@exaudeus/workrail 0.12.0 → 0.13.0

package/dist/v2/durable-core/schemas/session/preferences.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RiskPolicyV2Schema = exports.AutonomyV2Schema = void 0;
+const zod_1 = require("zod");
+exports.AutonomyV2Schema = zod_1.z.enum(['guided', 'full_auto_stop_on_user_deps', 'full_auto_never_stop']);
+exports.RiskPolicyV2Schema = zod_1.z.enum(['conservative', 'balanced', 'aggressive']);

package/dist/v2/durable-core/schemas/session/session-health.d.ts

@@ -10,6 +10,9 @@ export type CorruptionReasonV2 = {
 } | {
     readonly code: 'unknown_schema_version';
     readonly message: string;
+} | {
+    readonly code: 'schema_validation_failed';
+    readonly message: string;
 };
 export type SessionHealthV2 = {
     readonly kind: 'healthy';

package/dist/v2/durable-core/tokens/index.d.ts

@@ -1,4 +1,3 @@
-export { encodeBase64Url, decodeBase64Url } from './base64url.js';
 export { TokenPayloadV1Schema, StateTokenPayloadV1Schema, AckTokenPayloadV1Schema, CheckpointTokenPayloadV1Schema, expectedPrefixForTokenKind, } from './payloads.js';
 export type { TokenPayloadV1, StateTokenPayloadV1, AckTokenPayloadV1, CheckpointTokenPayloadV1 } from './payloads.js';
 export { encodeTokenPayloadV1, encodeUnsignedTokenV1, parseTokenV1 } from './token-codec.js';

package/dist/v2/durable-core/tokens/index.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.asOutputId = exports.asAttemptId = exports.assertTokenScopeMatchesState = exports.verifyTokenSignatureV1 = exports.signTokenV1 = exports.parseTokenV1 = exports.encodeUnsignedTokenV1 = exports.encodeTokenPayloadV1 = exports.expectedPrefixForTokenKind = exports.CheckpointTokenPayloadV1Schema = exports.AckTokenPayloadV1Schema = exports.StateTokenPayloadV1Schema = exports.TokenPayloadV1Schema = exports.decodeBase64Url = exports.encodeBase64Url = void 0;
-var base64url_js_1 = require("./base64url.js");
-Object.defineProperty(exports, "encodeBase64Url", { enumerable: true, get: function () { return base64url_js_1.encodeBase64Url; } });
-Object.defineProperty(exports, "decodeBase64Url", { enumerable: true, get: function () { return base64url_js_1.decodeBase64Url; } });
+exports.asOutputId = exports.asAttemptId = exports.assertTokenScopeMatchesState = exports.verifyTokenSignatureV1 = exports.signTokenV1 = exports.parseTokenV1 = exports.encodeUnsignedTokenV1 = exports.encodeTokenPayloadV1 = exports.expectedPrefixForTokenKind = exports.CheckpointTokenPayloadV1Schema = exports.AckTokenPayloadV1Schema = exports.StateTokenPayloadV1Schema = exports.TokenPayloadV1Schema = void 0;
 var payloads_js_1 = require("./payloads.js");
 Object.defineProperty(exports, "TokenPayloadV1Schema", { enumerable: true, get: function () { return payloads_js_1.TokenPayloadV1Schema; } });
 Object.defineProperty(exports, "StateTokenPayloadV1Schema", { enumerable: true, get: function () { return payloads_js_1.StateTokenPayloadV1Schema; } });

package/dist/v2/durable-core/tokens/token-codec.d.ts

@@ -1,6 +1,7 @@
 import type { Result } from 'neverthrow';
 import type { CanonicalBytes } from '../ids/index.js';
 import type { TokenStringV1 } from '../ids/index.js';
+import type { Base64UrlPortV2 } from '../../ports/base64url.port.js';
 import { type TokenPayloadV1, type TokenPrefixV1 } from './payloads.js';
 export type TokenDecodeErrorV2 = {
     readonly code: 'TOKEN_INVALID_FORMAT';
@@ -24,8 +25,8 @@ export interface ParsedTokenV1 {
     readonly payload: TokenPayloadV1;
 }
 export declare function encodeTokenPayloadV1(payload: TokenPayloadV1): Result<CanonicalBytes, TokenDecodeErrorV2>;
-export declare function encodeUnsignedTokenV1(payload: TokenPayloadV1): Result<{
+export declare function encodeUnsignedTokenV1(payload: TokenPayloadV1, base64url: Base64UrlPortV2): Result<{
     readonly token: TokenStringV1;
     readonly payloadBytes: CanonicalBytes;
 }, TokenDecodeErrorV2>;
-export declare function parseTokenV1(token: string): Result<ParsedTokenV1, TokenDecodeErrorV2>;
+export declare function parseTokenV1(token: string, base64url: Base64UrlPortV2): Result<ParsedTokenV1, TokenDecodeErrorV2>;

package/dist/v2/durable-core/tokens/token-codec.js

@@ -6,7 +6,6 @@ exports.parseTokenV1 = parseTokenV1;
 const neverthrow_1 = require("neverthrow");
 const jcs_js_1 = require("../canonical/jcs.js");
 const index_js_1 = require("../ids/index.js");
-const base64url_js_1 = require("./base64url.js");
 const payloads_js_1 = require("./payloads.js");
 function encodeTokenPayloadV1(payload) {
     return (0, jcs_js_1.toCanonicalBytes)(payload).mapErr((e) => ({
@@ -14,15 +13,15 @@ function encodeTokenPayloadV1(payload) {
         message: e.message,
     }));
 }
-function encodeUnsignedTokenV1(payload) {
+function encodeUnsignedTokenV1(payload, base64url) {
     const bytes = encodeTokenPayloadV1(payload);
     if (bytes.isErr())
         return (0, neverthrow_1.err)(bytes.error);
     const prefix = (0, payloads_js_1.expectedPrefixForTokenKind)(payload.tokenKind);
-    const token = `${prefix}.v1.${(0, base64url_js_1.encodeBase64Url)(bytes.value)}.`;
+    const token = `${prefix}.v1.${base64url.encodeBase64Url(bytes.value)}.`;
     return (0, neverthrow_1.ok)({ token: (0, index_js_1.asTokenStringV1)(token), payloadBytes: bytes.value });
 }
-function parseTokenV1(token) {
+function parseTokenV1(token, base64url) {
     const parts = token.split('.');
     if (parts.length !== 4)
         return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: 'Expected 4 dot-separated segments' });
@@ -35,13 +34,20 @@ function parseTokenV1(token) {
     if (payloadB64.trim() === '' || sigB64.trim() === '') {
         return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: 'Missing payload or signature segment' });
     }
-    const decoded = (0, base64url_js_1.decodeBase64Url)(payloadB64);
+    const decoded = base64url.decodeBase64Url(payloadB64);
     if (decoded.isErr())
         return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: decoded.error.message });
     const payloadBytes = (0, index_js_1.asCanonicalBytes)(decoded.value);
+    let payloadText;
+    try {
+        payloadText = new TextDecoder('utf-8', { fatal: true }).decode(payloadBytes);
+    }
+    catch {
+        return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: 'Payload is not valid UTF-8' });
+    }
     let payloadJson;
     try {
-        payloadJson = JSON.parse(new TextDecoder().decode(payloadBytes));
+        payloadJson = JSON.parse(payloadText);
     }
     catch {
         return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: 'Payload is not valid JSON' });

package/dist/v2/durable-core/tokens/token-signer.d.ts

@@ -1,6 +1,7 @@
 import type { Result } from 'neverthrow';
 import type { HmacSha256PortV2 } from '../../ports/hmac-sha256.port.js';
 import type { KeyringV1 } from '../../ports/keyring.port.js';
+import type { Base64UrlPortV2 } from '../../ports/base64url.port.js';
 import type { CanonicalBytes, TokenStringV1 } from '../ids/index.js';
 import type { ParsedTokenV1, TokenDecodeErrorV2 } from './token-codec.js';
 export type TokenVerifyErrorV2 = {
@@ -10,6 +11,6 @@ export type TokenVerifyErrorV2 = {
     readonly code: 'TOKEN_INVALID_FORMAT';
     readonly message: string;
 };
-export declare function signTokenV1(unsignedTokenPrefix: 'st.v1.' | 'ack.v1.' | 'chk.v1.', payloadBytes: CanonicalBytes, keyring: KeyringV1, hmac: HmacSha256PortV2): Result<TokenStringV1, TokenVerifyErrorV2>;
-export declare function verifyTokenSignatureV1(parsed: ParsedTokenV1, keyring: KeyringV1, hmac: HmacSha256PortV2): Result<void, TokenVerifyErrorV2>;
+export declare function signTokenV1(unsignedTokenPrefix: 'st.v1.' | 'ack.v1.' | 'chk.v1.', payloadBytes: CanonicalBytes, keyring: KeyringV1, hmac: HmacSha256PortV2, base64url: Base64UrlPortV2): Result<TokenStringV1, TokenVerifyErrorV2>;
+export declare function verifyTokenSignatureV1(parsed: ParsedTokenV1, keyring: KeyringV1, hmac: HmacSha256PortV2, base64url: Base64UrlPortV2): Result<void, TokenVerifyErrorV2>;
 export declare function assertTokenScopeMatchesState(state: ParsedTokenV1, other: ParsedTokenV1): Result<void, TokenDecodeErrorV2>;

package/dist/v2/durable-core/tokens/token-signer.js

@@ -4,26 +4,25 @@ exports.signTokenV1 = signTokenV1;
 exports.verifyTokenSignatureV1 = verifyTokenSignatureV1;
 exports.assertTokenScopeMatchesState = assertTokenScopeMatchesState;
 const neverthrow_1 = require("neverthrow");
-const base64url_js_1 = require("./base64url.js");
 const index_js_1 = require("../ids/index.js");
-function decodeKeyBytes(keyBase64Url) {
-    const decoded = (0, base64url_js_1.decodeBase64Url)(keyBase64Url);
+function decodeKeyBytes(keyBase64Url, base64url) {
+    const decoded = base64url.decodeBase64Url(keyBase64Url);
     if (decoded.isErr())
         return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: 'Invalid key encoding' });
     if (decoded.value.length !== 32)
         return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: 'Invalid key length' });
     return (0, neverthrow_1.ok)(decoded.value);
 }
-function signTokenV1(unsignedTokenPrefix, payloadBytes, keyring, hmac) {
-    const key = decodeKeyBytes(keyring.current.keyBase64Url);
+function signTokenV1(unsignedTokenPrefix, payloadBytes, keyring, hmac, base64url) {
+    const key = decodeKeyBytes(keyring.current.keyBase64Url, base64url);
     if (key.isErr())
         return (0, neverthrow_1.err)(key.error);
     const sig = hmac.hmacSha256(key.value, payloadBytes);
-    const token = `${unsignedTokenPrefix}${(0, base64url_js_1.encodeBase64Url)(payloadBytes)}.${(0, base64url_js_1.encodeBase64Url)(sig)}`;
+    const token = `${unsignedTokenPrefix}${base64url.encodeBase64Url(payloadBytes)}.${base64url.encodeBase64Url(sig)}`;
     return (0, neverthrow_1.ok)((0, index_js_1.asTokenStringV1)(token));
 }
-function verifyTokenSignatureV1(parsed, keyring, hmac) {
-    const sigBytes = (0, base64url_js_1.decodeBase64Url)(parsed.sigBase64Url);
+function verifyTokenSignatureV1(parsed, keyring, hmac, base64url) {
+    const sigBytes = base64url.decodeBase64Url(parsed.sigBase64Url);
     if (sigBytes.isErr())
         return (0, neverthrow_1.err)({ code: 'TOKEN_INVALID_FORMAT', message: 'Invalid signature encoding' });
     if (sigBytes.value.length !== 32)
@@ -32,7 +31,7 @@ function verifyTokenSignatureV1(parsed, keyring, hmac) {
     if (keyring.previous)
         keys.push(keyring.previous.keyBase64Url);
     for (const k of keys) {
-        const key = decodeKeyBytes(k);
+        const key = decodeKeyBytes(k, base64url);
         if (key.isErr())
             continue;
         const expected = hmac.hmacSha256(key.value, parsed.payloadBytes);

package/dist/v2/infra/local/base64url/index.d.ts

@@ -0,0 +1,5 @@
+import type { Base64UrlPortV2 } from '../../../ports/base64url.port.js';
+export declare class NodeBase64UrlV2 implements Base64UrlPortV2 {
+    encodeBase64Url(bytes: Uint8Array): string;
+    decodeBase64Url(input: string): ReturnType<Base64UrlPortV2['decodeBase64Url']>;
+}

package/dist/v2/infra/local/base64url/index.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeBase64UrlV2 = void 0;
+const neverthrow_1 = require("neverthrow");
+const node_buffer_1 = require("node:buffer");
+class NodeBase64UrlV2 {
+    encodeBase64Url(bytes) {
+        return node_buffer_1.Buffer.from(bytes).toString('base64url');
+    }
+    decodeBase64Url(input) {
+        if (input.trim() === '') {
+            return (0, neverthrow_1.err)({
+                code: 'INVALID_BASE64URL_CHARACTERS',
+                message: 'Invalid base64url: empty input',
+            });
+        }
+        if (input.includes('=')) {
+            return (0, neverthrow_1.err)({
+                code: 'INVALID_BASE64URL_PADDING',
+                message: 'Invalid base64url: padding is not allowed',
+            });
+        }
+        const base64UrlRe = /^[A-Za-z0-9_-]+$/;
+        if (!base64UrlRe.test(input)) {
+            return (0, neverthrow_1.err)({
+                code: 'INVALID_BASE64URL_CHARACTERS',
+                message: 'Invalid base64url: invalid characters',
+            });
+        }
+        try {
+            const decoded = node_buffer_1.Buffer.from(input, 'base64url');
+            if (decoded.toString('base64url') !== input) {
+                return (0, neverthrow_1.err)({
+                    code: 'INVALID_BASE64URL_CHARACTERS',
+                    message: 'Invalid base64url: non-canonical encoding',
+                });
+            }
+            return (0, neverthrow_1.ok)(new Uint8Array(decoded));
+        }
+        catch (e) {
+            return (0, neverthrow_1.err)({
+                code: 'INVALID_BASE64URL_CHARACTERS',
+                message: `Invalid base64url: ${e instanceof Error ? e.message : String(e)}`,
+            });
+        }
+    }
+}
+exports.NodeBase64UrlV2 = NodeBase64UrlV2;

package/dist/v2/infra/local/fs/index.js

@@ -38,9 +38,14 @@ const fs = __importStar(require("fs/promises"));
 const fsCb = __importStar(require("fs"));
 const fs_1 = require("fs");
 const neverthrow_1 = require("neverthrow");
+function nodeErrorCode(e) {
+    if (typeof e !== 'object' || e === null)
+        return undefined;
+    const code = e.code;
+    return typeof code === 'string' ? code : undefined;
+}
 function mapFsError(e, filePath) {
-    const any = e;
-    const code = any?.code;
+    const code = nodeErrorCode(e);
     if (code === 'ENOENT')
         return { code: 'FS_NOT_FOUND', message: `Not found: ${filePath}` };
     if (code === 'EEXIST')
@@ -130,8 +135,7 @@ class NodeFileSystemV2 {
                 await dirHandle.close();
             }
         })(), (e) => {
-            const any = e;
-            const code = any?.code;
+            const code = nodeErrorCode(e);
             if (code === 'EINVAL' || code === 'ENOTSUP') {
                 return { code: 'FS_UNSUPPORTED', message: `Directory fsync unsupported for: ${dirPath}` };
             }

package/dist/v2/infra/local/keyring/index.d.ts

@@ -2,10 +2,14 @@ import type { ResultAsync } from 'neverthrow';
 import type { DataDirPortV2 } from '../../../ports/data-dir.port.js';
 import type { FileSystemPortV2 } from '../../../ports/fs.port.js';
 import type { KeyringError, KeyringPortV2, KeyringV1 } from '../../../ports/keyring.port.js';
+import type { Base64UrlPortV2 } from '../../../ports/base64url.port.js';
+import type { RandomEntropyPortV2 } from '../../../ports/random-entropy.port.js';
 export declare class LocalKeyringV2 implements KeyringPortV2 {
     private readonly dataDir;
     private readonly fs;
-    constructor(dataDir: DataDirPortV2, fs: FileSystemPortV2);
+    private readonly base64url;
+    private readonly entropy;
+    constructor(dataDir: DataDirPortV2, fs: FileSystemPortV2, base64url: Base64UrlPortV2, entropy: RandomEntropyPortV2);
     loadOrCreate(): ResultAsync<KeyringV1, KeyringError>;
     rotate(): ResultAsync<KeyringV1, KeyringError>;
     private createAndPersistFresh;

package/dist/v2/infra/local/keyring/index.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalKeyringV2 = void 0;
-const crypto_1 = require("crypto");
 const zod_1 = require("zod");
 const neverthrow_1 = require("neverthrow");
 const jcs_js_1 = require("../../../durable-core/canonical/jcs.js");
@@ -14,32 +13,32 @@ const KeyringFileV1Schema = zod_1.z.object({
     current: KeyRecordSchema,
     previous: KeyRecordSchema.nullable(),
 });
-function encodeBase64Url(bytes) {
-    return Buffer.from(bytes).toString('base64url');
-}
-function decodeBase64Url(s) {
-    try {
-        return new Uint8Array(Buffer.from(s, 'base64url'));
+function validateKeyMaterialWithPort(base64url, keyBase64Url) {
+    const decoded = base64url.decodeBase64Url(keyBase64Url);
+    if (decoded.isErr()) {
+        return (0, neverthrow_1.err)({
+            code: 'KEYRING_CORRUPTION_DETECTED',
+            message: `Invalid base64url in key material: ${decoded.error.code}`,
+        });
     }
-    catch {
-        return null;
+    if (decoded.value.length !== 32) {
+        return (0, neverthrow_1.err)({
+            code: 'KEYRING_CORRUPTION_DETECTED',
+            message: `Key material must be exactly 32 bytes, got ${decoded.value.length}`,
+        });
     }
+    return (0, neverthrow_1.ok)(undefined);
 }
-function validateKeyMaterialOrThrow(keyBase64Url) {
-    const decoded = decodeBase64Url(keyBase64Url);
-    if (!decoded)
-        throw new Error('invalid_base64url');
-    if (decoded.length !== 32)
-        throw new Error('invalid_key_length');
-}
-function createFreshKeyRecord() {
-    const bytes = (0, crypto_1.randomBytes)(32);
-    return { alg: 'hmac_sha256', keyBase64Url: encodeBase64Url(bytes) };
+function createFreshKeyRecord(base64url, entropy) {
+    const bytes = entropy.generateBytes(32);
+    return { alg: 'hmac_sha256', keyBase64Url: base64url.encodeBase64Url(bytes) };
 }
 class LocalKeyringV2 {
-    constructor(dataDir, fs) {
+    constructor(dataDir, fs, base64url, entropy) {
         this.dataDir = dataDir;
         this.fs = fs;
+        this.base64url = base64url;
+        this.entropy = entropy;
     }
     loadOrCreate() {
         const path = this.dataDir.keyringPath();
@@ -56,27 +55,37 @@ class LocalKeyringV2 {
         return this.loadOrCreate().andThen((kr) => {
             const next = {
                 v: 1,
-                current: createFreshKeyRecord(),
+                current: createFreshKeyRecord(this.base64url, this.entropy),
                 previous: kr.current,
             };
             return this.persist(next).map(() => next);
         });
     }
     createAndPersistFresh() {
-        const fresh = { v: 1, current: createFreshKeyRecord(), previous: null };
+        const fresh = { v: 1, current: createFreshKeyRecord(this.base64url, this.entropy), previous: null };
         return this.persist(fresh).map(() => fresh);
     }
     parseAndValidate(raw, filePath) {
-        return neverthrow_1.ResultAsync.fromPromise((async () => {
-            const parsed = JSON.parse(raw);
-            const validated = KeyringFileV1Schema.safeParse(parsed);
-            if (!validated.success)
-                throw new Error('invalid_shape');
-            validateKeyMaterialOrThrow(validated.data.current.keyBase64Url);
-            if (validated.data.previous)
-                validateKeyMaterialOrThrow(validated.data.previous.keyBase64Url);
-            return validated.data;
-        })(), () => ({ code: 'KEYRING_CORRUPTION_DETECTED', message: `Invalid keyring file: ${filePath}` }));
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return (0, neverthrow_1.errAsync)({ code: 'KEYRING_CORRUPTION_DETECTED', message: `Invalid keyring file: ${filePath}` });
+        }
+        const validated = KeyringFileV1Schema.safeParse(parsed);
+        if (!validated.success) {
+            return (0, neverthrow_1.errAsync)({ code: 'KEYRING_CORRUPTION_DETECTED', message: `Invalid keyring file: ${filePath}` });
+        }
+        const currentValidation = validateKeyMaterialWithPort(this.base64url, validated.data.current.keyBase64Url);
+        if (currentValidation.isErr())
+            return (0, neverthrow_1.errAsync)(currentValidation.error);
+        if (validated.data.previous) {
+            const prevValidation = validateKeyMaterialWithPort(this.base64url, validated.data.previous.keyBase64Url);
+            if (prevValidation.isErr())
+                return (0, neverthrow_1.errAsync)(prevValidation.error);
+        }
+        return (0, neverthrow_1.okAsync)(validated.data);
     }
     persist(keyring) {
         const dir = this.dataDir.keysDir();

package/dist/v2/infra/local/pinned-workflow-store/index.d.ts

@@ -2,10 +2,12 @@ import type { ResultAsync } from 'neverthrow';
 import type { PinnedWorkflowStorePortV2, PinnedWorkflowStoreError } from '../../../ports/pinned-workflow-store.port.js';
 import type { WorkflowHash } from '../../../durable-core/ids/index.js';
 import type { DataDirPortV2 } from '../../../ports/data-dir.port.js';
+import type { FileSystemPortV2 } from '../../../ports/fs.port.js';
 import { type CompiledWorkflowSnapshot } from '../../../durable-core/schemas/compiled-workflow/index.js';
 export declare class LocalPinnedWorkflowStoreV2 implements PinnedWorkflowStorePortV2 {
     private readonly dataDir;
-    constructor(dataDir: DataDirPortV2);
+    private readonly fs;
+    constructor(dataDir: DataDirPortV2, fs: FileSystemPortV2);
     get(workflowHash: WorkflowHash): ResultAsync<CompiledWorkflowSnapshot | null, PinnedWorkflowStoreError>;
     put(workflowHash: WorkflowHash, compiled: CompiledWorkflowSnapshot): ResultAsync<void, PinnedWorkflowStoreError>;
 }

package/dist/v2/infra/local/pinned-workflow-store/index.js

@@ -1,84 +1,72 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalPinnedWorkflowStoreV2 = void 0;
-const fs = __importStar(require("fs/promises"));
 const neverthrow_1 = require("neverthrow");
 const index_js_1 = require("../../../durable-core/schemas/compiled-workflow/index.js");
 const jcs_js_1 = require("../../../durable-core/canonical/jcs.js");
+function mapFsToStoreError(e) {
+    return { code: 'PINNED_WORKFLOW_IO_ERROR', message: e.message };
+}
 class LocalPinnedWorkflowStoreV2 {
-    constructor(dataDir) {
+    constructor(dataDir, fs) {
         this.dataDir = dataDir;
+        this.fs = fs;
     }
     get(workflowHash) {
         const filePath = this.dataDir.pinnedWorkflowPath(workflowHash);
-        return neverthrow_1.ResultAsync.fromPromise((async () => {
+        return this.fs.readFileUtf8(filePath)
+            .orElse((e) => {
+            if (e.code === 'FS_NOT_FOUND')
+                return (0, neverthrow_1.okAsync)(null);
+            return (0, neverthrow_1.errAsync)(mapFsToStoreError(e));
+        })
+            .andThen((raw) => {
+            if (raw === null)
+                return (0, neverthrow_1.okAsync)(null);
+            let parsed;
             try {
-                const raw = await fs.readFile(filePath, 'utf8');
-                const parsed = JSON.parse(raw);
-                const validated = index_js_1.CompiledWorkflowSnapshotSchema.safeParse(parsed);
-                if (!validated.success) {
-                    throw new Error(`Pinned workflow snapshot is invalid: ${filePath}`);
-                }
-                return validated.data;
+                parsed = JSON.parse(raw);
             }
-            catch (e) {
-                if (e?.code === 'ENOENT')
-                    return null;
-                throw e;
+            catch {
+                return (0, neverthrow_1.errAsync)({
+                    code: 'PINNED_WORKFLOW_IO_ERROR',
+                    message: `Invalid JSON in pinned workflow snapshot: ${filePath}`,
+                });
             }
-        })(), (e) => ({
-            code: 'PINNED_WORKFLOW_IO_ERROR',
-            message: `Failed to read pinned workflow snapshot: ${filePath} (${e instanceof Error ? e.message : String(e)})`,
-        }));
+            const validated = index_js_1.CompiledWorkflowSnapshotSchema.safeParse(parsed);
+            if (!validated.success) {
+                return (0, neverthrow_1.errAsync)({
+                    code: 'PINNED_WORKFLOW_IO_ERROR',
+                    message: `Pinned workflow snapshot is invalid: ${filePath}`,
+                });
+            }
+            return (0, neverthrow_1.okAsync)(validated.data);
+        });
     }
     put(workflowHash, compiled) {
         const dir = this.dataDir.pinnedWorkflowsDir();
         const filePath = this.dataDir.pinnedWorkflowPath(workflowHash);
-        return neverthrow_1.ResultAsync.fromPromise((async () => {
-            await fs.mkdir(dir, { recursive: true });
-            const canonical = (0, jcs_js_1.toCanonicalBytes)(compiled);
-            if (canonical.isErr()) {
-                throw new Error(`Failed to canonicalize compiled snapshot for storage: ${canonical.error.message}`);
-            }
-            const tmp = `${filePath}.tmp`;
-            await fs.writeFile(tmp, Buffer.from(canonical.value));
-            await fs.rename(tmp, filePath);
-        })(), (e) => ({
+        const tmpPath = `${filePath}.tmp`;
+        const canonical = (0, jcs_js_1.toCanonicalBytes)(compiled).mapErr((e) => ({
             code: 'PINNED_WORKFLOW_IO_ERROR',
-            message: `Failed to write pinned workflow snapshot: ${filePath} (${e instanceof Error ? e.message : String(e)})`,
+            message: `Failed to canonicalize compiled snapshot for storage: ${e.message}`,
+        }));
+        if (canonical.isErr())
+            return (0, neverthrow_1.errAsync)(canonical.error);
+        const bytes = canonical.value;
+        return this.fs.mkdirp(dir)
+            .mapErr(mapFsToStoreError)
+            .andThen(() => this.fs.openWriteTruncate(tmpPath).mapErr(mapFsToStoreError))
+            .andThen(({ fd }) => this.fs.writeAll(fd, bytes)
+            .mapErr(mapFsToStoreError)
+            .andThen(() => this.fs.fsyncFile(fd).mapErr(mapFsToStoreError))
+            .andThen(() => this.fs.closeFile(fd).mapErr(mapFsToStoreError))
+            .orElse((e) => this.fs.closeFile(fd)
+            .mapErr(() => e)
+            .andThen(() => (0, neverthrow_1.errAsync)(e))))
+            .andThen(() => this.fs.rename(tmpPath, filePath).mapErr(mapFsToStoreError))
+            .andThen(() => this.fs.fsyncDir(dir).mapErr((e) => {
+            return mapFsToStoreError(e);
         }));
     }
 }

package/dist/v2/infra/local/random-entropy/index.d.ts

@@ -0,0 +1,4 @@
+import type { RandomEntropyPortV2 } from '../../../ports/random-entropy.port.js';
+export declare class NodeRandomEntropyV2 implements RandomEntropyPortV2 {
+    generateBytes(count: number): Uint8Array;
+}

package/dist/v2/infra/local/random-entropy/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeRandomEntropyV2 = void 0;
+const node_crypto_1 = require("node:crypto");
+class NodeRandomEntropyV2 {
+    generateBytes(count) {
+        return new Uint8Array((0, node_crypto_1.randomBytes)(count));
+    }
+}
+exports.NodeRandomEntropyV2 = NodeRandomEntropyV2;

package/dist/v2/infra/local/session-lock/index.d.ts

@@ -1,12 +1,14 @@
 import type { ResultAsync } from 'neverthrow';
 import type { DataDirPortV2 } from '../../../ports/data-dir.port.js';
 import type { FileSystemPortV2 } from '../../../ports/fs.port.js';
+import type { TimeClockPortV2 } from '../../../ports/time-clock.port.js';
 import type { SessionId } from '../../../durable-core/ids/index.js';
 import type { SessionLockHandleV2, SessionLockError, SessionLockPortV2 } from '../../../ports/session-lock.port.js';
 export declare class LocalSessionLockV2 implements SessionLockPortV2 {
     private readonly dataDir;
     private readonly fs;
-    constructor(dataDir: DataDirPortV2, fs: FileSystemPortV2);
+    private readonly clock;
+    constructor(dataDir: DataDirPortV2, fs: FileSystemPortV2, clock: TimeClockPortV2);
     acquire(sessionId: SessionId): ResultAsync<SessionLockHandleV2, SessionLockError>;
     release(handle: SessionLockHandleV2): ResultAsync<void, SessionLockError>;
 }

package/dist/v2/infra/local/session-lock/index.js

@@ -2,9 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalSessionLockV2 = void 0;
 class LocalSessionLockV2 {
-    constructor(dataDir, fs) {
+    constructor(dataDir, fs, clock) {
         this.dataDir = dataDir;
         this.fs = fs;
+        this.clock = clock;
     }
     acquire(sessionId) {
         const sessionDir = this.dataDir.sessionDir(sessionId);
@@ -25,8 +26,8 @@ class LocalSessionLockV2 {
             .andThen(() => this.fs.openExclusive(lockPath, new TextEncoder().encode(JSON.stringify({
             v: 1,
             sessionId,
-            pid: process.pid,
-            startedAtMs: Date.now(),
+            pid: this.clock.getPid(),
+            startedAtMs: this.clock.nowMs(),
         }))))
             .andThen(({ fd }) => this.fs.fsyncFile(fd).andThen(() => this.fs.closeFile(fd)))
             .mapErr(mapFs)

package/dist/v2/infra/local/session-store/index.js

@@ -233,7 +233,15 @@ class LocalSessionEventLogStoreV2 {
                 const validated = index_js_1.ManifestRecordV1Schema.safeParse(parsed);
                 if (!validated.success) {
                     isComplete = false;
-                    tailReason ?? (tailReason = { code: 'unknown_schema_version', message: 'Unknown manifest schema version (corrupt tail)' });
+                    const rawVersion = (typeof parsed === 'object' && parsed !== null && 'v' in parsed)
+                        ? parsed.v
+                        : undefined;
+                    if (rawVersion !== 1) {
+                        tailReason ?? (tailReason = { code: 'unknown_schema_version', message: `Expected v=1, got v=${rawVersion}` });
+                    }
+                    else {
+                        tailReason ?? (tailReason = { code: 'schema_validation_failed', message: 'Manifest record schema validation failed (corrupt tail)' });
+                    }
                     break;
                 }
                 if (validated.data.manifestIndex !== i) {
@@ -366,7 +374,10 @@ class LocalSessionEventLogStoreV2 {
             const bytes = bytesRes.value;
             return this.fs.writeAll(handle.fd, bytes).mapErr(mapFsToStoreError)
                 .andThen(() => this.fs.fsyncFile(handle.fd).mapErr(mapFsToStoreError))
-                .andThen(() => this.fs.closeFile(handle.fd).mapErr(mapFsToStoreError));
+                .andThen(() => this.fs.closeFile(handle.fd).mapErr(mapFsToStoreError))
+                .orElse((err) => this.fs.closeFile(handle.fd)
+                .mapErr(() => err)
+                .andThen(() => (0, neverthrow_1.errAsync)(err)));
         });
     }
 }
@@ -515,11 +526,22 @@ function parseJsonlText(text, schema) {
         }
         const validated = schema.safeParse(parsed);
         if (!validated.success) {
+            const rawVersion = (typeof parsed === 'object' && parsed !== null && 'v' in parsed)
+                ? parsed.v
+                : undefined;
+            if (rawVersion !== 1) {
+                return (0, neverthrow_1.err)({
+                    code: 'SESSION_STORE_CORRUPTION_DETECTED',
+                    location: i === 0 ? 'head' : 'tail',
+                    reason: { code: 'unknown_schema_version', message: `Expected v=1, got v=${rawVersion}` },
+                    message: `Unknown schema version at line ${i}: expected v=1, got v=${rawVersion}`,
+                });
+            }
             return (0, neverthrow_1.err)({
                 code: 'SESSION_STORE_CORRUPTION_DETECTED',
                 location: i === 0 ? 'head' : 'tail',
-                reason: { code: 'unknown_schema_version', message: `Invalid record at line ${i}` },
-                message: `Invalid record at line ${i}`,
+                reason: { code: 'schema_validation_failed', message: `Schema validation failed at line ${i}` },
+                message: `Schema validation failed at line ${i}`,
             });
         }
         out.push(validated.data);