@obversa/runtime 0.1.0

package/dist/storage/local.js

@@ -0,0 +1,1492 @@
+import { StorageError, validateStorageId, validateRunStoragePolicy, validateRunStorageRecord, validateArtifactScope, validateArtifactReference, validateNewArtifact, validateEventStreamRef, validateStreamRevision, validateDomainEventBatch, validateDomainEventEnvelope, findKnownSecretInEvents } from '../chunk-RZLMX3IA.js';
+import '../chunk-3L6YNPN6.js';
+import { digestJson, cloneFrozenJson, canonicalJson } from '../chunk-5GLEABOU.js';
+import { resolve, join, basename } from 'path';
+import { constants } from 'fs';
+import { rm, mkdir, readdir, lstat, open, link, unlink, realpath } from 'fs/promises';
+import { randomUUID, createHash } from 'crypto';
+import { TextDecoder as TextDecoder$1, isDeepStrictEqual } from 'util';
+
+var DEFAULT_LIMITS = {
+  maxArtifactBytes: 1048576,
+  maxTotalArtifactBytesPerRun: 16777216
+};
+var ADMISSION_FILE = /^(\d{16})\.json$/u;
+var MAX_ADMISSION_RECORD_BYTES = 4096;
+var MAX_ADMISSION_RETRIES = 1e3;
+var SHA256_DIGEST = /^sha256:[0-9a-f]{64}$/u;
+var CONTENT_POLICY_RULES = Object.freeze({
+  exact: "reject-known-secret-bytes-v1",
+  stateJson: "parse-json-and-reject-known-secret-bytes-keys-values-v1",
+  stateOther: "reject-known-secret-bytes-v1",
+  freeText: "redact-known-secrets-then-reject-known-secret-output-v1"
+});
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var encoder = new TextEncoder();
+function isJsonMediaType(mediaType) {
+  const value = mediaType.toLowerCase();
+  return value === "application/json" || value.startsWith("application/") && value.endsWith("+json") && value.length > "application/+json".length;
+}
+function storageError(code, message, details = {}) {
+  return new StorageError(code, message, details);
+}
+function nodeCode(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+}
+function digest(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function artifactPolicyDigest(limits) {
+  return digest(Buffer.from(JSON.stringify({
+    schemaVersion: 1,
+    limits: {
+      maxArtifactBytes: limits.maxArtifactBytes,
+      maxTotalArtifactBytesPerRun: limits.maxTotalArtifactBytesPerRun
+    },
+    contentModeRules: CONTENT_POLICY_RULES
+  }), "utf8"));
+}
+function admissionChecksum(entry) {
+  return digest(Buffer.from(JSON.stringify({
+    schemaVersion: entry.schemaVersion,
+    revision: entry.revision,
+    limits: {
+      maxArtifactBytes: entry.limits.maxArtifactBytes,
+      maxTotalArtifactBytesPerRun: entry.limits.maxTotalArtifactBytesPerRun
+    },
+    policyDigest: entry.policyDigest,
+    reference: {
+      schemaVersion: entry.reference.schemaVersion,
+      digest: entry.reference.digest,
+      byteLength: entry.reference.byteLength,
+      mediaType: entry.reference.mediaType,
+      purpose: entry.reference.purpose
+    }
+  }), "utf8"));
+}
+function admissionRecord(entry) {
+  return Object.freeze({
+    schemaVersion: 1,
+    revision: entry.revision,
+    limits: Object.freeze({ ...entry.limits }),
+    policyDigest: entry.policyDigest,
+    reference: entry.reference,
+    checksum: admissionChecksum(entry)
+  });
+}
+function containsKnownSecret(bytes, knownSecrets) {
+  const buffer = Buffer.from(bytes);
+  return knownSecrets.some((value) => buffer.includes(Buffer.from(value, "utf8")));
+}
+function assertSecretFree(bytes, knownSecrets, message) {
+  if (containsKnownSecret(bytes, knownSecrets)) {
+    throw storageError("KNOWN_SECRET", message);
+  }
+}
+function screenedAdmissionBytes(entry, knownSecrets) {
+  const record = admissionRecord(entry);
+  for (const value of [
+    record.policyDigest,
+    record.checksum,
+    record.reference.digest,
+    record.reference.mediaType,
+    record.reference.purpose
+  ]) {
+    assertSecretFree(
+      Buffer.from(value, "utf8"),
+      knownSecrets,
+      "Artifact admission metadata contains a known secret."
+    );
+  }
+  const bytes = Buffer.from(JSON.stringify(record), "utf8");
+  assertSecretFree(
+    bytes,
+    knownSecrets,
+    "Artifact admission metadata contains a known secret."
+  );
+  return bytes;
+}
+function jsonContainsKnownSecret(value, knownSecrets) {
+  if (typeof value === "string") {
+    return containsKnownSecret(Buffer.from(value, "utf8"), knownSecrets);
+  }
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) {
+    return value.some((item) => jsonContainsKnownSecret(item, knownSecrets));
+  }
+  return Object.entries(value).some(([key, item]) => containsKnownSecret(Buffer.from(key, "utf8"), knownSecrets) || jsonContainsKnownSecret(item, knownSecrets));
+}
+function hashedPathPart(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function validateLimits(options) {
+  const limits = {
+    maxArtifactBytes: options.maxArtifactBytes ?? DEFAULT_LIMITS.maxArtifactBytes,
+    maxTotalArtifactBytesPerRun: options.maxTotalArtifactBytesPerRun ?? DEFAULT_LIMITS.maxTotalArtifactBytesPerRun
+  };
+  for (const [name, value] of Object.entries(limits)) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw storageError(
+        "INVALID_STORED_VALUE",
+        `${name} must be a positive safe integer.`,
+        { path: `/${name}` }
+      );
+    }
+  }
+  if (limits.maxTotalArtifactBytesPerRun < limits.maxArtifactBytes) {
+    throw storageError(
+      "INVALID_STORED_VALUE",
+      "The per-run artifact limit cannot be smaller than the single-artifact limit.",
+      { path: "/maxTotalArtifactBytesPerRun" }
+    );
+  }
+  return Object.freeze(limits);
+}
+function validateKnownSecrets(values) {
+  const result = [...new Set(values ?? [])];
+  if (result.some((value) => typeof value !== "string" || value.length === 0 || /[\ud800-\udfff]/u.test(value))) {
+    throw storageError(
+      "INVALID_STORED_VALUE",
+      "Known secrets must be non-empty well-formed strings.",
+      { path: "/knownSecrets" }
+    );
+  }
+  return Object.freeze(result.sort((left, right) => right.length - left.length));
+}
+async function ensureDirectory(path) {
+  try {
+    await mkdir(path, { mode: 448 });
+  } catch (error) {
+    if (nodeCode(error) !== "EEXIST") throw error;
+  }
+  let stat;
+  try {
+    stat = await lstat(path);
+  } catch (error) {
+    throw storageError("UNSAFE_STORAGE_PATH", "Managed storage directory is unavailable.", {
+      path,
+      cause: nodeCode(error) ?? "unknown"
+    });
+  }
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw storageError(
+      "UNSAFE_STORAGE_PATH",
+      "Managed storage path must be a real directory.",
+      { path }
+    );
+  }
+}
+async function existingDirectory(path) {
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw storageError(
+        "UNSAFE_STORAGE_PATH",
+        "Managed storage path must be a real directory.",
+        { path }
+      );
+    }
+    return true;
+  } catch (error) {
+    if (nodeCode(error) === "ENOENT") return false;
+    throw error;
+  }
+}
+async function assertRegularFile(path) {
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw storageError(
+        "UNSAFE_STORAGE_PATH",
+        "Managed storage path must be a regular file.",
+        { path }
+      );
+    }
+    return true;
+  } catch (error) {
+    if (nodeCode(error) === "ENOENT") return false;
+    throw error;
+  }
+}
+function parseAdmission(value, expectedRevision, path) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw storageError("ARTIFACT_INTEGRITY", "Artifact admission is not an object.", {
+      path
+    });
+  }
+  const item = value;
+  const fields = [
+    "schemaVersion",
+    "revision",
+    "limits",
+    "policyDigest",
+    "reference",
+    "checksum"
+  ];
+  if (Object.keys(item).length !== fields.length || fields.some((field) => !Object.hasOwn(item, field)) || item.schemaVersion !== 1 || item.revision !== expectedRevision) {
+    throw storageError("ARTIFACT_INTEGRITY", "Artifact admission is invalid.", {
+      path
+    });
+  }
+  if (item.limits === null || typeof item.limits !== "object" || Array.isArray(item.limits)) {
+    throw storageError("ARTIFACT_INTEGRITY", "Artifact admission limits are invalid.", {
+      path
+    });
+  }
+  const rawLimits = item.limits;
+  if (Object.keys(rawLimits).length !== 2 || !Number.isSafeInteger(rawLimits.maxArtifactBytes) || rawLimits.maxArtifactBytes < 1 || !Number.isSafeInteger(rawLimits.maxTotalArtifactBytesPerRun) || rawLimits.maxTotalArtifactBytesPerRun < 1 || rawLimits.maxTotalArtifactBytesPerRun < rawLimits.maxArtifactBytes) {
+    throw storageError("ARTIFACT_INTEGRITY", "Artifact admission limits are invalid.", {
+      path
+    });
+  }
+  let reference;
+  try {
+    reference = validateArtifactReference(item.reference);
+  } catch (error) {
+    throw storageError("ARTIFACT_INTEGRITY", "Artifact admission reference is invalid.", {
+      path,
+      cause: error instanceof Error ? error.message : String(error)
+    });
+  }
+  if (typeof item.policyDigest !== "string" || !SHA256_DIGEST.test(item.policyDigest)) {
+    throw storageError(
+      "ARTIFACT_INTEGRITY",
+      "Artifact admission policy digest is invalid.",
+      { path }
+    );
+  }
+  const entry = {
+    schemaVersion: 1,
+    revision: expectedRevision,
+    limits: {
+      maxArtifactBytes: rawLimits.maxArtifactBytes,
+      maxTotalArtifactBytesPerRun: rawLimits.maxTotalArtifactBytesPerRun
+    },
+    policyDigest: item.policyDigest,
+    reference
+  };
+  if (item.checksum !== admissionChecksum(entry)) {
+    throw storageError("ARTIFACT_INTEGRITY", "Artifact admission checksum is invalid.", {
+      path
+    });
+  }
+  return admissionRecord(entry);
+}
+async function readBoundedFile(handle, path, maxByteLength, expectedByteLength, details = {}) {
+  const before = await handle.stat();
+  if (!before.isFile()) {
+    throw storageError(
+      "UNSAFE_STORAGE_PATH",
+      "Managed storage path must be a regular file.",
+      { ...details, path }
+    );
+  }
+  if (!Number.isSafeInteger(before.size) || before.size > maxByteLength || expectedByteLength !== void 0 && before.size !== expectedByteLength) {
+    throw storageError("ARTIFACT_INTEGRITY", "Stored bytes have an invalid length.", {
+      ...details,
+      path,
+      actualByteLength: before.size,
+      maxByteLength,
+      ...expectedByteLength === void 0 ? {} : { expectedByteLength }
+    });
+  }
+  const bytes = Buffer.alloc(before.size);
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const read = await handle.read(bytes, offset, bytes.byteLength - offset, offset);
+    if (read.bytesRead === 0) {
+      throw storageError("ARTIFACT_INTEGRITY", "Stored bytes changed while being read.", {
+        ...details,
+        path,
+        actualByteLength: offset,
+        expectedByteLength: before.size
+      });
+    }
+    offset += read.bytesRead;
+  }
+  const extra = Buffer.allocUnsafe(1);
+  const extraRead = await handle.read(extra, 0, 1, bytes.byteLength);
+  const after = await handle.stat();
+  if (extraRead.bytesRead !== 0 || after.size !== before.size) {
+    throw storageError("ARTIFACT_INTEGRITY", "Stored bytes changed while being read.", {
+      ...details,
+      path,
+      actualByteLength: after.size,
+      expectedByteLength: before.size
+    });
+  }
+  return bytes;
+}
+async function readAdmission(path, revision) {
+  if (!await assertRegularFile(path)) {
+    throw storageError("ARTIFACT_INTEGRITY", "Artifact admission disappeared.", { path });
+  }
+  let handle;
+  try {
+    handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const text = (await readBoundedFile(
+      handle,
+      path,
+      MAX_ADMISSION_RECORD_BYTES
+    )).toString("utf8");
+    try {
+      return parseAdmission(JSON.parse(text), revision, path);
+    } catch (error) {
+      if (error instanceof StorageError) throw error;
+      throw storageError("ARTIFACT_INTEGRITY", "Artifact admission contains invalid JSON.", {
+        path
+      });
+    }
+  } catch (error) {
+    if (nodeCode(error) === "ELOOP") {
+      throw storageError("UNSAFE_STORAGE_PATH", "Artifact admission is a symlink.", { path });
+    }
+    throw error;
+  } finally {
+    await handle?.close();
+  }
+}
+async function readAdmissions(directory) {
+  const records = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isSymbolicLink() || !entry.isFile()) {
+      throw storageError(
+        "UNSAFE_STORAGE_PATH",
+        "Artifact admission path must be a regular file.",
+        { path }
+      );
+    }
+    if (entry.name.startsWith(".tmp-")) continue;
+    const match = ADMISSION_FILE.exec(entry.name);
+    const revision = match ? Number(match[1]) : Number.NaN;
+    if (!Number.isSafeInteger(revision) || revision < 1) {
+      throw storageError("ARTIFACT_INTEGRITY", "Artifact admission filename is invalid.", {
+        path
+      });
+    }
+    records.push({ path, revision });
+  }
+  records.sort((left, right) => left.revision - right.revision);
+  const result = [];
+  for (const [index, record] of records.entries()) {
+    const expectedRevision = index + 1;
+    if (record.revision !== expectedRevision) {
+      throw storageError("ARTIFACT_INTEGRITY", "Artifact admission revisions are not contiguous.", {
+        expectedRevision,
+        actualRevision: record.revision
+      });
+    }
+    result.push(await readAdmission(record.path, expectedRevision));
+  }
+  return result;
+}
+function admissionFilename(revision) {
+  return `${String(revision).padStart(16, "0")}.json`;
+}
+async function syncDirectory(path) {
+  let handle;
+  try {
+    handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    await handle.sync();
+  } catch (error) {
+    if (nodeCode(error) === "ELOOP") {
+      throw storageError("UNSAFE_STORAGE_PATH", "Managed storage directory is a symlink.", {
+        path
+      });
+    }
+    throw error;
+  } finally {
+    await handle?.close();
+  }
+}
+async function commitAdmission(directory, entry, knownSecrets) {
+  const temporary = join(directory, `.tmp-${randomUUID()}`);
+  const destination = join(directory, admissionFilename(entry.revision));
+  const bytes = screenedAdmissionBytes(entry, knownSecrets);
+  let handle;
+  try {
+    handle = await open(
+      temporary,
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW,
+      384
+    );
+    await handle.writeFile(bytes);
+    await handle.sync();
+    await handle.chmod(256);
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    try {
+      await link(temporary, destination);
+      await syncDirectory(directory);
+      return "committed";
+    } catch (error) {
+      if (nodeCode(error) === "EEXIST") return "conflict";
+      throw error;
+    }
+  } finally {
+    await handle?.close();
+    await unlink(temporary).catch((error) => {
+      if (nodeCode(error) !== "ENOENT") throw error;
+    });
+  }
+}
+async function readBlob(path, reference) {
+  if (!await assertRegularFile(path)) {
+    throw storageError("ARTIFACT_NOT_FOUND", "Admitted artifact bytes are missing.", {
+      digest: reference.digest
+    });
+  }
+  let handle;
+  try {
+    handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const bytes = await readBoundedFile(
+      handle,
+      path,
+      reference.byteLength,
+      reference.byteLength,
+      { digest: reference.digest }
+    );
+    if (digest(bytes) !== reference.digest) {
+      throw storageError("ARTIFACT_INTEGRITY", "Artifact bytes do not match their reference.", {
+        digest: reference.digest
+      });
+    }
+    return Uint8Array.from(bytes);
+  } finally {
+    await handle?.close();
+  }
+}
+async function commitBlob(directory, reference, bytes) {
+  const path = join(directory, reference.digest.slice("sha256:".length));
+  if (await assertRegularFile(path)) {
+    await readBlob(path, reference);
+    return;
+  }
+  const temporary = join(directory, `.tmp-${randomUUID()}`);
+  let handle;
+  try {
+    handle = await open(
+      temporary,
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW,
+      384
+    );
+    await handle.writeFile(bytes);
+    await handle.sync();
+    await handle.chmod(256);
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    try {
+      await link(temporary, path);
+      await syncDirectory(directory);
+    } catch (error) {
+      if (nodeCode(error) !== "EEXIST") throw error;
+      await readBlob(path, reference);
+    }
+  } finally {
+    await handle?.close();
+    await unlink(temporary).catch((error) => {
+      if (nodeCode(error) !== "ENOENT") throw error;
+    });
+  }
+}
+async function assertTreeHasNoSymlink(path) {
+  for (const entry of await readdir(path, { withFileTypes: true })) {
+    const child = join(path, entry.name);
+    const stat = await lstat(child);
+    if (stat.isSymbolicLink()) {
+      throw storageError("UNSAFE_STORAGE_PATH", "Managed storage contains a symlink.", {
+        path: child
+      });
+    }
+    if (stat.isDirectory()) await assertTreeHasNoSymlink(child);
+  }
+}
+var LocalArtifactStore = class {
+  #root;
+  #limits;
+  #knownSecrets;
+  #policyDigest;
+  constructor(options) {
+    if (typeof options.root !== "string" || options.root.trim() === "") {
+      throw storageError("INVALID_STORED_VALUE", "Artifact store root must be a path.", {
+        path: "/root"
+      });
+    }
+    this.#root = resolve(options.root);
+    this.#limits = validateLimits(options);
+    this.#knownSecrets = validateKnownSecrets(options.knownSecrets);
+    this.#policyDigest = artifactPolicyDigest(this.#limits);
+  }
+  async preflightWrite(scopeValue, artifactValues) {
+    const scope = validateArtifactScope(scopeValue);
+    if (!Array.isArray(artifactValues) || artifactValues.length === 0) {
+      throw storageError(
+        "INVALID_STORED_VALUE",
+        "Artifact preflight requires a non-empty array.",
+        { path: "/artifacts" }
+      );
+    }
+    const prepared = artifactValues.map((artifact) => this.#prepareArtifact(artifact));
+    const paths = await this.#paths(scope, false);
+    const entries = paths ? await readAdmissions(paths.admissions) : [];
+    this.#assertAdmissionPolicy(entries);
+    if (paths) {
+      const verified = /* @__PURE__ */ new Set();
+      for (const item of prepared) {
+        if (verified.has(item.reference.digest)) continue;
+        verified.add(item.reference.digest);
+        const path = this.#blobPath(paths, item.reference);
+        const admitted = entries.some((entry) => entry.reference.digest === item.reference.digest);
+        if (admitted || await assertRegularFile(path)) {
+          await readBlob(path, item.reference);
+        }
+      }
+    }
+    return this.#simulateAdmissions(entries, prepared);
+  }
+  async write(scopeValue, artifactValue) {
+    const scope = validateArtifactScope(scopeValue);
+    const prepared = this.#prepareArtifact(artifactValue);
+    const { bytes, reference } = prepared;
+    const paths = await this.#paths(scope, true);
+    const initialEntries = await readAdmissions(paths.admissions);
+    this.#assertAdmissionPolicy(initialEntries);
+    if (initialEntries.some((entry) => isDeepStrictEqual(entry.reference, reference))) {
+      await readBlob(this.#blobPath(paths, reference), reference);
+      return reference;
+    }
+    this.#assertAdmissionSafe(this.#newAdmission(reference, initialEntries.length + 1));
+    this.#assertQuota(initialEntries, reference);
+    await commitBlob(paths.blobs, reference, bytes);
+    for (let attempt = 0; attempt < MAX_ADMISSION_RETRIES; attempt += 1) {
+      const entries = await readAdmissions(paths.admissions);
+      this.#assertAdmissionPolicy(entries);
+      if (entries.some((entry2) => isDeepStrictEqual(entry2.reference, reference))) {
+        await readBlob(this.#blobPath(paths, reference), reference);
+        return reference;
+      }
+      const entry = this.#newAdmission(reference, entries.length + 1);
+      this.#assertAdmissionSafe(entry);
+      this.#assertQuota(entries, reference);
+      const result = await commitAdmission(paths.admissions, entry, this.#knownSecrets);
+      if (result === "committed") return reference;
+    }
+    throw storageError(
+      "REVISION_CONFLICT",
+      "Artifact admission changed too often to complete this write."
+    );
+  }
+  async read(scopeValue, referenceValue) {
+    const scope = validateArtifactScope(scopeValue);
+    const reference = validateArtifactReference(referenceValue);
+    const paths = await this.#paths(scope, false);
+    if (!paths) {
+      throw storageError("ARTIFACT_NOT_ADMITTED", "Artifact is not admitted for this run.", {
+        digest: reference.digest
+      });
+    }
+    const entries = await readAdmissions(paths.admissions);
+    this.#assertAdmissionPolicy(entries);
+    if (!entries.some((entry) => isDeepStrictEqual(entry.reference, reference))) {
+      throw storageError("ARTIFACT_NOT_ADMITTED", "Artifact is not admitted for this run.", {
+        digest: reference.digest
+      });
+    }
+    return readBlob(this.#blobPath(paths, reference), reference);
+  }
+  async deleteRun(scopeValue) {
+    const scope = validateArtifactScope(scopeValue);
+    const paths = await this.#paths(scope, false);
+    if (!paths) return;
+    await assertTreeHasNoSymlink(paths.run);
+    await rm(paths.run, { recursive: true });
+  }
+  #safeBytes(artifact) {
+    const source = Uint8Array.from(artifact.bytes);
+    if (artifact.contentMode === "exact") {
+      assertSecretFree(
+        source,
+        this.#knownSecrets,
+        "Exact artifact bytes contain a known secret."
+      );
+      return source;
+    }
+    if (artifact.contentMode === "state") {
+      assertSecretFree(
+        source,
+        this.#knownSecrets,
+        "State artifact bytes contain a known secret."
+      );
+      if (!isJsonMediaType(artifact.mediaType)) return source;
+      let parsed;
+      try {
+        const text2 = decoder.decode(source);
+        parsed = cloneFrozenJson(JSON.parse(text2));
+      } catch {
+        throw storageError(
+          "INVALID_STORED_VALUE",
+          "JSON state artifact bytes must contain strict JSON encoded as UTF-8.",
+          { path: "/bytes" }
+        );
+      }
+      if (jsonContainsKnownSecret(parsed, this.#knownSecrets)) {
+        throw storageError(
+          "KNOWN_SECRET",
+          "JSON state contains a known secret in a key or value."
+        );
+      }
+      return source;
+    }
+    let text;
+    try {
+      text = decoder.decode(source);
+    } catch {
+      throw storageError(
+        "INVALID_STORED_VALUE",
+        "Free-text artifact bytes must contain valid UTF-8.",
+        { path: "/bytes" }
+      );
+    }
+    for (const value of this.#knownSecrets) text = text.split(value).join("[redacted]");
+    const redacted = encoder.encode(text);
+    assertSecretFree(
+      redacted,
+      this.#knownSecrets,
+      "Redacted free text still contains a known secret."
+    );
+    return redacted;
+  }
+  #prepareArtifact(artifactValue) {
+    const artifact = validateNewArtifact(artifactValue);
+    if (artifact.sensitive) {
+      throw storageError("SENSITIVE_CONTENT", "Marked-sensitive content cannot be stored.");
+    }
+    const bytes = this.#safeBytes(artifact);
+    if (bytes.byteLength > this.#limits.maxArtifactBytes) {
+      throw storageError("STORAGE_LIMIT_EXCEEDED", "Artifact exceeds the single-artifact limit.", {
+        byteLength: bytes.byteLength,
+        maxArtifactBytes: this.#limits.maxArtifactBytes
+      });
+    }
+    const reference = Object.freeze({
+      schemaVersion: 1,
+      digest: digest(bytes),
+      byteLength: bytes.byteLength,
+      mediaType: artifact.mediaType,
+      purpose: artifact.purpose
+    });
+    return Object.freeze({ bytes, reference });
+  }
+  #newAdmission(reference, revision) {
+    return Object.freeze({
+      schemaVersion: 1,
+      revision,
+      limits: this.#limits,
+      policyDigest: this.#policyDigest,
+      reference
+    });
+  }
+  #assertAdmissionSafe(entry) {
+    screenedAdmissionBytes(entry, this.#knownSecrets);
+  }
+  #assertQuota(entries, reference) {
+    const unique = /* @__PURE__ */ new Map();
+    for (const entry of entries) {
+      unique.set(entry.reference.digest, entry.reference.byteLength);
+    }
+    const total = [...unique.values()].reduce((sum, size) => sum + size, 0);
+    if (!unique.has(reference.digest) && total + reference.byteLength > this.#limits.maxTotalArtifactBytesPerRun) {
+      throw storageError("STORAGE_LIMIT_EXCEEDED", "Artifact exceeds the per-run storage limit.", {
+        byteLength: reference.byteLength,
+        admittedBytes: total,
+        maxTotalArtifactBytesPerRun: this.#limits.maxTotalArtifactBytesPerRun
+      });
+    }
+  }
+  #simulateAdmissions(entries, artifacts) {
+    const simulated = [...entries];
+    const unique = /* @__PURE__ */ new Map();
+    for (const entry of entries) {
+      unique.set(entry.reference.digest, entry.reference.byteLength);
+    }
+    let total = [...unique.values()].reduce((sum, size) => sum + size, 0);
+    const references = [];
+    for (const artifact of artifacts) {
+      const { reference } = artifact;
+      references.push(reference);
+      if (simulated.some((entry2) => isDeepStrictEqual(entry2.reference, reference))) continue;
+      const entry = this.#newAdmission(reference, simulated.length + 1);
+      this.#assertAdmissionSafe(entry);
+      if (!unique.has(reference.digest) && total + reference.byteLength > this.#limits.maxTotalArtifactBytesPerRun) {
+        throw storageError(
+          "STORAGE_LIMIT_EXCEEDED",
+          "Artifact batch exceeds the per-run storage limit.",
+          {
+            byteLength: reference.byteLength,
+            admittedBytes: total,
+            maxTotalArtifactBytesPerRun: this.#limits.maxTotalArtifactBytesPerRun
+          }
+        );
+      }
+      if (!unique.has(reference.digest)) {
+        unique.set(reference.digest, reference.byteLength);
+        total += reference.byteLength;
+      }
+      simulated.push(admissionRecord(entry));
+    }
+    return Object.freeze(references);
+  }
+  #assertAdmissionIntegrity(entries) {
+    const first = entries[0];
+    if (entries.some((entry) => !isDeepStrictEqual(entry.limits, first?.limits) || entry.policyDigest !== first?.policyDigest)) {
+      throw storageError("ARTIFACT_INTEGRITY", "Artifact admissions change the run policy.");
+    }
+  }
+  #assertAdmissionPolicy(entries) {
+    this.#assertAdmissionIntegrity(entries);
+    const first = entries[0];
+    if (first && !isDeepStrictEqual(first.limits, this.#limits)) {
+      throw storageError(
+        "INVALID_STORED_VALUE",
+        "Artifact-store limits do not match the run admissions."
+      );
+    }
+    if (first && first.policyDigest !== this.#policyDigest) {
+      throw storageError(
+        "INVALID_STORED_VALUE",
+        "Artifact-store behavior does not match the run admissions."
+      );
+    }
+  }
+  #blobPath(paths, reference) {
+    return join(paths.blobs, reference.digest.slice("sha256:".length));
+  }
+  async #paths(scope, create) {
+    if (create) await mkdir(this.#root, { recursive: true, mode: 448 });
+    if (!await existingDirectory(this.#root)) return void 0;
+    const namespaces = join(this.#root, "namespaces");
+    const namespace = join(namespaces, hashedPathPart(scope.namespace));
+    const runs = join(namespace, "runs");
+    const run = join(runs, hashedPathPart(scope.runId));
+    const blobs = join(run, "blobs");
+    const admissions = join(run, "admissions");
+    for (const path of [namespaces, namespace, runs, run, blobs, admissions]) {
+      if (create) await ensureDirectory(path);
+      else if (!await existingDirectory(path)) return void 0;
+    }
+    return {
+      run,
+      blobs,
+      admissions
+    };
+  }
+};
+function createLocalArtifactStore(options) {
+  return new LocalArtifactStore(options);
+}
+var DEFAULT_MAX_EVENT_PAYLOAD_BYTES = 256 * 1024;
+var DEFAULT_MAX_APPEND_BATCH_BYTES = 1024 * 1024;
+var CHECKSUM_RECORD_ALLOWANCE = 1024;
+var SEGMENT_NAME = /^(\d{16})\.jsonl$/u;
+var SHA256 = /^sha256:[0-9a-f]{64}$/u;
+var UTF8_DECODER = new TextDecoder$1("utf-8", { fatal: true });
+function storageError2(code, message, details = {}) {
+  return new StorageError(code, message, details);
+}
+function positiveLimit(value, name, fallback) {
+  if (value === void 0) return fallback;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) {
+    throw storageError2(
+      "INVALID_STORED_VALUE",
+      `${name} must be a positive safe integer.`,
+      { path: `/${name}` }
+    );
+  }
+  return value;
+}
+function resolveOptions(options) {
+  if (typeof options.root !== "string" || options.root.trim().length === 0) {
+    throw storageError2(
+      "INVALID_STORED_VALUE",
+      "Event-store root must be a non-empty path.",
+      { path: "/root" }
+    );
+  }
+  const knownSecrets = options.knownSecrets ?? [];
+  if (!Array.isArray(knownSecrets) || knownSecrets.some((secret) => typeof secret !== "string" || secret.length === 0)) {
+    throw storageError2(
+      "INVALID_STORED_VALUE",
+      "Known secrets must be non-empty strings.",
+      { path: "/knownSecrets" }
+    );
+  }
+  return Object.freeze({
+    root: resolve(options.root),
+    maxEventPayloadBytes: positiveLimit(
+      options.maxEventPayloadBytes,
+      "maxEventPayloadBytes",
+      DEFAULT_MAX_EVENT_PAYLOAD_BYTES
+    ),
+    maxAppendBatchBytes: positiveLimit(
+      options.maxAppendBatchBytes,
+      "maxAppendBatchBytes",
+      DEFAULT_MAX_APPEND_BATCH_BYTES
+    ),
+    knownSecrets: Object.freeze([...knownSecrets])
+  });
+}
+function isNodeError(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+async function existingDirectory2(path) {
+  try {
+    const item = await lstat(path);
+    if (item.isSymbolicLink() || !item.isDirectory()) {
+      throw storageError2(
+        "UNSAFE_STORAGE_PATH",
+        "Event-store path contains a symlink or non-directory component.",
+        { path }
+      );
+    }
+    return true;
+  } catch (error) {
+    if (isNodeError(error, "ENOENT")) return false;
+    throw error;
+  }
+}
+async function createContainedDirectory(path) {
+  try {
+    await mkdir(path, { mode: 448 });
+  } catch (error) {
+    if (!isNodeError(error, "EEXIST")) throw error;
+  }
+  if (!await existingDirectory2(path)) {
+    throw storageError2(
+      "UNSAFE_STORAGE_PATH",
+      "Event-store directory disappeared during creation.",
+      { path }
+    );
+  }
+}
+async function rootDirectory(options) {
+  await mkdir(options.root, { recursive: true, mode: 448 });
+  if (!await existingDirectory2(options.root)) {
+    throw storageError2(
+      "UNSAFE_STORAGE_PATH",
+      "Event-store root disappeared during creation.",
+      { path: options.root }
+    );
+  }
+  const root = await realpath(options.root);
+  const item = await lstat(root);
+  if (!item.isDirectory()) {
+    throw storageError2(
+      "UNSAFE_STORAGE_PATH",
+      "Event-store root is not a directory.",
+      { path: options.root }
+    );
+  }
+  return root;
+}
+var PATH_PARTS = ["namespaces", "streams", "segments"];
+async function ensureStreamDirectories(options, stream) {
+  const root = await rootDirectory(options);
+  const namespaces = join(root, PATH_PARTS[0]);
+  await createContainedDirectory(namespaces);
+  const namespace = join(namespaces, storagePathComponent(stream.namespace));
+  await createContainedDirectory(namespace);
+  const streams = join(namespace, PATH_PARTS[1]);
+  await createContainedDirectory(streams);
+  const streamDirectory = join(streams, storagePathComponent(stream.streamId));
+  await createContainedDirectory(streamDirectory);
+  const segments = join(streamDirectory, PATH_PARTS[2]);
+  await createContainedDirectory(segments);
+  const temporary = join(streamDirectory, ".tmp");
+  await createContainedDirectory(temporary);
+  return { segments, temporary };
+}
+async function findStreamSegments(options, stream) {
+  if (!await existingDirectory2(options.root)) return null;
+  const root = await realpath(options.root);
+  const parts = [
+    "namespaces",
+    storagePathComponent(stream.namespace),
+    "streams",
+    storagePathComponent(stream.streamId),
+    "segments"
+  ];
+  let current = root;
+  for (const part of parts) {
+    current = join(current, part);
+    if (!await existingDirectory2(current)) return null;
+  }
+  return current;
+}
+function sha256(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function eventPolicyDigest(options) {
+  return sha256(Buffer.from(canonicalJson({
+    schemaVersion: 1,
+    maxEventPayloadBytes: options.maxEventPayloadBytes,
+    maxAppendBatchBytes: options.maxAppendBatchBytes
+  }), "utf8"));
+}
+function storagePathComponent(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+async function readBoundedFile2(path, maximumBytes) {
+  let file;
+  try {
+    file = await open(
+      path,
+      constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)
+    );
+  } catch (error) {
+    if (isNodeError(error, "ELOOP")) {
+      throw storageError2(
+        "UNSAFE_STORAGE_PATH",
+        "Event segment cannot be a symlink.",
+        { path }
+      );
+    }
+    throw error;
+  }
+  try {
+    const before = await file.stat();
+    if (!before.isFile() || before.size < 1 || before.size > maximumBytes) {
+      throw storageError2(
+        "CORRUPT_EVENT_STREAM",
+        "Event segment size is invalid or exceeds the configured read bound.",
+        { path, byteLength: before.size, maximumBytes }
+      );
+    }
+    const bytes = Buffer.alloc(before.size);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const { bytesRead } = await file.read(
+        bytes,
+        offset,
+        bytes.length - offset,
+        offset
+      );
+      if (bytesRead === 0) break;
+      offset += bytesRead;
+    }
+    const extra = Buffer.alloc(1);
+    const extraRead = await file.read(extra, 0, 1, before.size);
+    const after = await file.stat();
+    if (offset !== bytes.length || extraRead.bytesRead !== 0 || after.size !== before.size) {
+      throw storageError2(
+        "CORRUPT_EVENT_STREAM",
+        "Event segment changed while it was being read.",
+        { path }
+      );
+    }
+    return bytes;
+  } finally {
+    await file.close();
+  }
+}
+function parseJsonLine(line, path) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    throw storageError2(
+      "CORRUPT_EVENT_STREAM",
+      "Event segment contains invalid JSON.",
+      { path }
+    );
+  }
+}
+function validateChecksum(value, path) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw storageError2(
+      "CORRUPT_EVENT_STREAM",
+      "Event segment checksum must be an object.",
+      { path }
+    );
+  }
+  const record = value;
+  const fields = Object.keys(record).sort();
+  const expected = [
+    "endRevision",
+    "eventCount",
+    "policyDigest",
+    "segmentVersion",
+    "sha256",
+    "startRevision"
+  ];
+  if (fields.length !== expected.length || fields.some((field, index) => field !== expected[index]) || record.segmentVersion !== 1 || typeof record.startRevision !== "number" || !Number.isSafeInteger(record.startRevision) || record.startRevision < 1 || typeof record.endRevision !== "number" || !Number.isSafeInteger(record.endRevision) || record.endRevision < record.startRevision || typeof record.eventCount !== "number" || !Number.isSafeInteger(record.eventCount) || record.eventCount < 1 || typeof record.policyDigest !== "string" || !SHA256.test(record.policyDigest) || typeof record.sha256 !== "string" || !SHA256.test(record.sha256)) {
+    throw storageError2(
+      "CORRUPT_EVENT_STREAM",
+      "Event segment checksum record is invalid.",
+      { path }
+    );
+  }
+  return record;
+}
+function parseSegment(options, bytes, path, stream, expectedStart) {
+  let text;
+  try {
+    text = UTF8_DECODER.decode(bytes);
+  } catch {
+    throw storageError2(
+      "CORRUPT_EVENT_STREAM",
+      "Event segment contains invalid UTF-8.",
+      { path }
+    );
+  }
+  if (!text.endsWith("\n")) {
+    throw storageError2(
+      "CORRUPT_EVENT_STREAM",
+      "Event segment must end with a newline.",
+      { path }
+    );
+  }
+  const lines = text.slice(0, -1).split("\n");
+  if (lines.length < 2 || lines.some((line) => line.length === 0)) {
+    throw storageError2(
+      "CORRUPT_EVENT_STREAM",
+      "Event segment must contain events followed by one checksum record.",
+      { path }
+    );
+  }
+  const eventLines = lines.slice(0, -1);
+  const eventBytes = Buffer.from(`${eventLines.join("\n")}
+`, "utf8");
+  const checksum = validateChecksum(
+    parseJsonLine(lines.at(-1), `${path}#checksum`),
+    `${path}#checksum`
+  );
+  if (checksum.policyDigest !== eventPolicyDigest(options)) {
+    throw storageError2(
+      "INVALID_STORED_VALUE",
+      "Event-store policy does not match the committed stream.",
+      { path }
+    );
+  }
+  if (checksum.startRevision !== expectedStart || checksum.endRevision !== expectedStart + eventLines.length - 1 || checksum.eventCount !== eventLines.length || checksum.sha256 !== sha256(eventBytes)) {
+    throw storageError2(
+      "CORRUPT_EVENT_STREAM",
+      "Event segment checksum or revision range does not match its events.",
+      { path }
+    );
+  }
+  return Object.freeze(eventLines.map((line, index) => {
+    let envelope;
+    try {
+      envelope = validateDomainEventEnvelope(
+        parseJsonLine(line, `${path}#event-${index + 1}`)
+      );
+    } catch (error) {
+      if (error instanceof StorageError) {
+        throw storageError2(
+          "CORRUPT_EVENT_STREAM",
+          `Event segment contains an invalid envelope: ${error.message}`,
+          { path, eventIndex: index }
+        );
+      }
+      throw error;
+    }
+    if (envelope.streamId !== stream.streamId || envelope.revision !== expectedStart + index) {
+      throw storageError2(
+        "CORRUPT_EVENT_STREAM",
+        "Event envelope does not match its stream or revision position.",
+        { path, eventIndex: index }
+      );
+    }
+    return envelope;
+  }));
+}
+async function segmentPaths(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const names = [];
+  for (const entry of entries) {
+    if (!SEGMENT_NAME.test(entry.name) || !entry.isFile()) {
+      throw storageError2(
+        entry.isSymbolicLink() ? "UNSAFE_STORAGE_PATH" : "CORRUPT_EVENT_STREAM",
+        "Event segment directory contains an invalid entry.",
+        { path: join(directory, entry.name) }
+      );
+    }
+    names.push(entry.name);
+  }
+  names.sort();
+  return Object.freeze(names.map((name) => join(directory, name)));
+}
+async function readStreamStateFromDirectory(options, stream, directory) {
+  const paths = await segmentPaths(directory);
+  const events = [];
+  const eventIds = /* @__PURE__ */ new Set();
+  const segments = /* @__PURE__ */ new Map();
+  let nextRevision = 1;
+  for (const path of paths) {
+    const filename = basename(path);
+    const match = SEGMENT_NAME.exec(filename);
+    const namedStart = Number(match?.[1]);
+    if (namedStart !== nextRevision) {
+      throw storageError2(
+        "CORRUPT_EVENT_STREAM",
+        "Event segment filenames do not form one continuous stream.",
+        { path, expectedRevision: nextRevision }
+      );
+    }
+    const bytes = await readBoundedFile2(
+      path,
+      options.maxAppendBatchBytes + CHECKSUM_RECORD_ALLOWANCE
+    );
+    const segment = parseSegment(options, bytes, path, stream, nextRevision);
+    segments.set(namedStart, bytes);
+    for (const event of segment) {
+      if (eventIds.has(event.eventId)) {
+        throw storageError2(
+          "CORRUPT_EVENT_STREAM",
+          "Committed event stream contains a duplicate event identity.",
+          { path, eventId: event.eventId }
+        );
+      }
+      eventIds.add(event.eventId);
+      events.push(event);
+    }
+    nextRevision += segment.length;
+  }
+  return Object.freeze({
+    events: Object.freeze(events),
+    revision: nextRevision - 1,
+    segments
+  });
+}
+async function readStreamState(options, stream) {
+  const directory = await findStreamSegments(options, stream);
+  if (directory === null) {
+    return { events: [], revision: 0, segments: /* @__PURE__ */ new Map() };
+  }
+  return readStreamStateFromDirectory(options, stream, directory);
+}
+function segmentFilename(startRevision) {
+  return `${String(startRevision).padStart(16, "0")}.jsonl`;
+}
+function serializedSegment(options, envelopes) {
+  const eventBytes = Buffer.from(
+    `${envelopes.map((event) => JSON.stringify(event)).join("\n")}
+`,
+    "utf8"
+  );
+  const checksum = {
+    segmentVersion: 1,
+    policyDigest: eventPolicyDigest(options),
+    startRevision: envelopes[0].revision,
+    endRevision: envelopes.at(-1).revision,
+    eventCount: envelopes.length,
+    sha256: sha256(eventBytes)
+  };
+  return {
+    eventBytes,
+    bytes: Buffer.concat([
+      eventBytes,
+      Buffer.from(`${JSON.stringify(checksum)}
+`, "utf8")
+    ])
+  };
+}
+function validateLimitsAndSecrets(options, events, segment) {
+  for (const event of events) {
+    const byteLength = Buffer.byteLength(canonicalJson(event.payload), "utf8");
+    if (byteLength > options.maxEventPayloadBytes) {
+      throw storageError2(
+        "STORAGE_LIMIT_EXCEEDED",
+        "Event payload exceeds maxEventPayloadBytes.",
+        {
+          eventId: event.eventId,
+          byteLength,
+          maximumBytes: options.maxEventPayloadBytes
+        }
+      );
+    }
+  }
+  if (segment.eventBytes.byteLength > options.maxAppendBatchBytes) {
+    throw storageError2(
+      "STORAGE_LIMIT_EXCEEDED",
+      "Event append exceeds maxAppendBatchBytes.",
+      {
+        byteLength: segment.eventBytes.byteLength,
+        maximumBytes: options.maxAppendBatchBytes
+      }
+    );
+  }
+  const exactBytes = segment.bytes.toString("utf8");
+  const secret = findKnownSecretInEvents(
+    options.knownSecrets,
+    exactBytes,
+    events
+  );
+  if (secret !== void 0) {
+    throw storageError2(
+      "KNOWN_SECRET",
+      "Exact event bytes contain a configured known secret.",
+      { eventIds: events.map((event) => event.eventId) }
+    );
+  }
+}
+function hasExactCommittedAppend(state, expectedRevision, segment, eventCount) {
+  if (state.revision < expectedRevision + eventCount) return false;
+  return state.segments.get(expectedRevision + 1)?.equals(segment.bytes) ?? false;
+}
+async function prepareAppend(options, unsafeStream, unsafeExpectedRevision, unsafeEvents, allowCommittedRetry = false) {
+  const stream = validateEventStreamRef(unsafeStream);
+  const expectedRevision = validateStreamRevision(
+    unsafeExpectedRevision,
+    "/expectedRevision"
+  );
+  const events = validateDomainEventBatch(unsafeEvents);
+  if (expectedRevision + events.length > Number.MAX_SAFE_INTEGER) {
+    throw storageError2(
+      "STORAGE_LIMIT_EXCEEDED",
+      "Event append would exceed the maximum safe stream revision.",
+      { expectedRevision, eventCount: events.length }
+    );
+  }
+  const envelopes = Object.freeze(events.map((event, index) => validateDomainEventEnvelope({
+    ...event,
+    envelopeVersion: 1,
+    streamId: stream.streamId,
+    revision: expectedRevision + index + 1
+  })));
+  const segment = serializedSegment(options, envelopes);
+  validateLimitsAndSecrets(options, events, segment);
+  const state = await readStreamState(options, stream);
+  if (state.revision !== expectedRevision) {
+    if (allowCommittedRetry && hasExactCommittedAppend(
+      state,
+      expectedRevision,
+      segment,
+      events.length
+    )) {
+      return {
+        stream,
+        expectedRevision,
+        events,
+        segment,
+        alreadyCommitted: true
+      };
+    }
+    throw storageError2(
+      "REVISION_CONFLICT",
+      "Event stream revision does not match the append expectation.",
+      { expectedRevision, actualRevision: state.revision }
+    );
+  }
+  const eventIds = new Set(state.events.map((event) => event.eventId));
+  for (const event of events) {
+    if (eventIds.has(event.eventId)) {
+      throw storageError2(
+        "DUPLICATE_EVENT_ID",
+        "Event identity is already present in this stream or append batch.",
+        { eventId: event.eventId }
+      );
+    }
+    eventIds.add(event.eventId);
+  }
+  return {
+    stream,
+    expectedRevision,
+    events,
+    segment,
+    alreadyCommitted: false
+  };
+}
+async function syncDirectory2(path) {
+  const directory = await open(path, constants.O_RDONLY);
+  try {
+    await directory.sync();
+  } finally {
+    await directory.close();
+  }
+}
+async function commitSegment(directories, startRevision, bytes) {
+  const temporary = join(
+    directories.temporary,
+    `${segmentFilename(startRevision)}.${randomUUID()}.tmp`
+  );
+  const target = join(directories.segments, segmentFilename(startRevision));
+  const file = await open(temporary, "wx", 384);
+  try {
+    await file.writeFile(bytes);
+    await file.sync();
+    await file.chmod(256);
+    try {
+      await link(temporary, target);
+    } catch (error) {
+      if (isNodeError(error, "EEXIST")) return false;
+      throw error;
+    }
+    await syncDirectory2(directories.segments);
+    return true;
+  } finally {
+    await file.close();
+    await unlink(temporary).catch(() => void 0);
+  }
+}
+var LocalEventStore = class {
+  #options;
+  constructor(options) {
+    this.#options = resolveOptions(options);
+  }
+  async preflightAppend(stream, expectedRevision, events) {
+    await prepareAppend(this.#options, stream, expectedRevision, events);
+  }
+  async *read(unsafeStream, unsafeAfterRevision = 0) {
+    const stream = validateEventStreamRef(unsafeStream);
+    const afterRevision = validateStreamRevision(
+      unsafeAfterRevision,
+      "/afterRevision"
+    );
+    const state = await readStreamState(this.#options, stream);
+    for (const event of state.events) {
+      if (event.revision > afterRevision) yield event;
+    }
+  }
+  async append(unsafeStream, unsafeExpectedRevision, unsafeEvents) {
+    const prepared = await prepareAppend(
+      this.#options,
+      unsafeStream,
+      unsafeExpectedRevision,
+      unsafeEvents,
+      true
+    );
+    if (prepared.alreadyCommitted) {
+      return prepared.expectedRevision + prepared.events.length;
+    }
+    const directories = await ensureStreamDirectories(
+      this.#options,
+      prepared.stream
+    );
+    if (await commitSegment(
+      directories,
+      prepared.expectedRevision + 1,
+      prepared.segment.bytes
+    )) {
+      return prepared.expectedRevision + prepared.events.length;
+    }
+    const actual = await readStreamState(this.#options, prepared.stream);
+    if (hasExactCommittedAppend(
+      actual,
+      prepared.expectedRevision,
+      prepared.segment,
+      prepared.events.length
+    )) {
+      return prepared.expectedRevision + prepared.events.length;
+    }
+    throw storageError2(
+      "REVISION_CONFLICT",
+      "Another writer committed the expected stream revision first.",
+      {
+        expectedRevision: prepared.expectedRevision,
+        actualRevision: actual.revision
+      }
+    );
+  }
+};
+function createLocalEventStore(options) {
+  return new LocalEventStore(options);
+}
+
+// src/storage/local.ts
+function containsText(value, textValue) {
+  if (typeof value === "string") return value.includes(textValue);
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) {
+    return value.some((item) => containsText(item, textValue));
+  }
+  return Object.entries(value).some(([key, item]) => key.includes(textValue) || containsText(item, textValue));
+}
+function rejectKnownSecret(value, knownSecrets, label) {
+  const serialized = canonicalJson(value);
+  if (knownSecrets.some((secret) => serialized.includes(secret) || containsText(value, secret))) {
+    throw new StorageError(
+      "KNOWN_SECRET",
+      `${label} contains a configured known secret.`
+    );
+  }
+}
+function createLocalRunStorage(options) {
+  if (typeof options.directory !== "string" || options.directory.trim().length === 0) {
+    throw new StorageError(
+      "INVALID_STORED_VALUE",
+      "Local storage directory must be a non-empty path.",
+      { path: "/directory" }
+    );
+  }
+  const knownSecrets = options.knownSecrets ?? [];
+  if (!Array.isArray(knownSecrets) || knownSecrets.some((secret) => typeof secret !== "string" || secret.length === 0)) {
+    throw new StorageError(
+      "INVALID_STORED_VALUE",
+      "Known secrets must be non-empty strings.",
+      { path: "/knownSecrets" }
+    );
+  }
+  const frozenSecrets = Object.freeze([...knownSecrets]);
+  const namespace = validateStorageId(options.namespace, "/namespace");
+  const policy = validateRunStoragePolicy(options.policy);
+  const directory = resolve(options.directory);
+  const eventRoot = join(directory, "events");
+  const artifactRoot = join(directory, "artifacts");
+  const eventOptions = {
+    root: eventRoot,
+    maxEventPayloadBytes: policy.maxEventPayloadBytes,
+    maxAppendBatchBytes: policy.maxAppendBatchBytes,
+    knownSecrets: frozenSecrets
+  };
+  const artifactOptions = {
+    root: artifactRoot,
+    maxArtifactBytes: policy.maxArtifactBytes,
+    maxTotalArtifactBytesPerRun: policy.maxTotalArtifactBytesPerRun,
+    knownSecrets: frozenSecrets
+  };
+  const eventConfiguration = {
+    schemaVersion: 1,
+    root: eventRoot,
+    maxEventPayloadBytes: policy.maxEventPayloadBytes,
+    maxAppendBatchBytes: policy.maxAppendBatchBytes
+  };
+  const artifactConfiguration = {
+    schemaVersion: 1,
+    root: artifactRoot,
+    maxArtifactBytes: policy.maxArtifactBytes,
+    maxTotalArtifactBytesPerRun: policy.maxTotalArtifactBytesPerRun
+  };
+  rejectKnownSecret(eventConfiguration, frozenSecrets, "Event-store configuration");
+  rejectKnownSecret(artifactConfiguration, frozenSecrets, "Artifact-store configuration");
+  const record = validateRunStorageRecord({
+    schemaVersion: 1,
+    namespace,
+    eventStore: {
+      schemaVersion: 1,
+      name: "local-jsonl",
+      version: "1",
+      configDigest: digestJson(eventConfiguration)
+    },
+    artifactStore: {
+      schemaVersion: 1,
+      name: "local-files",
+      version: "1",
+      configDigest: digestJson(artifactConfiguration)
+    },
+    policy
+  });
+  rejectKnownSecret(record, frozenSecrets, "Storage binding record");
+  return Object.freeze({
+    record,
+    knownSecrets: frozenSecrets,
+    eventStore: createLocalEventStore(eventOptions),
+    artifactStore: createLocalArtifactStore(artifactOptions)
+  });
+}
+
+export { createLocalArtifactStore, createLocalEventStore, createLocalRunStorage };
+//# sourceMappingURL=local.js.map
+//# sourceMappingURL=local.js.map