@rulvar/core 1.108.0 → 1.109.0

package/dist/index.d.ts

@@ -5973,7 +5973,11 @@ declare class AdmissionController {
 * Folds the per-run attribution buckets into the normative CostReport.
 * Live attribution buckets never see abandoned subtrees, so a host
 * that tracked abandoned spend itself passes it as `abandoned`;
-* omitted, the report shows a gross equal to the net.
+* omitted, the report shows a gross equal to the net. Non-finite
+* numbers anywhere in the inputs are a typed refusal (RV705): this
+* exported builder is the same public surface as
+* {@link costReportFromJournal} and holds the same RV610 doctrine,
+* instead of letting an Infinity or NaN serialize into null downstream.
 */
 declare function buildCostReport(attribution: CostAttribution, totalUsd: number, abandoned?: CostReport["abandoned"]): CostReport;
 /**
@@ -9430,6 +9434,13 @@ declare class JsonlFileStore implements MetaLookupStore {
   private metaPath;
   append(runId: string, e: JournalEntry): Promise<void>;
   load(runId: string): Promise<JournalEntry[]>;
+  /**
+  * Restores the trailing '\n' of a parseable-but-unterminated tail
+  * (RV701). One byte appended in place terminates the record exactly
+  * where the crash left it; the file's bytes before it stay untouched.
+  * No-op on a missing, empty, or already-terminated journal.
+  */
+  private terminateUnterminatedTail;
   private repairTornTail;
   putMeta(m: RunMeta): Promise<void>;
   getMeta(runId: string): Promise<RunMeta | undefined>;

package/dist/index.js

@@ -1,5 +1,5 @@
 import { createCipheriv, createDecipheriv, createHash, createHmac, getRandomValues, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, closeSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path, { dirname, join, resolve, sep } from "node:path";
 import { Client } from "@modelcontextprotocol/sdk/client";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -8080,7 +8080,13 @@ async function reconcileRunMeta(store, runId, opts) {
 *
 * Contract (DEF-4 tightening):
 * - A1 atomicity: a torn trailing line (crash mid-append) is never
-*   visible in load; it is dropped and overwritten by the next append.
+*   visible in load; the incomplete fragment is dropped and overwritten
+*   by the next append. Whole records on that line are data, never
+*   fragment (RV701): a crash that persisted every JSON byte but not
+*   the '\n' leaves a parseable tail that load serves and append
+*   terminates before writing, and repair salvages complete records a
+*   glued line carries instead of discarding the line, so an entry a
+*   load has served can never be un-served by a later repair.
 * - A2 total per-run order: load returns append order, stable across
 *   calls (the kernel's per-run queue serializes appends).
 * - A3 read-your-writes: append resolves after the line is written.
@@ -8097,6 +8103,62 @@ function safeName(runId) {
 	if (!/^[A-Za-z0-9._-]+$/.test(runId)) throw new JournalOrderViolation(`JsonlFileStore: runId '${runId}' is not filesystem-safe ([A-Za-z0-9._-] only)`);
 	return runId;
 }
+/**
+* Whole JSON values glued on one line, split apart without parser
+* ambiguity (RV701): depth is tracked outside string literals only, and
+* every candidate must still round-trip JSON.parse. A line that is not a
+* clean concatenation from its first byte salvages its whole prefix
+* values and returns everything after them as the torn fragment, so the
+* caller keeps accepted records and drops exactly the unacknowledged
+* tail a crash tore.
+*/
+function splitConcatenatedJson(line) {
+	const whole = [];
+	let start = 0;
+	let depth = 0;
+	let inString = false;
+	let escaped = false;
+	for (let i = 0; i < line.length; i += 1) {
+		const ch = line[i];
+		if (inString) {
+			if (escaped) escaped = false;
+			else if (ch === "\\") escaped = true;
+			else if (ch === "\"") inString = false;
+			continue;
+		}
+		if (ch === "\"") {
+			inString = true;
+			continue;
+		}
+		if (ch === "{" || ch === "[") {
+			depth += 1;
+			continue;
+		}
+		if (ch === "}" || ch === "]") {
+			depth -= 1;
+			if (depth < 0) return {
+				whole,
+				fragment: line.slice(start)
+			};
+			if (depth === 0) {
+				const candidate = line.slice(start, i + 1);
+				try {
+					whole.push(JSON.parse(candidate));
+				} catch {
+					return {
+						whole,
+						fragment: line.slice(start)
+					};
+				}
+				start = i + 1;
+			}
+		}
+	}
+	return {
+		whole,
+		fragment: line.slice(start)
+	};
+}
 var JsonlFileStore = class {
 	dir;
 	/**
@@ -8119,6 +8181,7 @@ var JsonlFileStore = class {
 		let tail = this.lastSeq.get(runId);
 		if (tail === void 0) {
 			const existing = await this.load(runId);
+			this.terminateUnterminatedTail(runId);
 			const last = existing[existing.length - 1];
 			tail = last !== void 0 && Number.isFinite(last.seq) ? last.seq : Number.NEGATIVE_INFINITY;
 			this.lastSeq.set(runId, tail);
@@ -8144,6 +8207,7 @@ var JsonlFileStore = class {
 				entries.push(JSON.parse(line));
 			} catch (thrown) {
 				if (lines.slice(i + 1).every((rest) => rest === "")) {
+					for (const value of splitConcatenatedJson(line).whole) entries.push(value);
 					this.repairTornTail(runId, entries);
 					break;
 				}
@@ -8152,6 +8216,34 @@ var JsonlFileStore = class {
 		}
 		return entries;
 	}
+	/**
+	* Restores the trailing '\n' of a parseable-but-unterminated tail
+	* (RV701). One byte appended in place terminates the record exactly
+	* where the crash left it; the file's bytes before it stay untouched.
+	* No-op on a missing, empty, or already-terminated journal.
+	*/
+	terminateUnterminatedTail(runId) {
+		const path = this.journalPath(runId);
+		let fd;
+		try {
+			fd = openSync(path, "r");
+		} catch (thrown) {
+			if (thrown.code === "ENOENT") return;
+			throw thrown;
+		}
+		let needsNewline = false;
+		try {
+			const size = fstatSync(fd).size;
+			if (size > 0) {
+				const lastByte = /* @__PURE__ */ new Uint8Array(1);
+				readSync(fd, lastByte, 0, 1, size - 1);
+				needsNewline = lastByte[0] !== 10;
+			}
+		} finally {
+			closeSync(fd);
+		}
+		if (needsNewline) appendFileSync(path, "\n", "utf8");
+	}
 	repairTornTail(runId, whole) {
 		const path = this.journalPath(runId);
 		const temp = `${path}.tmp`;
@@ -8308,7 +8400,11 @@ function isOrchestratorAccount(scope) {
 * Folds the per-run attribution buckets into the normative CostReport.
 * Live attribution buckets never see abandoned subtrees, so a host
 * that tracked abandoned spend itself passes it as `abandoned`;
-* omitted, the report shows a gross equal to the net.
+* omitted, the report shows a gross equal to the net. Non-finite
+* numbers anywhere in the inputs are a typed refusal (RV705): this
+* exported builder is the same public surface as
+* {@link costReportFromJournal} and holds the same RV610 doctrine,
+* instead of letting an Infinity or NaN serialize into null downstream.
 */
 function buildCostReport(attribution, totalUsd, abandoned = {
 	usd: 0,
@@ -8322,7 +8418,7 @@ function buildCostReport(attribution, totalUsd, abandoned = {
 		forcedFinish: false,
 		reserveUsedUsd: 0
 	};
-	return {
+	const report = {
 		totalUsd,
 		grossUsd: totalUsd + abandoned.usd,
 		abandoned,
@@ -8336,6 +8432,8 @@ function buildCostReport(attribution, totalUsd, abandoned = {
 		},
 		unpriced: attribution.unpriced
 	};
+	requireFiniteNumbersDeep(report, "costReport");
+	return report;
 }
 /**
 * The pure journal fold: the complete CostReport from terminal entries,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.108.0",
+  "version": "1.109.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",