<SchemaTypeFor<N>> | undefined>;
+/** Write a record, replacing any previous contents atomically. */
+export declare function writeDocument(path: string, value: unknown, options?: AtomicWriteOptions): Promise<void>;
+/**
+ * Merge a validated update back over the bytes it came from, keeping properties this build does
+ * not know about (ADR-0004 decision 3).
+ *
+ * The three arguments are what make this precise rather than a guess:
+ *
+ * - `raw` — everything that was on disk.
+ * - `original` — the same record after validation, so its keys are exactly the ones this build
+ *   understands.
+ * - `next` — the caller's updated record.
+ *
+ * A key present in `raw` but absent from `original` is unknown to this build, so it is preserved.
+ * A key present in both but absent from `next` was deliberately removed by the caller, so it is
+ * dropped. Without that distinction, preservation would resurrect fields a caller had just
+ * deleted.
+ *
+ * Arrays are merged element-wise **only when the lengths match**, which is the case where index
+ * identity is sound. If the caller added or removed elements, indices no longer denote the same
+ * records and `next` is taken wholesale — losing unknown properties inside those elements rather
+ * than attaching them to the wrong element. That trade is deliberate: silently misattributing a
+ * field is worse than dropping it.
+ */
+export declare function preserveUnknown(raw: unknown, original: unknown, next: unknown): unknown;
+/** Apply {@link preserveUnknown} against a stored document. */
+export declare function mergeForWrite<T>(document: StoredDocument<T>, next: T): unknown;
+/** True for a JSON object, excluding arrays and null. */
+export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=document.d.ts.map

package/dist/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../src/document.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAwC,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG5F,sFAAsF;AACtF,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,KAAK,EAAE,CAAC,CAAC;IACT,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,uEAAuE;IACvE,aAAa,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,CAAC,SAAS,mBAAmB,EAC9D,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,GACR,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAkCvD;AAED,kEAAkE;AAClE,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBvF;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAE9E;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E"}