@orion-agents/orion-code 0.1.9 → 0.2.0

package/dist/runtime/thread-event-store.js

@@ -0,0 +1,737 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThreadEventStore = exports.ThreadEventStoreError = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const atomic_write_1 = require("../services/atomic-write");
+const file_lock_1 = require("../services/file-lock");
+const canonical_1 = require("./protocol/canonical");
+const runtime_protocol_v1_1 = require("./protocol/runtime-protocol-v1");
+const thread_projection_1 = require("./thread-projection");
+class ThreadEventStoreError extends Error {
+    constructor(code, message, offset) {
+        super(message);
+        this.code = code;
+        this.offset = offset;
+        this.name = 'ThreadEventStoreError';
+    }
+}
+exports.ThreadEventStoreError = ThreadEventStoreError;
+const DEFAULT_MAX_LOG_BYTES = 128 * 1024 * 1024;
+const DEFAULT_MAX_REPLAY_EVENTS = 10000;
+const DEFAULT_LOCK_WAIT_MS = 10000;
+/**
+ * Append-only durable fact store for a single Thread.
+ *
+ * The log is authoritative. Its projection is an atomic, rebuildable cache and
+ * is never returned when it is ahead of or divergent from the durable cursor.
+ */
+class ThreadEventStore {
+    constructor(rootDir, threadId, options = {}) {
+        this.rootDir = rootDir;
+        this.threadId = threadId;
+        this.commitListeners = new Set();
+        if (!(0, runtime_protocol_v1_1.isRuntimeId)(threadId)) {
+            throw new ThreadEventStoreError('ORION_THREAD_EVENT_IDENTITY', `ThreadEventStore threadId must be a UUID: ${threadId}`);
+        }
+        this.logPath = (0, path_1.join)(rootDir, `${threadId}.events.v1.jsonl`);
+        this.projectionPath = (0, path_1.join)(rootDir, `${threadId}.projection.v1.json`);
+        this.compactStatePath = (0, path_1.join)(rootDir, `${threadId}.compact-state.v1.json`);
+        this.compactCheckpointsDir = (0, path_1.join)(rootDir, `${threadId}.compact-checkpoints.v1`);
+        this.maxLogBytes = positiveInteger(options.maxLogBytes ?? DEFAULT_MAX_LOG_BYTES, 'maxLogBytes');
+        this.maxReplayEvents = positiveInteger(options.maxReplayEvents ?? DEFAULT_MAX_REPLAY_EVENTS, 'maxReplayEvents');
+        this.lockWaitMs = positiveInteger(options.lockWaitMs ?? DEFAULT_LOCK_WAIT_MS, 'lockWaitMs');
+        this.clock = options.clock ?? Date.now;
+        this.idFactory = options.idFactory ?? runtime_protocol_v1_1.createRuntimeId;
+        this.onBoundary = options.onBoundary;
+    }
+    appendDurable(input) {
+        return this.appendDurableBatch([input]).events[0];
+    }
+    appendDurableBatch(inputs) {
+        if (inputs.length === 0) {
+            return { events: [], projection: this.loadProjection() };
+        }
+        const commit = this.withLogLock(() => {
+            ensurePrivateDirectory(this.rootDir);
+            const scan = scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes);
+            if (scan.discardedTailBytes > 0)
+                (0, fs_1.truncateSync)(this.logPath, scan.safeByteLength);
+            let seq = scan.events.length;
+            let previousHash = scan.records.at(-1)?.hash ?? null;
+            const records = [];
+            const eventIds = new Set(scan.events.map(event => event.eventId));
+            for (const input of inputs) {
+                seq += 1;
+                const eventId = this.idFactory();
+                if (!(0, runtime_protocol_v1_1.isRuntimeId)(eventId) || eventIds.has(eventId)) {
+                    throw new ThreadEventStoreError('ORION_THREAD_EVENT_IDENTITY', `Event ID factory returned an invalid or duplicate UUID: ${eventId}`);
+                }
+                eventIds.add(eventId);
+                const event = {
+                    protocolVersion: 1,
+                    eventId,
+                    seq,
+                    threadId: this.threadId,
+                    turnId: input.turnId,
+                    stepId: input.stepId,
+                    itemId: input.itemId,
+                    durability: 'durable',
+                    timestamp: input.timestamp ?? this.clock(),
+                    payload: input.payload,
+                };
+                (0, runtime_protocol_v1_1.assertRuntimeEventEnvelopeV1)(event);
+                const hash = (0, canonical_1.digestRuntimeValue)({ version: 1, previousHash, event });
+                records.push({ version: 1, previousHash, hash, event });
+                previousHash = hash;
+            }
+            // Validate the complete lifecycle before a byte becomes durable. A bad
+            // duplicate terminal event must never poison the append-only fact log.
+            const allEvents = [...scan.events, ...records.map(record => record.event)];
+            const projection = (0, thread_projection_1.projectThreadEvents)(this.threadId, allEvents);
+            this.boundary('before_log_write', seq);
+            appendRecordsAndFlush(this.logPath, records, () => this.boundary('after_log_write', seq));
+            // appendRecordsAndFlush fsyncs before returning; this boundary is the
+            // point after which consumers may safely publish success notifications.
+            this.boundary('after_log_flush', seq);
+            fsyncDirectory(this.rootDir);
+            this.boundary('before_projection_write', seq);
+            writeProjection(this.projectionPath, projection);
+            fsyncDirectory(this.rootDir);
+            this.boundary('after_projection_write', seq);
+            return deepFreeze({ events: records.map(record => record.event), projection });
+        });
+        this.notifyCommitted(commit.events);
+        return commit;
+    }
+    /** Observe locally committed durable facts after log and projection fsync. */
+    subscribeCommitted(listener) {
+        this.commitListeners.add(listener);
+        return () => this.commitListeners.delete(listener);
+    }
+    createEphemeral(input) {
+        const cursor = this.getCursor();
+        const event = {
+            protocolVersion: 1,
+            eventId: this.idFactory(),
+            seq: cursor,
+            threadId: this.threadId,
+            turnId: input.turnId,
+            stepId: input.stepId,
+            itemId: input.itemId,
+            durability: 'ephemeral',
+            timestamp: input.timestamp ?? this.clock(),
+            payload: input.payload,
+        };
+        (0, runtime_protocol_v1_1.assertRuntimeEventEnvelopeV1)(event);
+        return deepFreeze(event);
+    }
+    replay(cursor = 0, limit = this.maxReplayEvents) {
+        if (!Number.isSafeInteger(cursor) || cursor < 0) {
+            throw new ThreadEventStoreError('ORION_THREAD_EVENT_CURSOR', 'Replay cursor must be a non-negative safe integer');
+        }
+        const safeLimit = positiveInteger(limit, 'replay limit');
+        if (safeLimit > this.maxReplayEvents) {
+            throw new ThreadEventStoreError('ORION_THREAD_EVENT_LIMIT', `Replay limit ${safeLimit} exceeds ${this.maxReplayEvents}`);
+        }
+        return this.withLogLock(() => {
+            const scan = scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes);
+            const lastSeq = scan.events.length;
+            if (cursor > lastSeq) {
+                throw new ThreadEventStoreError('ORION_THREAD_EVENT_CURSOR', `Replay cursor ${cursor} is ahead of durable cursor ${lastSeq}`);
+            }
+            const events = scan.events.slice(cursor, cursor + safeLimit);
+            const nextCursor = events.at(-1)?.seq ?? cursor;
+            return deepFreeze({
+                events,
+                fromCursor: cursor,
+                nextCursor,
+                hasMore: nextCursor < lastSeq,
+            });
+        });
+    }
+    getCursor() {
+        return this.withLogLock(() => scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes).events.length);
+    }
+    loadProjection() {
+        return this.withLogLock(() => {
+            ensurePrivateDirectory(this.rootDir);
+            const scan = scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes);
+            const replayed = (0, thread_projection_1.projectThreadEvents)(this.threadId, scan.events);
+            const cached = readProjection(this.projectionPath);
+            if (cached &&
+                cached.threadId === this.threadId &&
+                cached.cursor === replayed.cursor &&
+                cached.digest === replayed.digest &&
+                (0, thread_projection_1.verifyThreadProjectionDigest)(cached)) {
+                return deepFreeze(cached);
+            }
+            writeProjection(this.projectionPath, replayed);
+            fsyncDirectory(this.rootDir);
+            return replayed;
+        });
+    }
+    /**
+     * Load exactly the history selected by the latest committed TurnCommit or,
+     * when newer, the atomically-installed Compact checkpoint pointer.
+     */
+    loadAuthoritativeModelHistory() {
+        return this.withLogLock(() => {
+            const scan = scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes);
+            const state = readCompactState(this.compactStatePath, this.threadId);
+            if (state)
+                this.assertCompactCheckpoint(state);
+            const turnState = readLatestDurableTurnState(scan.events, this.threadId);
+            if (!state && !turnState)
+                return undefined;
+            return resolveCompactAuthority(scan.events, state, this.threadId).history;
+        });
+    }
+    /**
+     * Capture the history and TaskContext that a maintenance compact is allowed
+     * to replace. The event log and compact pointer are read under the same lock.
+     */
+    captureCompactSource(turnId) {
+        return this.withLogLock(() => {
+            ensurePrivateDirectory(this.rootDir);
+            const scan = scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes);
+            const projection = (0, thread_projection_1.projectThreadEvents)(this.threadId, scan.events);
+            assertActiveMaintenanceTurn(projection, turnId);
+            const state = readCompactState(this.compactStatePath, this.threadId);
+            if (state)
+                this.assertCompactCheckpoint(state);
+            const authoritative = resolveCompactAuthority(scan.events, state, this.threadId);
+            return deepFreeze({
+                threadId: this.threadId,
+                maintenanceTurn: {
+                    turnId,
+                    mode: 'maintenance',
+                    active: true,
+                    steerable: false,
+                },
+                cursor: projection.cursor,
+                projectionDigest: projection.digest,
+                history: authoritative.history,
+                taskContext: authoritative.taskContext,
+                taskContextRevision: authoritative.taskContextRevision,
+                activeCheckpointId: state?.pointer.checkpointId ?? null,
+            });
+        });
+    }
+    /**
+     * The only compact pointer commit boundary. Cursor/projection, history,
+     * TaskContext and the previous pointer are rechecked while the log lock is
+     * held; the checkpoint is durable before one atomic state-file rename makes
+     * the new pointer and model-visible history authoritative together.
+     */
+    appendCompactCheckpointCas(input) {
+        return this.withLogLock(() => {
+            ensurePrivateDirectory(this.rootDir);
+            ensurePrivateDirectory(this.compactCheckpointsDir);
+            validateCompactCommitInput(input, this.threadId);
+            input.onBoundary('before_cas_recheck');
+            const scan = scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes);
+            const projection = (0, thread_projection_1.projectThreadEvents)(this.threadId, scan.events);
+            const eventsAfterAnchor = scan.events.slice(input.expectedEventAnchor.cursor);
+            const onlyQueuedFollowUps = eventsAfterAnchor.length > 0 &&
+                eventsAfterAnchor.every(event => event.payload.type === 'turn.queued');
+            if (projection.cursor !== input.expectedEventAnchor.cursor && !onlyQueuedFollowUps) {
+                return { status: 'conflict', reason: 'cursor_changed' };
+            }
+            if (projection.digest !== input.expectedEventAnchor.projectionDigest &&
+                !onlyQueuedFollowUps) {
+                return { status: 'conflict', reason: 'projection_changed' };
+            }
+            assertActiveMaintenanceTurn(projection, input.source.turnId);
+            const previousState = readCompactState(this.compactStatePath, this.threadId);
+            if (previousState)
+                this.assertCompactCheckpoint(previousState);
+            const authoritative = resolveCompactAuthority(scan.events, previousState, this.threadId);
+            if (authoritative.historyDigest !== input.source.historyDigest) {
+                return { status: 'conflict', reason: 'history_changed' };
+            }
+            if (authoritative.taskContextDigest !== input.source.taskContextDigest) {
+                return { status: 'conflict', reason: 'task_context_changed' };
+            }
+            if (authoritative.taskContextRevision !== input.source.taskContextRevision) {
+                return { status: 'conflict', reason: 'task_context_revision_changed' };
+            }
+            if ((previousState?.pointer.checkpointId ?? null) !== input.source.activeCheckpointId) {
+                return { status: 'conflict', reason: 'checkpoint_pointer_changed' };
+            }
+            input.onBoundary('after_cas_recheck');
+            const checkpoint = createStoredCompactCheckpoint(this.threadId, input);
+            const checkpointPath = (0, path_1.join)(this.compactCheckpointsDir, `${input.candidate.checkpointId}.json`);
+            const existingCheckpoint = readStoredCompactCheckpoint(checkpointPath, this.threadId);
+            if (existingCheckpoint && existingCheckpoint.digest !== checkpoint.digest) {
+                throw new ThreadEventStoreError('ORION_THREAD_COMPACT_CONFLICT', `Compact checkpoint ${input.candidate.checkpointId} already contains different data`);
+            }
+            if (!existingCheckpoint) {
+                (0, atomic_write_1.atomicWriteFileSync)(checkpointPath, `${(0, canonical_1.canonicalRuntimeJson)(checkpoint)}\n`, {
+                    mode: 0o600,
+                    fsync: true,
+                });
+                fsyncDirectory(this.compactCheckpointsDir);
+            }
+            input.onBoundary('after_checkpoint_write');
+            const state = createStoredCompactState(this.threadId, input, authoritative.taskContext, authoritative.taskContextRevision);
+            (0, atomic_write_1.atomicWriteFileSync)(this.compactStatePath, `${(0, canonical_1.canonicalRuntimeJson)(state)}\n`, {
+                mode: 0o600,
+                fsync: true,
+            });
+            fsyncDirectory(this.rootDir);
+            input.onBoundary('after_pointer_commit');
+            return deepFreeze({ status: 'committed', pointer: input.commit.pointer });
+        });
+    }
+    findCompactCheckpointCommit(turnId, sourceSeq) {
+        return this.withLogLock(() => {
+            const state = readCompactState(this.compactStatePath, this.threadId);
+            if (!state)
+                return undefined;
+            return state.commit.turnId === turnId && state.commit.source.cursor === sourceSeq
+                ? state.commit
+                : undefined;
+        });
+    }
+    listCompactEvents() {
+        return this.withLogLock(() => {
+            const scan = scanThreadEventLog(this.logPath, this.threadId, this.maxLogBytes);
+            return deepFreeze(scan.events.filter((event) => event.payload.type === 'compact.started' ||
+                event.payload.type === 'compact.completed' ||
+                event.payload.type === 'compact.failed'));
+        });
+    }
+    /**
+     * Converts orphaned started items to an explicit indeterminate terminal
+     * state, then interrupts their active turn. This never guesses success.
+     */
+    recoverIncomplete(reason = 'runtime_restarted_before_terminal_commit') {
+        const projection = this.loadProjection();
+        const openItems = Object.values(projection.items).filter(item => item.status === 'started');
+        const inputs = openItems.map(item => ({
+            turnId: item.turnId,
+            stepId: item.stepId,
+            itemId: item.itemId,
+            payload: { type: 'item.indeterminate', data: { reason } },
+        }));
+        if (projection.activeTurnId) {
+            const commit = projection.turns[projection.activeTurnId]?.commit;
+            if (commit?.terminal === 'completed') {
+                inputs.push({
+                    turnId: projection.activeTurnId,
+                    payload: {
+                        type: 'turn.completed',
+                        data: commit.outcome === undefined ? {} : { outcome: commit.outcome },
+                    },
+                });
+            }
+            else if (commit?.terminal === 'failed') {
+                inputs.push({
+                    turnId: projection.activeTurnId,
+                    payload: {
+                        type: 'turn.failed',
+                        data: { error: commit.error || 'Turn failed before terminal publication' },
+                    },
+                });
+            }
+            else {
+                inputs.push({
+                    turnId: projection.activeTurnId,
+                    payload: {
+                        type: 'turn.interrupted',
+                        data: { reason: commit?.reason ?? reason },
+                    },
+                });
+            }
+        }
+        return inputs.length > 0 ? this.appendDurableBatch(inputs).projection : projection;
+    }
+    withLogLock(operation) {
+        ensurePrivateDirectory((0, path_1.dirname)(this.logPath));
+        return (0, file_lock_1.withFileLockSync)(this.logPath, operation, { waitMs: this.lockWaitMs });
+    }
+    assertCompactCheckpoint(state) {
+        const checkpointPath = (0, path_1.join)(this.compactCheckpointsDir, `${state.pointer.checkpointId}.json`);
+        const checkpoint = readStoredCompactCheckpoint(checkpointPath, this.threadId);
+        if (!checkpoint ||
+            checkpoint.checkpointId !== state.pointer.checkpointId ||
+            checkpoint.commit.digest !== state.commit.digest ||
+            checkpoint.nextModelVisibleHistoryDigest !== state.historyDigest ||
+            checkpoint.nextModelVisibleHistoryDigest !== state.pointer.nextModelVisibleHistoryDigest) {
+            throw compactCorrupt('Compact pointer does not resolve to its committed checkpoint');
+        }
+    }
+    boundary(boundary, lastSeq) {
+        this.onBoundary?.(boundary, { threadId: this.threadId, lastSeq });
+    }
+    notifyCommitted(events) {
+        for (const listener of this.commitListeners) {
+            try {
+                listener(events);
+            }
+            catch {
+                // Durable commit observers are projections only and cannot veto facts.
+            }
+        }
+    }
+}
+exports.ThreadEventStore = ThreadEventStore;
+function scanThreadEventLog(path, threadId, maxLogBytes) {
+    if (!(0, fs_1.existsSync)(path)) {
+        return { records: [], events: [], safeByteLength: 0, discardedTailBytes: 0 };
+    }
+    const content = (0, fs_1.readFileSync)(path);
+    if (content.byteLength > maxLogBytes) {
+        throw new ThreadEventStoreError('ORION_THREAD_EVENT_LIMIT', `Thread event log exceeds ${maxLogBytes} bytes`);
+    }
+    const endsWithNewline = content.byteLength === 0 || content[content.byteLength - 1] === 0x0a;
+    const text = content.toString('utf8');
+    const allLines = text.split('\n');
+    const tail = endsWithNewline ? '' : (allLines.pop() ?? '');
+    if (endsWithNewline)
+        allLines.pop();
+    const records = [];
+    const events = [];
+    const eventIds = new Set();
+    let expectedPreviousHash = null;
+    let safeByteLength = 0;
+    for (const line of allLines) {
+        const lineBytes = Buffer.byteLength(line, 'utf8') + 1;
+        if (line.length === 0) {
+            throw corrupt('Empty record inside the durable event log', safeByteLength);
+        }
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            throw corrupt('Malformed JSON record inside the durable event log', safeByteLength);
+        }
+        const record = validateStoredRecord(value, threadId, records.length + 1, expectedPreviousHash, safeByteLength);
+        if (eventIds.has(record.event.eventId)) {
+            throw corrupt(`Duplicate eventId ${record.event.eventId}`, safeByteLength);
+        }
+        eventIds.add(record.event.eventId);
+        records.push(record);
+        events.push(record.event);
+        expectedPreviousHash = record.hash;
+        safeByteLength += lineBytes;
+    }
+    return {
+        records,
+        events,
+        safeByteLength,
+        discardedTailBytes: Buffer.byteLength(tail, 'utf8'),
+    };
+}
+function validateStoredRecord(value, threadId, expectedSeq, expectedPreviousHash, offset) {
+    if (!isRecord(value) || value.version !== 1 || !isRecord(value.event)) {
+        throw corrupt('Invalid durable record envelope', offset);
+    }
+    try {
+        (0, runtime_protocol_v1_1.assertRuntimeEventEnvelopeV1)(value.event);
+    }
+    catch (error) {
+        throw corrupt(error instanceof Error ? error.message : 'Invalid runtime event', offset);
+    }
+    const event = value.event;
+    if (event.durability !== 'durable')
+        throw corrupt('Ephemeral event found in durable log', offset);
+    if (event.threadId !== threadId)
+        throw corrupt('Thread identity changed inside event log', offset);
+    if (event.seq !== expectedSeq) {
+        throw corrupt(`Expected durable seq ${expectedSeq}, found ${event.seq}`, offset);
+    }
+    if (value.previousHash !== expectedPreviousHash) {
+        throw corrupt('Event hash chain predecessor mismatch', offset);
+    }
+    if (typeof value.hash !== 'string')
+        throw corrupt('Event record hash is missing', offset);
+    const expectedHash = (0, canonical_1.digestRuntimeValue)({
+        version: 1,
+        previousHash: expectedPreviousHash,
+        event,
+    });
+    if (value.hash !== expectedHash)
+        throw corrupt('Event record hash mismatch', offset);
+    return {
+        version: 1,
+        previousHash: expectedPreviousHash,
+        hash: value.hash,
+        event,
+    };
+}
+function appendRecordsAndFlush(path, records, afterWrite) {
+    const fd = (0, fs_1.openSync)(path, 'a', 0o600);
+    try {
+        for (const record of records)
+            writeAll(fd, Buffer.from(`${(0, canonical_1.canonicalRuntimeJson)(record)}\n`));
+        afterWrite();
+        (0, fs_1.fsyncSync)(fd);
+    }
+    finally {
+        (0, fs_1.closeSync)(fd);
+    }
+}
+function writeAll(fd, content) {
+    let offset = 0;
+    while (offset < content.byteLength) {
+        const written = (0, fs_1.writeSync)(fd, content, offset, content.byteLength - offset);
+        if (written <= 0)
+            throw new Error('Unable to append durable event record');
+        offset += written;
+    }
+}
+function writeProjection(path, projection) {
+    (0, atomic_write_1.atomicWriteFileSync)(path, `${(0, canonical_1.canonicalRuntimeJson)(projection)}\n`, { mode: 0o600, fsync: true });
+}
+function readProjection(path) {
+    if (!(0, fs_1.existsSync)(path))
+        return null;
+    try {
+        const value = JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+        return value?.version === 1 && typeof value.digest === 'string' ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function ensurePrivateDirectory(path) {
+    (0, fs_1.mkdirSync)(path, { recursive: true, mode: 0o700 });
+}
+function fsyncDirectory(path) {
+    let fd;
+    try {
+        fd = (0, fs_1.openSync)(path, 'r');
+        (0, fs_1.fsyncSync)(fd);
+    }
+    catch {
+        // Some filesystems do not support directory fsync. File fsync and atomic
+        // rename still preserve the fail-closed ordering used by the store.
+    }
+    finally {
+        if (fd !== undefined)
+            (0, fs_1.closeSync)(fd);
+    }
+}
+function assertActiveMaintenanceTurn(projection, turnId) {
+    const turn = projection.turns[turnId];
+    if (!(0, runtime_protocol_v1_1.isRuntimeId)(turnId) ||
+        projection.activeTurnId !== turnId ||
+        !turn ||
+        turn.status !== 'active' ||
+        turn.mode !== 'maintenance') {
+        throw new ThreadEventStoreError('ORION_THREAD_COMPACT_INVALID', `Compact requires ${turnId} to be the active maintenance turn`);
+    }
+}
+function resolveCompactAuthority(events, compactState, threadId) {
+    const turnState = readLatestDurableTurnState(events, threadId);
+    if (!turnState && !compactState) {
+        throw new ThreadEventStoreError('ORION_THREAD_COMPACT_INVALID', 'Compact requires a durable TurnCommitV1 source');
+    }
+    const historyOwner = compactState && (!turnState || compactState.installedAtCursor > turnState.eventSeq)
+        ? compactState
+        : turnState;
+    const taskContextOwner = turnState && (!compactState || turnState.eventSeq > compactState.installedAtCursor)
+        ? turnState
+        : compactState;
+    if (!historyOwner || !taskContextOwner) {
+        throw new ThreadEventStoreError('ORION_THREAD_COMPACT_INVALID', 'Compact authoritative state could not be resolved');
+    }
+    return deepFreeze({
+        history: structuredClone(historyOwner.history),
+        historyDigest: historyOwner.historyDigest,
+        taskContext: structuredClone(taskContextOwner.taskContext),
+        taskContextDigest: taskContextOwner.taskContextDigest,
+        taskContextRevision: taskContextOwner.taskContextRevision,
+    });
+}
+function readLatestDurableTurnState(events, threadId) {
+    const event = [...events]
+        .reverse()
+        .find(candidate => candidate.payload.type === 'turn.committed');
+    if (!event || event.payload.type !== 'turn.committed')
+        return null;
+    let receipt;
+    try {
+        receipt = JSON.parse(event.payload.data.receipt);
+    }
+    catch {
+        throw compactCorrupt('TurnCommitV1 receipt is not valid JSON');
+    }
+    const { digest, ...content } = receipt;
+    if (receipt.version !== 1 ||
+        receipt.threadId !== threadId ||
+        typeof digest !== 'string' ||
+        (0, canonical_1.digestRuntimeValue)(content) !== digest ||
+        typeof receipt.history !== 'string' ||
+        typeof receipt.historyDigest !== 'string' ||
+        typeof receipt.taskContext !== 'string' ||
+        typeof receipt.taskContextDigest !== 'string' ||
+        !Number.isSafeInteger(receipt.taskContextRevision) ||
+        receipt.taskContextRevision < 0) {
+        throw compactCorrupt('TurnCommitV1 receipt failed compact source validation');
+    }
+    let history;
+    let taskContext;
+    try {
+        history = JSON.parse(receipt.history);
+        taskContext = JSON.parse(receipt.taskContext);
+    }
+    catch {
+        throw compactCorrupt('TurnCommitV1 history or TaskContext is not valid JSON');
+    }
+    if (!Array.isArray(history) ||
+        (0, canonical_1.digestRuntimeValue)(history) !== receipt.historyDigest ||
+        (0, canonical_1.digestRuntimeValue)(taskContext) !== receipt.taskContextDigest) {
+        throw compactCorrupt('TurnCommitV1 history or TaskContext digest changed');
+    }
+    return deepFreeze({
+        eventSeq: event.seq,
+        history: structuredClone(history),
+        historyDigest: receipt.historyDigest,
+        taskContext: structuredClone(taskContext),
+        taskContextDigest: receipt.taskContextDigest,
+        taskContextRevision: receipt.taskContextRevision,
+    });
+}
+function validateCompactCommitInput(input, threadId) {
+    const commit = input.commit;
+    const { digest, ...content } = commit;
+    if (commit.version !== 1 ||
+        commit.threadId !== threadId ||
+        commit.threadId !== input.source.threadId ||
+        commit.turnId !== input.source.turnId ||
+        commit.source.digest !== input.source.digest ||
+        commit.startedEvent.cursor !== input.expectedEventAnchor.cursor ||
+        commit.startedEvent.projectionDigest !== input.expectedEventAnchor.projectionDigest ||
+        commit.checkpointId !== input.candidate.checkpointId ||
+        commit.checkpointDigest !== (0, canonical_1.digestRuntimeValue)(input.candidate.checkpoint) ||
+        commit.pointer.nextModelVisibleHistoryDigest !==
+            (0, canonical_1.digestRuntimeValue)(input.candidate.modelVisibleHistory) ||
+        (0, canonical_1.digestRuntimeValue)(content) !== digest ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(commit.transactionId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(commit.checkpointId)) {
+        throw compactCorrupt('Compact CAS input failed receipt validation');
+    }
+    const { digest: pointerDigest, ...pointerContent } = commit.pointer;
+    if (commit.pointer.version !== 1 ||
+        commit.pointer.checkpointId !== commit.checkpointId ||
+        commit.pointer.transactionId !== commit.transactionId ||
+        commit.pointer.sourceReceiptDigest !== commit.source.digest ||
+        (0, canonical_1.digestRuntimeValue)(pointerContent) !== pointerDigest) {
+        throw compactCorrupt('Compact pointer failed receipt validation');
+    }
+}
+function createStoredCompactCheckpoint(threadId, input) {
+    const content = {
+        version: 1,
+        threadId,
+        checkpointId: input.candidate.checkpointId,
+        checkpoint: structuredClone(input.candidate.checkpoint),
+        checkpointDigest: input.commit.checkpointDigest,
+        modelVisibleHistory: structuredClone(input.candidate.modelVisibleHistory),
+        nextModelVisibleHistoryDigest: input.commit.pointer.nextModelVisibleHistoryDigest,
+        commit: structuredClone(input.commit),
+    };
+    return deepFreeze({ ...content, digest: (0, canonical_1.digestRuntimeValue)(content) });
+}
+function createStoredCompactState(threadId, input, taskContext, taskContextRevision) {
+    const history = structuredClone(input.candidate.modelVisibleHistory);
+    const task = structuredClone(taskContext);
+    const content = {
+        version: 1,
+        threadId,
+        installedAtCursor: input.expectedEventAnchor.cursor,
+        pointer: structuredClone(input.commit.pointer),
+        history,
+        historyDigest: (0, canonical_1.digestRuntimeValue)(history),
+        taskContext: task,
+        taskContextDigest: (0, canonical_1.digestRuntimeValue)(task),
+        taskContextRevision,
+        commit: structuredClone(input.commit),
+    };
+    return deepFreeze({ ...content, digest: (0, canonical_1.digestRuntimeValue)(content) });
+}
+function readCompactState(path, threadId) {
+    if (!(0, fs_1.existsSync)(path))
+        return null;
+    let value;
+    try {
+        value = JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        throw compactCorrupt('Compact state is not valid JSON');
+    }
+    const { digest, ...content } = value;
+    if (value.version !== 1 ||
+        value.threadId !== threadId ||
+        !Number.isSafeInteger(value.installedAtCursor) ||
+        value.installedAtCursor < 0 ||
+        !Array.isArray(value.history) ||
+        (0, canonical_1.digestRuntimeValue)(value.history) !== value.historyDigest ||
+        (0, canonical_1.digestRuntimeValue)(value.taskContext) !== value.taskContextDigest ||
+        !Number.isSafeInteger(value.taskContextRevision) ||
+        value.taskContextRevision < 0 ||
+        (0, canonical_1.digestRuntimeValue)(content) !== digest ||
+        value.commit?.digest === undefined ||
+        value.pointer?.digest === undefined ||
+        value.commit.digest !== (0, canonical_1.digestRuntimeValue)(stripDigest(value.commit)) ||
+        value.pointer.digest !== (0, canonical_1.digestRuntimeValue)(stripDigest(value.pointer)) ||
+        value.commit.pointer.digest !== value.pointer.digest) {
+        throw compactCorrupt('Compact state failed integrity validation');
+    }
+    return deepFreeze(value);
+}
+function readStoredCompactCheckpoint(path, threadId) {
+    if (!(0, fs_1.existsSync)(path))
+        return null;
+    let value;
+    try {
+        value = JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        throw compactCorrupt('Compact checkpoint is not valid JSON');
+    }
+    const { digest, ...content } = value;
+    if (value.version !== 1 ||
+        value.threadId !== threadId ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(value.checkpointId) ||
+        (0, canonical_1.digestRuntimeValue)(value.checkpoint) !== value.checkpointDigest ||
+        !Array.isArray(value.modelVisibleHistory) ||
+        (0, canonical_1.digestRuntimeValue)(value.modelVisibleHistory) !== value.nextModelVisibleHistoryDigest ||
+        (0, canonical_1.digestRuntimeValue)(content) !== digest) {
+        throw compactCorrupt('Compact checkpoint failed integrity validation');
+    }
+    return deepFreeze(value);
+}
+function stripDigest(value) {
+    const { digest: _digest, ...content } = value;
+    void _digest;
+    return content;
+}
+function compactCorrupt(message) {
+    return new ThreadEventStoreError('ORION_THREAD_COMPACT_INVALID', message);
+}
+function positiveInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new ThreadEventStoreError('ORION_THREAD_EVENT_LIMIT', `${name} must be a positive safe integer`);
+    }
+    return value;
+}
+function corrupt(message, offset) {
+    return new ThreadEventStoreError('ORION_THREAD_EVENT_CORRUPT', message, offset);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null || Object.isFrozen(value))
+        return value;
+    Object.freeze(value);
+    for (const entry of Object.values(value))
+        deepFreeze(entry);
+    return value;
+}
+//# sourceMappingURL=thread-event-store.js.map