@sentropic/artifacts 0.0.0-stage → 0.1.1

package/dist/server/bindings.js

@@ -0,0 +1,60 @@
+/**
+ * L-5a — owner-scoped stable bindings (spec-v8 §9).
+ *
+ * A logical binding (owner + name) resolves to one server-allocated UUID no
+ * matter which client ensures it first; both fresh clients converge on the
+ * same identity. Another owner resolves nothing: lookup is always qualified
+ * by ownerId, so binding names and digests cannot be guessed across owners.
+ * A conflicting storage scope on an existing binding fails closed (mappings
+ * stay server-verified; ambiguous mappings never silently win). Concurrent
+ * ensures serialize on a per-key singleflight so exactly one creation wins.
+ * Persistence goes through the injected KvPort only (ports.ts).
+ */
+import { createCryptoUuid, createKeyMutex, createMemoryKv, } from './ports.js';
+function bindingKey(ownerId, bindingName) {
+    return `binding:${ownerId}:${bindingName}`;
+}
+/** Memory-backed KvPort for unit tests (re-exported from the ports module). */
+export function createMemoryBindingKv() {
+    return createMemoryKv();
+}
+/** Create a binding service over an injected KvPort (no driver imports). */
+export function createBindingService(kv, uuid = createCryptoUuid()) {
+    const mutex = createKeyMutex();
+    async function read(key) {
+        const raw = await kv.get(key);
+        if (raw === undefined)
+            return undefined;
+        return JSON.parse(raw);
+    }
+    async function ensureOnce(input) {
+        const key = bindingKey(input.ownerId, input.bindingName);
+        const found = await read(key);
+        if (found !== undefined) {
+            if (found.storageScopeId !== input.storageScopeId) {
+                throw new Error(`binding scope mismatch for ${input.bindingName}: ambiguous mappings fail closed`);
+            }
+            return { artifactId: found.artifactId, created: false };
+        }
+        const candidate = { artifactId: uuid.randomUUID(), storageScopeId: input.storageScopeId };
+        const won = await kv.putIfAbsent(key, JSON.stringify(candidate));
+        if (won)
+            return { artifactId: candidate.artifactId, created: true };
+        const raced = await read(key);
+        if (raced === undefined)
+            throw new Error(`binding lost for ${input.bindingName}`);
+        if (raced.storageScopeId !== input.storageScopeId) {
+            throw new Error(`binding scope mismatch for ${input.bindingName}: ambiguous mappings fail closed`);
+        }
+        return { artifactId: raced.artifactId, created: false };
+    }
+    return {
+        ensure(input) {
+            return mutex.runSerialized(bindingKey(input.ownerId, input.bindingName), () => ensureOnce(input));
+        },
+        async find(lookup) {
+            const stored = await read(bindingKey(lookup.ownerId, lookup.bindingName));
+            return stored?.artifactId;
+        },
+    };
+}

package/dist/server/fork.d.ts

@@ -0,0 +1,51 @@
+/**
+ * L-5c — private forks (spec-v8 §9 5c).
+ *
+ * A fork creates a private independent artifact under a fresh server UUID:
+ * manifest content is copied, the ACL is not (the forker becomes sole
+ * owner), blobs stay shared through reference counting, and provenance
+ * records the origin release. Forking a deleted or purged artifact is
+ * refused; a fork never resurrects its parent and the parent's later
+ * lifecycle never disables the fork. Storage is a port; the memory double
+ * serves unit tests.
+ */
+export type ForkableState = 'active' | 'withdrawn' | 'deleted' | 'purged';
+export interface ForkRecord {
+    artifactId: string;
+    ownerId: string;
+    releaseId: string;
+    manifest: string;
+    state: ForkableState;
+    readerIds: string[];
+    blobDigests: string[];
+}
+export interface ForkStore {
+    get(artifactId: string): Promise<ForkRecord | undefined>;
+    put(record: ForkRecord): Promise<void>;
+    setState(artifactId: string, state: ForkableState): Promise<void>;
+    addRef(digest: string): Promise<void>;
+}
+export interface ForkService {
+    fork(input: {
+        actorId: string;
+        artifactId: string;
+    }): Promise<{
+        artifactId: string;
+        ownerId: string;
+        origin: {
+            artifactId: string;
+            releaseId: string;
+        };
+    }>;
+    setState(artifactId: string, state: ForkableState): Promise<void>;
+    /** Track a parent record so hosts can sync the source of truth (no-op read). */
+    track(record: ForkRecord): Promise<void>;
+}
+/** In-memory ForkStore double for unit tests (also exposes test readers). */
+export declare function createMemoryForkStore(): ForkStore & {
+    seed(record: ForkRecord): void;
+    refcount(digest: string): number;
+    readers(artifactId: string): string[];
+};
+/** Create a fork service over an injected store (no driver imports). */
+export declare function createForkService(store: ForkStore, ids?: () => string): ForkService;

package/dist/server/fork.js

@@ -0,0 +1,75 @@
+/** In-memory ForkStore double for unit tests (also exposes test readers). */
+export function createMemoryForkStore() {
+    const records = new Map();
+    const refcounts = new Map();
+    const store = {
+        seed(record) {
+            records.set(record.artifactId, { ...record, readerIds: [...record.readerIds] });
+            for (const digest of record.blobDigests) {
+                refcounts.set(digest, (refcounts.get(digest) ?? 0) + 1);
+            }
+        },
+        refcount(digest) {
+            return refcounts.get(digest) ?? 0;
+        },
+        readers(artifactId) {
+            return [...(records.get(artifactId)?.readerIds ?? [])];
+        },
+        get(artifactId) {
+            return Promise.resolve(records.get(artifactId));
+        },
+        put(record) {
+            records.set(record.artifactId, record);
+            return Promise.resolve();
+        },
+        setState(artifactId, state) {
+            const record = records.get(artifactId);
+            if (record === undefined)
+                throw new Error(`unknown artifact: ${artifactId}`);
+            record.state = state;
+            return Promise.resolve();
+        },
+        addRef(digest) {
+            refcounts.set(digest, (refcounts.get(digest) ?? 0) + 1);
+            return Promise.resolve();
+        },
+    };
+    return store;
+}
+/** Create a fork service over an injected store (no driver imports). */
+export function createForkService(store, ids = () => crypto.randomUUID()) {
+    return {
+        async fork(input) {
+            const parent = await store.get(input.artifactId);
+            if (parent === undefined)
+                throw new Error(`unknown artifact: ${input.artifactId}`);
+            if (parent.state === 'deleted' || parent.state === 'purged') {
+                throw new Error(`cannot fork ${parent.state} artifact: ${input.artifactId}`);
+            }
+            const artifactId = ids();
+            await store.put({
+                artifactId,
+                ownerId: input.actorId,
+                releaseId: parent.releaseId,
+                manifest: parent.manifest,
+                state: 'active',
+                readerIds: [],
+                blobDigests: [...parent.blobDigests],
+            });
+            for (const digest of parent.blobDigests) {
+                await store.addRef(digest);
+            }
+            return {
+                artifactId,
+                ownerId: input.actorId,
+                origin: { artifactId: parent.artifactId, releaseId: parent.releaseId },
+            };
+        },
+        async setState(artifactId, state) {
+            await store.setState(artifactId, state);
+        },
+        async track(record) {
+            await store.put(record);
+        },
+    };
+}

package/dist/server/gc.d.ts

@@ -0,0 +1,24 @@
+import { type PublicationBlobStore } from './publication.js';
+export interface RefcountStore {
+    addRef(digest: string, holder: string): Promise<void>;
+    releaseRef(digest: string, holder: string): Promise<void>;
+    pin(digest: string, reason: string): Promise<void>;
+    unpin(digest: string, reason: string): Promise<void>;
+    count(digest: string): Promise<number>;
+    isPinned(digest: string): Promise<boolean>;
+}
+/** In-memory RefcountStore double (yields mid-update to expose races). */
+export declare function createMemoryRefcountStore(): RefcountStore;
+export interface GcReport {
+    deleted: string[];
+    retained: string[];
+    failures: {
+        key: string;
+        error: string;
+    }[];
+}
+export interface GcService {
+    collect(blobs: PublicationBlobStore, prefix: string): Promise<GcReport>;
+}
+/** Create a GC service over an injected refcount store (no driver imports). */
+export declare function createGcService(refs: RefcountStore): GcService;

package/dist/server/gc.js

@@ -0,0 +1,90 @@
+/**
+ * L-5c — garbage collection (spec-v8 §9 5c).
+ *
+ * Blobs stay alive while referenced (per-digest holder sets) or pinned
+ * (explicit retention against concurrent GC). Collection deletes only
+ * unreferenced, unpinned blobs and reports per-key failures without
+ * throwing, so revoked access, pending purge and actual erasure stay
+ * distinguishable. Reference updates serialize per digest (in-process
+ * mutex); the memory double yields mid-update to simulate store latency so
+ * races are genuinely exercised. Deleting state (refcounts vs purge) is
+ * serialized by the caller: purge dereferences first, then collects.
+ */
+import { createKeyMutex } from './ports.js';
+import { blobDigestOfKey } from './publication.js';
+/** In-memory RefcountStore double (yields mid-update to expose races). */
+export function createMemoryRefcountStore() {
+    const holders = new Map();
+    const pins = new Map();
+    const mutex = createKeyMutex();
+    return {
+        async addRef(digest, holder) {
+            await mutex.runSerialized(digest, async () => {
+                const set = holders.get(digest) ?? new Set();
+                await Promise.resolve();
+                set.add(holder);
+                holders.set(digest, set);
+            });
+        },
+        async releaseRef(digest, holder) {
+            await mutex.runSerialized(digest, async () => {
+                const set = holders.get(digest);
+                await Promise.resolve();
+                if (set === undefined || !set.has(holder)) {
+                    throw new Error(`refcount not held: ${digest} by ${holder}`);
+                }
+                set.delete(holder);
+            });
+        },
+        async pin(digest, reason) {
+            const set = pins.get(digest) ?? new Set();
+            if (set.has(reason))
+                throw new Error(`duplicate pin: ${digest} (${reason})`);
+            set.add(reason);
+            pins.set(digest, set);
+        },
+        async unpin(digest, reason) {
+            const set = pins.get(digest);
+            if (set === undefined || !set.has(reason)) {
+                throw new Error(`not pinned: ${digest} (${reason})`);
+            }
+            set.delete(reason);
+        },
+        async count(digest) {
+            return holders.get(digest)?.size ?? 0;
+        },
+        async isPinned(digest) {
+            return (pins.get(digest)?.size ?? 0) !== 0;
+        },
+    };
+}
+/** Create a GC service over an injected refcount store (no driver imports). */
+export function createGcService(refs) {
+    return {
+        async collect(blobs, prefix) {
+            const report = { deleted: [], retained: [], failures: [] };
+            for (const key of await blobs.listKeys(prefix)) {
+                let digest;
+                try {
+                    digest = blobDigestOfKey(key);
+                }
+                catch {
+                    report.retained.push(key);
+                    continue;
+                }
+                if ((await refs.count(digest)) !== 0 || (await refs.isPinned(digest))) {
+                    report.retained.push(key);
+                    continue;
+                }
+                try {
+                    await blobs.deleteBlob(key);
+                    report.deleted.push(key);
+                }
+                catch (error) {
+                    report.failures.push({ key, error: String(error) });
+                }
+            }
+            return report;
+        },
+    };
+}

package/dist/server/idempotency.d.ts

@@ -0,0 +1,23 @@
+/**
+ * L-5a — operation idempotency (spec-v8 §9).
+ *
+ * One stored result per idempotency key: the first execution runs the work
+ * and records {paramsHash, result}; replays with the same key and hash
+ * return the stored result without re-executing. A reused key with a
+ * different hash is an explicit conflict, never a silent overwrite.
+ * Executions serialize per key (in-process mutex) so concurrent replays
+ * converge without double work. Persistence goes through the injected
+ * KvPort only (ports.ts); the memory double serves unit tests.
+ */
+import { type KvPort } from './ports.js';
+export interface IdempotentResult<T> {
+    result: T;
+    replayed: boolean;
+}
+export interface IdempotencyStore {
+    execute<T>(key: string, paramsHash: string, work: () => Promise<T>): Promise<IdempotentResult<T>>;
+}
+/** Memory-backed KvPort for unit tests (re-exported from the ports module). */
+export declare function createMemoryIdempotencyKv(): KvPort;
+/** Create an idempotency store over an injected KvPort (no driver imports). */
+export declare function createIdempotencyStore(kv: KvPort): IdempotencyStore;

package/dist/server/idempotency.js

@@ -0,0 +1,38 @@
+/**
+ * L-5a — operation idempotency (spec-v8 §9).
+ *
+ * One stored result per idempotency key: the first execution runs the work
+ * and records {paramsHash, result}; replays with the same key and hash
+ * return the stored result without re-executing. A reused key with a
+ * different hash is an explicit conflict, never a silent overwrite.
+ * Executions serialize per key (in-process mutex) so concurrent replays
+ * converge without double work. Persistence goes through the injected
+ * KvPort only (ports.ts); the memory double serves unit tests.
+ */
+import { createKeyMutex, createMemoryKv } from './ports.js';
+/** Memory-backed KvPort for unit tests (re-exported from the ports module). */
+export function createMemoryIdempotencyKv() {
+    return createMemoryKv();
+}
+/** Create an idempotency store over an injected KvPort (no driver imports). */
+export function createIdempotencyStore(kv) {
+    const mutex = createKeyMutex();
+    return {
+        execute(key, paramsHash, work) {
+            const storeKey = `idempotency:${key}`;
+            return mutex.runSerialized(storeKey, async () => {
+                const raw = await kv.get(storeKey);
+                if (raw !== undefined) {
+                    const stored = JSON.parse(raw);
+                    if (stored.paramsHash !== paramsHash) {
+                        throw new Error(`idempotency conflict: key ${key} already used with different parameters`);
+                    }
+                    return { result: stored.result, replayed: true };
+                }
+                const result = await work();
+                await kv.putIfAbsent(storeKey, JSON.stringify({ paramsHash, result }));
+                return { result, replayed: false };
+            });
+        },
+    };
+}

package/dist/server/lifecycle.d.ts

@@ -0,0 +1,57 @@
+import { type AccessAction, type ArtifactAcl } from './access.js';
+import type { PublicationStateStore } from './publication.js';
+/**
+ * The current-release pointer the service promotes through. A subset of the
+ * publication state store on purpose: there is exactly one current pointer,
+ * owned by publication state (DB: `artifact_current`). Hosts must wire both
+ * services to the same backing.
+ */
+export type CurrentPointer = Pick<PublicationStateStore, 'getCurrentReleaseId' | 'compareAndSwapCurrent'>;
+export type ArtifactState = 'active' | 'withdrawn' | 'deleted' | 'purged';
+/** Release states use `ready` (not `active`) to match the releases table. */
+export type ReleaseState = 'ready' | 'retired' | 'purged';
+export interface LifecycleStore {
+    register(artifactId: string, ownerId: string): Promise<void>;
+    getOwner(artifactId: string): Promise<string | undefined>;
+    getArtifactState(artifactId: string): Promise<ArtifactState>;
+    setArtifactState(artifactId: string, state: ArtifactState): Promise<void>;
+    getRenewedAt(artifactId: string): Promise<string | undefined>;
+    setRenewedAt(artifactId: string, renewedAt: string): Promise<void>;
+    addRelease(artifactId: string, releaseId: string): Promise<void>;
+    listArtifactReleases(artifactId: string): Promise<string[]>;
+    getReleaseState(releaseId: string): Promise<ReleaseState>;
+    setReleaseState(releaseId: string, state: ReleaseState): Promise<void>;
+}
+/** In-memory LifecycleStore double for unit tests (plus a test setup alias). */
+export declare function createMemoryLifecycleStore(): LifecycleStore & {
+    setRelease(artifactId: string, releaseId: string): Promise<void>;
+};
+export interface LifecycleService {
+    /** Register an artifact owner (idempotent; production binds the DB row). */
+    register(artifactId: string, ownerId: string): Promise<void>;
+    stateOf(artifactId: string): Promise<ArtifactState>;
+    canRead(artifact: {
+        artifactId: string;
+        state: ArtifactState;
+    }, acl: ArtifactAcl, actorId: string, action?: AccessAction, isApproved?: (principalId: string) => boolean): boolean;
+    withdraw(artifactId: string, actorId: string): Promise<void>;
+    restore(artifactId: string, actorId: string): Promise<void>;
+    deleteArtifact(artifactId: string, actorId: string): Promise<void>;
+    purge(artifactId: string, actorId: string, blobDigests: string[]): Promise<{
+        artifactId: string;
+        purgedReleases: string[];
+        blobDigests: string[];
+    }>;
+    promote(artifactId: string, actorId: string, releaseId: string, expectedCurrent: string): Promise<{
+        releaseId: string;
+    }>;
+    renew(artifactId: string, actorId: string): Promise<{
+        renewedAt: string;
+    }>;
+    /** List release IDs for purge derivation (delegates to the store). */
+    listReleases(artifactId: string): Promise<string[]>;
+    /** Track a published release so promotion sees it (idempotent). */
+    trackRelease(artifactId: string, releaseId: string): Promise<void>;
+}
+/** Create a lifecycle service over an injected store (mutations owner-only). */
+export declare function createLifecycleService(store: LifecycleStore, clock?: () => string, current?: CurrentPointer): LifecycleService;

package/dist/server/lifecycle.js

@@ -0,0 +1,184 @@
+/**
+ * L-5c — lifecycle: withdraw/restore/delete/purge, promote/rollback, renew.
+ *
+ * Part 1: states and the store port. Artifact states run active → withdrawn
+ * → active (restore) or → deleted → active (undo) → purged (terminal);
+ * releases run active → retired (supplanted) → purged (cascade). `retired`
+ * is also derivable (exists but not current); the stored flag lets the
+ * Postgres adapter answer without joining the current pointer. Like
+ * production (ensureArtifact before any lifecycle step), artifacts register
+ * with their owner first. Part 2 adds the service.
+ */
+import { assertArtifactAccess } from './authorization.js';
+import { evaluateAccess } from './access.js';
+/** In-memory LifecycleStore double for unit tests (plus a test setup alias). */
+export function createMemoryLifecycleStore() {
+    const artifacts = new Map();
+    const releaseStates = new Map();
+    const store = {
+        async register(artifactId, ownerId) {
+            const entry = artifacts.get(artifactId);
+            if (entry !== undefined) {
+                if (entry.ownerId !== ownerId)
+                    throw new Error(`owner mismatch for ${artifactId}`);
+                return;
+            }
+            artifacts.set(artifactId, { ownerId, state: 'active', releases: [] });
+        },
+        async getOwner(artifactId) {
+            return artifacts.get(artifactId)?.ownerId;
+        },
+        async getArtifactState(artifactId) {
+            return artifacts.get(artifactId)?.state ?? 'active';
+        },
+        async setArtifactState(artifactId, state) {
+            const entry = artifacts.get(artifactId);
+            if (entry === undefined)
+                throw new Error(`unknown artifact: ${artifactId}`);
+            entry.state = state;
+        },
+        async getRenewedAt(artifactId) {
+            return artifacts.get(artifactId)?.renewedAt;
+        },
+        async setRenewedAt(artifactId, renewedAt) {
+            const entry = artifacts.get(artifactId);
+            if (entry === undefined)
+                throw new Error(`unknown artifact: ${artifactId}`);
+            entry.renewedAt = renewedAt;
+        },
+        async addRelease(artifactId, releaseId) {
+            const entry = artifacts.get(artifactId);
+            if (entry === undefined)
+                throw new Error(`unknown artifact: ${artifactId}`);
+            if (!entry.releases.includes(releaseId))
+                entry.releases.push(releaseId);
+            if (!releaseStates.has(releaseId))
+                releaseStates.set(releaseId, 'ready');
+        },
+        async listArtifactReleases(artifactId) {
+            return [...(artifacts.get(artifactId)?.releases ?? [])];
+        },
+        async getReleaseState(releaseId) {
+            return releaseStates.get(releaseId) ?? 'ready';
+        },
+        async setReleaseState(releaseId, state) {
+            releaseStates.set(releaseId, state);
+        },
+        async setRelease(artifactId, releaseId) {
+            await store.addRelease(artifactId, releaseId);
+        },
+    };
+    return store;
+}
+/** Create a lifecycle service over an injected store (mutations owner-only). */
+export function createLifecycleService(store, clock = () => new Date().toISOString(), current) {
+    async function ownerOf(artifactId) {
+        const owner = await store.getOwner(artifactId);
+        if (owner === undefined)
+            throw new Error(`unknown artifact: ${artifactId}`);
+        return owner;
+    }
+    async function assertOwner(artifactId, actorId) {
+        assertArtifactAccess({ actorUserId: actorId, artifactOwnerId: await ownerOf(artifactId), action: 'mutate' });
+    }
+    return {
+        async register(artifactId, ownerId) {
+            await store.register(artifactId, ownerId);
+        },
+        async stateOf(artifactId) {
+            return store.getArtifactState(artifactId);
+        },
+        canRead(artifact, acl, actorId, action = 'read', isApproved = () => false) {
+            if (artifact.state === 'deleted' || artifact.state === 'purged')
+                return false;
+            if (artifact.state === 'withdrawn')
+                return actorId === acl.ownerId;
+            return evaluateAccess(acl, actorId, action, isApproved);
+        },
+        async withdraw(artifactId, actorId) {
+            await assertOwner(artifactId, actorId);
+            const state = await store.getArtifactState(artifactId);
+            if (state === 'purged')
+                throw new Error(`cannot withdraw purged artifact: terminal ${artifactId}`);
+            if (state === 'deleted')
+                throw new Error(`cannot withdraw deleted artifact: ${artifactId}`);
+            if (state === 'withdrawn')
+                throw new Error(`already withdrawn: ${artifactId}`);
+            await store.setArtifactState(artifactId, 'withdrawn');
+        },
+        async restore(artifactId, actorId) {
+            await assertOwner(artifactId, actorId);
+            const state = await store.getArtifactState(artifactId);
+            if (state === 'purged')
+                throw new Error(`cannot restore purged artifact: terminal ${artifactId}`);
+            if (state === 'active')
+                throw new Error(`already active: ${artifactId}`);
+            await store.setArtifactState(artifactId, 'active');
+        },
+        async deleteArtifact(artifactId, actorId) {
+            await assertOwner(artifactId, actorId);
+            const state = await store.getArtifactState(artifactId);
+            if (state === 'purged')
+                throw new Error(`cannot delete purged artifact: terminal ${artifactId}`);
+            if (state === 'deleted')
+                throw new Error(`already deleted: ${artifactId}`);
+            await store.setArtifactState(artifactId, 'deleted');
+        },
+        async purge(artifactId, actorId, blobDigests) {
+            await assertOwner(artifactId, actorId);
+            const state = await store.getArtifactState(artifactId);
+            if (state !== 'deleted') {
+                throw new Error(`can only purge a deleted artifact: ${artifactId} is ${state}`);
+            }
+            const releases = await store.listArtifactReleases(artifactId);
+            for (const releaseId of releases) {
+                await store.setReleaseState(releaseId, 'purged');
+            }
+            await store.setArtifactState(artifactId, 'purged');
+            return { artifactId, purgedReleases: releases, blobDigests: [...blobDigests] };
+        },
+        async promote(artifactId, actorId, releaseId, expectedCurrent) {
+            await assertOwner(artifactId, actorId);
+            if (current === undefined)
+                throw new Error(`promotion needs a current pointer for ${artifactId}`);
+            const state = await store.getArtifactState(artifactId);
+            if (state !== 'active')
+                throw new Error(`cannot promote on ${state} artifact: ${artifactId}`);
+            const releases = await store.listArtifactReleases(artifactId);
+            if (!releases.includes(releaseId))
+                throw new Error(`unknown release: ${releaseId}`);
+            if ((await store.getReleaseState(releaseId)) === 'purged') {
+                throw new Error(`cannot promote purged release: ${releaseId}`);
+            }
+            const actual = (await current.getCurrentReleaseId(artifactId)) ?? null;
+            if (actual !== expectedCurrent) {
+                throw new Error(`promotion conflict for ${artifactId}: expected ${expectedCurrent}`);
+            }
+            const won = await current.compareAndSwapCurrent(artifactId, expectedCurrent, releaseId);
+            if (!won)
+                throw new Error(`promotion conflict for ${artifactId}: concurrent move won`);
+            if (actual !== null && actual !== releaseId) {
+                await store.setReleaseState(actual, 'retired');
+            }
+            await store.setReleaseState(releaseId, 'ready');
+            return { releaseId };
+        },
+        async renew(artifactId, actorId) {
+            await assertOwner(artifactId, actorId);
+            const state = await store.getArtifactState(artifactId);
+            if (state === 'deleted')
+                throw new Error(`cannot renew deleted artifact: ${artifactId}`);
+            if (state === 'purged')
+                throw new Error(`cannot renew purged artifact: terminal ${artifactId}`);
+            const renewedAt = clock();
+            await store.setRenewedAt(artifactId, renewedAt);
+            return { renewedAt };
+        },
+        async listReleases(artifactId) {
+            return store.listArtifactReleases(artifactId);
+        },
+        async trackRelease(artifactId, releaseId) {
+            await store.addRelease(artifactId, releaseId);
+        },
+    };
+}

package/dist/server/object-intents.d.ts

@@ -0,0 +1,41 @@
+/**
+ * L-5b — object intents (spec-v8 §9).
+ *
+ * An intent is recorded before every external object operation (blob put,
+ * release commit, promotion). Crash reprise reconciles pending intents:
+ * completed effects are marked done, missing effects are marked failed for
+ * explicit retry — a pending intent never becomes a visible release on its
+ * own. The store is a port; the memory double serves unit tests and the
+ * Postgres adapter serves the L-5b integration proof.
+ */
+import type { JsonValue } from '../contracts.js';
+export type IntentKind = 'commit-release' | 'delete-blob' | 'promote-release';
+export type IntentState = 'pending' | 'done' | 'failed';
+export interface ObjectIntent {
+    intentId: string;
+    kind: IntentKind;
+    state: IntentState;
+    payload: Record<string, JsonValue | undefined>;
+    error?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface IntentStore {
+    record(kind: IntentKind, payload: Record<string, JsonValue | undefined>): Promise<ObjectIntent>;
+    complete(intentId: string): Promise<void>;
+    markFailed(intentId: string, error: string): Promise<void>;
+    get(intentId: string): Promise<ObjectIntent | undefined>;
+    listPending(): Promise<ObjectIntent[]>;
+}
+/** In-memory IntentStore double for unit tests. */
+export declare function createMemoryIntentStore(clock?: () => string, ids?: () => string): IntentStore;
+export type IntentResolution = 'done' | 'failed';
+/**
+ * Reconcile pending intents after a crash: the resolver inspects each
+ * pending intent (effect present → done, effect missing → failed for
+ * explicit retry) and the store records the outcome. Returns the report.
+ */
+export declare function reconcileIntents(store: IntentStore, resolve: (intent: ObjectIntent) => Promise<IntentResolution>): Promise<{
+    done: string[];
+    failed: string[];
+}>;