@lore-co/cli 0.1.17 → 0.1.19

package/dist/reliability-store.js

@@ -0,0 +1,1913 @@
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, readdir, rename, rm, rmdir, stat, unlink, } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { homedir, hostname } from "node:os";
+import { basename, dirname, resolve } from "node:path";
+export const RELIABILITY_STORE_VERSION = 1;
+export const DEFAULT_MAX_RECORD_BYTES = 1024 * 1024;
+export const DEFAULT_MAX_SNAPSHOT_BYTES = 2 * 1024 * 1024;
+export const DEFAULT_MAX_OUTBOX_ITEMS = 100;
+export const DEFAULT_MAX_OUTBOX_BYTES = 64 * 1024 * 1024;
+export const DEFAULT_MAX_CONTEXT_CACHE_ITEMS = 256;
+export const DEFAULT_MAX_CONTEXT_CACHE_BYTES = 64 * 1024 * 1024;
+const MAX_CONTEXT_CACHE_SCAN_FILES = DEFAULT_MAX_CONTEXT_CACHE_ITEMS * 16;
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+const OUTBOX_STATES = [
+    "ready",
+    "in-flight",
+    "auth-blocked",
+    "dead",
+];
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/u;
+export class ReliabilityStoreError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ReliabilityStoreError";
+        this.code = code;
+    }
+}
+function isErrno(error, code) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === code);
+}
+function storeError(code, message) {
+    return new ReliabilityStoreError(code, message);
+}
+function positiveInteger(value, fallback, name) {
+    const selected = value ?? fallback;
+    if (!Number.isSafeInteger(selected) || selected <= 0) {
+        throw storeError("INVALID_INPUT", `${name} must be a positive integer`);
+    }
+    return selected;
+}
+function dateIso(date, name) {
+    if (!Number.isFinite(date.getTime())) {
+        throw storeError("INVALID_INPUT", `${name} must be a valid date`);
+    }
+    return date.toISOString();
+}
+function validIso(value) {
+    return (typeof value === "string" &&
+        Number.isFinite(Date.parse(value)) &&
+        new Date(value).toISOString() === value);
+}
+function contextCacheRecord(value) {
+    const record = objectRecord(value);
+    if (record.version !== RELIABILITY_STORE_VERSION ||
+        typeof record.cacheKey !== "string" ||
+        !validIso(record.writtenAt) ||
+        record.value === undefined) {
+        throw storeError("CORRUPT_RECORD", "Context cache record is invalid");
+    }
+    return record;
+}
+function boundedString(value, name, maxCharacters) {
+    const trimmed = value.trim();
+    if (trimmed === "" || Array.from(trimmed).length > maxCharacters) {
+        throw storeError("INVALID_INPUT", `${name} must contain 1-${maxCharacters} characters`);
+    }
+    return trimmed;
+}
+function workspaceSegment(workspaceId) {
+    const value = boundedString(workspaceId, "workspaceId", 200);
+    if (value === "." ||
+        value === ".." ||
+        !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(value)) {
+        throw storeError("INVALID_INPUT", "workspaceId is not path-safe");
+    }
+    return value;
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function truncate(value, maxCharacters = 1_000) {
+    return Array.from(value.trim()).slice(0, maxCharacters).join("");
+}
+function normalizeJson(value, state, depth) {
+    state.nodes += 1;
+    if (state.nodes > 100_000 || depth > 100) {
+        throw storeError("SERIALIZATION_LIMIT", "JSON value is too complex");
+    }
+    if (value === null ||
+        typeof value === "boolean" ||
+        typeof value === "string") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw storeError("INVALID_INPUT", "JSON numbers must be finite");
+        }
+        return value;
+    }
+    if (typeof value !== "object") {
+        throw storeError("INVALID_INPUT", "Value is not JSON-serializable");
+    }
+    if (state.seen.has(value)) {
+        throw storeError("INVALID_INPUT", "Circular JSON values are not supported");
+    }
+    state.seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            return value.map((item) => normalizeJson(item, state, depth + 1));
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw storeError("INVALID_INPUT", "Only plain JSON objects are supported");
+        }
+        const normalized = {};
+        for (const key of Object.keys(value).sort()) {
+            normalized[key] = normalizeJson(value[key], state, depth + 1);
+        }
+        return normalized;
+    }
+    finally {
+        state.seen.delete(value);
+    }
+}
+export function serializeBoundedJson(value, maxBytes = DEFAULT_MAX_RECORD_BYTES) {
+    positiveInteger(maxBytes, DEFAULT_MAX_RECORD_BYTES, "maxBytes");
+    const normalized = normalizeJson(value, { nodes: 0, seen: new Set() }, 0);
+    const serialized = `${JSON.stringify(normalized)}\n`;
+    if (Buffer.byteLength(serialized) > maxBytes) {
+        throw storeError("SERIALIZATION_LIMIT", `Serialized JSON exceeds ${maxBytes} bytes`);
+    }
+    return serialized;
+}
+export function parseBoundedJson(serialized, maxBytes = DEFAULT_MAX_RECORD_BYTES) {
+    if (Buffer.byteLength(serialized) > maxBytes) {
+        throw storeError("SERIALIZATION_LIMIT", `JSON exceeds ${maxBytes} bytes`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(serialized);
+    }
+    catch {
+        throw storeError("CORRUPT_RECORD", "Stored JSON is malformed");
+    }
+    return normalizeJson(parsed, { nodes: 0, seen: new Set() }, 0);
+}
+async function assertDirectory(path) {
+    let metadata;
+    try {
+        metadata = await lstat(path);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT")) {
+            throw storeError("UNSAFE_PATH", `Directory does not exist: ${path}`);
+        }
+        throw error;
+    }
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw storeError("UNSAFE_PATH", `Expected a real directory: ${path}`);
+    }
+}
+async function ensurePrivateDirectory(path) {
+    await assertDirectory(dirname(path));
+    let created = false;
+    try {
+        await mkdir(path, { mode: DIRECTORY_MODE });
+        created = true;
+    }
+    catch (error) {
+        if (!isErrno(error, "EEXIST")) {
+            throw error;
+        }
+    }
+    const metadata = await lstat(path);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw storeError("UNSAFE_PATH", `Refusing unsafe directory: ${path}`);
+    }
+    await chmod(path, DIRECTORY_MODE);
+    if (created) {
+        await fsyncDirectory(dirname(path));
+    }
+}
+async function regularFileMetadata(path, missingOk = false) {
+    try {
+        const metadata = await lstat(path);
+        if (metadata.isSymbolicLink() || !metadata.isFile()) {
+            throw storeError("UNSAFE_PATH", `Refusing non-regular file: ${path}`);
+        }
+        return metadata;
+    }
+    catch (error) {
+        if (missingOk && isErrno(error, "ENOENT")) {
+            return null;
+        }
+        throw error;
+    }
+}
+async function privateFileMetadata(path) {
+    const metadata = await regularFileMetadata(path);
+    if (metadata === null || (metadata.mode & 0o777) !== FILE_MODE) {
+        throw storeError("UNSAFE_PATH", `File permissions must be 0600: ${path}`);
+    }
+    return metadata;
+}
+export async function fsyncDirectory(path) {
+    await assertDirectory(path);
+    const handle = await open(path, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0));
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function atomicWriteFile(path, contents, maxBytes = DEFAULT_MAX_SNAPSHOT_BYTES) {
+    const bytes = typeof contents === "string"
+        ? Buffer.byteLength(contents)
+        : contents.byteLength;
+    if (bytes > maxBytes) {
+        throw storeError("SERIALIZATION_LIMIT", `File contents exceed ${maxBytes} bytes`);
+    }
+    const parent = dirname(path);
+    await assertDirectory(parent);
+    await regularFileMetadata(path, true);
+    const temporaryPath = resolve(parent, `.${sha256(path).slice(0, 16)}.${process.pid}.${randomUUID()}.tmp`);
+    let handle;
+    try {
+        handle = await open(temporaryPath, constants.O_CREAT |
+            constants.O_EXCL |
+            constants.O_WRONLY |
+            (constants.O_NOFOLLOW ?? 0), FILE_MODE);
+        await handle.writeFile(contents);
+        await handle.chmod(FILE_MODE);
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        await regularFileMetadata(path, true);
+        await rename(temporaryPath, path);
+        await chmod(path, FILE_MODE);
+        await fsyncDirectory(parent);
+    }
+    catch (error) {
+        if (handle !== undefined) {
+            await handle.close().catch(() => undefined);
+        }
+        await unlink(temporaryPath).catch(() => undefined);
+        throw error;
+    }
+}
+export async function atomicWriteJson(path, value, maxBytes = DEFAULT_MAX_RECORD_BYTES) {
+    await atomicWriteFile(path, serializeBoundedJson(value, maxBytes), maxBytes);
+}
+export async function readBoundedFile(path, maxBytes = DEFAULT_MAX_SNAPSHOT_BYTES) {
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile()) {
+            throw storeError("UNSAFE_PATH", `Refusing non-regular file: ${path}`);
+        }
+        if (metadata.size > maxBytes) {
+            throw storeError("SERIALIZATION_LIMIT", `File exceeds ${maxBytes} bytes`);
+        }
+        return await handle.readFile("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readBoundedJsonFile(path, maxBytes = DEFAULT_MAX_RECORD_BYTES) {
+    return parseBoundedJson(await readBoundedFile(path, maxBytes), maxBytes);
+}
+export async function durableUnlink(path, missingOk = false) {
+    const metadata = await regularFileMetadata(path, missingOk);
+    if (metadata === null) {
+        return false;
+    }
+    await unlink(path);
+    await fsyncDirectory(dirname(path));
+    return true;
+}
+export async function durableMove(sourcePath, destinationPath) {
+    await regularFileMetadata(sourcePath);
+    await assertDirectory(dirname(destinationPath));
+    if ((await regularFileMetadata(destinationPath, true)) !== null) {
+        throw storeError("IDEMPOTENCY_CONFLICT", `Destination already exists: ${destinationPath}`);
+    }
+    const sourceHandle = await open(sourcePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const metadata = await sourceHandle.stat();
+        if (!metadata.isFile()) {
+            throw storeError("UNSAFE_PATH", `Refusing non-regular file: ${sourcePath}`);
+        }
+        await sourceHandle.sync();
+    }
+    finally {
+        await sourceHandle.close();
+    }
+    await rename(sourcePath, destinationPath);
+    await fsyncDirectory(dirname(destinationPath));
+    if (dirname(sourcePath) !== dirname(destinationPath)) {
+        await fsyncDirectory(dirname(sourcePath));
+    }
+}
+async function sleep(milliseconds) {
+    await new Promise((resolvePromise) => {
+        setTimeout(resolvePromise, milliseconds);
+    });
+}
+async function removeOwnedLock(lockPath, ownerPath, token) {
+    try {
+        const parsed = await readBoundedJsonFile(ownerPath, 4_096);
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed) ||
+            parsed.token !== token) {
+            return;
+        }
+        await durableUnlink(ownerPath, true);
+        await rmdir(lockPath);
+        await fsyncDirectory(dirname(lockPath));
+    }
+    catch (error) {
+        if (!isErrno(error, "ENOENT")) {
+            throw error;
+        }
+    }
+}
+async function stealStaleLock(lockPath, staleMs) {
+    let metadata;
+    try {
+        metadata = await lstat(lockPath);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT")) {
+            return;
+        }
+        throw error;
+    }
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw storeError("UNSAFE_PATH", `Refusing unsafe lock: ${lockPath}`);
+    }
+    let ownerIsDead = false;
+    try {
+        const owner = objectRecord(await readBoundedJsonFile(resolve(lockPath, "owner.json"), 4_096));
+        if (owner.hostname === hostname() &&
+            typeof owner.pid === "number" &&
+            Number.isSafeInteger(owner.pid) &&
+            owner.pid > 0) {
+            try {
+                process.kill(owner.pid, 0);
+                return;
+            }
+            catch (error) {
+                if (!isErrno(error, "ESRCH")) {
+                    return;
+                }
+                ownerIsDead = true;
+            }
+        }
+    }
+    catch {
+        // Old or malformed locks can be reclaimed after the stale threshold.
+    }
+    if (!ownerIsDead && Date.now() - metadata.mtimeMs <= staleMs) {
+        return;
+    }
+    const stalePath = `${lockPath}.stale.${randomUUID()}`;
+    try {
+        await rename(lockPath, stalePath);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT")) {
+            return;
+        }
+        throw error;
+    }
+    await fsyncDirectory(dirname(lockPath));
+    await rm(stalePath, { recursive: true, force: false });
+    await fsyncDirectory(dirname(lockPath));
+}
+export async function withDirectoryLock(lockPath, operation, options = {}) {
+    const timeoutMs = positiveInteger(options.timeoutMs, 5_000, "timeoutMs");
+    const staleMs = positiveInteger(options.staleMs, 60_000, "staleMs");
+    const retryMs = positiveInteger(options.retryMs, 20, "retryMs");
+    await assertDirectory(dirname(lockPath));
+    const startedAt = Date.now();
+    const token = randomUUID();
+    const ownerPath = resolve(lockPath, "owner.json");
+    for (;;) {
+        let created = false;
+        try {
+            await mkdir(lockPath, { mode: DIRECTORY_MODE });
+            created = true;
+            await chmod(lockPath, DIRECTORY_MODE);
+            await fsyncDirectory(dirname(lockPath));
+            await atomicWriteJson(ownerPath, {
+                token,
+                pid: process.pid,
+                hostname: hostname(),
+                acquiredAt: new Date().toISOString(),
+            }, 4_096);
+            break;
+        }
+        catch (error) {
+            if (created) {
+                await rm(lockPath, { recursive: true, force: true });
+                await fsyncDirectory(dirname(lockPath));
+            }
+            if (!isErrno(error, "EEXIST")) {
+                throw error;
+            }
+            await stealStaleLock(lockPath, staleMs);
+            if (Date.now() - startedAt >= timeoutMs) {
+                throw storeError("LOCK_TIMEOUT", `Timed out acquiring ${lockPath}`);
+            }
+            await sleep(Math.min(retryMs, timeoutMs));
+        }
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        await removeOwnedLock(lockPath, ownerPath, token);
+    }
+}
+export function computeRetryBackoffMs(attempt, options = {}) {
+    if (!Number.isSafeInteger(attempt) || attempt < 1) {
+        throw storeError("INVALID_INPUT", "attempt must be a positive integer");
+    }
+    const baseMs = positiveInteger(options.baseMs, 1_000, "baseMs");
+    const maxMs = positiveInteger(options.maxMs, 5 * 60_000, "maxMs");
+    const jitterRatio = options.jitterRatio ?? 0.2;
+    if (!Number.isFinite(jitterRatio) || jitterRatio < 0 || jitterRatio > 1) {
+        throw storeError("INVALID_INPUT", "jitterRatio must be between 0 and 1");
+    }
+    const exponential = Math.min(maxMs, baseMs * 2 ** Math.min(attempt - 1, 30));
+    const random = options.random ?? Math.random;
+    const jitter = exponential * jitterRatio * (random() * 2 - 1);
+    return Math.max(0, Math.min(maxMs, Math.round(exponential + jitter)));
+}
+export function classifyRetryFailure(input) {
+    if (typeof input !== "object" || input === null) {
+        return "retryable";
+    }
+    const failure = input;
+    if (failure.incompatible === true) {
+        return "incompatible";
+    }
+    if (failure.retryable === true) {
+        return "retryable";
+    }
+    if (failure.retryable === false) {
+        return "permanent";
+    }
+    const httpStatus = typeof failure.httpStatus === "number"
+        ? failure.httpStatus
+        : typeof failure.status === "number"
+            ? failure.status
+            : undefined;
+    if (httpStatus === 401 || httpStatus === 403) {
+        return "authentication";
+    }
+    if (httpStatus === 408 ||
+        httpStatus === 409 ||
+        httpStatus === 425 ||
+        httpStatus === 429 ||
+        (httpStatus !== undefined && httpStatus >= 500)) {
+        return "retryable";
+    }
+    if (httpStatus !== undefined && httpStatus >= 400) {
+        return "permanent";
+    }
+    const code = failure.code;
+    if (typeof code === "string" &&
+        new Set([
+            "ECONNABORTED",
+            "ECONNREFUSED",
+            "ECONNRESET",
+            "EHOSTUNREACH",
+            "ENETDOWN",
+            "ENETUNREACH",
+            "ENOTFOUND",
+            "ETIMEDOUT",
+        ]).has(code)) {
+        return "retryable";
+    }
+    return "retryable";
+}
+function objectRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw storeError("CORRUPT_RECORD", "Stored record must be an object");
+    }
+    return value;
+}
+function parseRetry(value) {
+    const record = value === undefined ? null : objectRecord(value);
+    if (record === null ||
+        typeof record.attempts !== "number" ||
+        !Number.isSafeInteger(record.attempts) ||
+        record.attempts < 0 ||
+        !(record.nextAttemptAt === null ||
+            validIso(record.nextAttemptAt)) ||
+        !(record.lastAttemptAt === null ||
+            validIso(record.lastAttemptAt)) ||
+        !(record.lastError === null ||
+            typeof record.lastError === "string") ||
+        !(record.lastFailureClassification === null ||
+            record.lastFailureClassification === "retryable" ||
+            record.lastFailureClassification === "authentication" ||
+            record.lastFailureClassification === "permanent" ||
+            record.lastFailureClassification === "incompatible")) {
+        throw storeError("CORRUPT_RECORD", "Stored retry metadata is invalid");
+    }
+    return {
+        attempts: record.attempts,
+        nextAttemptAt: record.nextAttemptAt,
+        lastAttemptAt: record.lastAttemptAt,
+        lastError: record.lastError,
+        lastFailureClassification: record.lastFailureClassification,
+    };
+}
+function parseClaim(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const record = objectRecord(value);
+    if (typeof record.id !== "string" ||
+        typeof record.workerId !== "string" ||
+        !validIso(record.claimedAt) ||
+        !validIso(record.leaseExpiresAt)) {
+        throw storeError("CORRUPT_RECORD", "Stored claim is invalid");
+    }
+    return {
+        id: record.id,
+        workerId: record.workerId,
+        claimedAt: record.claimedAt,
+        leaseExpiresAt: record.leaseExpiresAt,
+    };
+}
+function parseStoredOutbox(value, state) {
+    const record = objectRecord(value);
+    if (record.version !== RELIABILITY_STORE_VERSION ||
+        typeof record.id !== "string" ||
+        typeof record.sequence !== "number" ||
+        !Number.isSafeInteger(record.sequence) ||
+        record.sequence < 1 ||
+        typeof record.kind !== "string" ||
+        typeof record.idempotencyKey !== "string" ||
+        typeof record.payloadHash !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(record.payloadHash) ||
+        record.payload === undefined ||
+        !validIso(record.enqueuedAt)) {
+        throw storeError("CORRUPT_RECORD", "Stored outbox entry is invalid");
+    }
+    const claim = parseClaim(record.claim);
+    return {
+        version: RELIABILITY_STORE_VERSION,
+        id: record.id,
+        sequence: record.sequence,
+        state,
+        kind: record.kind,
+        idempotencyKey: record.idempotencyKey,
+        payloadHash: record.payloadHash,
+        payload: record.payload,
+        enqueuedAt: record.enqueuedAt,
+        retry: parseRetry(record.retry),
+        ...(state !== "in-flight" || claim === undefined ? {} : { claim }),
+    };
+}
+function storedEntry(entry) {
+    const { state: _state, ...stored } = entry;
+    return stored;
+}
+function sequenceFilename(sequence, id) {
+    return `${String(sequence).padStart(16, "0")}-${id}.json`;
+}
+function stateDirectoryName(state) {
+    return state;
+}
+function trustKey(value, workspaceId) {
+    if (value.workspaceId !== workspaceId ||
+        value.kty !== "OKP" ||
+        value.crv !== "Ed25519" ||
+        typeof value.kid !== "string" ||
+        value.kid.trim() === "" ||
+        typeof value.x !== "string" ||
+        !BASE64URL_PATTERN.test(value.x) ||
+        value.x.includes("=") ||
+        Buffer.from(value.x, "base64url").byteLength !== 32 ||
+        (value.alg !== undefined && value.alg !== "EdDSA") ||
+        (value.use !== undefined && value.use !== "sig") ||
+        (value.notBefore !== undefined && !validIso(value.notBefore)) ||
+        (value.retiredAt !== undefined &&
+            value.retiredAt !== null &&
+            !validIso(value.retiredAt)) ||
+        "d" in value) {
+        throw storeError("INVALID_INPUT", "Public trust key is invalid");
+    }
+    return {
+        workspaceId,
+        kid: boundedString(value.kid, "kid", 200),
+        kty: "OKP",
+        crv: "Ed25519",
+        x: value.x,
+        ...(value.alg === undefined ? {} : { alg: value.alg }),
+        ...(value.use === undefined ? {} : { use: value.use }),
+        ...(value.notBefore === undefined
+            ? {}
+            : { notBefore: value.notBefore }),
+        ...(value.retiredAt === undefined
+            ? {}
+            : { retiredAt: value.retiredAt }),
+    };
+}
+export class ReliabilityStore {
+    workspaceId;
+    directory;
+    home;
+    rootDirectory;
+    maxRecordBytes;
+    maxSnapshotBytes;
+    maxOutboxItems;
+    maxOutboxBytes;
+    lockOptions;
+    now;
+    random;
+    constructor(workspaceId, options = {}) {
+        this.workspaceId = workspaceSegment(workspaceId);
+        this.home = resolve(options.home ?? homedir());
+        this.rootDirectory = resolve(this.home, ".lore", "store-v1");
+        this.directory = resolve(this.rootDirectory, "workspaces", this.workspaceId);
+        this.maxRecordBytes = positiveInteger(options.maxRecordBytes, DEFAULT_MAX_RECORD_BYTES, "maxRecordBytes");
+        this.maxSnapshotBytes = positiveInteger(options.maxSnapshotBytes, DEFAULT_MAX_SNAPSHOT_BYTES, "maxSnapshotBytes");
+        this.maxOutboxItems = positiveInteger(options.maxOutboxItems, DEFAULT_MAX_OUTBOX_ITEMS, "maxOutboxItems");
+        this.maxOutboxBytes = positiveInteger(options.maxOutboxBytes, DEFAULT_MAX_OUTBOX_BYTES, "maxOutboxBytes");
+        this.lockOptions = {
+            timeoutMs: positiveInteger(options.lockTimeoutMs, 5_000, "lockTimeoutMs"),
+            staleMs: positiveInteger(options.lockStaleMs, 60_000, "lockStaleMs"),
+            retryMs: positiveInteger(options.lockRetryMs, 20, "lockRetryMs"),
+        };
+        this.now = options.now ?? (() => new Date());
+        this.random = options.random ?? Math.random;
+    }
+    layoutPaths() {
+        const lore = resolve(this.home, ".lore");
+        const workspaces = resolve(this.rootDirectory, "workspaces");
+        return [
+            lore,
+            this.rootDirectory,
+            workspaces,
+            this.directory,
+            resolve(this.directory, "outbox"),
+            ...OUTBOX_STATES.map((state) => resolve(this.directory, "outbox", stateDirectoryName(state))),
+            resolve(this.directory, "cache"),
+            resolve(this.directory, "cache", "context"),
+            resolve(this.directory, "cache", "policy"),
+            resolve(this.directory, "state"),
+            resolve(this.directory, "trust"),
+            resolve(this.directory, "locks"),
+            resolve(this.directory, "quarantine"),
+        ];
+    }
+    async initialize() {
+        await assertDirectory(this.home);
+        for (const path of this.layoutPaths()) {
+            await ensurePrivateDirectory(path);
+        }
+    }
+    async assertExistingLayout() {
+        await assertDirectory(this.home);
+        for (const path of this.layoutPaths()) {
+            const metadata = await lstat(path);
+            if (metadata.isSymbolicLink() ||
+                !metadata.isDirectory() ||
+                (metadata.mode & 0o777) !== DIRECTORY_MODE) {
+                throw storeError("UNSAFE_PATH", `Store directory permissions must be 0700: ${path}`);
+            }
+        }
+    }
+    stateDirectory(state) {
+        return resolve(this.directory, "outbox", stateDirectoryName(state));
+    }
+    async withLock(operation, lockName = "mutation.lock") {
+        await this.initialize();
+        return withDirectoryLock(resolve(this.directory, "locks", lockName), operation, this.lockOptions);
+    }
+    stateLockName(key) {
+        return `state-${sha256(key)}.lock`;
+    }
+    async scanOutbox(states = OUTBOX_STATES) {
+        const located = [];
+        for (const state of states) {
+            const directory = this.stateDirectory(state);
+            const names = (await readdir(directory))
+                .filter((name) => name.endsWith(".json"))
+                .sort();
+            for (const name of names) {
+                const path = resolve(directory, name);
+                const metadata = await regularFileMetadata(path);
+                if (metadata === null) {
+                    continue;
+                }
+                const entry = parseStoredOutbox(await readBoundedJsonFile(path, this.maxRecordBytes), state);
+                located.push({ entry, path, bytes: metadata.size });
+            }
+        }
+        return located.sort((left, right) => left.entry.sequence - right.entry.sequence);
+    }
+    async nextSequence(entries) {
+        const counterPath = resolve(this.directory, "outbox", "sequence.json");
+        let fromCounter = 1;
+        try {
+            const record = objectRecord(await readBoundedJsonFile(counterPath, 4_096));
+            if (record.version !== RELIABILITY_STORE_VERSION ||
+                typeof record.nextSequence !== "number" ||
+                !Number.isSafeInteger(record.nextSequence) ||
+                record.nextSequence < 1) {
+                throw storeError("CORRUPT_RECORD", "Outbox sequence is invalid");
+            }
+            fromCounter = record.nextSequence;
+        }
+        catch (error) {
+            if (!isErrno(error, "ENOENT")) {
+                throw error;
+            }
+        }
+        const highest = entries.length === 0
+            ? 0
+            : Math.max(...entries.map(({ entry }) => entry.sequence));
+        return Math.max(fromCounter, highest + 1);
+    }
+    async writeEntry(path, entry) {
+        await atomicWriteJson(path, storedEntry(entry), this.maxRecordBytes);
+    }
+    async enqueue(input) {
+        const kind = boundedString(input.kind, "kind", 100);
+        const idempotencyKey = boundedString(input.idempotencyKey, "idempotencyKey", 500);
+        const payload = normalizeJson(input.payload, { nodes: 0, seen: new Set() }, 0);
+        const payloadHash = sha256(serializeBoundedJson({ kind, payload }, this.maxRecordBytes));
+        const enqueuedAt = dateIso(input.enqueuedAt ?? this.now(), "enqueuedAt");
+        return this.withLock(async () => {
+            const entries = await this.scanOutbox();
+            const existing = entries.find(({ entry }) => entry.idempotencyKey === idempotencyKey);
+            if (existing !== undefined) {
+                if (existing.entry.payloadHash !== payloadHash ||
+                    existing.entry.kind !== kind) {
+                    throw storeError("IDEMPOTENCY_CONFLICT", "Idempotency key was already used with a different payload");
+                }
+                return { entry: existing.entry, created: false };
+            }
+            if (entries.length >= this.maxOutboxItems) {
+                throw storeError("CAPACITY_EXCEEDED", "Outbox item capacity has been reached");
+            }
+            const sequence = await this.nextSequence(entries);
+            if (!Number.isSafeInteger(sequence)) {
+                throw storeError("CAPACITY_EXCEEDED", "Outbox sequence is exhausted");
+            }
+            const id = randomUUID();
+            const entry = {
+                version: RELIABILITY_STORE_VERSION,
+                id,
+                sequence,
+                state: "ready",
+                kind,
+                idempotencyKey,
+                payloadHash,
+                payload,
+                enqueuedAt,
+                retry: {
+                    attempts: 0,
+                    nextAttemptAt: enqueuedAt,
+                    lastAttemptAt: null,
+                    lastError: null,
+                    lastFailureClassification: null,
+                },
+            };
+            const serialized = serializeBoundedJson(storedEntry(entry), this.maxRecordBytes);
+            const usedBytes = entries.reduce((sum, item) => sum + item.bytes, 0);
+            if (usedBytes + Buffer.byteLength(serialized) > this.maxOutboxBytes) {
+                throw storeError("CAPACITY_EXCEEDED", "Outbox byte capacity has been reached");
+            }
+            const path = resolve(this.stateDirectory("ready"), sequenceFilename(sequence, id));
+            await atomicWriteFile(path, serialized, this.maxRecordBytes);
+            const counter = {
+                version: RELIABILITY_STORE_VERSION,
+                nextSequence: sequence + 1,
+            };
+            await atomicWriteJson(resolve(this.directory, "outbox", "sequence.json"), counter, 4_096);
+            return { entry, created: true };
+        });
+    }
+    async transferPendingTo(destination) {
+        if (destination.directory === this.directory) {
+            return 0;
+        }
+        await destination.initialize();
+        return this.withLock(async () => {
+            await this.recoverStaleClaimsLocked(this.now());
+            const pending = await this.scanOutbox(["ready", "auth-blocked"]);
+            let transferred = 0;
+            for (const located of pending) {
+                await destination.enqueue({
+                    kind: located.entry.kind,
+                    idempotencyKey: located.entry.idempotencyKey,
+                    payload: located.entry.payload,
+                    enqueuedAt: new Date(located.entry.enqueuedAt),
+                });
+                await durableUnlink(located.path);
+                transferred += 1;
+            }
+            return transferred;
+        });
+    }
+    async recoverStaleClaimsLocked(now) {
+        const nowIso = dateIso(now, "now");
+        const inFlight = await this.scanOutbox(["in-flight"]);
+        let recovered = 0;
+        for (const located of inFlight) {
+            const claim = located.entry.claim;
+            if (claim !== undefined &&
+                Date.parse(claim.leaseExpiresAt) > now.getTime()) {
+                continue;
+            }
+            const { claim: _claim, ...withoutClaim } = located.entry;
+            const recoveredEntry = {
+                ...withoutClaim,
+                state: "ready",
+                retry: {
+                    attempts: located.entry.retry.attempts + 1,
+                    nextAttemptAt: nowIso,
+                    lastAttemptAt: located.entry.retry.lastAttemptAt,
+                    lastError: "Recovered stale in-flight claim",
+                    lastFailureClassification: "retryable",
+                },
+            };
+            const destination = resolve(this.stateDirectory("ready"), basename(located.path));
+            await durableMove(located.path, destination);
+            await this.writeEntry(destination, recoveredEntry);
+            recovered += 1;
+        }
+        return recovered;
+    }
+    async recoverStaleClaims(now = this.now()) {
+        return this.withLock(() => this.recoverStaleClaimsLocked(now));
+    }
+    async claimNext(options) {
+        const workerId = boundedString(options.workerId, "workerId", 200);
+        const kinds = options.kinds === undefined
+            ? undefined
+            : new Set(options.kinds.map((kind) => boundedString(kind, "outbox kind", 200)));
+        const leaseMs = positiveInteger(options.leaseMs, 30_000, "leaseMs");
+        const now = options.now ?? this.now();
+        const nowIso = dateIso(now, "now");
+        return this.withLock(async () => {
+            await this.recoverStaleClaimsLocked(now);
+            const active = (await this.scanOutbox(["in-flight"])).filter(({ entry }) => kinds === undefined || kinds.has(entry.kind));
+            if (active.length > 0) {
+                return null;
+            }
+            const ready = (await this.scanOutbox(["ready"])).filter(({ entry }) => kinds === undefined || kinds.has(entry.kind));
+            const first = ready[0];
+            if (first === undefined ||
+                (first.entry.retry.nextAttemptAt !== null &&
+                    Date.parse(first.entry.retry.nextAttemptAt) > now.getTime())) {
+                return null;
+            }
+            const claim = {
+                id: randomUUID(),
+                workerId,
+                claimedAt: nowIso,
+                leaseExpiresAt: new Date(now.getTime() + leaseMs).toISOString(),
+            };
+            const claimed = {
+                ...first.entry,
+                state: "in-flight",
+                retry: {
+                    ...first.entry.retry,
+                    lastAttemptAt: nowIso,
+                },
+                claim,
+            };
+            const destination = resolve(this.stateDirectory("in-flight"), basename(first.path));
+            await durableMove(first.path, destination);
+            await this.writeEntry(destination, claimed);
+            return claimed;
+        });
+    }
+    async claimedEntry(claimId) {
+        const claimed = (await this.scanOutbox(["in-flight"])).find(({ entry }) => entry.claim?.id === claimId);
+        if (claimed === undefined) {
+            throw storeError("CLAIM_CONFLICT", "Outbox claim is no longer active");
+        }
+        return claimed;
+    }
+    async acknowledgeClaim(claimId) {
+        const id = boundedString(claimId, "claimId", 200);
+        await this.withLock(async () => {
+            const claimed = await this.claimedEntry(id);
+            await durableUnlink(claimed.path);
+        });
+    }
+    async failClaim(input) {
+        const claimId = boundedString(input.claimId, "claimId", 200);
+        const message = truncate(input.message);
+        if (message === "") {
+            throw storeError("INVALID_INPUT", "message must not be empty");
+        }
+        const now = input.now ?? this.now();
+        const nowIso = dateIso(now, "now");
+        return this.withLock(async () => {
+            const located = await this.claimedEntry(claimId);
+            const attempts = located.entry.retry.attempts + 1;
+            const retryable = input.classification === "retryable";
+            const nextState = input.classification === "authentication"
+                ? "auth-blocked"
+                : retryable
+                    ? "ready"
+                    : "dead";
+            const retryAfterMs = input.retryAfterMs === undefined
+                ? computeRetryBackoffMs(attempts, { random: this.random })
+                : positiveInteger(input.retryAfterMs, 1, "retryAfterMs");
+            const nextAttemptAt = nextState === "ready"
+                ? new Date(now.getTime() + retryAfterMs).toISOString()
+                : null;
+            const { claim: _claim, ...withoutClaim } = located.entry;
+            const failed = {
+                ...withoutClaim,
+                state: nextState,
+                retry: {
+                    attempts,
+                    nextAttemptAt,
+                    lastAttemptAt: nowIso,
+                    lastError: message,
+                    lastFailureClassification: input.classification,
+                },
+            };
+            const destination = resolve(this.stateDirectory(nextState), basename(located.path));
+            await durableMove(located.path, destination);
+            await this.writeEntry(destination, failed);
+            return failed;
+        });
+    }
+    async releaseAuthBlocked(now = this.now()) {
+        const nowIso = dateIso(now, "now");
+        return this.withLock(async () => {
+            const blocked = await this.scanOutbox(["auth-blocked"]);
+            for (const located of blocked) {
+                const released = {
+                    ...located.entry,
+                    state: "ready",
+                    retry: {
+                        ...located.entry.retry,
+                        nextAttemptAt: nowIso,
+                    },
+                };
+                const destination = resolve(this.stateDirectory("ready"), basename(located.path));
+                await durableMove(located.path, destination);
+                await this.writeEntry(destination, released);
+            }
+            return blocked.length;
+        });
+    }
+    async removeDead(sequence) {
+        if (!Number.isSafeInteger(sequence) || sequence < 1) {
+            throw storeError("INVALID_INPUT", "sequence must be a positive integer");
+        }
+        return this.withLock(async () => {
+            const dead = (await this.scanOutbox(["dead"])).find(({ entry }) => entry.sequence === sequence);
+            return dead === undefined ? false : durableUnlink(dead.path);
+        });
+    }
+    async listOutbox(states = OUTBOX_STATES) {
+        await this.initialize();
+        for (const state of states) {
+            if (!OUTBOX_STATES.includes(state)) {
+                throw storeError("INVALID_INPUT", `Unknown outbox state: ${state}`);
+            }
+        }
+        return (await this.scanOutbox(states)).map(({ entry }) => entry);
+    }
+    cachePath(kind, cacheKey) {
+        const key = boundedString(cacheKey, "cacheKey", 1_000);
+        return resolve(this.directory, "cache", kind, `${sha256(key)}.${kind === "context" ? "json" : "jws.json"}`);
+    }
+    async pruneContextSnapshotsLocked() {
+        const directory = resolve(this.directory, "cache", "context");
+        const located = [];
+        for (const name of (await readdir(directory))
+            .filter((value) => value.endsWith(".json"))
+            .sort()
+            .slice(0, MAX_CONTEXT_CACHE_SCAN_FILES)) {
+            const path = resolve(directory, name);
+            try {
+                const metadata = await regularFileMetadata(path);
+                if (metadata === null) {
+                    continue;
+                }
+                const record = contextCacheRecord(await readBoundedJsonFile(path, this.maxSnapshotBytes));
+                if (this.cachePath("context", record.cacheKey) !== path) {
+                    continue;
+                }
+                located.push({
+                    path,
+                    bytes: metadata.size,
+                    writtenAt: record.writtenAt,
+                    cacheKey: record.cacheKey,
+                });
+            }
+            catch {
+                // Corrupt records remain visible to doctor and are ignored for pruning.
+            }
+        }
+        located.sort((left, right) => Date.parse(right.writtenAt) - Date.parse(left.writtenAt) ||
+            (left.cacheKey < right.cacheKey
+                ? -1
+                : left.cacheKey > right.cacheKey
+                    ? 1
+                    : 0));
+        let retainedBytes = 0;
+        for (const [index, item] of located.entries()) {
+            retainedBytes += item.bytes;
+            if (index >= DEFAULT_MAX_CONTEXT_CACHE_ITEMS ||
+                retainedBytes > DEFAULT_MAX_CONTEXT_CACHE_BYTES) {
+                await durableUnlink(item.path, true);
+            }
+        }
+    }
+    statePath(stateKey) {
+        const key = boundedString(stateKey, "stateKey", 1_000);
+        return resolve(this.directory, "state", `${sha256(key)}.json`);
+    }
+    async readStateValue(key) {
+        try {
+            const record = objectRecord(await readBoundedJsonFile(this.statePath(key), this.maxRecordBytes));
+            if (record.version !== RELIABILITY_STORE_VERSION ||
+                record.cacheKey !== key ||
+                !validIso(record.writtenAt) ||
+                record.value === undefined) {
+                throw storeError("CORRUPT_RECORD", "Runtime state record is invalid");
+            }
+            return record.value;
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT")) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async writeState(stateKey, value, writtenAt = this.now()) {
+        const key = boundedString(stateKey, "stateKey", 1_000);
+        const state = normalizeJson(value, { nodes: 0, seen: new Set() }, 0);
+        await this.withLock(() => atomicWriteJson(this.statePath(key), {
+            version: RELIABILITY_STORE_VERSION,
+            cacheKey: key,
+            writtenAt: dateIso(writtenAt, "writtenAt"),
+            value: state,
+        }, this.maxRecordBytes), this.stateLockName(key));
+    }
+    async readState(stateKey) {
+        const key = boundedString(stateKey, "stateKey", 1_000);
+        await this.initialize();
+        return this.readStateValue(key);
+    }
+    async readStateExisting(stateKey) {
+        const key = boundedString(stateKey, "stateKey", 1_000);
+        await this.assertExistingLayout();
+        return this.readStateValue(key);
+    }
+    async updateState(stateKey, update, writtenAt = this.now(), options = {}) {
+        const key = boundedString(stateKey, "stateKey", 1_000);
+        return this.withLock(async () => {
+            const quarantineCurrent = async () => {
+                await durableMove(this.statePath(key), resolve(this.directory, "quarantine", `state-${sha256(key).slice(0, 16)}-${randomUUID()}.json`));
+            };
+            let current;
+            try {
+                current = await this.readStateValue(key);
+            }
+            catch (error) {
+                if (options.recoverCorrupt !== true ||
+                    !(error instanceof ReliabilityStoreError) ||
+                    error.code !== "CORRUPT_RECORD") {
+                    throw error;
+                }
+                await quarantineCurrent();
+                current = null;
+            }
+            if (current !== null &&
+                options.validateCurrent !== undefined &&
+                !options.validateCurrent(current)) {
+                if (options.recoverCorrupt !== true) {
+                    throw storeError("CORRUPT_RECORD", "Runtime state value is invalid");
+                }
+                await quarantineCurrent();
+                current = null;
+            }
+            const state = normalizeJson(update(current), { nodes: 0, seen: new Set() }, 0);
+            await atomicWriteJson(this.statePath(key), {
+                version: RELIABILITY_STORE_VERSION,
+                cacheKey: key,
+                writtenAt: dateIso(writtenAt, "writtenAt"),
+                value: state,
+            }, this.maxRecordBytes);
+            return state;
+        }, this.stateLockName(key));
+    }
+    async deleteState(stateKey) {
+        const key = boundedString(stateKey, "stateKey", 1_000);
+        return this.withLock(() => durableUnlink(this.statePath(key), true), this.stateLockName(key));
+    }
+    async writeContextSnapshot(cacheKey, value, writtenAt = this.now()) {
+        const key = boundedString(cacheKey, "cacheKey", 1_000);
+        const snapshot = normalizeJson(value, { nodes: 0, seen: new Set() }, 0);
+        await this.withLock(async () => {
+            await atomicWriteJson(this.cachePath("context", key), {
+                version: RELIABILITY_STORE_VERSION,
+                cacheKey: key,
+                writtenAt: dateIso(writtenAt, "writtenAt"),
+                value: snapshot,
+            }, this.maxSnapshotBytes);
+            await this.pruneContextSnapshotsLocked();
+        });
+    }
+    async readContextSnapshot(cacheKey) {
+        const key = boundedString(cacheKey, "cacheKey", 1_000);
+        await this.initialize();
+        try {
+            const record = contextCacheRecord(await readBoundedJsonFile(this.cachePath("context", key), this.maxSnapshotBytes));
+            if (record.cacheKey !== key ||
+                this.cachePath("context", record.cacheKey) !==
+                    this.cachePath("context", key)) {
+                throw storeError("CORRUPT_RECORD", "Context cache record is invalid");
+            }
+            return record.value;
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT")) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async listContextSnapshots(options = {}) {
+        const limit = Math.min(positiveInteger(options.limit, 128, "limit"), DEFAULT_MAX_CONTEXT_CACHE_ITEMS);
+        const maxBytes = Math.min(positiveInteger(options.maxBytes, DEFAULT_MAX_CONTEXT_CACHE_BYTES, "maxBytes"), DEFAULT_MAX_CONTEXT_CACHE_BYTES);
+        await this.initialize();
+        return this.withLock(async () => {
+            const directory = resolve(this.directory, "cache", "context");
+            const names = (await readdir(directory))
+                .filter((name) => name.endsWith(".json"))
+                .sort();
+            const records = [];
+            let bytes = 0;
+            let invalid = 0;
+            let truncated = names.length > MAX_CONTEXT_CACHE_SCAN_FILES;
+            for (const name of names.slice(0, MAX_CONTEXT_CACHE_SCAN_FILES)) {
+                const path = resolve(directory, name);
+                let chargedBytes = 0;
+                try {
+                    const metadata = await regularFileMetadata(path);
+                    if (metadata === null) {
+                        continue;
+                    }
+                    if (bytes + metadata.size > maxBytes) {
+                        truncated = true;
+                        continue;
+                    }
+                    bytes += metadata.size;
+                    chargedBytes = metadata.size;
+                    const record = contextCacheRecord(await readBoundedJsonFile(path, this.maxSnapshotBytes));
+                    if (this.cachePath("context", record.cacheKey) !== path) {
+                        throw storeError("CORRUPT_RECORD", "Context cache key does not match its filename");
+                    }
+                    records.push({
+                        cacheKey: record.cacheKey,
+                        writtenAt: record.writtenAt,
+                        value: record.value,
+                    });
+                }
+                catch {
+                    bytes -= chargedBytes;
+                    invalid += 1;
+                    await unlink(path).catch(() => undefined);
+                }
+            }
+            if (invalid > 0) {
+                await fsyncDirectory(directory);
+            }
+            records.sort((left, right) => Date.parse(right.writtenAt) - Date.parse(left.writtenAt) ||
+                (left.cacheKey < right.cacheKey
+                    ? -1
+                    : left.cacheKey > right.cacheKey
+                        ? 1
+                        : 0));
+            if (records.length > limit) {
+                truncated = true;
+            }
+            return {
+                records: records.slice(0, limit),
+                invalid,
+                truncated,
+            };
+        });
+    }
+    async writePolicySnapshot(cacheKey, compactJws, writtenAt = this.now()) {
+        const key = boundedString(cacheKey, "cacheKey", 1_000);
+        const jws = boundedString(compactJws, "compactJws", this.maxSnapshotBytes);
+        await this.withLock(() => atomicWriteJson(this.cachePath("policy", key), {
+            version: RELIABILITY_STORE_VERSION,
+            cacheKey: key,
+            writtenAt: dateIso(writtenAt, "writtenAt"),
+            compactJws: jws,
+        }, this.maxSnapshotBytes));
+    }
+    async readPolicySnapshot(cacheKey) {
+        const key = boundedString(cacheKey, "cacheKey", 1_000);
+        await this.initialize();
+        try {
+            const record = objectRecord(await readBoundedJsonFile(this.cachePath("policy", key), this.maxSnapshotBytes));
+            if (record.version !== RELIABILITY_STORE_VERSION ||
+                record.cacheKey !== key ||
+                !validIso(record.writtenAt) ||
+                typeof record.compactJws !== "string") {
+                throw storeError("CORRUPT_RECORD", "Policy cache record is invalid");
+            }
+            return record.compactJws;
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT")) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async writePublicTrustKeys(keys, updatedAt = this.now()) {
+        const normalized = keys.map((key) => trustKey(key, this.workspaceId));
+        if (new Set(normalized.map(({ kid }) => kid)).size !== normalized.length) {
+            throw storeError("INVALID_INPUT", "Trust key IDs must be unique");
+        }
+        await this.withLock(() => atomicWriteJson(resolve(this.directory, "trust", "public-keys.json"), {
+            version: RELIABILITY_STORE_VERSION,
+            workspaceId: this.workspaceId,
+            updatedAt: dateIso(updatedAt, "updatedAt"),
+            keys: normalized,
+        }, this.maxRecordBytes));
+    }
+    async readPublicTrustKeysValue() {
+        try {
+            const record = objectRecord(await readBoundedJsonFile(resolve(this.directory, "trust", "public-keys.json"), this.maxRecordBytes));
+            if (record.version !== RELIABILITY_STORE_VERSION ||
+                record.workspaceId !== this.workspaceId ||
+                !validIso(record.updatedAt) ||
+                !Array.isArray(record.keys)) {
+                throw storeError("CORRUPT_RECORD", "Trust key record is invalid");
+            }
+            const keys = record.keys.map((value) => {
+                const key = objectRecord(value);
+                return trustKey({
+                    workspaceId: String(key.workspaceId),
+                    kid: String(key.kid),
+                    kty: key.kty,
+                    crv: key.crv,
+                    x: String(key.x),
+                    ...(key.alg === undefined ? {} : { alg: key.alg }),
+                    ...(key.use === undefined ? {} : { use: key.use }),
+                    ...(key.notBefore === undefined
+                        ? {}
+                        : { notBefore: String(key.notBefore) }),
+                    ...(key.retiredAt === undefined
+                        ? {}
+                        : {
+                            retiredAt: key.retiredAt === null ? null : String(key.retiredAt),
+                        }),
+                }, this.workspaceId);
+            });
+            if (new Set(keys.map(({ kid }) => kid)).size !== keys.length) {
+                throw storeError("CORRUPT_RECORD", "Trust key IDs are duplicated");
+            }
+            return keys;
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT")) {
+                return [];
+            }
+            throw error;
+        }
+    }
+    async readPublicTrustKeys() {
+        await this.initialize();
+        return this.readPublicTrustKeysValue();
+    }
+    async quarantineLegacy(path) {
+        const destination = resolve(this.directory, "quarantine", `legacy-${Date.now()}-${randomUUID()}.json`);
+        await durableMove(path, destination);
+    }
+    async migrateLegacyQueue(legacyDirectory = resolve(this.home, ".lore", "queue")) {
+        await this.initialize();
+        const report = {
+            migrated: 0,
+            duplicates: 0,
+            quarantined: 0,
+            rejected: 0,
+        };
+        let metadata;
+        try {
+            metadata = await lstat(legacyDirectory);
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT")) {
+                return report;
+            }
+            throw error;
+        }
+        if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+            throw storeError("UNSAFE_PATH", "Legacy queue must be a real directory");
+        }
+        const names = (await readdir(legacyDirectory))
+            .filter((name) => name.endsWith(".json"))
+            .sort();
+        for (const name of names) {
+            const path = resolve(legacyDirectory, name);
+            try {
+                await regularFileMetadata(path);
+            }
+            catch (error) {
+                if (error instanceof ReliabilityStoreError &&
+                    error.code === "UNSAFE_PATH") {
+                    report.rejected += 1;
+                    continue;
+                }
+                throw error;
+            }
+            let request;
+            let idempotencyKey;
+            let kind;
+            try {
+                const parsed = objectRecord(await readBoundedJsonFile(path, this.maxRecordBytes));
+                request =
+                    parsed.request === undefined ? parsed : objectRecord(parsed.request);
+                if (typeof request.idempotencyKey !== "string") {
+                    throw storeError("CORRUPT_RECORD", "Legacy entry has no idempotency key");
+                }
+                idempotencyKey = request.idempotencyKey;
+                kind =
+                    typeof parsed.kind === "string"
+                        ? parsed.kind
+                        : typeof request.connector === "string"
+                            ? request.connector
+                            : "legacy";
+            }
+            catch {
+                await this.quarantineLegacy(path);
+                report.quarantined += 1;
+                continue;
+            }
+            try {
+                const result = await this.enqueue({
+                    kind,
+                    idempotencyKey,
+                    payload: request,
+                });
+                if (result.created) {
+                    report.migrated += 1;
+                }
+                else {
+                    report.duplicates += 1;
+                }
+                await durableUnlink(path);
+            }
+            catch (error) {
+                if (error instanceof ReliabilityStoreError &&
+                    error.code === "CAPACITY_EXCEEDED") {
+                    report.rejected += 1;
+                    continue;
+                }
+                if (error instanceof ReliabilityStoreError &&
+                    (error.code === "IDEMPOTENCY_CONFLICT" ||
+                        error.code === "INVALID_INPUT" ||
+                        error.code === "SERIALIZATION_LIMIT")) {
+                    await this.quarantineLegacy(path);
+                    report.quarantined += 1;
+                    continue;
+                }
+                throw error;
+            }
+        }
+        return report;
+    }
+    async inspectContents() {
+        const entries = await this.scanOutbox();
+        await Promise.all(entries.map(({ path }) => privateFileMetadata(path)));
+        const countFiles = async (path) => {
+            let count = 0;
+            for (const name of (await readdir(path)).filter((entry) => entry.endsWith(".json"))) {
+                const itemPath = resolve(path, name);
+                try {
+                    await privateFileMetadata(itemPath);
+                }
+                catch (error) {
+                    if (isErrno(error, "ENOENT")) {
+                        continue;
+                    }
+                    throw error;
+                }
+                count += 1;
+            }
+            return count;
+        };
+        const countCacheRecords = async (kind) => {
+            const directory = resolve(this.directory, "cache", kind);
+            let count = 0;
+            const writtenAt = [];
+            for (const name of (await readdir(directory)).filter((entry) => entry.endsWith(".json"))) {
+                const itemPath = resolve(directory, name);
+                await privateFileMetadata(itemPath);
+                const record = objectRecord(await readBoundedJsonFile(itemPath, this.maxSnapshotBytes));
+                if (record.version !== RELIABILITY_STORE_VERSION ||
+                    typeof record.cacheKey !== "string" ||
+                    !validIso(record.writtenAt) ||
+                    this.cachePath(kind, record.cacheKey) !== itemPath ||
+                    (kind === "context" && record.value === undefined) ||
+                    (kind === "policy" && typeof record.compactJws !== "string")) {
+                    throw storeError("CORRUPT_RECORD", `${kind} cache record is invalid`);
+                }
+                count += 1;
+                writtenAt.push(record.writtenAt);
+            }
+            writtenAt.sort();
+            return {
+                count,
+                oldestWrittenAt: writtenAt[0] ?? null,
+                newestWrittenAt: writtenAt.at(-1) ?? null,
+            };
+        };
+        const oldest = entries
+            .map(({ entry }) => entry.enqueuedAt)
+            .sort()[0] ?? null;
+        const counts = (state) => entries.filter(({ entry }) => entry.state === state).length;
+        await Promise.all([
+            countFiles(resolve(this.directory, "state")),
+            countFiles(resolve(this.directory, "trust")),
+        ]);
+        const [contextCache, policyCache] = await Promise.all([
+            countCacheRecords("context"),
+            countCacheRecords("policy"),
+        ]);
+        const operational = localOperationalMetricsInspection(await this.readStateValue(LOCAL_OPERATIONAL_METRICS_STATE_KEY));
+        return {
+            workspaceId: this.workspaceId,
+            directory: this.directory,
+            outbox: {
+                ready: counts("ready"),
+                inFlight: counts("in-flight"),
+                authBlocked: counts("auth-blocked"),
+                dead: counts("dead"),
+                total: entries.length,
+                bytes: entries.reduce((sum, entry) => sum + entry.bytes, 0),
+                oldestEnqueuedAt: oldest,
+            },
+            cache: {
+                context: contextCache.count,
+                policy: policyCache.count,
+                oldestContextWrittenAt: contextCache.oldestWrittenAt,
+                newestContextWrittenAt: contextCache.newestWrittenAt,
+            },
+            trustKeys: (await this.readPublicTrustKeysValue()).length,
+            quarantined: await countFiles(resolve(this.directory, "quarantine")),
+            operational,
+        };
+    }
+    async inspect() {
+        return this.withLock(() => this.inspectContents());
+    }
+    async inspectExisting() {
+        await this.assertExistingLayout();
+        return this.inspectContents();
+    }
+}
+const LOCAL_OPERATIONAL_METRICS_STATE_KEY = "operational-metrics-v1";
+function metricInteger(value) {
+    return (typeof value === "number" &&
+        Number.isSafeInteger(value) &&
+        value >= 0);
+}
+function localOperationalMetricsState(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    const retrieval = value.retrieval;
+    const guard = value.guard;
+    if (value.version !== 1 ||
+        typeof value.since !== "string" ||
+        !validIso(value.since) ||
+        typeof value.updatedAt !== "string" ||
+        !validIso(value.updatedAt) ||
+        retrieval === null ||
+        typeof retrieval !== "object" ||
+        Array.isArray(retrieval) ||
+        guard === null ||
+        typeof guard !== "object" ||
+        Array.isArray(guard)) {
+        return null;
+    }
+    const retrievalValues = [
+        retrieval.attempts,
+        retrieval.livePrimary,
+        retrieval.liveLexicalFallback,
+        retrieval.cachedFallback,
+        retrieval.failed,
+        retrieval.cachedAgeSamples,
+        retrieval.cachedAgeTotalMs,
+        retrieval.maxCachedAgeMs,
+    ];
+    const guardValues = [
+        guard.eligibleActions,
+        guard.liveChecks,
+        guard.reusedDecisions,
+        guard.failures,
+        guard.latencySamples,
+        guard.latencyTotalMs,
+        guard.maxLatencyMs,
+    ];
+    if (!retrievalValues.every(metricInteger) ||
+        !guardValues.every(metricInteger)) {
+        return null;
+    }
+    return value;
+}
+function emptyLocalOperationalMetrics(now) {
+    const timestamp = now.toISOString();
+    return {
+        version: 1,
+        since: timestamp,
+        updatedAt: timestamp,
+        retrieval: {
+            attempts: 0,
+            livePrimary: 0,
+            liveLexicalFallback: 0,
+            cachedFallback: 0,
+            failed: 0,
+            cachedAgeSamples: 0,
+            cachedAgeTotalMs: 0,
+            maxCachedAgeMs: 0,
+        },
+        guard: {
+            eligibleActions: 0,
+            liveChecks: 0,
+            reusedDecisions: 0,
+            failures: 0,
+            latencySamples: 0,
+            latencyTotalMs: 0,
+            maxLatencyMs: 0,
+        },
+    };
+}
+function incrementMetric(value) {
+    return Math.min(Number.MAX_SAFE_INTEGER, value + 1);
+}
+function addMetric(value, addition) {
+    return Math.min(Number.MAX_SAFE_INTEGER, value + addition);
+}
+function localOperationalMetricsInspection(value) {
+    const state = localOperationalMetricsState(value);
+    if (state === null) {
+        return {
+            since: null,
+            updatedAt: null,
+            retrieval: {
+                attempts: 0,
+                livePrimary: 0,
+                liveLexicalFallback: 0,
+                cachedFallback: 0,
+                failed: 0,
+                fallbackRate: null,
+                averageCachedAgeMs: null,
+                maxCachedAgeMs: null,
+            },
+            guard: {
+                eligibleActions: 0,
+                liveChecks: 0,
+                reusedDecisions: 0,
+                failures: 0,
+                coverageRate: null,
+                averageLatencyMs: null,
+                maxLatencyMs: null,
+            },
+        };
+    }
+    const fallbackCount = state.retrieval.liveLexicalFallback + state.retrieval.cachedFallback;
+    const protectedActions = state.guard.liveChecks + state.guard.reusedDecisions;
+    return {
+        since: state.since,
+        updatedAt: state.updatedAt,
+        retrieval: {
+            attempts: state.retrieval.attempts,
+            livePrimary: state.retrieval.livePrimary,
+            liveLexicalFallback: state.retrieval.liveLexicalFallback,
+            cachedFallback: state.retrieval.cachedFallback,
+            failed: state.retrieval.failed,
+            fallbackRate: state.retrieval.attempts === 0
+                ? null
+                : fallbackCount / state.retrieval.attempts,
+            averageCachedAgeMs: state.retrieval.cachedAgeSamples === 0
+                ? null
+                : state.retrieval.cachedAgeTotalMs /
+                    state.retrieval.cachedAgeSamples,
+            maxCachedAgeMs: state.retrieval.cachedAgeSamples === 0
+                ? null
+                : state.retrieval.maxCachedAgeMs,
+        },
+        guard: {
+            eligibleActions: state.guard.eligibleActions,
+            liveChecks: state.guard.liveChecks,
+            reusedDecisions: state.guard.reusedDecisions,
+            failures: state.guard.failures,
+            coverageRate: state.guard.eligibleActions === 0
+                ? null
+                : protectedActions / state.guard.eligibleActions,
+            averageLatencyMs: state.guard.latencySamples === 0
+                ? null
+                : state.guard.latencyTotalMs / state.guard.latencySamples,
+            maxLatencyMs: state.guard.latencySamples === 0
+                ? null
+                : state.guard.maxLatencyMs,
+        },
+    };
+}
+export async function recordLocalRetrievalMetric(store, input, now = new Date()) {
+    await store.updateState(LOCAL_OPERATIONAL_METRICS_STATE_KEY, (current) => {
+        const state = localOperationalMetricsState(current) ??
+            emptyLocalOperationalMetrics(now);
+        state.updatedAt = now.toISOString();
+        state.retrieval.attempts = incrementMetric(state.retrieval.attempts);
+        switch (input.outcome) {
+            case "live_primary":
+                state.retrieval.livePrimary = incrementMetric(state.retrieval.livePrimary);
+                break;
+            case "live_lexical_fallback":
+                state.retrieval.liveLexicalFallback = incrementMetric(state.retrieval.liveLexicalFallback);
+                break;
+            case "cached_fallback": {
+                state.retrieval.cachedFallback = incrementMetric(state.retrieval.cachedFallback);
+                const ageMs = Math.max(0, Math.trunc(input.cacheAgeMs ?? 0));
+                state.retrieval.cachedAgeSamples = incrementMetric(state.retrieval.cachedAgeSamples);
+                state.retrieval.cachedAgeTotalMs = addMetric(state.retrieval.cachedAgeTotalMs, ageMs);
+                state.retrieval.maxCachedAgeMs = Math.max(state.retrieval.maxCachedAgeMs, ageMs);
+                break;
+            }
+            case "failed":
+                state.retrieval.failed = incrementMetric(state.retrieval.failed);
+                break;
+        }
+        return state;
+    }, now, {
+        recoverCorrupt: true,
+        validateCurrent: (current) => localOperationalMetricsState(current) !== null,
+    });
+}
+export async function recordLocalGuardMetric(store, input, now = new Date()) {
+    await store.updateState(LOCAL_OPERATIONAL_METRICS_STATE_KEY, (current) => {
+        const state = localOperationalMetricsState(current) ??
+            emptyLocalOperationalMetrics(now);
+        state.updatedAt = now.toISOString();
+        state.guard.eligibleActions = incrementMetric(state.guard.eligibleActions);
+        if (input.outcome === "reused_decision") {
+            state.guard.reusedDecisions = incrementMetric(state.guard.reusedDecisions);
+        }
+        else if (input.outcome === "failed") {
+            state.guard.failures = incrementMetric(state.guard.failures);
+        }
+        else {
+            state.guard.liveChecks = incrementMetric(state.guard.liveChecks);
+            const durationMs = Math.max(0, Math.trunc(input.durationMs ?? 0));
+            state.guard.latencySamples = incrementMetric(state.guard.latencySamples);
+            state.guard.latencyTotalMs = addMetric(state.guard.latencyTotalMs, durationMs);
+            state.guard.maxLatencyMs = Math.max(state.guard.maxLatencyMs, durationMs);
+        }
+        return state;
+    }, now, {
+        recoverCorrupt: true,
+        validateCurrent: (current) => localOperationalMetricsState(current) !== null,
+    });
+}
+function normalizedIntegrationId(value) {
+    const integrationId = boundedString(value, "integrationId", 100);
+    if (!/^[a-z0-9](?:[a-z0-9._/-]*[a-z0-9])?$/u.test(integrationId)) {
+        throw storeError("INVALID_INPUT", "integrationId is invalid");
+    }
+    return integrationId;
+}
+export function integrationInvocationStateKey(integrationId) {
+    return `integration-invocation-v1:${normalizedIntegrationId(integrationId)}`;
+}
+function invocationRecord(value, integrationId) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    if (Object.keys(value).sort().join(",") !==
+        "integrationId,lastAttempt,lastCompletion,version" ||
+        value.version !== 1 ||
+        value.integrationId !== integrationId) {
+        return null;
+    }
+    const attempt = value.lastAttempt;
+    const completion = value.lastCompletion;
+    const validAttempt = attempt === null ||
+        (typeof attempt === "object" &&
+            !Array.isArray(attempt) &&
+            Object.keys(attempt).sort().join(",") === "at,id,runtimeVersion" &&
+            typeof attempt.id === "string" &&
+            /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(attempt.id) &&
+            typeof attempt.at === "string" &&
+            validIso(attempt.at) &&
+            (attempt.runtimeVersion === null ||
+                (typeof attempt.runtimeVersion === "string" &&
+                    attempt.runtimeVersion.trim() !== "" &&
+                    attempt.runtimeVersion.length <= 100)));
+    const validCompletion = completion === null ||
+        (typeof completion === "object" &&
+            !Array.isArray(completion) &&
+            Object.keys(completion).sort().join(",") ===
+                "at,attemptId,failureCode,outcome" &&
+            typeof completion.attemptId === "string" &&
+            /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(completion.attemptId) &&
+            typeof completion.at === "string" &&
+            validIso(completion.at) &&
+            ((completion.outcome === "success" &&
+                completion.failureCode === null) ||
+                (completion.outcome === "failure" &&
+                    (completion.failureCode === "invalid_input" ||
+                        completion.failureCode === "runtime_error"))));
+    if (!validAttempt ||
+        !validCompletion ||
+        (attempt === null && completion !== null)) {
+        return null;
+    }
+    if (attempt !== null &&
+        completion !== null &&
+        typeof completion.attemptId === "string" &&
+        typeof completion.at === "string" &&
+        typeof attempt.id === "string" &&
+        typeof attempt.at === "string" &&
+        (completion.attemptId === attempt.id
+            ? Date.parse(completion.at) < Date.parse(attempt.at)
+            : Date.parse(completion.at) > Date.parse(attempt.at))) {
+        return null;
+    }
+    return value;
+}
+function latestInvocationAttempt(record) {
+    const value = record?.lastAttempt;
+    if (value === null ||
+        value === undefined ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        typeof value.id !== "string" ||
+        typeof value.at !== "string") {
+        return null;
+    }
+    return { id: value.id, at: value.at };
+}
+export function createIntegrationInvocationAttempt(integrationId, options = {}) {
+    const normalizedId = normalizedIntegrationId(integrationId);
+    const attemptId = randomUUID();
+    const attemptedAt = dateIso(options.now ?? new Date(), "now");
+    const runtimeVersion = options.runtimeVersion === undefined || options.runtimeVersion === null
+        ? null
+        : boundedString(options.runtimeVersion, "runtimeVersion", 100);
+    return {
+        id: attemptId,
+        integrationId: normalizedId,
+        attemptedAt,
+        runtimeVersion,
+    };
+}
+export async function recordIntegrationInvocationAttempt(store, attempt) {
+    const normalizedId = normalizedIntegrationId(attempt.integrationId);
+    const attemptId = boundedString(attempt.id, "attemptId", 100);
+    const attemptedAt = dateIso(new Date(attempt.attemptedAt), "attemptedAt");
+    const runtimeVersion = attempt.runtimeVersion === null
+        ? null
+        : boundedString(attempt.runtimeVersion, "runtimeVersion", 100);
+    await store.updateState(integrationInvocationStateKey(normalizedId), (current) => {
+        const previous = invocationRecord(current, normalizedId);
+        const previousAttempt = latestInvocationAttempt(previous);
+        if (previousAttempt !== null) {
+            const chronology = Date.parse(previousAttempt.at) - Date.parse(attemptedAt);
+            if (chronology > 0 ||
+                (chronology === 0 && previousAttempt.id > attemptId) ||
+                previousAttempt.id === attemptId) {
+                return current;
+            }
+        }
+        return {
+            version: 1,
+            integrationId: normalizedId,
+            lastAttempt: {
+                id: attemptId,
+                at: attemptedAt,
+                runtimeVersion,
+            },
+            lastCompletion: previous?.lastCompletion ?? null,
+        };
+    }, new Date(attemptedAt), {
+        recoverCorrupt: true,
+        validateCurrent: (current) => invocationRecord(current, normalizedId) !== null,
+    });
+}
+export async function beginIntegrationInvocation(store, integrationId, options = {}) {
+    const attempt = createIntegrationInvocationAttempt(integrationId, options);
+    await recordIntegrationInvocationAttempt(store, attempt);
+    return attempt;
+}
+export async function recordIntegrationInvocationResult(store, attempt, outcome, now = new Date()) {
+    const normalizedId = normalizedIntegrationId(attempt.integrationId);
+    const attemptId = boundedString(attempt.id, "attemptId", 100);
+    const attemptedAt = dateIso(new Date(attempt.attemptedAt), "attemptedAt");
+    const runtimeVersion = attempt.runtimeVersion === null
+        ? null
+        : boundedString(attempt.runtimeVersion, "runtimeVersion", 100);
+    const completedAt = dateIso(now, "now");
+    if (Date.parse(completedAt) < Date.parse(attemptedAt)) {
+        throw storeError("INVALID_INPUT", "Invocation completion cannot precede its attempt");
+    }
+    if (!outcome.success &&
+        outcome.failureCode !== "invalid_input" &&
+        outcome.failureCode !== "runtime_error") {
+        throw storeError("INVALID_INPUT", "Invocation failure code is invalid");
+    }
+    await store.updateState(integrationInvocationStateKey(normalizedId), (current) => {
+        const previous = invocationRecord(current, normalizedId);
+        const previousAttempt = latestInvocationAttempt(previous);
+        if (previousAttempt !== null) {
+            const chronology = Date.parse(previousAttempt.at) - Date.parse(attemptedAt);
+            if (chronology > 0 ||
+                (chronology === 0 &&
+                    previousAttempt.id !== attemptId &&
+                    previousAttempt.id > attemptId)) {
+                return current;
+            }
+        }
+        return {
+            version: 1,
+            integrationId: normalizedId,
+            lastAttempt: {
+                id: attemptId,
+                at: attemptedAt,
+                runtimeVersion,
+            },
+            lastCompletion: outcome.success
+                ? {
+                    attemptId,
+                    at: completedAt,
+                    outcome: "success",
+                    failureCode: null,
+                }
+                : {
+                    attemptId,
+                    at: completedAt,
+                    outcome: "failure",
+                    failureCode: outcome.failureCode,
+                },
+        };
+    }, new Date(completedAt), {
+        recoverCorrupt: true,
+        validateCurrent: (current) => invocationRecord(current, normalizedId) !== null,
+    });
+}
+export async function completeIntegrationInvocation(store, attempt, outcome, now = new Date()) {
+    const normalizedId = normalizedIntegrationId(attempt.integrationId);
+    const attemptId = boundedString(attempt.id, "attemptId", 100);
+    const completedAt = dateIso(now, "now");
+    await store.updateState(integrationInvocationStateKey(normalizedId), (current) => {
+        const record = invocationRecord(current, normalizedId);
+        const lastAttempt = record?.lastAttempt !== null &&
+            typeof record?.lastAttempt === "object" &&
+            !Array.isArray(record.lastAttempt)
+            ? record.lastAttempt
+            : null;
+        if (record === null || lastAttempt?.id !== attemptId) {
+            return current ?? {
+                version: 1,
+                integrationId: normalizedId,
+                lastAttempt: null,
+                lastCompletion: null,
+            };
+        }
+        return {
+            ...record,
+            lastCompletion: outcome.success
+                ? {
+                    attemptId,
+                    at: completedAt,
+                    outcome: "success",
+                    failureCode: null,
+                }
+                : {
+                    attemptId,
+                    at: completedAt,
+                    outcome: "failure",
+                    failureCode: outcome.failureCode,
+                },
+        };
+    }, new Date(completedAt));
+}
+//# sourceMappingURL=reliability-store.js.map