@anhlp/alp-core 0.0.0-beta.1 → 0.10.0

package/src/index.js

@@ -1,7 +1,5 @@
 // Stable module namespaces avoid collisions between domain exports.
 export * as adapter from './adapter.js';
-export * as atomic from './atomic.js';
-export * as backup from './backup.js';
 export * as beads from './beads.js';
 export * as delegation from './delegation.js';
 export * as errors from './errors.js';
@@ -11,15 +9,12 @@ export * as hooks from './hooks.js';
 export * as init from './init.js';
 export * as library_edit from './library-edit.js';
 export * as library from './library.js';
-export * as log from './log.js';
-export * as migrations from './migrations.js';
 export * as models from './models.js';
 export * as permissions from './permissions.js';
 export * as profiles from './profiles.js';
 export * as promptsafe from './promptsafe.js';
 export * as providers from './providers.js';
 export * as resolver from './resolver.js';
-export * as state_schema from './state-schema.js';
 export * as task_rows from './task-rows.js';
 export * as tasks from './tasks.js';
 export * as teams from './teams.js';

package/src/library-edit.js

@@ -1,9 +1,7 @@
 import { mkdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
 import path from 'node:path';
-import { moveFile } from './atomic.js';
 import { AlpError } from './errors.js';
-import { assertNoSymlinks } from './safe-path.js';
 import { agentSources, builtinText, jsonObject, libraryEntries, optionalText } from './resolver.js';
 import { teamSources, validateTeam } from './teams.js';
 import { normalizeMcp, validateAgentConfig, validateHook } from './validation.js';
@@ -60,17 +58,8 @@ function base(scope, { root, library }, kind) {
 }
 const revisionOf = content => content === undefined ? null : createHash('sha256').update(JSON.stringify(content)).digest('hex').slice(0, 16);
 
-/** Reject repository-controlled links before any entry read or mutation. This is
- * a preflight for static repository input, not a sandbox against same-user races. */
-async function safeEntryPaths(directory, kind, name) {
-  for (const [file] of FILES[kind](name)) {
-    await assertNoSymlinks(directory, path.join(kind, file));
-  }
-}
-
 /** An entry's content as one layer holds it, or undefined when that layer has none. */
 async function readLayer(kind, name, directory) {
-  await safeEntryPaths(directory, kind, name);
   const content = {};
   let found = false;
   for (const [file, key, type] of FILES[kind](name)) {
@@ -264,7 +253,7 @@ async function writeAtomic(file, text) {
   await mkdir(path.dirname(file), { recursive: true });
   const temporary = `${file}.${randomUUID().slice(0, 8)}.tmp`;
   await writeFile(temporary, text);
-  await moveFile(temporary, file); // retried on Windows while a reader has the target open
+  await rename(temporary, file);
 }
 
 const exists = target => stat(target).then(() => true, () => false);
@@ -277,13 +266,11 @@ const exists = target => stat(target).then(() => true, () => false);
 export async function saveEntry(kind, name, content, { scope, root, library, templates, revision } = {}) {
   kindOf(kind); nameOf(name);
   const directory = base(scope, { root, library }, kind);
-  await safeEntryPaths(directory, kind, name);
   await check(kind, name, content, { scope, root, library, templates });
   const current = await readLayer(kind, name, directory);
   if (revision !== undefined && revision !== revisionOf(current)) {
     fail('REVISION_CONFLICT', current === undefined ? `${kind} '${name}' was removed from the ${scope} since you opened it` : revision === null ? `${kind} '${name}' already exists in the ${scope}` : `${kind} '${name}' changed in the ${scope} since you opened it; reload it and apply your change again`);
   }
-  if (scope === 'library') await mkdir(directory, { recursive: true, mode: 0o700 });
   for (const [file, key, type] of FILES[kind](name)) {
     const target = path.join(directory, kind, file);
     const value = content[key];

package/src/library.js

@@ -1,6 +1,5 @@
 import { shippedTemplateRoot } from './template-path.js';
-import { mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
-import { moveFile } from './atomic.js';
+import { mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
@@ -50,7 +49,6 @@ async function shippedFiles({ templateRoot, templates }) {
  */
 export async function seedLibrary(home, options = {}) {
   const shipped = await shippedFiles(options);
-  await mkdir(home, { recursive: true, mode: 0o700 });
   const manifestPath = path.join(home, MANIFEST);
   const manifestText = await optional(manifestPath);
   const manifest = manifestText ? JSON.parse(manifestText) : { files: {} };
@@ -78,7 +76,7 @@ export async function seedLibrary(home, options = {}) {
     await mkdir(home, { recursive: true });
     const temporary = `${manifestPath}.${randomUUID().slice(0, 8)}.tmp`;
     await writeFile(temporary, JSON.stringify(manifest, null, 2) + '\n');
-    await moveFile(temporary, manifestPath);
+    await rename(temporary, manifestPath);
   }
   return { created, updated };
 }

package/src/permissions.js

@@ -1,7 +1,6 @@
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { readFile, writeFile } from 'node:fs/promises';
-import { moveFile } from './atomic.js';
+import { readFile, rename, writeFile } from 'node:fs/promises';
 import { AlpError } from './errors.js';
 
 /**
@@ -33,8 +32,6 @@ const RULE = /^([A-Za-z][\w-]*)(?:\((.*)\))?$/s;
 /** Tools a rule may name; a misspelt one would silently match nothing. MCP tools are mcp__<server>__<tool>. */
 export const TOOLS = ['Bash', 'Read', 'Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'Glob', 'Grep', 'WebFetch', 'WebSearch', 'Skill'];
 
-const own = (value, key) => Object.hasOwn(value, key) ? value[key] : undefined;
-const setOwn = (value, key, entry) => Object.defineProperty(value, key, { value: entry, enumerable: true, writable: true, configurable: true });
 const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
 const fail = (source, message) => { throw new AlpError('INVALID_SETTINGS', `${source}: ${message}`); };
 
@@ -73,7 +70,7 @@ export function validatePermissions(value, source) {
         for (const rule of list) parseRule(rule, `${source}: ${where}.${kind}`);
         rules[kind] = list.map(rule => rule.trim());
       }
-      setOwn(profiles, name, { ...(profile.base ? { base: profile.base } : {}), ...(profile.beyondMode ? { beyondMode: profile.beyondMode } : {}), ...(profile.workdir ? { workdir: profile.workdir } : {}), ...rules });
+      profiles[name] = { ...(profile.base ? { base: profile.base } : {}), ...(profile.beyondMode ? { beyondMode: profile.beyondMode } : {}), ...(profile.workdir ? { workdir: profile.workdir } : {}), ...rules };
     }
   }
   const agents = {};
@@ -81,7 +78,7 @@ export function validatePermissions(value, source) {
     if (!object(value.agents)) fail(source, 'permissions.agents must be an object');
     for (const [agent, profile] of Object.entries(value.agents)) {
       if (typeof profile !== 'string' || !NAME.test(profile)) fail(source, `permissions.agents.${agent} must name a profile`);
-      setOwn(agents, agent, profile);
+      agents[agent] = profile;
     }
   }
   return { profiles, agents };
@@ -106,10 +103,10 @@ async function settingsPermissions(file) {
 export async function profileFor(projectRoot, home, agent) {
   const project = await settingsPermissions(path.join(projectRoot, '.alp', 'settings.json'));
   const user = home ? await settingsPermissions(path.join(home, 'settings.json')) : { profiles: {}, agents: {} };
-  const name = own(project.agents, agent) ?? own(user.agents, agent);
+  const name = project.agents[agent] ?? user.agents[agent];
   const advisor = ADVISORS.includes(agent);
   if (!name) return advisor ? { name: 'read-only', base: 'read-only', allow: [], ask: [], deny: [], beyondMode: 'refuse' } : null;
-  const defined = [own(project.profiles, name), own(user.profiles, name)].filter(Boolean);
+  const defined = [project.profiles[name], user.profiles[name]].filter(Boolean);
   if (!defined.length && !BASES.includes(name)) {
     throw new AlpError('INVALID_SETTINGS', `permissions.agents.${agent} names profile '${name}', which no settings file defines`);
   }
@@ -143,7 +140,7 @@ export async function addAllowRule(projectRoot, home, profileName, rule) {
     validatePermissions(settings.permissions, file);
     const temporary = `${file}.${randomUUID().slice(0, 8)}.tmp`;
     await writeFile(temporary, `${JSON.stringify(settings, null, 2)}\n`);
-    await moveFile(temporary, file);
+    await rename(temporary, file);
     return file;
   }
   throw new AlpError('INVALID_SETTINGS', `No settings file defines profile ${profileName}`);

package/src/providers.js

@@ -1,4 +1,3 @@
-import { existsSync, readFileSync } from 'node:fs';
 import { readdir, readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { AlpError } from './errors.js';
@@ -93,30 +92,3 @@ export function acpModel(model) {
   const slash = model.indexOf('/');
   return slash < 0 ? { provider: model, model: undefined } : { provider: model.slice(0, slash), model: model.slice(slash + 1) || undefined };
 }
-
-/**
- * How to start a command without a shell. On Windows a bare name installed with npm is a
- * `<name>.cmd` shim, which spawn refuses to run without one; its target runs instead: the
- * native executable it calls, or the Node script, under this Node. A bare name with an .exe or
- * .com on PATH, any other command, and every command elsewhere are returned as they are.
- * @param {string} command @param {string[]} [args] @param {Record<string, string | undefined>} [env]
- * @returns {{ command: string, args: string[] }}
- */
-export function launchCommand(command, args = [], env = process.env) {
-  if (process.platform !== 'win32' || /[\\/]/.test(command) || path.extname(command)) return { command, args };
-  const key = Object.keys(env).find(name => name.toUpperCase() === 'PATH');
-  for (const directory of (key ? env[key] ?? '' : '').split(';').filter(Boolean)) {
-    if (['.exe', '.com'].some(extension => existsSync(path.join(directory, command + extension)))) break;
-    const shim = path.join(directory, `${command}.cmd`);
-    if (!existsSync(shim)) continue;
-    // npm's cmd-shim ends with `"%dp0%\<target>" %*`, or `"%_prog%" [node flags] "%dp0%\<script>" %*`
-    // for a Node script. Anything else (a hand-written batch file) stays refused by spawn, as before.
-    const text = readFileSync(shim, 'utf8');
-    const script = /"%_prog%"((?:\s+[^\s"]+)*)\s+"%~?dp0%\\?([^"]+)"\s+%\*/i.exec(text);
-    if (script) return { command: process.execPath, args: [...script[1].split(/\s+/).filter(Boolean), path.join(directory, script[2]), ...args] };
-    const native = /^\s*"%~?dp0%\\?([^"]+\.(?:exe|com))"\s+%\*/im.exec(text);
-    if (native) return { command: path.join(directory, native[1]), args };
-    break;
-  }
-  return { command, args };
-}

package/src/task-rows.js

@@ -23,7 +23,7 @@ export async function taskRows(projectRoot) {
     const approvals = task.status === 'closed' ? [] : task.gates.filter(gate => gate.kind === 'human' && !gate.resolved).map(gate => ({ gate: gate.id, note: gate.note ?? '' }));
     const waits = task.status === 'closed' ? [] : gatesOf(task, tasks);
     return {
-      id: task.id, title: task.title, type: task.type, priority: task.priority, status: task.status, rev: task.rev,
+      id: task.id, title: task.title, type: task.type, priority: task.priority, status: task.status,
       ...(task.parent ? { parent: task.parent } : {}),
       ...(task.assignee ? { assignee: task.assignee.agent } : {}),
       ready: ready.has(task.id),

package/src/tasks.d.ts

@@ -108,7 +108,7 @@ export function gateOpen(gate: TaskGate, now?: number): boolean;
 export function describeGate(gate: TaskGate): string;
 export function gatesOf(task: Task, tasks: Task[]): string[];
 export function addGate(projectRoot: string, id: string, gate: { kind: GateKind; note?: string; until?: string; ref?: string | number }, by: string): Promise<Task>;
-export function resolveGate(projectRoot: string, id: string, gateId: string, resolve: { by: string; note?: string; remove?: boolean; ifRev?: number }): Promise<Task>;
+export function resolveGate(projectRoot: string, id: string, gateId: string, resolve: { by: string; note?: string; remove?: boolean }): Promise<Task>;
 export function checkGates(projectRoot: string, gh: (args: string[], options: { cwd: string }) => Promise<string>): Promise<{ cleared: Array<{ task: string; gate: string; detail: string }>; pending: Array<{ task: string; gate: string; detail: string }>; errors: Array<{ task: string; gate: string; error: string }> }>;
 export function compactTasks(projectRoot: string, options: { days?: number; dryRun?: boolean }, by: string): Promise<Array<{ id: string; before: number; after: number }>>;
 export type TaskBatch = {
@@ -125,4 +125,3 @@ export type TaskVerification = { at: string; by: string; passed: boolean; where?
 export type EpicReport = { id: string; title: string; status: TaskStatus; tasks: number; closed: number; durationMs: number; reworked: number; verification: { passed: number; failed: number; skipped: number; none: number }; unverified: string[]; lines: string[]; text: string };
 export function epicReport(id: string, tasks: Task[]): EpicReport;
 export function landedParents(tasks: Task[]): Array<{ task: Task; children: number }>;
-export function withTaskLock<T>(projectRoot: string, work: () => Promise<T>): Promise<T>;

package/src/tasks.js

@@ -1,9 +1,7 @@
-import { mkdir, readFile, readdir, rmdir, stat, writeFile } from 'node:fs/promises';
-import { moveFile } from './atomic.js';
+import { mkdir, readFile, readdir, rename, rmdir, stat, writeFile } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
 import path from 'node:path';
 import { AlpError } from './errors.js';
-import { assertNoSymlinks } from './safe-path.js';
 import { describeVerification } from './verify.js';
 
 /**
@@ -14,8 +12,7 @@ import { describeVerification } from './verify.js';
  * module: it holds a lock directory while it reads, checks and writes a task.
  */
 
-/** Relative to the project, written with slashes on every platform: it appears in messages and in what agents read. */
-export const TASKS_DIR = '.alp/tasks';
+export const TASKS_DIR = path.join('.alp', 'tasks');
 export const TASK_TYPES = ['task', 'bug', 'feature', 'chore', 'epic'];
 export const TASK_STATUSES = ['open', 'in_progress', 'review', 'closed'];
 export const CLOSE_REASONS = ['done', 'wontfix', 'duplicate', 'superseded'];
@@ -41,23 +38,12 @@ const taskFile = (projectRoot, id) => path.join(tasksDir(projectRoot), `${id}.js
 const now = () => new Date().toISOString();
 const fail = (code, message) => { throw new AlpError(code, message); };
 
-/** Validate all repository-controlled task paths before reads or lock creation. */
-async function taskNames(projectRoot) {
-  const scope = path.join(path.resolve(projectRoot), '.alp');
-  await assertNoSymlinks(scope, 'tasks');
-  let names;
-  try { names = await readdir(tasksDir(projectRoot)); }
-  catch (error) { if (error.code === 'ENOENT') return []; throw error; }
-  for (const name of [...names.filter(name => name.endsWith('.json')), LOCK, '.gitignore']) {
-    await assertNoSymlinks(scope, path.join('tasks', name));
-  }
-  return names;
-}
-
-/** Reads every task. Invalid JSON is reported and skipped; unsafe paths are fatal. */
+/** Reads every task. A file that does not parse is reported and skipped, never fatal. */
 export async function loadTasks(projectRoot) {
   const dir = tasksDir(projectRoot);
-  const names = await taskNames(projectRoot);
+  let names;
+  try { names = await readdir(dir); }
+  catch (error) { if (error.code === 'ENOENT') return { tasks: [], errors: [] }; throw error; }
   const tasks = [];
   const errors = [];
   for (const name of names.filter(name => name.endsWith('.json')).sort()) {
@@ -246,7 +232,6 @@ async function locked(projectRoot, work) {
   const dir = tasksDir(projectRoot);
   const previous = queues.get(dir) ?? Promise.resolve();
   const run = previous.catch(() => {}).then(async () => {
-    await taskNames(projectRoot);
     await prepare(dir);
     const lock = path.join(dir, LOCK);
     const deadline = Date.now() + LOCK_WAIT_MS;
@@ -267,9 +252,6 @@ async function locked(projectRoot, work) {
   return run;
 }
 
-/** Runs `work` holding the project's task lock, as every task writer does; backups and restores use it (ALPD §68). */
-export const withTaskLock = (projectRoot, work) => locked(projectRoot, work);
-
 /** Creates the directory and its .gitignore on first use, so tasks are ready to commit. */
 async function prepare(dir) {
   await mkdir(dir, { recursive: true });
@@ -278,10 +260,9 @@ async function prepare(dir) {
 
 async function save(projectRoot, task) {
   const file = taskFile(projectRoot, task.id);
-  await assertNoSymlinks(path.join(path.resolve(projectRoot), ".alp"), path.join("tasks", `${task.id}.json`));
   const temporary = `${file}.${randomUUID().slice(0, 8)}.tmp`;
   await writeFile(temporary, JSON.stringify(task, null, 2) + '\n');
-  await moveFile(temporary, file);
+  await rename(temporary, file);
   return task;
 }
 
@@ -709,7 +690,7 @@ export function addGate(projectRoot, id, { kind, note, until, ref } = {}, by) {
 }
 
 /** Clears a gate by hand, or removes it with `remove`. Only the user clears a human gate; the caller enforces who `by` is. */
-export function resolveGate(projectRoot, id, gateId, { by, note, remove = false, ifRev } = {}) {
+export function resolveGate(projectRoot, id, gateId, { by, note, remove = false } = {}) {
   return mutate(projectRoot, id, task => {
     const gate = (task.gates ?? []).find(entry => entry.id === gateId) ?? fail('INVALID_TASK', `${id} has no gate ${gateId}`);
     if (remove) {
@@ -729,7 +710,7 @@ export function resolveGate(projectRoot, id, gateId, { by, note, remove = false,
       task.closed = { at: now(), by, reason: 'done', summary };
       addLog(task, by, 'closed', { reason: 'done', summary });
     }
-  }, { ifRev });
+  });
 }
 
 /**

package/src/trust.js

@@ -1,5 +1,4 @@
-import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
-import { moveFile } from './atomic.js';
+import { mkdir, readFile, realpath, rename, writeFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 
@@ -28,7 +27,7 @@ async function store(home, value) {
   await mkdir(path.dirname(file(home)), { recursive: true });
   const temporary = `${file(home)}.${randomUUID().slice(0, 8)}.tmp`;
   await writeFile(temporary, JSON.stringify(value, null, 2) + '\n');
-  await moveFile(temporary, file(home));
+  await rename(temporary, file(home));
 }
 
 /** Whether the user trusts this project's hooks. */

package/src/user-settings.js

@@ -1,5 +1,4 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { moveFile } from './atomic.js';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 import { AlpError } from './errors.js';
@@ -52,10 +51,10 @@ export async function setLanguage(home, language) {
   const next = { ...settings };
   if (language === null) delete next.language; else next.language = language.trim();
   validateUserSettings(next, file);
-  await mkdir(home, { recursive: true, mode: 0o700 });
+  await mkdir(home, { recursive: true });
   const temporary = `${file}.${randomUUID().slice(0, 8)}.tmp`;
   await writeFile(temporary, JSON.stringify(next, null, 2) + '\n');
-  await moveFile(temporary, file);
+  await rename(temporary, file);
   return languageSetting(home);
 }
 
@@ -68,9 +67,9 @@ export async function setWebRelay(home, patch) {
   const { file, settings } = await readSettings(home);
   const next = { ...settings, web: { ...settings.web, relay: { ...settings.web?.relay, ...patch } } };
   validateUserSettings(next, file);
-  await mkdir(home, { recursive: true, mode: 0o700 });
+  await mkdir(home, { recursive: true });
   const temporary = `${file}.${randomUUID().slice(0, 8)}.tmp`;
   await writeFile(temporary, JSON.stringify(next, null, 2) + '\n');
-  await moveFile(temporary, file);
+  await rename(temporary, file);
   return next.web.relay;
 }

package/src/verify.js

@@ -1,7 +1,7 @@
+import { spawn } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { AlpError } from './errors.js';
-import { signalShell, spawnShell } from './shell.js';
 
 /**
  * The project's verification gate (plans/reference/ALPD.md §28): commands from
@@ -59,11 +59,14 @@ export async function verifyConfig(projectRoot) {
 function runCommand(command, cwd, { timeoutMs, idleMs }, env) {
   return new Promise(resolve => {
     const started = Date.now();
-    const child = spawnShell(command, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    const windows = process.platform === 'win32';
+    const child = spawn(windows ? process.env.ComSpec ?? 'cmd.exe' : '/bin/sh', windows ? ['/d', '/s', '/c', command] : ['-c', command], {
+      cwd, env, stdio: ['ignore', 'pipe', 'pipe'], detached: !windows, windowsHide: true,
+    });
     let output = '';
     let stopped;
     let idle;
-    const signal = name => signalShell(child, name);
+    const signal = name => { try { windows ? child.kill() : process.kill(-child.pid, name); } catch {} };
     const stop = reason => {
       if (stopped) return;
       stopped = reason;

package/LICENSE

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

package/NOTICE

@@ -1,7 +0,0 @@
-ALP
-Copyright 2026 Lê Phúc Anh
-
-Licensed under the Apache License, Version 2.0 (see LICENSE).
-
-Where a package's bundled files include third-party code, its
-THIRD-PARTY-NOTICES.txt names each package and reproduces its licence.

package/dist/atomic.d.ts

@@ -1,2 +0,0 @@
-export function moveFile(from: string, to: string): Promise<void>;
-export function writeAtomic(file: string, body: string | Uint8Array, mode?: number): Promise<void>;

package/dist/atomic.js

@@ -1,28 +0,0 @@
-// packages/core/src/atomic.js
-import { randomBytes } from "node:crypto";
-import { rename, rm, writeFile } from "node:fs/promises";
-async function moveFile(from, to) {
-  for (let attempt = 0; ; attempt++) {
-    try {
-      return await rename(from, to);
-    } catch (error) {
-      if (process.platform !== "win32" || attempt >= 20 || !["EPERM", "EACCES", "EBUSY"].includes(error?.code)) throw error;
-      await new Promise((resolve) => setTimeout(resolve, 10 + attempt * 10));
-    }
-  }
-}
-async function writeAtomic(file, body, mode = 384) {
-  const temporary = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
-  try {
-    await writeFile(temporary, body, { mode });
-    await moveFile(temporary, file);
-  } catch (error) {
-    await rm(temporary, { force: true }).catch(() => {
-    });
-    throw error;
-  }
-}
-export {
-  moveFile,
-  writeAtomic
-};