@apexops/kernel 0.10.0-next.0

package/dist/content-cache.d.ts

@@ -0,0 +1,18 @@
+import { type JsonValue } from "./canonical.js";
+export interface ContentCacheInput {
+    dependencies: Record<string, JsonValue>;
+    config: JsonValue;
+    toolchain: JsonValue;
+}
+export declare function contentCacheKey(input: ContentCacheInput): string;
+export declare class ContentCache {
+    private readonly root;
+    private readonly objects;
+    constructor(projectRoot: string);
+    get<T extends JsonValue>(input: ContentCacheInput): Promise<T | null>;
+    set(input: ContentCacheInput, value: JsonValue): Promise<string>;
+    invalidate(dependency?: string): Promise<number>;
+    private assertRoot;
+    private entryPath;
+}
+//# sourceMappingURL=content-cache.d.ts.map

package/dist/content-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-cache.d.ts","sourceRoot":"","sources":["../src/content-cache.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;CACtB;AAOD,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAEhE;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IAEtC,YAAY,WAAW,EAAE,MAAM,EAI9B;IAEK,GAAG,CAAC,CAAC,SAAS,SAAS,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAS1E;IAEK,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrE;IAEK,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBrD;YAEa,UAAU;YASV,SAAS;CAexB"}

package/dist/content-cache.js

@@ -0,0 +1,94 @@
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, rm } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import { sha256Json } from "./canonical.js";
+import { atomicWriteJson } from "./files.js";
+import { ObjectStore } from "./object-store.js";
+export function contentCacheKey(input) {
+    return sha256Json(input);
+}
+export class ContentCache {
+    root;
+    objects;
+    constructor(projectRoot) {
+        const root = resolve(projectRoot);
+        this.root = join(root, ".apex", "cache", "content");
+        this.objects = new ObjectStore(projectRoot);
+    }
+    async get(input) {
+        const path = await this.entryPath(contentCacheKey(input));
+        try {
+            const entry = JSON.parse(await readFile(path, "utf8"));
+            return this.objects.getJson(entry.objectHash);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async set(input, value) {
+        const key = contentCacheKey(input);
+        const objectHash = await this.objects.putJson(value);
+        await atomicWriteJson(await this.entryPath(key, true), {
+            objectHash,
+            dependencies: Object.keys(input.dependencies).sort(),
+        });
+        return key;
+    }
+    async invalidate(dependency) {
+        await this.assertRoot();
+        let names;
+        try {
+            names = await readdir(this.root);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return 0;
+            throw error;
+        }
+        let count = 0;
+        for (const name of names.filter((item) => /^[0-9a-f]{64}\.json$/.test(item))) {
+            const path = await this.entryPath(name.slice(0, -5));
+            const entry = JSON.parse(await readFile(path, "utf8"));
+            if (dependency === undefined || entry.dependencies.includes(dependency)) {
+                await rm(path);
+                count += 1;
+            }
+        }
+        return count;
+    }
+    async assertRoot(create = false) {
+        if (create)
+            await mkdir(this.root, { recursive: true });
+        try {
+            if ((await lstat(this.root)).isSymbolicLink())
+                throw new Error("Content cache root must not be a symlink");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    async entryPath(key, create = false) {
+        if (!/^[0-9a-f]{64}$/.test(key))
+            throw new Error("Invalid content cache key");
+        await this.assertRoot(create);
+        const path = join(this.root, `${key}.json`);
+        if (relative(this.root, path).startsWith(".."))
+            throw new Error("Content cache path escapes root");
+        try {
+            const stat = await lstat(path);
+            if (stat.isSymbolicLink() || !stat.isFile())
+                throw new Error("Content cache entry must be a regular file");
+            const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+            await handle.close();
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        return path;
+    }
+}
+//# sourceMappingURL=content-cache.js.map

package/dist/content-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-cache.js","sourceRoot":"","sources":["../src/content-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAkB,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAahD,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,OAAO,UAAU,CAAC,KAA6B,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,YAAY;IACN,IAAI,CAAS;IACb,OAAO,CAAc;IAEtC,YAAY,WAAmB;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAsB,KAAwB;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAe,CAAC;YACrE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAwB,EAAE,KAAgB;QAClD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,eAAe,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;YACrD,UAAU;YACV,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;SACrD,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAmB;QAClC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;YACjE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAe,CAAC;YACrE,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,KAAK;QACrC,IAAI,MAAM;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC7G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,MAAM,GAAG,KAAK;QACjD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9E,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACnG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC3G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YAC3E,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/event-journal.d.ts

@@ -0,0 +1,20 @@
+import type { EventV1, ProjectId, RunId } from "@apexops/contracts";
+import { type JsonValue } from "./canonical.js";
+export interface AppendEventInput {
+    eventId: string;
+    projectId: ProjectId;
+    runId: RunId;
+    type: string;
+    timestamp: string;
+    ownerEpoch: number;
+    expectedHead: string | null;
+    payload: JsonValue;
+}
+export declare class EventJournal {
+    readonly directory: string;
+    constructor(directory: string);
+    head(): Promise<string | null>;
+    append(input: AppendEventInput): Promise<EventV1>;
+    replay(): Promise<EventV1[]>;
+}
+//# sourceMappingURL=event-journal.d.ts.map

package/dist/event-journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-journal.d.ts","sourceRoot":"","sources":["../src/event-journal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAKpE,OAAO,EAAkC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,SAAS,CAAC;CACpB;AAiCD,qBAAa,YAAY;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,SAAS,EAAE,MAAM,EAE5B;IAEK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGnC;IAEK,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAsCtD;IAEK,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAiDjC;CACF"}

package/dist/event-journal.js

@@ -0,0 +1,136 @@
+import { CONTRACT_VERSION } from "@apexops/contracts";
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { canonicalJsonBytes, sha256Json } from "./canonical.js";
+import { atomicWriteBytes } from "./files.js";
+const MAX_EVENT_BYTES = 1024 * 1024;
+async function readEventFile(path) {
+    const before = await lstat(path, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.size > BigInt(MAX_EVENT_BYTES)) {
+        throw new Error("Journal event must be a bounded regular file");
+    }
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() ||
+            opened.dev !== before.dev ||
+            opened.ino !== before.ino ||
+            opened.size > BigInt(MAX_EVENT_BYTES)) {
+            throw new Error("Journal event changed before read");
+        }
+        const bytes = await handle.readFile();
+        if (bytes.byteLength > MAX_EVENT_BYTES)
+            throw new Error("Journal event exceeds its byte budget");
+        const after = await lstat(path, { bigint: true });
+        if (after.isSymbolicLink() || after.dev !== opened.dev || after.ino !== opened.ino) {
+            throw new Error("Journal event changed during read");
+        }
+        return bytes.toString("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+export class EventJournal {
+    directory;
+    constructor(directory) {
+        this.directory = resolve(directory);
+    }
+    async head() {
+        const events = await this.replay();
+        return events.at(-1)?.hash ?? null;
+    }
+    async append(input) {
+        const events = await this.replay();
+        const previous = events.at(-1);
+        const actualHead = previous?.hash ?? null;
+        if (input.expectedHead !== actualHead) {
+            throw new Error(`Stale journal head: expected ${String(input.expectedHead)}, found ${String(actualHead)}`);
+        }
+        if (previous !== undefined && input.ownerEpoch < previous.ownerEpoch) {
+            throw new Error(`Stale owner epoch: minimum ${previous.ownerEpoch}, received ${input.ownerEpoch}`);
+        }
+        if (!Number.isInteger(input.ownerEpoch) || input.ownerEpoch < 1) {
+            throw new Error("Owner epoch must be a positive integer");
+        }
+        const eventWithoutHash = {
+            schemaVersion: CONTRACT_VERSION,
+            eventId: input.eventId,
+            projectId: input.projectId,
+            runId: input.runId,
+            sequence: events.length + 1,
+            type: input.type,
+            timestamp: input.timestamp,
+            ownerEpoch: input.ownerEpoch,
+            previousHash: actualHead,
+            payloadHash: sha256Json(input.payload),
+            payload: input.payload,
+        };
+        const event = { ...eventWithoutHash, hash: sha256Json(eventWithoutHash) };
+        const path = join(this.directory, `${String(event.sequence).padStart(16, "0")}.json`);
+        try {
+            await atomicWriteBytes(path, canonicalJsonBytes(event), { refuseOverwrite: true });
+        }
+        catch (error) {
+            if (error.code === "EEXIST") {
+                throw new Error("Stale journal head: another writer appended first", { cause: error });
+            }
+            throw error;
+        }
+        return event;
+    }
+    async replay() {
+        let names;
+        try {
+            names = (await readdir(this.directory)).filter((name) => /^\d{16}\.json$/.test(name)).sort();
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return [];
+            }
+            throw error;
+        }
+        const events = [];
+        let previousHash = null;
+        let identity;
+        for (const [index, name] of names.entries()) {
+            let contents;
+            try {
+                contents = await readEventFile(join(this.directory, name));
+            }
+            catch (error) {
+                throw new Error(`Corrupt journal event ${name}: unsafe file`, { cause: error });
+            }
+            let event;
+            try {
+                event = JSON.parse(contents);
+            }
+            catch (error) {
+                throw new Error(`Corrupt journal event ${name}: invalid JSON`, { cause: error });
+            }
+            const { hash, ...withoutHash } = event;
+            const expectedSequence = index + 1;
+            if (event.sequence !== expectedSequence || name !== `${String(expectedSequence).padStart(16, "0")}.json`) {
+                throw new Error(`Corrupt journal sequence at ${name}`);
+            }
+            if (event.previousHash !== previousHash) {
+                throw new Error(`Corrupt journal chain at sequence ${event.sequence}`);
+            }
+            if (sha256Json(event.payload) !== event.payloadHash) {
+                throw new Error(`Corrupt journal payload at sequence ${event.sequence}`);
+            }
+            if (sha256Json(withoutHash) !== hash) {
+                throw new Error(`Corrupt journal hash at sequence ${event.sequence}`);
+            }
+            identity ??= event;
+            if (event.projectId !== identity.projectId || event.runId !== identity.runId) {
+                throw new Error(`Corrupt journal identity at sequence ${event.sequence}`);
+            }
+            events.push(event);
+            previousHash = hash;
+        }
+        return events;
+    }
+}
+//# sourceMappingURL=event-journal.js.map

package/dist/event-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-journal.js","sourceRoot":"","sources":["../src/event-journal.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAkB,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAc9C,MAAM,eAAe,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpC,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;YAChB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACzB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACzB,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,GAAG,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAY;IACd,SAAS,CAAS;IAE3B,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;QAC1C,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,UAAU,cAAc,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,gBAAgB,GAAqB;YACzC,aAAa,EAAE,gBAAgB;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,UAAU;YACxB,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,MAAM,KAAK,GAAY,EAAE,GAAG,gBAAgB,EAAE,IAAI,EAAE,UAAU,CAAC,gBAA6B,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,CAAC,KAAkB,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,mDAAmD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,QAA0D,CAAC;QAC/D,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,CAAC;YACvC,MAAM,gBAAgB,GAAG,KAAK,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,IAAI,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;gBACzG,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,CAAC,OAAoB,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,UAAU,CAAC,WAAwB,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,QAAQ,KAAK,KAAK,CAAC;YACnB,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/evidence-store.d.ts

@@ -0,0 +1,42 @@
+import { type JsonValue } from "./canonical.js";
+export type EvidenceRetention = "immutable" | "project" | "optional";
+export interface EvidenceKindPolicy {
+    contentTypes: string[];
+    maxBytes: number;
+    retention: EvidenceRetention;
+}
+export interface EvidencePolicyConfig {
+    kinds: Record<string, EvidenceKindPolicy>;
+}
+export interface EvidenceAcceptance {
+    status: "accepted" | "quarantined";
+    kind: string;
+    bytes: number;
+    retention: EvidenceRetention;
+    hash?: string;
+    quarantinePath?: string;
+    redacted: boolean;
+    reasons: string[];
+}
+export declare class EvidencePolicy {
+    readonly config: EvidencePolicyConfig;
+    constructor(config: EvidencePolicyConfig);
+    rule(kind: string, contentType: string): EvidenceKindPolicy;
+}
+export declare class EvidenceStore {
+    private readonly policy;
+    private readonly objects;
+    private readonly localRoot;
+    private readonly telemetryPath;
+    constructor(projectRoot: string, policy: EvidencePolicy);
+    accept(input: {
+        kind: string;
+        contentType: string;
+        value: JsonValue | Uint8Array;
+        required: boolean;
+    }): Promise<EvidenceAcceptance>;
+    setTelemetryConsent(consent: boolean): Promise<void>;
+    exportTelemetry(): Promise<JsonValue | null>;
+    deleteTelemetry(): Promise<void>;
+}
+//# sourceMappingURL=evidence-store.d.ts.map

package/dist/evidence-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-store.d.ts","sourceRoot":"","sources":["../src/evidence-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIpE,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;AAErE,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,GAAG,aAAa,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,iBAAiB,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAeD,qBAAa,cAAc;IACb,QAAQ,CAAC,MAAM,EAAE,oBAAoB;IAAjD,YAAqB,MAAM,EAAE,oBAAoB,EAAI;IAErD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAQ1D;CACF;AAED,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YACE,WAAW,EAAE,MAAM,EACF,MAAM,EAAE,cAAc,EAMxC;IAEK,MAAM,CAAC,KAAK,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B;IAEK,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAEK,eAAe,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAOjD;IAEK,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErC;CACF"}

package/dist/evidence-store.js

@@ -0,0 +1,151 @@
+import { readFile, rm } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { canonicalJsonBytes } from "./canonical.js";
+import { atomicWriteBytes, atomicWriteJson } from "./files.js";
+import { ObjectStore } from "./object-store.js";
+const SECRET_KEY = /(?:secret|password|passphrase|token|authorization|api[-_]?key|private[-_]?key|access[-_]?key|clientSecret|connectionString|sasToken)/i;
+const HIGH_RISK = [
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    /\b(?:ghp|github_pat)_[A-Za-z0-9_]{20,}\b/,
+    /\b(?:AccountKey|SharedAccessSignature)=[^\s;]+/i,
+    /\bAuthorization\s*[:=]\s*Bearer\s+[A-Za-z0-9._~+\/-]{16,}/i,
+    /\bBearer\s+[A-Za-z0-9._~+\/-]{20,}/i,
+    /\b(?:Server|Data Source)=[^;\r\n]+;[\s\S]{0,512}\b(?:Password|Pwd|AccountKey)=[^;\r\n]+/i,
+    /\b(?:clientSecret|accessToken|refreshToken|sasToken)\s*[:=]\s*["']?[^\s,"'}]{8,}/i,
+];
+export class EvidencePolicy {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    rule(kind, contentType) {
+        const rule = this.config.kinds[kind];
+        if (rule === undefined)
+            throw new Error(`Evidence kind ${kind} is not allowed`);
+        if (!rule.contentTypes.includes(contentType))
+            throw new Error(`Content type ${contentType} is not allowed for ${kind}`);
+        if (!Number.isInteger(rule.maxBytes) || rule.maxBytes < 1)
+            throw new Error(`Invalid evidence byte budget for ${kind}`);
+        return rule;
+    }
+}
+export class EvidenceStore {
+    policy;
+    objects;
+    localRoot;
+    telemetryPath;
+    constructor(projectRoot, policy) {
+        this.policy = policy;
+        const root = resolve(projectRoot);
+        this.objects = new ObjectStore(root);
+        this.localRoot = join(root, ".apex", "local");
+        this.telemetryPath = join(this.localRoot, "telemetry.json");
+    }
+    async accept(input) {
+        const rule = this.policy.rule(input.kind, input.contentType);
+        const originalBytes = input.value instanceof Uint8Array ? Buffer.from(input.value) : canonicalJsonBytes(input.value);
+        let bytes;
+        let wasRedacted = false;
+        const uncertainReasons = [];
+        if (input.value instanceof Uint8Array) {
+            bytes = Buffer.from(input.value);
+            if (input.contentType === "application/json") {
+                try {
+                    const parsed = JSON.parse(bytes.toString("utf8"));
+                    const redactedValue = redact(parsed);
+                    bytes = canonicalJsonBytes(redactedValue.value);
+                    wasRedacted = redactedValue.redacted;
+                }
+                catch {
+                    uncertainReasons.push("malformed-json");
+                }
+            }
+            else if (!isSafeText(bytes)) {
+                uncertainReasons.push("unknown-binary");
+            }
+        }
+        else {
+            const redactedValue = redact(input.value);
+            bytes = canonicalJsonBytes(redactedValue.value);
+            wasRedacted = redactedValue.redacted;
+        }
+        if (bytes.byteLength > rule.maxBytes)
+            throw new Error(`Evidence exceeds ${input.kind} byte budget`);
+        const reasons = [
+            ...uncertainReasons,
+            ...HIGH_RISK.filter((pattern) => pattern.test(originalBytes.toString("utf8")) || pattern.test(bytes.toString("utf8"))).map((pattern) => `high-risk-pattern:${pattern.source}`),
+        ];
+        if (reasons.length > 0) {
+            if (input.required || rule.retention === "immutable")
+                throw new Error("Required immutable evidence contains high-risk content");
+            const quarantinePath = join(this.localRoot, "quarantine", `${crypto.randomUUID()}.bin`);
+            await atomicWriteBytes(quarantinePath, bytes, { refuseOverwrite: true });
+            return {
+                status: "quarantined",
+                kind: input.kind,
+                bytes: bytes.byteLength,
+                retention: rule.retention,
+                quarantinePath,
+                redacted: wasRedacted,
+                reasons,
+            };
+        }
+        const hash = await this.objects.putBytes(bytes);
+        return {
+            status: "accepted",
+            kind: input.kind,
+            bytes: bytes.byteLength,
+            retention: input.required ? "immutable" : rule.retention,
+            hash,
+            redacted: wasRedacted,
+            reasons: [],
+        };
+    }
+    async setTelemetryConsent(consent) {
+        await atomicWriteJson(this.telemetryPath, { consent });
+    }
+    async exportTelemetry() {
+        try {
+            return JSON.parse(await readFile(this.telemetryPath, "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async deleteTelemetry() {
+        await rm(this.telemetryPath, { force: true });
+    }
+}
+function isSafeText(bytes) {
+    if (bytes.includes(0))
+        return false;
+    const text = bytes.toString("utf8");
+    return Buffer.from(text, "utf8").equals(bytes) && !/[\u0001-\u0008\u000B\u000C\u000E-\u001F]/.test(text);
+}
+function redact(value) {
+    if (Array.isArray(value)) {
+        const items = value.map(redact);
+        return { value: items.map((item) => item.value), redacted: items.some((item) => item.redacted) };
+    }
+    if (value !== null && typeof value === "object") {
+        let changed = false;
+        const result = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (SECRET_KEY.test(key)) {
+                result[key] = "[REDACTED]";
+                changed = true;
+            }
+            else {
+                const nested = redact(item);
+                result[key] = nested.value;
+                changed ||= nested.redacted;
+            }
+        }
+        return { value: result, redacted: changed };
+    }
+    return { value, redacted: false };
+}
+//# sourceMappingURL=evidence-store.js.map

package/dist/evidence-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-store.js","sourceRoot":"","sources":["../src/evidence-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAkB,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAyBhD,MAAM,UAAU,GACd,uIAAuI,CAAC;AAC1I,MAAM,SAAS,GAAG;IAChB,mDAAmD;IACnD,0GAA0G;IAC1G,0CAA0C;IAC1C,iDAAiD;IACjD,4DAA4D;IAC5D,qCAAqC;IACrC,0FAA0F;IAC1F,mFAAmF;CACpF,CAAC;AAEF,MAAM,OAAO,cAAc;IACJ,MAAM;IAA3B,YAAqB,MAA4B;sBAA5B,MAAM;IAAyB,CAAC;IAErD,IAAI,CAAC,IAAY,EAAE,WAAmB;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAOL,MAAM;IANR,OAAO,CAAc;IACrB,SAAS,CAAS;IAClB,aAAa,CAAS;IAEvC,YACE,WAAmB,EACF,MAAsB;sBAAtB,MAAM;QAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,aAAa,GACjB,KAAK,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjG,IAAI,KAAa,CAAC;QAClB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,KAAK,YAAY,UAAU,EAAE,CAAC;YACtC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,WAAW,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc,CAAC;oBAC/D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;oBACrC,KAAK,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;oBAChD,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,KAAK,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAChD,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG;YACd,GAAG,gBAAgB;YACnB,GAAG,SAAS,CAAC,MAAM,CACjB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAClG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,CAAC;SAC1D,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,WAAW;gBAClD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,gBAAgB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,UAAU;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc;gBACd,QAAQ,EAAE,WAAW;gBACrB,OAAO;aACR,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,UAAU;YACvB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;YACxD,IAAI;YACJ,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAgB;QACxC,MAAM,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAc,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,MAAM,CAAC,KAAgB;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAA8B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;gBAC3B,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC3B,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}

package/dist/files.d.ts

@@ -0,0 +1,6 @@
+export interface AtomicWriteOptions {
+    refuseOverwrite?: boolean;
+}
+export declare function atomicWriteBytes(path: string, bytes: Uint8Array, options?: AtomicWriteOptions): Promise<void>;
+export declare function atomicWriteJson(path: string, value: unknown, options?: AtomicWriteOptions): Promise<void>;
+//# sourceMappingURL=files.d.ts.map

package/dist/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../src/files.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnH"}

package/dist/files.js

@@ -0,0 +1,33 @@
+import { constants } from "node:fs";
+import { link, mkdir, open, rename, rm } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { canonicalJsonBytes } from "./canonical.js";
+export async function atomicWriteBytes(path, bytes, options = {}) {
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true });
+    const temporary = join(directory, `.${basename(path)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+    const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+    try {
+        await handle.writeFile(bytes);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        if (options.refuseOverwrite) {
+            await link(temporary, path);
+            await rm(temporary);
+            return;
+        }
+        await rename(temporary, path);
+    }
+    catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+    }
+}
+export async function atomicWriteJson(path, value, options = {}) {
+    await atomicWriteBytes(path, canonicalJsonBytes(value), options);
+}
+//# sourceMappingURL=files.js.map

package/dist/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../src/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAMpD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,KAAiB,EACjB,OAAO,GAAuB,EAAE;IAEhC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvG,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc,EAAE,OAAO,GAAuB,EAAE;IAClG,MAAM,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC"}

package/dist/gates.d.ts

@@ -0,0 +1,6 @@
+import type { GateRecordV1, RunId } from "@apexops/contracts";
+export declare function openGate(gate: GateRecordV1, dependencyHash: string): GateRecordV1;
+export declare function decideGate(gate: GateRecordV1, decision: "approved" | "rejected", decidedAt: string, reason?: string): GateRecordV1;
+export declare function invalidateGate(gate: GateRecordV1, dependencyHash: string, reason: string): GateRecordV1;
+export declare function inheritGate(gate: GateRecordV1, fromRunId: RunId, dependencyHash: string, decidedAt: string): GateRecordV1;
+//# sourceMappingURL=gates.d.ts.map

package/dist/gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../src/gates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,GAAG,YAAY,CAKjF;AAED,wBAAgB,UAAU,CACxB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,UAAU,GAAG,UAAU,EACjC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,YAAY,CAKd;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAEvG;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,KAAK,EAChB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,GAChB,YAAY,CAQd"}

package/dist/gates.js

@@ -0,0 +1,25 @@
+export function openGate(gate, dependencyHash) {
+    if (gate.state !== "closed" && gate.state !== "invalidated") {
+        throw new Error(`Gate ${gate.gate} cannot open from ${gate.state}`);
+    }
+    return { gate: gate.gate, state: "open", dependencyHash };
+}
+export function decideGate(gate, decision, decidedAt, reason) {
+    if (gate.state !== "open") {
+        throw new Error(`Gate ${gate.gate} is not open`);
+    }
+    return { ...gate, state: decision, decidedAt, ...(reason === undefined ? {} : { reason }) };
+}
+export function invalidateGate(gate, dependencyHash, reason) {
+    return { gate: gate.gate, state: "invalidated", dependencyHash, reason };
+}
+export function inheritGate(gate, fromRunId, dependencyHash, decidedAt) {
+    if (gate.gate === 4) {
+        throw new Error("Gate 4 cannot be inherited");
+    }
+    if (gate.dependencyHash !== dependencyHash || (gate.state !== "approved" && gate.state !== "inherited")) {
+        throw new Error(`Gate ${gate.gate} dependencies are not approved for inheritance`);
+    }
+    return { gate: gate.gate, state: "inherited", dependencyHash, inheritedFromRunId: fromRunId, decidedAt };
+}
+//# sourceMappingURL=gates.js.map

package/dist/gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.js","sourceRoot":"","sources":["../src/gates.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,QAAQ,CAAC,IAAkB,EAAE,cAAsB;IACjE,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAkB,EAClB,QAAiC,EACjC,SAAiB,EACjB,MAAe;IAEf,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAkB,EAAE,cAAsB,EAAE,MAAc;IACvF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAkB,EAClB,SAAgB,EAChB,cAAsB,EACtB,SAAiB;IAEjB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,gDAAgD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC3G,CAAC"}