@aldus-runtime/release 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,21 @@
+Aldus
+Copyright 2026 Jam Chen
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this software except in compliance with the License. You may obtain a copy of
+the License in the LICENSE file distributed with this software, or at:
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Aldus is currently owned as personal work and has not been assigned to a
+separate legal entity. If ownership is transferred, this file and the related
+copyright statements will be updated at that time.
+
+No third-party code is bundled, inlined, or vendored into any published Aldus
+package. Dependencies are resolved at install time and reach the consumer under
+their own licenses, from their own publishers. The dependency audit is recorded
+in THIRD-PARTY-NOTICES.md.
+
+This NOTICE file exists by the project's choice rather than by obligation:
+Apache-2.0 section 4(d) governs the preservation of a NOTICE file when the work
+already carries one, and does not itself require that one be created.

package/dist/adapter.d.ts

@@ -0,0 +1,140 @@
+/**
+ * The release adapter contract (architecture contract §17, §4.3).
+ *
+ * This package contains **no platform client, and names no platform.** Contract §4.2 keeps
+ * publishing platforms out of the runtime and §1.2 explicitly rules out prescribing particular
+ * release targets; §4.3 places provider and release configuration in Integration. Contract §22's
+ * own wording for this work package names two platforms, and following that wording literally
+ * would have put an adopter's channel semantics inside the runtime — the dependency direction
+ * §4.3 forbids.
+ *
+ * So what lives here is the shape an adopter implements, plus the resumable machinery that shape
+ * plugs into. The only implementation in this package is {@link RecordingReleaseAdapter}, a test
+ * double.
+ */
+import type { ReleaseOperation } from "./operation.js";
+/** What an adapter is asked to do. */
+export interface ReleaseRequest {
+    /** The operation being performed. */
+    operation: ReleaseOperation;
+    /**
+     * The key that makes this request safe to repeat (contract §17, §19.1).
+     *
+     * An adapter whose platform supports client-supplied idempotency keys SHOULD pass this
+     * through, so that a repeat caused by a lost response is deduplicated remotely as well as
+     * locally.
+     */
+    idempotencyKey: string;
+    /** Run the release belongs to. */
+    runId: string;
+}
+/** What an adapter reports back. */
+export type AdapterOutcome = {
+    status: "succeeded";
+    /** Identifier assigned by the destination, where one is returned. */
+    remoteId?: string;
+    /** Address of the released item, where one is meaningful. */
+    remoteUrl?: string;
+} | {
+    status: "failed";
+    /** Operator-facing reason, already redacted by the adapter (contract §19.2). */
+    message: string;
+    /** Whether repeating the identical request could plausibly succeed (contract §19.1). */
+    retryable?: boolean;
+} | {
+    /**
+     * The outcome is genuinely unknown — a timeout, a lost connection after the request was
+     * accepted, a platform that acknowledges asynchronously.
+     *
+     * Distinct from `failed` and the reason `ReleaseReceipt` has a `pending` status: an
+     * unknown outcome MUST be reconciled against the destination rather than retried, because
+     * retrying something that already succeeded is how a double publish happens.
+     */
+    status: "pending";
+    message?: string;
+};
+/** What reconciliation found at the destination. */
+export interface RemoteState {
+    /** Whether the destination holds the result of this operation. */
+    exists: boolean;
+    remoteId?: string;
+    remoteUrl?: string;
+}
+/**
+ * An adopter's implementation for one destination.
+ *
+ * Implementations live in an adopter integration, never here (§4.3).
+ */
+export interface ReleaseAdapter {
+    /** The destination this adapter serves, matching `ReleaseOperation.destination`. */
+    readonly destination: string;
+    /** Perform one operation. */
+    execute(request: ReleaseRequest): Promise<AdapterOutcome>;
+    /**
+     * Ask the destination whether an operation already happened (contract §17).
+     *
+     * Optional because §17 qualifies resumability with "where the platform allows it" — a
+     * destination with no way to query prior state genuinely cannot support this. An adapter that
+     * omits it makes reconciliation impossible for its operations, and the executor reports that
+     * rather than guessing; see {@link ReleaseErrorCodes.RECONCILIATION_UNAVAILABLE}.
+     */
+    lookup?(request: ReleaseRequest): Promise<RemoteState>;
+}
+/** Adapters by destination. */
+export declare class AdapterRegistry {
+    #private;
+    constructor(adapters?: readonly ReleaseAdapter[]);
+    /** Register an adapter, replacing any previous one for its destination. */
+    register(adapter: ReleaseAdapter): void;
+    /** The adapter for a destination, or `undefined`. */
+    find(destination: string): ReleaseAdapter | undefined;
+    /**
+     * The adapter for a destination.
+     *
+     * @throws {AldusError} `ALDUS_RELEASE_ADAPTER_NOT_REGISTERED` when none is registered. Refusing
+     * is deliberate: a missing adapter means an operator declared work nothing can perform, and
+     * skipping it would report a complete release that never touched the destination.
+     */
+    require(destination: string): ReleaseAdapter;
+}
+/** Scripted behaviour for {@link RecordingReleaseAdapter}. */
+export interface RecordingAdapterOptions {
+    /** Outcome per `operationId`. Anything unlisted succeeds. */
+    outcomes?: Readonly<Record<string, AdapterOutcome>>;
+    /** Remote state per idempotency key, as reconciliation would find it. */
+    remote?: Readonly<Record<string, RemoteState>>;
+    /** Omit `lookup` entirely, modelling a destination that cannot be queried. */
+    withoutLookup?: boolean;
+}
+/**
+ * A test double that records what it was asked to do.
+ *
+ * Counting executions is the point: the double-publish tests assert that a *real* second
+ * execution never happened, which a spy on the executor could not establish.
+ */
+export declare class RecordingReleaseAdapter implements ReleaseAdapter {
+    #private;
+    readonly destination: string;
+    /** Every request passed to {@link execute}, in order. */
+    readonly executed: ReleaseRequest[];
+    /** Every request passed to {@link lookup}, in order. */
+    readonly lookedUp: ReleaseRequest[];
+    /** Remote state, mutable so a test can simulate a destination that already holds a result. */
+    readonly remote: Map<string, RemoteState>;
+    /**
+     * Present only when the destination can be queried.
+     *
+     * An own property assigned in the constructor rather than a prototype method, because
+     * `withoutLookup` has to make `lookup` genuinely **absent**. A method that returns "not found"
+     * would be indistinguishable from a destination that was queried and had nothing — and those
+     * are opposite situations: one means the operation still needs to run, the other means nobody
+     * can say. Deleting a prototype method does not remove it from the instance, which is the bug
+     * this shape avoids.
+     */
+    readonly lookup?: (request: ReleaseRequest) => Promise<RemoteState>;
+    constructor(destination: string, options?: RecordingAdapterOptions);
+    execute(request: ReleaseRequest): Promise<AdapterOutcome>;
+    /** How many times an operation was actually sent to the destination. */
+    executionCount(operationId: string): number;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,MAAM,cAAc,GACtB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACD;IACE,MAAM,EAAE,QAAQ,CAAC;IACjB,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACD;IACE;;;;;;;OAOG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,MAAM,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACxD;AAED,+BAA+B;AAC/B,qBAAa,eAAe;;IAG1B,YAAY,QAAQ,GAAE,SAAS,cAAc,EAAO,EAEnD;IAED,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAEtC;IAED,qDAAqD;IACrD,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEpD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAU3C;CACF;AAED,8DAA8D;AAC9D,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACpD,yEAAyE;IACzE,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,cAAc;;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAM;IACzC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAM;IAEzC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE1C;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,EAUrE;IAED,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAexD;IAED,wEAAwE;IACxE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1C;CACF"}

package/dist/adapter.js

@@ -0,0 +1,104 @@
+/**
+ * The release adapter contract (architecture contract §17, §4.3).
+ *
+ * This package contains **no platform client, and names no platform.** Contract §4.2 keeps
+ * publishing platforms out of the runtime and §1.2 explicitly rules out prescribing particular
+ * release targets; §4.3 places provider and release configuration in Integration. Contract §22's
+ * own wording for this work package names two platforms, and following that wording literally
+ * would have put an adopter's channel semantics inside the runtime — the dependency direction
+ * §4.3 forbids.
+ *
+ * So what lives here is the shape an adopter implements, plus the resumable machinery that shape
+ * plugs into. The only implementation in this package is {@link RecordingReleaseAdapter}, a test
+ * double.
+ */
+import { ReleaseErrorCodes, releaseError } from "./errors.js";
+/** Adapters by destination. */
+export class AdapterRegistry {
+    #byDestination = new Map();
+    constructor(adapters = []) {
+        for (const adapter of adapters)
+            this.register(adapter);
+    }
+    /** Register an adapter, replacing any previous one for its destination. */
+    register(adapter) {
+        this.#byDestination.set(adapter.destination, adapter);
+    }
+    /** The adapter for a destination, or `undefined`. */
+    find(destination) {
+        return this.#byDestination.get(destination);
+    }
+    /**
+     * The adapter for a destination.
+     *
+     * @throws {AldusError} `ALDUS_RELEASE_ADAPTER_NOT_REGISTERED` when none is registered. Refusing
+     * is deliberate: a missing adapter means an operator declared work nothing can perform, and
+     * skipping it would report a complete release that never touched the destination.
+     */
+    require(destination) {
+        const adapter = this.#byDestination.get(destination);
+        if (adapter === undefined) {
+            throw releaseError(ReleaseErrorCodes.ADAPTER_NOT_REGISTERED, `No release adapter is registered for destination "${destination}".`, { category: "validation", retryable: false, details: { destination } });
+        }
+        return adapter;
+    }
+}
+/**
+ * A test double that records what it was asked to do.
+ *
+ * Counting executions is the point: the double-publish tests assert that a *real* second
+ * execution never happened, which a spy on the executor could not establish.
+ */
+export class RecordingReleaseAdapter {
+    destination;
+    /** Every request passed to {@link execute}, in order. */
+    executed = [];
+    /** Every request passed to {@link lookup}, in order. */
+    lookedUp = [];
+    #options;
+    /** Remote state, mutable so a test can simulate a destination that already holds a result. */
+    remote;
+    /**
+     * Present only when the destination can be queried.
+     *
+     * An own property assigned in the constructor rather than a prototype method, because
+     * `withoutLookup` has to make `lookup` genuinely **absent**. A method that returns "not found"
+     * would be indistinguishable from a destination that was queried and had nothing — and those
+     * are opposite situations: one means the operation still needs to run, the other means nobody
+     * can say. Deleting a prototype method does not remove it from the instance, which is the bug
+     * this shape avoids.
+     */
+    lookup;
+    constructor(destination, options = {}) {
+        this.destination = destination;
+        this.#options = options;
+        this.remote = new Map(Object.entries(options.remote ?? {}));
+        if (options.withoutLookup !== true) {
+            this.lookup = (request) => {
+                this.lookedUp.push(request);
+                return Promise.resolve(this.remote.get(request.idempotencyKey) ?? { exists: false });
+            };
+        }
+    }
+    execute(request) {
+        this.executed.push(request);
+        const scripted = this.#options.outcomes?.[request.operation.operationId];
+        const outcome = scripted ?? {
+            status: "succeeded",
+            remoteId: `remote-${request.operation.operationId}`,
+        };
+        if (outcome.status === "succeeded") {
+            this.remote.set(request.idempotencyKey, {
+                exists: true,
+                ...(outcome.remoteId === undefined ? {} : { remoteId: outcome.remoteId }),
+                ...(outcome.remoteUrl === undefined ? {} : { remoteUrl: outcome.remoteUrl }),
+            });
+        }
+        return Promise.resolve(outcome);
+    }
+    /** How many times an operation was actually sent to the destination. */
+    executionCount(operationId) {
+        return this.executed.filter((request) => request.operation.operationId === operationId).length;
+    }
+}
+//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA4E9D,+BAA+B;AAC/B,MAAM,OAAO,eAAe;IACjB,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE5D,YAAY,QAAQ,GAA8B,EAAE;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,2EAA2E;IAC3E,QAAQ,CAAC,OAAuB;QAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC,WAAmB;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAmB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,YAAY,CAChB,iBAAiB,CAAC,sBAAsB,EACxC,qDAAqD,WAAW,IAAI,EACpE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAYD;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACzB,WAAW,CAAS;IAC7B,yDAAyD;IAChD,QAAQ,GAAqB,EAAE,CAAC;IACzC,wDAAwD;IAC/C,QAAQ,GAAqB,EAAE,CAAC;IAChC,QAAQ,CAA0B;IAC3C,8FAA8F;IACrF,MAAM,CAA2B;IAE1C;;;;;;;;;OASG;IACM,MAAM,CAAqD;IAEpE,YAAY,WAAmB,EAAE,OAAO,GAA4B,EAAE;QACpE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAuB,EAAwB,EAAE;gBAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvF,CAAC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAuB;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,OAAO,GAAmB,QAAQ,IAAI;YAC1C,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,UAAU,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SACpD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,cAAc,CAAC,WAAmB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACjG,CAAC;CACF"}

package/dist/authorization.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Release authorization (architecture contract §13.4, §17, §18.1).
+ *
+ * This package does **not** decide whether a release is approved. `@aldus-runtime/gate-engine` already
+ * models §13.4's separation of uploading from making public as two gates granting two
+ * operations, and derives staleness from bound digests (ADR-0009). Re-deciding any of that here
+ * would produce a second approval path — and §3.6 exists because a second path is how an
+ * approval that nobody recorded ends up authorizing something.
+ *
+ * So the executor consumes a verdict through a narrow port, and {@link gateEngineAuthorizer}
+ * wires that port to the real engine.
+ */
+import type { GateEngine, SubjectsByGate } from "@aldus-runtime/gate-engine";
+/** A verdict on one operation's authority. */
+export interface AuthorityVerdict {
+    authorized: boolean;
+    /** Why not, when refused. Shown to an operator, so it must name the gate. */
+    explanation?: string;
+    /** The gate that granted it, when authorized — recorded for trace (contract §20). */
+    gateId?: string;
+}
+/**
+ * Whatever decides if a release operation may proceed.
+ *
+ * A port rather than a direct dependency so that the executor can be tested against a refusal
+ * without constructing a gate graph, and so an adopter with its own authority model can supply
+ * one. The shipped implementation is {@link gateEngineAuthorizer}.
+ */
+export interface ReleaseAuthorizer {
+    /**
+     * Whether `authority` is currently held for this Run.
+     *
+     * `authority` is the operation string a gate grants, e.g. the separate upload and publication
+     * authorities of §13.4.
+     */
+    check(runId: string, authority: string): Promise<AuthorityVerdict>;
+}
+/**
+ * A {@link ReleaseAuthorizer} backed by the gate engine (contract §13).
+ *
+ * `subjects` are the current digests of everything the gates bind — the final render, captions,
+ * metadata, destination, and visibility policy of §13.4. They are supplied by the caller and
+ * read afresh on every check, so an approval that was valid when the bundle was assembled and
+ * has since drifted is refused at the moment of release rather than at the moment of planning.
+ */
+export declare function gateEngineAuthorizer(engine: GateEngine, subjects: SubjectsByGate | (() => SubjectsByGate | Promise<SubjectsByGate>)): ReleaseAuthorizer;
+/**
+ * An authorizer that permits everything.
+ *
+ * For operations that genuinely need no approval, and for tests exercising execution mechanics
+ * rather than authority. Deliberately named for what it does: a default called
+ * `defaultAuthorizer` would be reached for without the reader noticing it approves everything.
+ */
+export declare function permitAllAuthorizer(): ReleaseAuthorizer;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,cAAc,GAAG,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,GAC1E,iBAAiB,CAUnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CAEvD"}

package/dist/authorization.js

@@ -0,0 +1,42 @@
+/**
+ * Release authorization (architecture contract §13.4, §17, §18.1).
+ *
+ * This package does **not** decide whether a release is approved. `@aldus-runtime/gate-engine` already
+ * models §13.4's separation of uploading from making public as two gates granting two
+ * operations, and derives staleness from bound digests (ADR-0009). Re-deciding any of that here
+ * would produce a second approval path — and §3.6 exists because a second path is how an
+ * approval that nobody recorded ends up authorizing something.
+ *
+ * So the executor consumes a verdict through a narrow port, and {@link gateEngineAuthorizer}
+ * wires that port to the real engine.
+ */
+/**
+ * A {@link ReleaseAuthorizer} backed by the gate engine (contract §13).
+ *
+ * `subjects` are the current digests of everything the gates bind — the final render, captions,
+ * metadata, destination, and visibility policy of §13.4. They are supplied by the caller and
+ * read afresh on every check, so an approval that was valid when the bundle was assembled and
+ * has since drifted is refused at the moment of release rather than at the moment of planning.
+ */
+export function gateEngineAuthorizer(engine, subjects) {
+    return {
+        async check(runId, authority) {
+            const current = typeof subjects === "function" ? await subjects() : subjects;
+            const result = await engine.authorize(runId, authority, current);
+            return result.authorized
+                ? { authorized: true, gateId: result.gateId }
+                : { authorized: false, explanation: result.explanation };
+        },
+    };
+}
+/**
+ * An authorizer that permits everything.
+ *
+ * For operations that genuinely need no approval, and for tests exercising execution mechanics
+ * rather than authority. Deliberately named for what it does: a default called
+ * `defaultAuthorizer` would be reached for without the reader noticing it approves everything.
+ */
+export function permitAllAuthorizer() {
+    return { check: () => Promise.resolve({ authorized: true }) };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA8BH;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAkB,EAClB,QAA2E;IAE3E,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,SAAiB;YAC1C,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,MAAM,CAAC,UAAU;gBACtB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC7C,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/bundle.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Release bundles (architecture contract §17).
+ *
+ * A bundle is a **declaration**, not a record of what happened: contract §17 states that
+ * "publishing is a domain, not a single command", and the bundle is the domain's unit of intent.
+ * What happened lives in `ReleaseReceipt`s, one per operation, in the Run's `release.json`
+ * (§7).
+ *
+ * There is deliberately no persisted bundle state. Execution state is derived from the receipts
+ * on every inspection, for the same reason ADR-0009 derives gate state rather than storing it: a
+ * stored "in progress" flag survives a crash that the operation it describes did not, and an
+ * operator then reads a status that was true once and is not true now.
+ */
+import type { BestEffortOperation, ReleaseOperation, RequiredOperation } from "./operation.js";
+/**
+ * A set of release operations for one Run.
+ *
+ * The two lists are the §17 distinction between pre-release hard gates and post-upload
+ * best-effort work. Required operations run first, in order; best-effort operations run only
+ * once every required one has succeeded, because §17 calls them "post-upload".
+ */
+export interface ReleaseBundle {
+    /** Identity of this bundle. Part of every operation's idempotency key. */
+    bundleId: string;
+    /** Run this release belongs to (contract §6). */
+    runId: string;
+    /** Canonical Episode identity, for the emitted events (contract §6.4). */
+    episodeId: string;
+    /** Operations whose failure fails the release, in execution order. */
+    required: readonly RequiredOperation[];
+    /** Operations attempted after the required ones, whose failure is recorded but tolerated. */
+    bestEffort: readonly BestEffortOperation[];
+}
+/** Every operation in a bundle, required first, in execution order. */
+export declare function operationsOf(bundle: ReleaseBundle): readonly ReleaseOperation[];
+/**
+ * Check a bundle's internal consistency.
+ *
+ * @throws {AldusError} `ALDUS_RELEASE_EMPTY_BUNDLE` if it declares no operations.
+ * @throws {AldusError} `ALDUS_RELEASE_DUPLICATE_OPERATION` if an `operationId` repeats.
+ */
+export declare function assertBundleValid(bundle: ReleaseBundle): void;
+/**
+ * Derive the idempotency key for one operation (contract §17, §19.1).
+ *
+ * §17 requires each operation to be "independently idempotent and resumable where the platform
+ * allows it", and `ReleaseReceipt.idempotencyKey` is the mechanism. The key is **derived, not
+ * supplied**, from the bundle, the operation, its destination, and the digests of what it
+ * releases — so a resumed execution computes the identical key without having to remember one,
+ * and a changed input produces a different key rather than silently reusing an old outcome.
+ *
+ * Input hashes are sorted before digesting: the set of things released is what matters, not the
+ * order a caller happened to list them in.
+ */
+export declare function deriveIdempotencyKey(bundleId: string, operation: ReleaseOperation): string;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,6FAA6F;IAC7F,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC5C;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,gBAAgB,EAAE,CAE/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CA2B7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,GAAG,MAAM,CAS1F"}