@smeltjs/core 0.4.0 → 0.6.0

package/dist/store-dir.js

@@ -4,7 +4,7 @@ import { randomBytes } from 'node:crypto';
 import process from 'node:process';
 import { HashCollisionError, SmeltError, StoreCorruptionError, StoreFormatError, UnknownHashError, } from './errors.js';
 import { contentHash } from './hash.js';
-import { retrieveStats } from './stats.js';
+import { retrieveStats, ruleLedger } from './stats.js';
 /**
  * The format marker every store directory carries, and the one version this code
  * understands. A future layout is a new version, refused loudly by old code — never a
@@ -18,8 +18,16 @@ export const DIRECTORY_STORE_VERSION = 1;
  * key can never traverse out of `blobs/` or collide with `format.json`.
  */
 const KEY_PATTERN = /^[0-9a-f]{4,128}$/;
-/** One journal line: a kind, a space, and the hash as a JSON string literal. */
+/** One counter line: a kind, a space, and the hash as a JSON string literal. */
 const LOG_LINE = /^(hit|miss|corrupt) ("(?:[^"\\]|\\.)*")$/;
+/**
+ * One ledger line: `put`, the hash, and the rule id — both JSON string literals. A
+ * separate pattern from {@link LOG_LINE} on purpose: the counter fold matches only
+ * counter lines and skips these, exactly as a reader that predates the ledger skips a
+ * line it does not know, so a directory written by this version reads as the same
+ * counters under the previous one (`test/ledger.test.ts` pins that).
+ */
+const PUT_LINE = /^put ("(?:[^"\\]|\\.)*") ("(?:[^"\\]|\\.)*")$/;
 /**
  * A persistent {@link ElisionStore} over a content-addressed directory. `node:fs` only —
  * no SQLite, no new dependency, nothing that phones home. Elisions put here outlive the
@@ -33,6 +41,7 @@ const LOG_LINE = /^(hit|miss|corrupt) ("(?:[^"\\]|\\.)*")$/;
  *   blobs/<hash>     one file per elision: the exact UTF-8 bytes, named by their content hash
  *   tmp/             staging for atomic writes; never read, safe to sweep
  *   retrievals.log   append-only journal: `hit "<hash>"` | `miss "<hash>"` | `corrupt "<hash>"`
+ *                    | `put "<hash>" "<rule>"` (the ledger: which rule cut what)
  * ```
  *
  * **Nothing lives in memory.** Every read — `stats()` included — comes off the disk, so
@@ -129,7 +138,16 @@ export class DirectoryElisionStore {
         mkdirSync(this.#tmpDir, { recursive: true });
         this.#claimFormat(markerPath);
     }
-    put(content) {
+    put(content, reason) {
+        const hash = this.#putBlob(content);
+        // The ledger line, after the bytes are safe: attribution is bookkeeping, and a
+        // failure to write it is surfaced as a warning rather than a failed put.
+        if (reason !== undefined)
+            this.#appendLogCounting('put', hash, reason.rule);
+        return hash;
+    }
+    /** The publish itself: verify or write the blob, return its hash. */
+    #putBlob(content) {
         const hash = this.#hash(content);
         if (!KEY_PATTERN.test(hash)) {
             throw new SmeltError(`smelt: hash "${hash}" is not usable as a storage key — it must match ` +
@@ -245,6 +263,26 @@ export class DirectoryElisionStore {
     stats() {
         return retrieveStats(this.rawCounters());
     }
+    /**
+     * The per-rule ledger: a fold over the journal's `put` lines against its `hit`
+     * lines, derived by the shared `ruleLedger()`. Uncounted, and read off the disk
+     * like everything else here, so two processes agree.
+     */
+    ledger() {
+        const puts = [];
+        const hits = new Set();
+        for (const line of this.#readLog().split('\n')) {
+            const put = PUT_LINE.exec(line);
+            if (put !== null) {
+                puts.push({ hash: JSON.parse(put[1]), rule: JSON.parse(put[2]) });
+                continue;
+            }
+            const counter = LOG_LINE.exec(line);
+            if (counter !== null && counter[1] === 'hit')
+                hits.add(JSON.parse(counter[2]));
+        }
+        return ruleLedger(puts, hits);
+    }
     /** The blob's exact content, or `undefined` when no such blob is stored. */
     #readBlob(hash) {
         if (!KEY_PATTERN.test(hash))
@@ -283,9 +321,9 @@ export class DirectoryElisionStore {
      * so it is caught and surfaced as a distinct `process.emitWarning` — see the class
      * doc, and the read-only-journal case in `test/store-dir.test.ts`.
      */
-    #appendLogCounting(kind, hash) {
+    #appendLogCounting(kind, hash, rule) {
         try {
-            this.#appendLog(kind, hash);
+            this.#appendLog(kind, hash, rule);
         }
         catch (error) {
             process.emitWarning(`smelt: could not journal a "${kind}" for hash "${hash}" in ${this.#logPath} ` +
@@ -301,10 +339,13 @@ export class DirectoryElisionStore {
      * partial record with no trailing newline — can never bleed into this one: the tear
      * stays on its own line and is skipped by `stats()`, as blank lines are.
      */
-    #appendLog(kind, hash) {
+    #appendLog(kind, hash, rule) {
         const fd = openSync(this.#logPath, 'a');
         try {
-            const record = Buffer.from(`\n${kind} ${JSON.stringify(hash)}\n`, 'utf8');
+            const fields = rule === undefined
+                ? [kind, JSON.stringify(hash)]
+                : [kind, JSON.stringify(hash), JSON.stringify(rule)];
+            const record = Buffer.from(`\n${fields.join(' ')}\n`, 'utf8');
             let written = 0;
             while (written < record.length) {
                 written += writeSync(fd, record, written);

package/dist/store-dir.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-dir.js","sourceRoot":"","sources":["../src/store-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,gFAAgF;AAChF,MAAM,QAAQ,GAAG,0CAA0C,CAAC;AAW5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,MAAM,OAAO,qBAAqB;IACvB,SAAS,CAAS;IAClB,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,KAAK,CAA8B;IAE5C,YAAY,IAAY,EAAE,OAAO,GAAiC,EAAE;QAClE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QACzC,6EAA6E;QAC7E,mFAAmF;QACnF,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACrD,6EAA6E;QAC7E,gFAAgF;QAChF,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAClB,gBAAgB,IAAI,mDAAmD;gBACrE,GAAG,MAAM,CAAC,WAAW,CAAC,wDAAwD,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,gFAAgF;YAChF,0EAA0E;YAC1E,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,QAAQ,KAAK,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,8EAA8E;YAC9E,gFAAgF;YAChF,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAChE,+EAA+E;YAC/E,gFAAgF;YAChF,+EAA+E;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAY;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,wCAAwC;YAChF,cAAc,IAAI,CAAC,CAAC;YACpB,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC;QAED,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS,CAAC,gDAAgD;YAC9E,aAAa,IAAI,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;gBAAE,MAAM,IAAI,CAAC,CAAC;iBAChC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAW,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5F,CAAC;IAED,KAAK;QACH,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,IAAY;QACpB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,yBAAyB;QACxE,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,UAAU,CAAC,OAAe;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,8EAA8E;YAC9E,sEAAsE;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC9B,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,IAAgC,EAAE,IAAY;QAC/D,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,WAAW,CACjB,+BAA+B,IAAI,eAAe,IAAI,QAAQ,IAAI,CAAC,QAAQ,GAAG;gBAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB;gBAC7E,mEAAmE;gBACnE,qEAAqE,EACvE,0BAA0B,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,IAAgC,EAAE,IAAY;QACvD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1E,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC/B,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YACD,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,QAAQ;QACN,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAkB;QAC7B,MAAM,KAAK,GAAG,GAAuB,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,EAAE,sBAAsB;gBAC9B,OAAO,EAAE,uBAAuB;aACjC,CAAC,IAAI,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC9B,OAAO,SAAS,CAAC,CAAC,mCAAmC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAChE,OAAO,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACT,UAAU,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,yEAAyE;IACzE,WAAW,CAAC,UAAkB;QAC5B,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,aAAa,CAAC,UAAkB,EAAE,QAAgB;QAChD,IAAI,MAA+C,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4C,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CACxB,WAAW,UAAU,uDAAuD;gBAC1E,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAsB,IAAI,MAAM,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;YAC3F,MAAM,IAAI,gBAAgB,CACxB,WAAW,UAAU,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG;gBACxE,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,0BAA0B;gBACnE,IAAI,sBAAsB,aAAa,MAAM,CAAC,uBAAuB,CAAC,IAAI;gBAC1E,gDAAgD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,sEAAsE;IAChF,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,kFAAkF;QAClF,yEAAyE;QACzE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACpF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC","sourcesContent":["import {\n  closeSync,\n  fsyncSync,\n  linkSync,\n  mkdirSync,\n  openSync,\n  readdirSync,\n  readFileSync,\n  statSync,\n  unlinkSync,\n  writeSync,\n} from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { randomBytes } from 'node:crypto';\nimport process from 'node:process';\n\nimport {\n  HashCollisionError,\n  SmeltError,\n  StoreCorruptionError,\n  StoreFormatError,\n  UnknownHashError,\n} from './errors.ts';\nimport { contentHash } from './hash.ts';\nimport { retrieveStats } from './stats.ts';\nimport type { RawRetrieveCounters } from './stats.ts';\nimport type { ElisionStore, RetrieveStats } from './types.ts';\n\n/**\n * The format marker every store directory carries, and the one version this code\n * understands. A future layout is a new version, refused loudly by old code — never a\n * quiet reinterpretation of someone's stored bytes.\n */\nexport const DIRECTORY_STORE_FORMAT = 'smelt-elision-store';\nexport const DIRECTORY_STORE_VERSION = 1;\n\n/**\n * What a storage key may look like. `contentHash` produces 16 lowercase hex characters;\n * the pattern is wider so an injected test hash still works, and strict enough that a\n * key can never traverse out of `blobs/` or collide with `format.json`.\n */\nconst KEY_PATTERN = /^[0-9a-f]{4,128}$/;\n\n/** One journal line: a kind, a space, and the hash as a JSON string literal. */\nconst LOG_LINE = /^(hit|miss|corrupt) (\"(?:[^\"\\\\]|\\\\.)*\")$/;\n\n/** See {@link MemoryElisionStoreOptions} in `store.ts` — same escape hatch, same reason. */\nexport interface DirectoryElisionStoreOptions {\n  /**\n   * Override the hash function, so the collision branch — unreachable with sha256 —\n   * can be tested. Production has no reason to pass this.\n   */\n  readonly hash?: (content: string) => string;\n}\n\n/**\n * A persistent {@link ElisionStore} over a content-addressed directory. `node:fs` only —\n * no SQLite, no new dependency, nothing that phones home. Elisions put here outlive the\n * process, so a long-lived agent session can `retrieve()` across restarts.\n *\n * ## Storage layout\n *\n * ```text\n * <root>/\n *   format.json      { \"format\": \"smelt-elision-store\", \"version\": 1 } — refused if unknown\n *   blobs/<hash>     one file per elision: the exact UTF-8 bytes, named by their content hash\n *   tmp/             staging for atomic writes; never read, safe to sweep\n *   retrievals.log   append-only journal: `hit \"<hash>\"` | `miss \"<hash>\"` | `corrupt \"<hash>\"`\n * ```\n *\n * **Nothing lives in memory.** Every read — `stats()` included — comes off the disk, so\n * two instances over the same directory (two processes, or one process before and after\n * a restart) always agree. `stats()` is a scan; elision counts per session are small and\n * retrieval is the model asking for material back, which is rare by design.\n *\n * ## Durability\n *\n * - **Writes are crash-safe.** A blob is written to `tmp/`, `fsync`ed, then `link(2)`ed\n *   into `blobs/` — an atomic, no-clobber publish. A torn write dies in `tmp/`, where\n *   nothing looks; a name in `blobs/` always refers to a fully written file.\n * - **`fsync` is only as strong as the platform makes it.** Every flush here is Node's\n *   `fsyncSync`, which is libuv's `uv_fs_fsync`, and what that reaches the hardware with\n *   differs by platform. On Apple it is strong: libuv knows macOS's own `fsync(2)` only\n *   hands the write to the drive, so its `__APPLE__` branch issues\n *   `fcntl(fd, F_FULLFSYNC)` — a real drive-cache flush — before falling back to\n *   `F_BARRIERFSYNC` and then plain `fsync(2)`. Measured here (Node 26, libuv 1.52,\n *   internal APFS SSD): an 11-byte append costs 0.01 ms unflushed, 5.5 ms through\n *   `fsyncSync`, and 0.10 ms through a raw `fsync(2)` against 4.8 ms through a raw\n *   `F_FULLFSYNC` — the cost says which syscall is being made. Everywhere else libuv\n *   calls plain `fsync(2)`, which is as durable as the drive's honesty about its own\n *   write cache. So a **power loss** can lose a blob or a journal line this code has\n *   already `fsync`ed and reported as written on any non-Apple platform whose drive\n *   lies, and on Apple only where `F_FULLFSYNC` itself fails and libuv degrades\n *   silently — some non-APFS and network mounts. A **process** crash cannot lose one\n *   anywhere: the bytes are in the page cache and the publish is still atomic. Nothing\n *   is ever handed back unverified either way, so the worst a lost blob can produce is\n *   {@link UnknownHashError} — never wrong bytes presented as right ones. \"Crash-safe\"\n *   is the claim, deliberately not \"power-loss-proof\": the durability is real, it is\n *   just not unconditional.\n * - **Reads verify.** `retrieve()`, `peek()` and `has()` re-hash the bytes and refuse a\n *   mismatch with {@link StoreCorruptionError} — a damaged blob is never handed back as\n *   a retrieval nor reported as present, and \"we hold damaged bytes\" is distinct from\n *   {@link UnknownHashError}'s \"never existed\". The guard in\n *   `test/guards/persistent-store.test.ts` watches this.\n * - **Counters survive a restart.** Every `retrieve()` appends one `fsync`ed line to\n *   `retrievals.log`, and `stats()` is a fold over it — so `expansionRate` stays\n *   meaningful across a whole session, not just one process. A crash in the middle of\n *   an append can tear at most that one line; a torn tail is skipped, costing at most\n *   the single count that was being written when the process died.\n * - **Concurrent writers are safe.** `link(2)` refuses to clobber, so two processes\n *   putting at once race to publish and the loser verifies byte-for-byte agreement with\n *   the winner — identical content dedupes, different content under one hash is a\n *   {@link HashCollisionError}. Journal appends use `O_APPEND`. Tested with two real\n *   processes in `test/store-dir.test.ts`.\n *\n * ## No eviction\n *\n * Same rule as {@link MemoryElisionStore}: no cap, no LRU, no `clear()`. A store that\n * can forget turns Law 3 into \"reversible, usually\". Elided text is smaller than the\n * session that produced it; if disk pressure ever forces a cap, retrieval of an evicted\n * hash must throw a distinct \"evicted\" error — never {@link UnknownHashError} — so the\n * model can tell \"we lost it\" from \"never existed\". Today there is no such error because\n * there is no such cap.\n *\n * ## Two deliberate choices around the edges\n *\n * - **The root is resolved to an absolute path at construction.** Every later path is\n *   joined from that, so a `process.chdir()` after construction cannot silently\n *   re-target the store — the bytes a relative-rooted store put before a chdir would\n *   otherwise be unreachable after it, which reads exactly like data loss.\n * - **A failed journal append never withholds intact bytes.** `retrieve()`'s order of\n *   business is: read, verify, count, return. When the *count* cannot be written (a\n *   read-only journal, a full disk), the bytes are still returned — they are verified\n *   and the caller asked for them; refusing would turn a bookkeeping failure into\n *   Law 3 breaking. The failure is surfaced distinctly instead: a\n *   `process.emitWarning` with name `SmeltCounterWriteFailure`, so \"your retrieval\n *   worked\" and \"your counters just went quiet\" stay two separate facts. The same\n *   applies to the `miss`/`corrupt` journal lines: the store's own error for the\n *   lookup still wins over the journal's I/O error.\n */\nexport class DirectoryElisionStore implements ElisionStore {\n  readonly #blobsDir: string;\n  readonly #tmpDir: string;\n  readonly #logPath: string;\n  readonly #hash: (content: string) => string;\n\n  constructor(root: string, options: DirectoryElisionStoreOptions = {}) {\n    this.#hash = options.hash ?? contentHash;\n    // Resolve NOW, against the working directory the caller constructed with — a\n    // later chdir must never re-point an already-constructed store. See the class doc.\n    const absoluteRoot = resolve(root);\n    this.#blobsDir = join(absoluteRoot, 'blobs');\n    this.#tmpDir = join(absoluteRoot, 'tmp');\n    this.#logPath = join(absoluteRoot, 'retrievals.log');\n    const markerPath = join(absoluteRoot, 'format.json');\n    // Validate before mutating: a directory carrying a marker this code does not\n    // understand is refused with the directory exactly as it was found — no blobs/,\n    // no tmp/, no staged temp file created inside someone else's layout.\n    const existing = this.#readMarker(markerPath);\n    if (existing !== undefined) this.#verifyMarker(markerPath, existing);\n    mkdirSync(this.#blobsDir, { recursive: true });\n    mkdirSync(this.#tmpDir, { recursive: true });\n    this.#claimFormat(markerPath);\n  }\n\n  put(content: string): string {\n    const hash = this.#hash(content);\n    if (!KEY_PATTERN.test(hash)) {\n      throw new SmeltError(\n        `smelt: hash \"${hash}\" is not usable as a storage key — it must match ` +\n          `${String(KEY_PATTERN)} so it can name a file inside blobs/ and nothing else.`,\n      );\n    }\n    const existing = this.#readBlob(hash);\n    if (existing !== undefined) {\n      // Verify the stored bytes before comparing: a damaged blob is corruption, not a\n      // collision. Only intact bytes that still differ earn HashCollisionError.\n      if (this.#hash(existing) !== hash) throw new StoreCorruptionError(hash);\n      if (existing !== content) throw new HashCollisionError(hash);\n      return hash;\n    }\n    const tmpPath = this.#writeTemp(content);\n    try {\n      // link(2) is the atomic, no-clobber publish: it fails with EEXIST rather than\n      // overwrite, so a concurrent writer can never silently replace someone's bytes.\n      linkSync(tmpPath, join(this.#blobsDir, hash));\n    } catch (error) {\n      if ((error as { code?: string }).code !== 'EEXIST') throw error;\n      // Another writer published this hash between our existence check and our link.\n      // Same bytes: idempotent put, done. Damaged or vanished bytes: corruption — the\n      // store was torn or edited outside smelt. Intact different bytes: a collision.\n      const winner = this.#readBlob(hash);\n      if (winner === undefined || this.#hash(winner) !== hash) {\n        throw new StoreCorruptionError(hash);\n      }\n      if (winner !== content) throw new HashCollisionError(hash);\n    } finally {\n      unlinkSync(tmpPath);\n    }\n    fsyncDirBestEffort(this.#blobsDir);\n    return hash;\n  }\n\n  peek(hash: string): string | undefined {\n    const content = this.#readBlob(hash);\n    if (content === undefined) return undefined;\n    if (this.#hash(content) !== hash) throw new StoreCorruptionError(hash);\n    return content;\n  }\n\n  retrieve(hash: string): string {\n    const content = this.#readBlob(hash);\n    if (content === undefined) {\n      this.#appendLogCounting('miss', hash);\n      throw new UnknownHashError(hash);\n    }\n    if (this.#hash(content) !== hash) {\n      this.#appendLogCounting('corrupt', hash);\n      throw new StoreCorruptionError(hash);\n    }\n    this.#appendLogCounting('hit', hash);\n    return content;\n  }\n\n  /**\n   * Whether this hash can be **retrieved** — verified, exactly as {@link peek} and\n   * {@link retrieve} verify, because it is `peek()`.\n   *\n   * `has()` used to be the one read that skipped verification: a damaged blob answered\n   * `true` and then threw {@link StoreCorruptionError} on the very next line, so a\n   * consumer that checked before retrieving was told a lie by the cheaper call. The two\n   * answers now come from one place and cannot drift: `true` means the bytes are there\n   * and hash to their name, `false` means this store never held them, and damage is\n   * raised rather than hidden behind a boolean — the same distinction `peek()` draws\n   * between \"we hold damaged bytes\" and \"never existed\".\n   *\n   * It stays uncounted: a check is not the model asking for material back, and counting\n   * one would inflate `retrieveCalls` and with it the expansion rate, which is the one\n   * number this library exists to keep honest. So no journal line is written here, not\n   * even for the corrupt case — `retrieve()` journals that when the model asks.\n   *\n   * @throws {StoreCorruptionError} when the stored bytes do not hash to their name.\n   */\n  has(hash: string): boolean {\n    return this.peek(hash) !== undefined;\n  }\n\n  /**\n   * The five directly-observed counts, every one read off the disk — a scan of\n   * `blobs/` plus a fold over `retrievals.log`. See {@link RawRetrieveCounters}; the\n   * derived half of the stats comes from the shared `retrieveStats()`, never here.\n   */\n  rawCounters(): RawRetrieveCounters {\n    let elisionsStored = 0;\n    let bytesStored = 0;\n    for (const entry of readdirSync(this.#blobsDir)) {\n      if (!KEY_PATTERN.test(entry)) continue; // `.DS_Store` and friends are not blobs\n      elisionsStored += 1;\n      bytesStored += statSync(join(this.#blobsDir, entry)).size;\n    }\n\n    let retrieveCalls = 0;\n    let misses = 0;\n    const hits = new Set<string>();\n    for (const line of this.#readLog().split('\\n')) {\n      const match = LOG_LINE.exec(line);\n      if (match === null) continue; // a torn tail from a crash mid-append, or blank\n      retrieveCalls += 1;\n      if (match[1] === 'miss') misses += 1;\n      else if (match[1] === 'hit') hits.add(JSON.parse(match[2]!) as string);\n    }\n\n    return { elisionsStored, bytesStored, retrieveCalls, uniqueRetrieved: hits.size, misses };\n  }\n\n  stats(): RetrieveStats {\n    return retrieveStats(this.rawCounters());\n  }\n\n  /** The blob's exact content, or `undefined` when no such blob is stored. */\n  #readBlob(hash: string): string | undefined {\n    if (!KEY_PATTERN.test(hash)) return undefined; // never a path component\n    try {\n      return readFileSync(join(this.#blobsDir, hash), 'utf8');\n    } catch (error) {\n      if ((error as { code?: string }).code === 'ENOENT') return undefined;\n      throw error;\n    }\n  }\n\n  /** Write content to a unique file in `tmp/`, fsynced, and return its path. */\n  #writeTemp(content: string): string {\n    const tmpPath = join(this.#tmpDir, `${String(process.pid)}-${randomBytes(8).toString('hex')}`);\n    const fd = openSync(tmpPath, 'wx');\n    try {\n      // writeSync may write fewer bytes than asked; loop, or a short write would be\n      // fsynced and published under the full content's hash as a torn blob.\n      const bytes = Buffer.from(content, 'utf8');\n      let written = 0;\n      while (written < bytes.length) {\n        written += writeSync(fd, bytes, written);\n      }\n      fsyncSync(fd);\n    } finally {\n      closeSync(fd);\n    }\n    return tmpPath;\n  }\n\n  /**\n   * A journal append on the `retrieve()` path — counting, not custody. A failure here\n   * must never decide whether the caller gets its verified bytes (or its true error),\n   * so it is caught and surfaced as a distinct `process.emitWarning` — see the class\n   * doc, and the read-only-journal case in `test/store-dir.test.ts`.\n   */\n  #appendLogCounting(kind: 'hit' | 'miss' | 'corrupt', hash: string): void {\n    try {\n      this.#appendLog(kind, hash);\n    } catch (error) {\n      process.emitWarning(\n        `smelt: could not journal a \"${kind}\" for hash \"${hash}\" in ${this.#logPath} ` +\n          `(${error instanceof Error ? error.message : String(error)}). The retrieval ` +\n          `itself is unaffected, but this count is lost — retrieveCalls and ` +\n          `expansionRate now UNDER-report until the journal is writable again.`,\n        'SmeltCounterWriteFailure',\n      );\n    }\n  }\n\n  /**\n   * One durable journal line. The hash is JSON-encoded because `retrieve()` takes it\n   * from the model verbatim — a hash containing a newline must not forge a second line.\n   * The record starts with its own newline so a torn tail from an earlier crash — a\n   * partial record with no trailing newline — can never bleed into this one: the tear\n   * stays on its own line and is skipped by `stats()`, as blank lines are.\n   */\n  #appendLog(kind: 'hit' | 'miss' | 'corrupt', hash: string): void {\n    const fd = openSync(this.#logPath, 'a');\n    try {\n      const record = Buffer.from(`\\n${kind} ${JSON.stringify(hash)}\\n`, 'utf8');\n      let written = 0;\n      while (written < record.length) {\n        written += writeSync(fd, record, written);\n      }\n      fsyncSync(fd);\n    } finally {\n      closeSync(fd);\n    }\n  }\n\n  #readLog(): string {\n    try {\n      return readFileSync(this.#logPath, 'utf8');\n    } catch (error) {\n      if ((error as { code?: string }).code === 'ENOENT') return '';\n      throw error;\n    }\n  }\n\n  /**\n   * Write the format marker if this directory has none, or verify the one it has.\n   * Creation is atomic (write to `tmp/`, then `link`), so a concurrent creator never\n   * observes a half-written marker. The constructor pre-verified any pre-existing\n   * marker; the verify here catches only a concurrent creator's claim.\n   */\n  #claimFormat(markerPath: string): void {\n    const claim = (): string | undefined => {\n      const body = `${JSON.stringify({\n        format: DIRECTORY_STORE_FORMAT,\n        version: DIRECTORY_STORE_VERSION,\n      })}\\n`;\n      const tmpPath = this.#writeTemp(body);\n      try {\n        linkSync(tmpPath, markerPath);\n        return undefined; // claimed by us; nothing to verify\n      } catch (error) {\n        if ((error as { code?: string }).code !== 'EEXIST') throw error;\n        return readFileSync(markerPath, 'utf8');\n      } finally {\n        unlinkSync(tmpPath);\n      }\n    };\n\n    const existing = claim();\n    if (existing === undefined) return;\n    this.#verifyMarker(markerPath, existing);\n  }\n\n  /** The marker's body, or `undefined` when the directory carries none. */\n  #readMarker(markerPath: string): string | undefined {\n    try {\n      return readFileSync(markerPath, 'utf8');\n    } catch (error) {\n      if ((error as { code?: string }).code === 'ENOENT') return undefined;\n      throw error;\n    }\n  }\n\n  /** Refuse a marker this version of smelt does not understand. */\n  #verifyMarker(markerPath: string, existing: string): void {\n    let parsed: { format?: unknown; version?: unknown };\n    try {\n      parsed = JSON.parse(existing) as { format?: unknown; version?: unknown };\n    } catch {\n      throw new StoreFormatError(\n        `smelt: \"${markerPath}\" is not parseable JSON, so this directory cannot be ` +\n          `trusted as an elision store. Refusing to read or write it.`,\n      );\n    }\n    if (parsed.format !== DIRECTORY_STORE_FORMAT || parsed.version !== DIRECTORY_STORE_VERSION) {\n      throw new StoreFormatError(\n        `smelt: \"${markerPath}\" declares format ${JSON.stringify(parsed.format)} ` +\n          `version ${JSON.stringify(parsed.version)}; this code understands ` +\n          `\"${DIRECTORY_STORE_FORMAT}\" version ${String(DIRECTORY_STORE_VERSION)}. ` +\n          `Refusing to reinterpret someone else's layout.`,\n      );\n    }\n  }\n}\n\n/**\n * Flush the directory entry after a publish, so the *name* survives a crash as well as\n * the bytes. Where the platform refuses to fsync a directory (Windows does), the publish\n * is still atomic — only the durability of the directory entry falls back to the OS's\n * own schedule. Only that refusal is swallowed: a real I/O failure (`EIO`) propagates,\n * because \"the disk could not flush\" must never be reported as a successful put.\n *\n * Where it does work it is the same `fsyncSync` the blob's own flush uses, and so is\n * exactly as strong as that — see the durability note on {@link DirectoryElisionStore}\n * for what that means per platform.\n */\nfunction fsyncDirBestEffort(path: string): void {\n  let fd: number;\n  try {\n    fd = openSync(path, 'r');\n  } catch {\n    return; // the platform refuses to even open a directory for reading (Windows)\n  }\n  try {\n    fsyncSync(fd);\n  } catch (error) {\n    const code = (error as { code?: string }).code;\n    // EINVAL/ENOTSUP/EPERM/EBADF: the platform refuses to fsync a directory — see the\n    // doc comment. Anything else (EIO above all) is a genuine write failure.\n    if (code !== 'EINVAL' && code !== 'ENOTSUP' && code !== 'EPERM' && code !== 'EBADF') {\n      throw error;\n    }\n  } finally {\n    closeSync(fd);\n  }\n}\n"]}
+{"version":3,"file":"store-dir.js","sourceRoot":"","sources":["../src/store-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,gFAAgF;AAChF,MAAM,QAAQ,GAAG,0CAA0C,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,+CAA+C,CAAC;AAWjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,MAAM,OAAO,qBAAqB;IACvB,SAAS,CAAS;IAClB,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,KAAK,CAA8B;IAE5C,YAAY,IAAY,EAAE,OAAO,GAAiC,EAAE;QAClE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QACzC,6EAA6E;QAC7E,mFAAmF;QACnF,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACrD,6EAA6E;QAC7E,gFAAgF;QAChF,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,MAAsB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,+EAA+E;QAC/E,yEAAyE;QACzE,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,QAAQ,CAAC,OAAe;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAClB,gBAAgB,IAAI,mDAAmD;gBACrE,GAAG,MAAM,CAAC,WAAW,CAAC,wDAAwD,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,gFAAgF;YAChF,0EAA0E;YAC1E,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,QAAQ,KAAK,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,8EAA8E;YAC9E,gFAAgF;YAChF,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAChE,+EAA+E;YAC/E,gFAAgF;YAChF,+EAA+E;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAY;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,wCAAwC;YAChF,cAAc,IAAI,CAAC,CAAC;YACpB,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC;QAED,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS,CAAC,gDAAgD;YAC9E,aAAa,IAAI,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;gBAAE,MAAM,IAAI,CAAC,CAAC;iBAChC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAW,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5F,CAAC;IAED,KAAK;QACH,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,MAAM;QACJ,MAAM,IAAI,GAAqC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,CAAW,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,CAAW,EAAE,CAAC,CAAC;gBACxF,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAW,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,IAAY;QACpB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,yBAAyB;QACxE,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,UAAU,CAAC,OAAe;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,8EAA8E;YAC9E,sEAAsE;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC9B,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,IAAwC,EAAE,IAAY,EAAE,IAAa;QACtF,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,WAAW,CACjB,+BAA+B,IAAI,eAAe,IAAI,QAAQ,IAAI,CAAC,QAAQ,GAAG;gBAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB;gBAC7E,mEAAmE;gBACnE,qEAAqE,EACvE,0BAA0B,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,IAAwC,EAAE,IAAY,EAAE,IAAa;QAC9E,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GACV,IAAI,KAAK,SAAS;gBAChB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC/B,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YACD,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,QAAQ;QACN,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAkB;QAC7B,MAAM,KAAK,GAAG,GAAuB,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,EAAE,sBAAsB;gBAC9B,OAAO,EAAE,uBAAuB;aACjC,CAAC,IAAI,CAAC;YACP,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC9B,OAAO,SAAS,CAAC,CAAC,mCAAmC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAChE,OAAO,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACT,UAAU,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,yEAAyE;IACzE,WAAW,CAAC,UAAkB;QAC5B,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,aAAa,CAAC,UAAkB,EAAE,QAAgB;QAChD,IAAI,MAA+C,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4C,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CACxB,WAAW,UAAU,uDAAuD;gBAC1E,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAsB,IAAI,MAAM,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;YAC3F,MAAM,IAAI,gBAAgB,CACxB,WAAW,UAAU,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG;gBACxE,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,0BAA0B;gBACnE,IAAI,sBAAsB,aAAa,MAAM,CAAC,uBAAuB,CAAC,IAAI;gBAC1E,gDAAgD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,sEAAsE;IAChF,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,kFAAkF;QAClF,yEAAyE;QACzE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACpF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC","sourcesContent":["import {\n  closeSync,\n  fsyncSync,\n  linkSync,\n  mkdirSync,\n  openSync,\n  readdirSync,\n  readFileSync,\n  statSync,\n  unlinkSync,\n  writeSync,\n} from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { randomBytes } from 'node:crypto';\nimport process from 'node:process';\n\nimport {\n  HashCollisionError,\n  SmeltError,\n  StoreCorruptionError,\n  StoreFormatError,\n  UnknownHashError,\n} from './errors.ts';\nimport { contentHash } from './hash.ts';\nimport { retrieveStats, ruleLedger } from './stats.ts';\nimport type { RawRetrieveCounters } from './stats.ts';\nimport type { ElisionReason, ElisionStore, RetrieveStats, RuleLedgerEntry } from './types.ts';\n\n/**\n * The format marker every store directory carries, and the one version this code\n * understands. A future layout is a new version, refused loudly by old code — never a\n * quiet reinterpretation of someone's stored bytes.\n */\nexport const DIRECTORY_STORE_FORMAT = 'smelt-elision-store';\nexport const DIRECTORY_STORE_VERSION = 1;\n\n/**\n * What a storage key may look like. `contentHash` produces 16 lowercase hex characters;\n * the pattern is wider so an injected test hash still works, and strict enough that a\n * key can never traverse out of `blobs/` or collide with `format.json`.\n */\nconst KEY_PATTERN = /^[0-9a-f]{4,128}$/;\n\n/** One counter line: a kind, a space, and the hash as a JSON string literal. */\nconst LOG_LINE = /^(hit|miss|corrupt) (\"(?:[^\"\\\\]|\\\\.)*\")$/;\n\n/**\n * One ledger line: `put`, the hash, and the rule id — both JSON string literals. A\n * separate pattern from {@link LOG_LINE} on purpose: the counter fold matches only\n * counter lines and skips these, exactly as a reader that predates the ledger skips a\n * line it does not know, so a directory written by this version reads as the same\n * counters under the previous one (`test/ledger.test.ts` pins that).\n */\nconst PUT_LINE = /^put (\"(?:[^\"\\\\]|\\\\.)*\") (\"(?:[^\"\\\\]|\\\\.)*\")$/;\n\n/** See {@link MemoryElisionStoreOptions} in `store.ts` — same escape hatch, same reason. */\nexport interface DirectoryElisionStoreOptions {\n  /**\n   * Override the hash function, so the collision branch — unreachable with sha256 —\n   * can be tested. Production has no reason to pass this.\n   */\n  readonly hash?: (content: string) => string;\n}\n\n/**\n * A persistent {@link ElisionStore} over a content-addressed directory. `node:fs` only —\n * no SQLite, no new dependency, nothing that phones home. Elisions put here outlive the\n * process, so a long-lived agent session can `retrieve()` across restarts.\n *\n * ## Storage layout\n *\n * ```text\n * <root>/\n *   format.json      { \"format\": \"smelt-elision-store\", \"version\": 1 } — refused if unknown\n *   blobs/<hash>     one file per elision: the exact UTF-8 bytes, named by their content hash\n *   tmp/             staging for atomic writes; never read, safe to sweep\n *   retrievals.log   append-only journal: `hit \"<hash>\"` | `miss \"<hash>\"` | `corrupt \"<hash>\"`\n *                    | `put \"<hash>\" \"<rule>\"` (the ledger: which rule cut what)\n * ```\n *\n * **Nothing lives in memory.** Every read — `stats()` included — comes off the disk, so\n * two instances over the same directory (two processes, or one process before and after\n * a restart) always agree. `stats()` is a scan; elision counts per session are small and\n * retrieval is the model asking for material back, which is rare by design.\n *\n * ## Durability\n *\n * - **Writes are crash-safe.** A blob is written to `tmp/`, `fsync`ed, then `link(2)`ed\n *   into `blobs/` — an atomic, no-clobber publish. A torn write dies in `tmp/`, where\n *   nothing looks; a name in `blobs/` always refers to a fully written file.\n * - **`fsync` is only as strong as the platform makes it.** Every flush here is Node's\n *   `fsyncSync`, which is libuv's `uv_fs_fsync`, and what that reaches the hardware with\n *   differs by platform. On Apple it is strong: libuv knows macOS's own `fsync(2)` only\n *   hands the write to the drive, so its `__APPLE__` branch issues\n *   `fcntl(fd, F_FULLFSYNC)` — a real drive-cache flush — before falling back to\n *   `F_BARRIERFSYNC` and then plain `fsync(2)`. Measured here (Node 26, libuv 1.52,\n *   internal APFS SSD): an 11-byte append costs 0.01 ms unflushed, 5.5 ms through\n *   `fsyncSync`, and 0.10 ms through a raw `fsync(2)` against 4.8 ms through a raw\n *   `F_FULLFSYNC` — the cost says which syscall is being made. Everywhere else libuv\n *   calls plain `fsync(2)`, which is as durable as the drive's honesty about its own\n *   write cache. So a **power loss** can lose a blob or a journal line this code has\n *   already `fsync`ed and reported as written on any non-Apple platform whose drive\n *   lies, and on Apple only where `F_FULLFSYNC` itself fails and libuv degrades\n *   silently — some non-APFS and network mounts. A **process** crash cannot lose one\n *   anywhere: the bytes are in the page cache and the publish is still atomic. Nothing\n *   is ever handed back unverified either way, so the worst a lost blob can produce is\n *   {@link UnknownHashError} — never wrong bytes presented as right ones. \"Crash-safe\"\n *   is the claim, deliberately not \"power-loss-proof\": the durability is real, it is\n *   just not unconditional.\n * - **Reads verify.** `retrieve()`, `peek()` and `has()` re-hash the bytes and refuse a\n *   mismatch with {@link StoreCorruptionError} — a damaged blob is never handed back as\n *   a retrieval nor reported as present, and \"we hold damaged bytes\" is distinct from\n *   {@link UnknownHashError}'s \"never existed\". The guard in\n *   `test/guards/persistent-store.test.ts` watches this.\n * - **Counters survive a restart.** Every `retrieve()` appends one `fsync`ed line to\n *   `retrievals.log`, and `stats()` is a fold over it — so `expansionRate` stays\n *   meaningful across a whole session, not just one process. A crash in the middle of\n *   an append can tear at most that one line; a torn tail is skipped, costing at most\n *   the single count that was being written when the process died.\n * - **Concurrent writers are safe.** `link(2)` refuses to clobber, so two processes\n *   putting at once race to publish and the loser verifies byte-for-byte agreement with\n *   the winner — identical content dedupes, different content under one hash is a\n *   {@link HashCollisionError}. Journal appends use `O_APPEND`. Tested with two real\n *   processes in `test/store-dir.test.ts`.\n *\n * ## No eviction\n *\n * Same rule as {@link MemoryElisionStore}: no cap, no LRU, no `clear()`. A store that\n * can forget turns Law 3 into \"reversible, usually\". Elided text is smaller than the\n * session that produced it; if disk pressure ever forces a cap, retrieval of an evicted\n * hash must throw a distinct \"evicted\" error — never {@link UnknownHashError} — so the\n * model can tell \"we lost it\" from \"never existed\". Today there is no such error because\n * there is no such cap.\n *\n * ## Two deliberate choices around the edges\n *\n * - **The root is resolved to an absolute path at construction.** Every later path is\n *   joined from that, so a `process.chdir()` after construction cannot silently\n *   re-target the store — the bytes a relative-rooted store put before a chdir would\n *   otherwise be unreachable after it, which reads exactly like data loss.\n * - **A failed journal append never withholds intact bytes.** `retrieve()`'s order of\n *   business is: read, verify, count, return. When the *count* cannot be written (a\n *   read-only journal, a full disk), the bytes are still returned — they are verified\n *   and the caller asked for them; refusing would turn a bookkeeping failure into\n *   Law 3 breaking. The failure is surfaced distinctly instead: a\n *   `process.emitWarning` with name `SmeltCounterWriteFailure`, so \"your retrieval\n *   worked\" and \"your counters just went quiet\" stay two separate facts. The same\n *   applies to the `miss`/`corrupt` journal lines: the store's own error for the\n *   lookup still wins over the journal's I/O error.\n */\nexport class DirectoryElisionStore implements ElisionStore {\n  readonly #blobsDir: string;\n  readonly #tmpDir: string;\n  readonly #logPath: string;\n  readonly #hash: (content: string) => string;\n\n  constructor(root: string, options: DirectoryElisionStoreOptions = {}) {\n    this.#hash = options.hash ?? contentHash;\n    // Resolve NOW, against the working directory the caller constructed with — a\n    // later chdir must never re-point an already-constructed store. See the class doc.\n    const absoluteRoot = resolve(root);\n    this.#blobsDir = join(absoluteRoot, 'blobs');\n    this.#tmpDir = join(absoluteRoot, 'tmp');\n    this.#logPath = join(absoluteRoot, 'retrievals.log');\n    const markerPath = join(absoluteRoot, 'format.json');\n    // Validate before mutating: a directory carrying a marker this code does not\n    // understand is refused with the directory exactly as it was found — no blobs/,\n    // no tmp/, no staged temp file created inside someone else's layout.\n    const existing = this.#readMarker(markerPath);\n    if (existing !== undefined) this.#verifyMarker(markerPath, existing);\n    mkdirSync(this.#blobsDir, { recursive: true });\n    mkdirSync(this.#tmpDir, { recursive: true });\n    this.#claimFormat(markerPath);\n  }\n\n  put(content: string, reason?: ElisionReason): string {\n    const hash = this.#putBlob(content);\n    // The ledger line, after the bytes are safe: attribution is bookkeeping, and a\n    // failure to write it is surfaced as a warning rather than a failed put.\n    if (reason !== undefined) this.#appendLogCounting('put', hash, reason.rule);\n    return hash;\n  }\n\n  /** The publish itself: verify or write the blob, return its hash. */\n  #putBlob(content: string): string {\n    const hash = this.#hash(content);\n    if (!KEY_PATTERN.test(hash)) {\n      throw new SmeltError(\n        `smelt: hash \"${hash}\" is not usable as a storage key — it must match ` +\n          `${String(KEY_PATTERN)} so it can name a file inside blobs/ and nothing else.`,\n      );\n    }\n    const existing = this.#readBlob(hash);\n    if (existing !== undefined) {\n      // Verify the stored bytes before comparing: a damaged blob is corruption, not a\n      // collision. Only intact bytes that still differ earn HashCollisionError.\n      if (this.#hash(existing) !== hash) throw new StoreCorruptionError(hash);\n      if (existing !== content) throw new HashCollisionError(hash);\n      return hash;\n    }\n    const tmpPath = this.#writeTemp(content);\n    try {\n      // link(2) is the atomic, no-clobber publish: it fails with EEXIST rather than\n      // overwrite, so a concurrent writer can never silently replace someone's bytes.\n      linkSync(tmpPath, join(this.#blobsDir, hash));\n    } catch (error) {\n      if ((error as { code?: string }).code !== 'EEXIST') throw error;\n      // Another writer published this hash between our existence check and our link.\n      // Same bytes: idempotent put, done. Damaged or vanished bytes: corruption — the\n      // store was torn or edited outside smelt. Intact different bytes: a collision.\n      const winner = this.#readBlob(hash);\n      if (winner === undefined || this.#hash(winner) !== hash) {\n        throw new StoreCorruptionError(hash);\n      }\n      if (winner !== content) throw new HashCollisionError(hash);\n    } finally {\n      unlinkSync(tmpPath);\n    }\n    fsyncDirBestEffort(this.#blobsDir);\n    return hash;\n  }\n\n  peek(hash: string): string | undefined {\n    const content = this.#readBlob(hash);\n    if (content === undefined) return undefined;\n    if (this.#hash(content) !== hash) throw new StoreCorruptionError(hash);\n    return content;\n  }\n\n  retrieve(hash: string): string {\n    const content = this.#readBlob(hash);\n    if (content === undefined) {\n      this.#appendLogCounting('miss', hash);\n      throw new UnknownHashError(hash);\n    }\n    if (this.#hash(content) !== hash) {\n      this.#appendLogCounting('corrupt', hash);\n      throw new StoreCorruptionError(hash);\n    }\n    this.#appendLogCounting('hit', hash);\n    return content;\n  }\n\n  /**\n   * Whether this hash can be **retrieved** — verified, exactly as {@link peek} and\n   * {@link retrieve} verify, because it is `peek()`.\n   *\n   * `has()` used to be the one read that skipped verification: a damaged blob answered\n   * `true` and then threw {@link StoreCorruptionError} on the very next line, so a\n   * consumer that checked before retrieving was told a lie by the cheaper call. The two\n   * answers now come from one place and cannot drift: `true` means the bytes are there\n   * and hash to their name, `false` means this store never held them, and damage is\n   * raised rather than hidden behind a boolean — the same distinction `peek()` draws\n   * between \"we hold damaged bytes\" and \"never existed\".\n   *\n   * It stays uncounted: a check is not the model asking for material back, and counting\n   * one would inflate `retrieveCalls` and with it the expansion rate, which is the one\n   * number this library exists to keep honest. So no journal line is written here, not\n   * even for the corrupt case — `retrieve()` journals that when the model asks.\n   *\n   * @throws {StoreCorruptionError} when the stored bytes do not hash to their name.\n   */\n  has(hash: string): boolean {\n    return this.peek(hash) !== undefined;\n  }\n\n  /**\n   * The five directly-observed counts, every one read off the disk — a scan of\n   * `blobs/` plus a fold over `retrievals.log`. See {@link RawRetrieveCounters}; the\n   * derived half of the stats comes from the shared `retrieveStats()`, never here.\n   */\n  rawCounters(): RawRetrieveCounters {\n    let elisionsStored = 0;\n    let bytesStored = 0;\n    for (const entry of readdirSync(this.#blobsDir)) {\n      if (!KEY_PATTERN.test(entry)) continue; // `.DS_Store` and friends are not blobs\n      elisionsStored += 1;\n      bytesStored += statSync(join(this.#blobsDir, entry)).size;\n    }\n\n    let retrieveCalls = 0;\n    let misses = 0;\n    const hits = new Set<string>();\n    for (const line of this.#readLog().split('\\n')) {\n      const match = LOG_LINE.exec(line);\n      if (match === null) continue; // a torn tail from a crash mid-append, or blank\n      retrieveCalls += 1;\n      if (match[1] === 'miss') misses += 1;\n      else if (match[1] === 'hit') hits.add(JSON.parse(match[2]!) as string);\n    }\n\n    return { elisionsStored, bytesStored, retrieveCalls, uniqueRetrieved: hits.size, misses };\n  }\n\n  stats(): RetrieveStats {\n    return retrieveStats(this.rawCounters());\n  }\n\n  /**\n   * The per-rule ledger: a fold over the journal's `put` lines against its `hit`\n   * lines, derived by the shared `ruleLedger()`. Uncounted, and read off the disk\n   * like everything else here, so two processes agree.\n   */\n  ledger(): readonly RuleLedgerEntry[] {\n    const puts: { hash: string; rule: string }[] = [];\n    const hits = new Set<string>();\n    for (const line of this.#readLog().split('\\n')) {\n      const put = PUT_LINE.exec(line);\n      if (put !== null) {\n        puts.push({ hash: JSON.parse(put[1]!) as string, rule: JSON.parse(put[2]!) as string });\n        continue;\n      }\n      const counter = LOG_LINE.exec(line);\n      if (counter !== null && counter[1] === 'hit') hits.add(JSON.parse(counter[2]!) as string);\n    }\n    return ruleLedger(puts, hits);\n  }\n\n  /** The blob's exact content, or `undefined` when no such blob is stored. */\n  #readBlob(hash: string): string | undefined {\n    if (!KEY_PATTERN.test(hash)) return undefined; // never a path component\n    try {\n      return readFileSync(join(this.#blobsDir, hash), 'utf8');\n    } catch (error) {\n      if ((error as { code?: string }).code === 'ENOENT') return undefined;\n      throw error;\n    }\n  }\n\n  /** Write content to a unique file in `tmp/`, fsynced, and return its path. */\n  #writeTemp(content: string): string {\n    const tmpPath = join(this.#tmpDir, `${String(process.pid)}-${randomBytes(8).toString('hex')}`);\n    const fd = openSync(tmpPath, 'wx');\n    try {\n      // writeSync may write fewer bytes than asked; loop, or a short write would be\n      // fsynced and published under the full content's hash as a torn blob.\n      const bytes = Buffer.from(content, 'utf8');\n      let written = 0;\n      while (written < bytes.length) {\n        written += writeSync(fd, bytes, written);\n      }\n      fsyncSync(fd);\n    } finally {\n      closeSync(fd);\n    }\n    return tmpPath;\n  }\n\n  /**\n   * A journal append on the `retrieve()` path — counting, not custody. A failure here\n   * must never decide whether the caller gets its verified bytes (or its true error),\n   * so it is caught and surfaced as a distinct `process.emitWarning` — see the class\n   * doc, and the read-only-journal case in `test/store-dir.test.ts`.\n   */\n  #appendLogCounting(kind: 'hit' | 'miss' | 'corrupt' | 'put', hash: string, rule?: string): void {\n    try {\n      this.#appendLog(kind, hash, rule);\n    } catch (error) {\n      process.emitWarning(\n        `smelt: could not journal a \"${kind}\" for hash \"${hash}\" in ${this.#logPath} ` +\n          `(${error instanceof Error ? error.message : String(error)}). The retrieval ` +\n          `itself is unaffected, but this count is lost — retrieveCalls and ` +\n          `expansionRate now UNDER-report until the journal is writable again.`,\n        'SmeltCounterWriteFailure',\n      );\n    }\n  }\n\n  /**\n   * One durable journal line. The hash is JSON-encoded because `retrieve()` takes it\n   * from the model verbatim — a hash containing a newline must not forge a second line.\n   * The record starts with its own newline so a torn tail from an earlier crash — a\n   * partial record with no trailing newline — can never bleed into this one: the tear\n   * stays on its own line and is skipped by `stats()`, as blank lines are.\n   */\n  #appendLog(kind: 'hit' | 'miss' | 'corrupt' | 'put', hash: string, rule?: string): void {\n    const fd = openSync(this.#logPath, 'a');\n    try {\n      const fields =\n        rule === undefined\n          ? [kind, JSON.stringify(hash)]\n          : [kind, JSON.stringify(hash), JSON.stringify(rule)];\n      const record = Buffer.from(`\\n${fields.join(' ')}\\n`, 'utf8');\n      let written = 0;\n      while (written < record.length) {\n        written += writeSync(fd, record, written);\n      }\n      fsyncSync(fd);\n    } finally {\n      closeSync(fd);\n    }\n  }\n\n  #readLog(): string {\n    try {\n      return readFileSync(this.#logPath, 'utf8');\n    } catch (error) {\n      if ((error as { code?: string }).code === 'ENOENT') return '';\n      throw error;\n    }\n  }\n\n  /**\n   * Write the format marker if this directory has none, or verify the one it has.\n   * Creation is atomic (write to `tmp/`, then `link`), so a concurrent creator never\n   * observes a half-written marker. The constructor pre-verified any pre-existing\n   * marker; the verify here catches only a concurrent creator's claim.\n   */\n  #claimFormat(markerPath: string): void {\n    const claim = (): string | undefined => {\n      const body = `${JSON.stringify({\n        format: DIRECTORY_STORE_FORMAT,\n        version: DIRECTORY_STORE_VERSION,\n      })}\\n`;\n      const tmpPath = this.#writeTemp(body);\n      try {\n        linkSync(tmpPath, markerPath);\n        return undefined; // claimed by us; nothing to verify\n      } catch (error) {\n        if ((error as { code?: string }).code !== 'EEXIST') throw error;\n        return readFileSync(markerPath, 'utf8');\n      } finally {\n        unlinkSync(tmpPath);\n      }\n    };\n\n    const existing = claim();\n    if (existing === undefined) return;\n    this.#verifyMarker(markerPath, existing);\n  }\n\n  /** The marker's body, or `undefined` when the directory carries none. */\n  #readMarker(markerPath: string): string | undefined {\n    try {\n      return readFileSync(markerPath, 'utf8');\n    } catch (error) {\n      if ((error as { code?: string }).code === 'ENOENT') return undefined;\n      throw error;\n    }\n  }\n\n  /** Refuse a marker this version of smelt does not understand. */\n  #verifyMarker(markerPath: string, existing: string): void {\n    let parsed: { format?: unknown; version?: unknown };\n    try {\n      parsed = JSON.parse(existing) as { format?: unknown; version?: unknown };\n    } catch {\n      throw new StoreFormatError(\n        `smelt: \"${markerPath}\" is not parseable JSON, so this directory cannot be ` +\n          `trusted as an elision store. Refusing to read or write it.`,\n      );\n    }\n    if (parsed.format !== DIRECTORY_STORE_FORMAT || parsed.version !== DIRECTORY_STORE_VERSION) {\n      throw new StoreFormatError(\n        `smelt: \"${markerPath}\" declares format ${JSON.stringify(parsed.format)} ` +\n          `version ${JSON.stringify(parsed.version)}; this code understands ` +\n          `\"${DIRECTORY_STORE_FORMAT}\" version ${String(DIRECTORY_STORE_VERSION)}. ` +\n          `Refusing to reinterpret someone else's layout.`,\n      );\n    }\n  }\n}\n\n/**\n * Flush the directory entry after a publish, so the *name* survives a crash as well as\n * the bytes. Where the platform refuses to fsync a directory (Windows does), the publish\n * is still atomic — only the durability of the directory entry falls back to the OS's\n * own schedule. Only that refusal is swallowed: a real I/O failure (`EIO`) propagates,\n * because \"the disk could not flush\" must never be reported as a successful put.\n *\n * Where it does work it is the same `fsyncSync` the blob's own flush uses, and so is\n * exactly as strong as that — see the durability note on {@link DirectoryElisionStore}\n * for what that means per platform.\n */\nfunction fsyncDirBestEffort(path: string): void {\n  let fd: number;\n  try {\n    fd = openSync(path, 'r');\n  } catch {\n    return; // the platform refuses to even open a directory for reading (Windows)\n  }\n  try {\n    fsyncSync(fd);\n  } catch (error) {\n    const code = (error as { code?: string }).code;\n    // EINVAL/ENOTSUP/EPERM/EBADF: the platform refuses to fsync a directory — see the\n    // doc comment. Anything else (EIO above all) is a genuine write failure.\n    if (code !== 'EINVAL' && code !== 'ENOTSUP' && code !== 'EPERM' && code !== 'EBADF') {\n      throw error;\n    }\n  } finally {\n    closeSync(fd);\n  }\n}\n"]}

package/dist/store.d.ts

@@ -1,5 +1,5 @@
 import type { RawRetrieveCounters } from './stats.ts';
-import type { ElisionStore, RetrieveStats } from './types.ts';
+import type { ElisionReason, ElisionStore, RetrieveStats, RuleLedgerEntry } from './types.ts';
 /**
  * The default store: in-process, content-addressed, no eviction.
  *
@@ -25,7 +25,7 @@ export interface MemoryElisionStoreOptions {
 export declare class MemoryElisionStore implements ElisionStore {
     #private;
     constructor(options?: MemoryElisionStoreOptions);
-    put(content: string): string;
+    put(content: string, reason?: ElisionReason): string;
     peek(hash: string): string | undefined;
     retrieve(hash: string): string;
     /**
@@ -38,5 +38,7 @@ export declare class MemoryElisionStore implements ElisionStore {
     /** The five directly-observed counts. See {@link RawRetrieveCounters} — no derivation here. */
     rawCounters(): RawRetrieveCounters;
     stats(): RetrieveStats;
+    /** The per-rule ledger, derived by the shared `ruleLedger()` — see {@link RuleLedgerEntry}. */
+    ledger(): readonly RuleLedgerEntry[];
 }
 //# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7C;AAED,qBAAa,kBAAmB,YAAW,YAAY;;IAQrD,YAAY,OAAO,GAAE,yBAA8B,EAElD;IAED,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU3B;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErC;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS7B;IAED;;;;;OAKG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzB;IAED,+FAA+F;IAC/F,WAAW,IAAI,mBAAmB,CAQjC;IAED,KAAK,IAAI,aAAa,CAErB;CACF","sourcesContent":["import { HashCollisionError, UnknownHashError } from './errors.ts';\nimport { contentHash } from './hash.ts';\nimport { retrieveStats } from './stats.ts';\nimport type { RawRetrieveCounters } from './stats.ts';\nimport type { ElisionStore, RetrieveStats } from './types.ts';\n\n/**\n * The default store: in-process, content-addressed, no eviction.\n *\n * In-process is the right default because it is the only one with no failure modes to\n * explain. A consumer that needs elisions to survive a process restart (a long-lived\n * agent session, say) hands `createSmelter()` a {@link DirectoryElisionStore} — or\n * implements {@link ElisionStore} over storage of its own; the interface is five\n * methods wide for exactly that reason.\n *\n * There is no `clear()` and no LRU. A store that can forget turns Law 3 into\n * \"reversible, usually\", and a `retrieve()` that fails after an eviction is\n * indistinguishable to the model from a hallucinated hash.\n */\nexport interface MemoryElisionStoreOptions {\n  /**\n   * Override the hash function. The only reason this exists: the collision branch in\n   * {@link MemoryElisionStore.put} is unreachable with sha256, and an untestable branch\n   * is a branch nobody knows works. A test injects a colliding hash and watches it\n   * throw. Production has no reason to pass this.\n   */\n  readonly hash?: (content: string) => string;\n}\n\nexport class MemoryElisionStore implements ElisionStore {\n  readonly #blobs = new Map<string, string>();\n  readonly #hash: (content: string) => string;\n  #bytesStored = 0;\n  #retrieveCalls = 0;\n  #misses = 0;\n  readonly #retrievedHashes = new Set<string>();\n\n  constructor(options: MemoryElisionStoreOptions = {}) {\n    this.#hash = options.hash ?? contentHash;\n  }\n\n  put(content: string): string {\n    const hash = this.#hash(content);\n    const existing = this.#blobs.get(hash);\n    if (existing !== undefined) {\n      if (existing !== content) throw new HashCollisionError(hash);\n      return hash;\n    }\n    this.#blobs.set(hash, content);\n    this.#bytesStored += Buffer.byteLength(content, 'utf8');\n    return hash;\n  }\n\n  peek(hash: string): string | undefined {\n    return this.#blobs.get(hash);\n  }\n\n  retrieve(hash: string): string {\n    this.#retrieveCalls += 1;\n    const content = this.#blobs.get(hash);\n    if (content === undefined) {\n      this.#misses += 1;\n      throw new UnknownHashError(hash);\n    }\n    this.#retrievedHashes.add(hash);\n    return content;\n  }\n\n  /**\n   * True exactly when `retrieve(hash)` would return bytes. Nothing to verify: `put`\n   * hashed the content itself and no one else can reach the map, so a key here cannot\n   * name bytes that stopped matching it — unlike a directory on someone's disk, where\n   * {@link DirectoryElisionStore.has} re-hashes for this same promise.\n   */\n  has(hash: string): boolean {\n    return this.#blobs.has(hash);\n  }\n\n  /** The five directly-observed counts. See {@link RawRetrieveCounters} — no derivation here. */\n  rawCounters(): RawRetrieveCounters {\n    return {\n      elisionsStored: this.#blobs.size,\n      bytesStored: this.#bytesStored,\n      retrieveCalls: this.#retrieveCalls,\n      uniqueRetrieved: this.#retrievedHashes.size,\n      misses: this.#misses,\n    };\n  }\n\n  stats(): RetrieveStats {\n    return retrieveStats(this.rawCounters());\n  }\n}\n"]}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7C;AAED,qBAAa,kBAAmB,YAAW,YAAY;;IAUrD,YAAY,OAAO,GAAE,yBAA8B,EAElD;IAED,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,CAYnD;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErC;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS7B;IAED;;;;;OAKG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzB;IAED,+FAA+F;IAC/F,WAAW,IAAI,mBAAmB,CAQjC;IAED,KAAK,IAAI,aAAa,CAErB;IAED,+FAA+F;IAC/F,MAAM,IAAI,SAAS,eAAe,EAAE,CAEnC;CACF","sourcesContent":["import { HashCollisionError, UnknownHashError } from './errors.ts';\nimport { contentHash } from './hash.ts';\nimport { retrieveStats, ruleLedger } from './stats.ts';\nimport type { RawRetrieveCounters } from './stats.ts';\nimport type { ElisionReason, ElisionStore, RetrieveStats, RuleLedgerEntry } from './types.ts';\n\n/**\n * The default store: in-process, content-addressed, no eviction.\n *\n * In-process is the right default because it is the only one with no failure modes to\n * explain. A consumer that needs elisions to survive a process restart (a long-lived\n * agent session, say) hands `createSmelter()` a {@link DirectoryElisionStore} — or\n * implements {@link ElisionStore} over storage of its own; the interface is five\n * methods wide for exactly that reason.\n *\n * There is no `clear()` and no LRU. A store that can forget turns Law 3 into\n * \"reversible, usually\", and a `retrieve()` that fails after an eviction is\n * indistinguishable to the model from a hallucinated hash.\n */\nexport interface MemoryElisionStoreOptions {\n  /**\n   * Override the hash function. The only reason this exists: the collision branch in\n   * {@link MemoryElisionStore.put} is unreachable with sha256, and an untestable branch\n   * is a branch nobody knows works. A test injects a colliding hash and watches it\n   * throw. Production has no reason to pass this.\n   */\n  readonly hash?: (content: string) => string;\n}\n\nexport class MemoryElisionStore implements ElisionStore {\n  readonly #blobs = new Map<string, string>();\n  readonly #hash: (content: string) => string;\n  #bytesStored = 0;\n  #retrieveCalls = 0;\n  #misses = 0;\n  readonly #retrievedHashes = new Set<string>();\n  /** Every attributed put, in order — the ledger's facts. */\n  readonly #puts: { readonly hash: string; readonly rule: string }[] = [];\n\n  constructor(options: MemoryElisionStoreOptions = {}) {\n    this.#hash = options.hash ?? contentHash;\n  }\n\n  put(content: string, reason?: ElisionReason): string {\n    const hash = this.#hash(content);\n    const existing = this.#blobs.get(hash);\n    if (existing !== undefined) {\n      if (existing !== content) throw new HashCollisionError(hash);\n      if (reason !== undefined) this.#puts.push({ hash, rule: reason.rule });\n      return hash;\n    }\n    this.#blobs.set(hash, content);\n    this.#bytesStored += Buffer.byteLength(content, 'utf8');\n    if (reason !== undefined) this.#puts.push({ hash, rule: reason.rule });\n    return hash;\n  }\n\n  peek(hash: string): string | undefined {\n    return this.#blobs.get(hash);\n  }\n\n  retrieve(hash: string): string {\n    this.#retrieveCalls += 1;\n    const content = this.#blobs.get(hash);\n    if (content === undefined) {\n      this.#misses += 1;\n      throw new UnknownHashError(hash);\n    }\n    this.#retrievedHashes.add(hash);\n    return content;\n  }\n\n  /**\n   * True exactly when `retrieve(hash)` would return bytes. Nothing to verify: `put`\n   * hashed the content itself and no one else can reach the map, so a key here cannot\n   * name bytes that stopped matching it — unlike a directory on someone's disk, where\n   * {@link DirectoryElisionStore.has} re-hashes for this same promise.\n   */\n  has(hash: string): boolean {\n    return this.#blobs.has(hash);\n  }\n\n  /** The five directly-observed counts. See {@link RawRetrieveCounters} — no derivation here. */\n  rawCounters(): RawRetrieveCounters {\n    return {\n      elisionsStored: this.#blobs.size,\n      bytesStored: this.#bytesStored,\n      retrieveCalls: this.#retrieveCalls,\n      uniqueRetrieved: this.#retrievedHashes.size,\n      misses: this.#misses,\n    };\n  }\n\n  stats(): RetrieveStats {\n    return retrieveStats(this.rawCounters());\n  }\n\n  /** The per-rule ledger, derived by the shared `ruleLedger()` — see {@link RuleLedgerEntry}. */\n  ledger(): readonly RuleLedgerEntry[] {\n    return ruleLedger(this.#puts, this.#retrievedHashes);\n  }\n}\n"]}

package/dist/store.js

@@ -1,6 +1,6 @@
 import { HashCollisionError, UnknownHashError } from './errors.js';
 import { contentHash } from './hash.js';
-import { retrieveStats } from './stats.js';
+import { retrieveStats, ruleLedger } from './stats.js';
 export class MemoryElisionStore {
     #blobs = new Map();
     #hash;
@@ -8,19 +8,25 @@ export class MemoryElisionStore {
     #retrieveCalls = 0;
     #misses = 0;
     #retrievedHashes = new Set();
+    /** Every attributed put, in order — the ledger's facts. */
+    #puts = [];
     constructor(options = {}) {
         this.#hash = options.hash ?? contentHash;
     }
-    put(content) {
+    put(content, reason) {
         const hash = this.#hash(content);
         const existing = this.#blobs.get(hash);
         if (existing !== undefined) {
             if (existing !== content)
                 throw new HashCollisionError(hash);
+            if (reason !== undefined)
+                this.#puts.push({ hash, rule: reason.rule });
             return hash;
         }
         this.#blobs.set(hash, content);
         this.#bytesStored += Buffer.byteLength(content, 'utf8');
+        if (reason !== undefined)
+            this.#puts.push({ hash, rule: reason.rule });
         return hash;
     }
     peek(hash) {
@@ -58,5 +64,9 @@ export class MemoryElisionStore {
     stats() {
         return retrieveStats(this.rawCounters());
     }
+    /** The per-rule ledger, derived by the shared `ruleLedger()` — see {@link RuleLedgerEntry}. */
+    ledger() {
+        return ruleLedger(this.#puts, this.#retrievedHashes);
+    }
 }
 //# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA2B3C,MAAM,OAAO,kBAAkB;IACpB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,KAAK,CAA8B;IAC5C,YAAY,GAAG,CAAC,CAAC;IACjB,cAAc,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC,CAAC;IACH,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,YAAY,OAAO,GAA8B,EAAE;QACjD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,KAAK,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,+FAA+F;IAC/F,WAAW;QACT,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAChC,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;YAC3C,MAAM,EAAE,IAAI,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC;IAED,KAAK;QACH,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF","sourcesContent":["import { HashCollisionError, UnknownHashError } from './errors.ts';\nimport { contentHash } from './hash.ts';\nimport { retrieveStats } from './stats.ts';\nimport type { RawRetrieveCounters } from './stats.ts';\nimport type { ElisionStore, RetrieveStats } from './types.ts';\n\n/**\n * The default store: in-process, content-addressed, no eviction.\n *\n * In-process is the right default because it is the only one with no failure modes to\n * explain. A consumer that needs elisions to survive a process restart (a long-lived\n * agent session, say) hands `createSmelter()` a {@link DirectoryElisionStore} — or\n * implements {@link ElisionStore} over storage of its own; the interface is five\n * methods wide for exactly that reason.\n *\n * There is no `clear()` and no LRU. A store that can forget turns Law 3 into\n * \"reversible, usually\", and a `retrieve()` that fails after an eviction is\n * indistinguishable to the model from a hallucinated hash.\n */\nexport interface MemoryElisionStoreOptions {\n  /**\n   * Override the hash function. The only reason this exists: the collision branch in\n   * {@link MemoryElisionStore.put} is unreachable with sha256, and an untestable branch\n   * is a branch nobody knows works. A test injects a colliding hash and watches it\n   * throw. Production has no reason to pass this.\n   */\n  readonly hash?: (content: string) => string;\n}\n\nexport class MemoryElisionStore implements ElisionStore {\n  readonly #blobs = new Map<string, string>();\n  readonly #hash: (content: string) => string;\n  #bytesStored = 0;\n  #retrieveCalls = 0;\n  #misses = 0;\n  readonly #retrievedHashes = new Set<string>();\n\n  constructor(options: MemoryElisionStoreOptions = {}) {\n    this.#hash = options.hash ?? contentHash;\n  }\n\n  put(content: string): string {\n    const hash = this.#hash(content);\n    const existing = this.#blobs.get(hash);\n    if (existing !== undefined) {\n      if (existing !== content) throw new HashCollisionError(hash);\n      return hash;\n    }\n    this.#blobs.set(hash, content);\n    this.#bytesStored += Buffer.byteLength(content, 'utf8');\n    return hash;\n  }\n\n  peek(hash: string): string | undefined {\n    return this.#blobs.get(hash);\n  }\n\n  retrieve(hash: string): string {\n    this.#retrieveCalls += 1;\n    const content = this.#blobs.get(hash);\n    if (content === undefined) {\n      this.#misses += 1;\n      throw new UnknownHashError(hash);\n    }\n    this.#retrievedHashes.add(hash);\n    return content;\n  }\n\n  /**\n   * True exactly when `retrieve(hash)` would return bytes. Nothing to verify: `put`\n   * hashed the content itself and no one else can reach the map, so a key here cannot\n   * name bytes that stopped matching it — unlike a directory on someone's disk, where\n   * {@link DirectoryElisionStore.has} re-hashes for this same promise.\n   */\n  has(hash: string): boolean {\n    return this.#blobs.has(hash);\n  }\n\n  /** The five directly-observed counts. See {@link RawRetrieveCounters} — no derivation here. */\n  rawCounters(): RawRetrieveCounters {\n    return {\n      elisionsStored: this.#blobs.size,\n      bytesStored: this.#bytesStored,\n      retrieveCalls: this.#retrieveCalls,\n      uniqueRetrieved: this.#retrievedHashes.size,\n      misses: this.#misses,\n    };\n  }\n\n  stats(): RetrieveStats {\n    return retrieveStats(this.rawCounters());\n  }\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA2BvD,MAAM,OAAO,kBAAkB;IACpB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,KAAK,CAA8B;IAC5C,YAAY,GAAG,CAAC,CAAC;IACjB,cAAc,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC,CAAC;IACH,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,2DAA2D;IAClD,KAAK,GAAuD,EAAE,CAAC;IAExE,YAAY,OAAO,GAA8B,EAAE;QACjD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,MAAsB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,KAAK,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,+FAA+F;IAC/F,WAAW;QACT,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAChC,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;YAC3C,MAAM,EAAE,IAAI,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC;IAED,KAAK;QACH,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,+FAA+F;IAC/F,MAAM;QACJ,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC;CACF","sourcesContent":["import { HashCollisionError, UnknownHashError } from './errors.ts';\nimport { contentHash } from './hash.ts';\nimport { retrieveStats, ruleLedger } from './stats.ts';\nimport type { RawRetrieveCounters } from './stats.ts';\nimport type { ElisionReason, ElisionStore, RetrieveStats, RuleLedgerEntry } from './types.ts';\n\n/**\n * The default store: in-process, content-addressed, no eviction.\n *\n * In-process is the right default because it is the only one with no failure modes to\n * explain. A consumer that needs elisions to survive a process restart (a long-lived\n * agent session, say) hands `createSmelter()` a {@link DirectoryElisionStore} — or\n * implements {@link ElisionStore} over storage of its own; the interface is five\n * methods wide for exactly that reason.\n *\n * There is no `clear()` and no LRU. A store that can forget turns Law 3 into\n * \"reversible, usually\", and a `retrieve()` that fails after an eviction is\n * indistinguishable to the model from a hallucinated hash.\n */\nexport interface MemoryElisionStoreOptions {\n  /**\n   * Override the hash function. The only reason this exists: the collision branch in\n   * {@link MemoryElisionStore.put} is unreachable with sha256, and an untestable branch\n   * is a branch nobody knows works. A test injects a colliding hash and watches it\n   * throw. Production has no reason to pass this.\n   */\n  readonly hash?: (content: string) => string;\n}\n\nexport class MemoryElisionStore implements ElisionStore {\n  readonly #blobs = new Map<string, string>();\n  readonly #hash: (content: string) => string;\n  #bytesStored = 0;\n  #retrieveCalls = 0;\n  #misses = 0;\n  readonly #retrievedHashes = new Set<string>();\n  /** Every attributed put, in order — the ledger's facts. */\n  readonly #puts: { readonly hash: string; readonly rule: string }[] = [];\n\n  constructor(options: MemoryElisionStoreOptions = {}) {\n    this.#hash = options.hash ?? contentHash;\n  }\n\n  put(content: string, reason?: ElisionReason): string {\n    const hash = this.#hash(content);\n    const existing = this.#blobs.get(hash);\n    if (existing !== undefined) {\n      if (existing !== content) throw new HashCollisionError(hash);\n      if (reason !== undefined) this.#puts.push({ hash, rule: reason.rule });\n      return hash;\n    }\n    this.#blobs.set(hash, content);\n    this.#bytesStored += Buffer.byteLength(content, 'utf8');\n    if (reason !== undefined) this.#puts.push({ hash, rule: reason.rule });\n    return hash;\n  }\n\n  peek(hash: string): string | undefined {\n    return this.#blobs.get(hash);\n  }\n\n  retrieve(hash: string): string {\n    this.#retrieveCalls += 1;\n    const content = this.#blobs.get(hash);\n    if (content === undefined) {\n      this.#misses += 1;\n      throw new UnknownHashError(hash);\n    }\n    this.#retrievedHashes.add(hash);\n    return content;\n  }\n\n  /**\n   * True exactly when `retrieve(hash)` would return bytes. Nothing to verify: `put`\n   * hashed the content itself and no one else can reach the map, so a key here cannot\n   * name bytes that stopped matching it — unlike a directory on someone's disk, where\n   * {@link DirectoryElisionStore.has} re-hashes for this same promise.\n   */\n  has(hash: string): boolean {\n    return this.#blobs.has(hash);\n  }\n\n  /** The five directly-observed counts. See {@link RawRetrieveCounters} — no derivation here. */\n  rawCounters(): RawRetrieveCounters {\n    return {\n      elisionsStored: this.#blobs.size,\n      bytesStored: this.#bytesStored,\n      retrieveCalls: this.#retrieveCalls,\n      uniqueRetrieved: this.#retrievedHashes.size,\n      misses: this.#misses,\n    };\n  }\n\n  stats(): RetrieveStats {\n    return retrieveStats(this.rawCounters());\n  }\n\n  /** The per-rule ledger, derived by the shared `ruleLedger()` — see {@link RuleLedgerEntry}. */\n  ledger(): readonly RuleLedgerEntry[] {\n    return ruleLedger(this.#puts, this.#retrievedHashes);\n  }\n}\n"]}

package/dist/text/json-edit.d.ts

@@ -52,7 +52,21 @@ export declare function jsonStyle(text: string): JsonStyle;
  * array, a scalar, or something that is not JSON at all. Callers should have
  * `JSON.parse`d first and refused; this is belt and braces, not a validator.
  */
-export declare function editTopLevelProperty(text: string, key: string, value: unknown, style?: JsonStyle): string | undefined;
+export declare function editTopLevelProperty(text: string, key: string, value: unknown, style?: JsonStyle, valueIndent?: string): string | undefined;
+/**
+ * `editJsonProperty`: the same contract, one level deeper. Replace, insert or remove
+ * the property at `path` — e.g. `['mcpServers', 'smelt']` — where the *container* is a
+ * top-level property whose value is itself a JSON object. Everything outside the
+ * edited bytes rides through verbatim, including sibling entries inside the container.
+ *
+ * When the container key is absent and a value is given, the container is created
+ * fresh around the entry. When a removal empties the container, the container is
+ * lifted out too — a file that never carried the key comes back byte-identical after
+ * an apply → remove round trip, and one that carried other entries keeps them
+ * untouched. Returns `undefined` when the container's value is not a JSON object the
+ * scanner can walk (the caller refuses or skips, as with {@link editTopLevelProperty}).
+ */
+export declare function editJsonProperty(text: string, path: readonly [string, ...(readonly string[])], value: unknown, style?: JsonStyle): string | undefined;
 /**
  * Replace the block delimited by `start` … `end` in `existingText`, or append it.
  *

package/dist/text/json-edit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-edit.d.ts","sourceRoot":"","sources":["../../src/text/json-edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kFAAkF;AAClF,MAAM,WAAW,SAAS;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAKjD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,SAA2B,GACjC,MAAM,GAAG,SAAS,CAWpB;AA+ID;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAQpB","sourcesContent":["/**\n * Byte-faithful edits to somebody else's text file.\n *\n * Two editors, one contract: **change the one thing you were asked to change and\n * leave every other byte alone.** An installer that reformats a settings file has\n * edited what it was never asked to — key order, indentation, string escapes, number\n * spellings and unknown keys are all somebody's choices, and `JSON.parse` →\n * `JSON.stringify` erases every one of them.\n *\n *  - {@link editTopLevelProperty}: replace, insert or remove **one top-level property**\n *    of a JSON object, in its source text. The value is rendered fresh; nothing\n *    outside its bytes moves. Callers have already `JSON.parse`d the text and decided\n *    what the new value is; this module holds only the tokenising.\n *  - {@link upsertMarkerBlock} / {@link stripMarkerBlock}: the same idea over a\n *    delimited block in a plain-text file (an instruction file, a Markdown snippet\n *    between two marker lines).\n *\n * Neither knows what a harness or a hook is. `cli/hooks.ts` is the consumer today; the\n * module lives under `src/text/` rather than `cli/` because its whole interface is\n * strings in, strings out — it reads no argv, prints nothing and imports nothing from\n * the CLI, and the next byte-faithful editor (an instruction-file rewrite) wants a\n * sibling here, not a CLI import.\n */\n\n/** How a JSON file is laid out — what a rendered value must match to blend in. */\nexport interface JsonStyle {\n  /** The indentation unit — the whitespace before a top-level key. */\n  readonly indent: string;\n  /** `'\\r\\n'` when the file uses it anywhere, `'\\n'` otherwise. */\n  readonly newline: string;\n}\n\n/**\n * The layout an existing file uses: its first indented key's leading whitespace (two\n * spaces when nothing is indented) and its newline convention. Detected once, before\n * any edit, so a sequence of edits renders consistently even after an earlier one has\n * changed the first indented line.\n */\nexport function jsonStyle(text: string): JsonStyle {\n  return {\n    newline: text.includes('\\r\\n') ? '\\r\\n' : '\\n',\n    indent: /\\n([ \\t]+)\"/.exec(text)?.[1] ?? '  ',\n  };\n}\n\n/**\n * Replace, insert or remove one top-level property of the JSON object in `text`,\n * leaving every other byte verbatim.\n *\n *  - `value` defined: the property's value is replaced in place when the key exists,\n *    otherwise the property is appended after the last one (or into an empty object).\n *  - `value === undefined`: the property is removed, with its separating comma and\n *    whitespace; a key that is not there is a no-op and the text comes back unchanged.\n *\n * The rendered value is `JSON.stringify(value, null, indent)`, re-indented to sit at\n * top level. `style` defaults to {@link jsonStyle} of `text`; pass it explicitly when\n * making several edits to one file.\n *\n * Returns `undefined` when `text` is not a JSON object the scanner can walk — an\n * array, a scalar, or something that is not JSON at all. Callers should have\n * `JSON.parse`d first and refused; this is belt and braces, not a validator.\n */\nexport function editTopLevelProperty(\n  text: string,\n  key: string,\n  value: unknown,\n  style: JsonStyle = jsonStyle(text),\n): string | undefined {\n  const scan = scanJsonTopLevel(text);\n  if (scan === undefined) return undefined;\n  const property = scan.properties.find((candidate) => candidate.key === key);\n  if (value === undefined) {\n    return property === undefined ? text : removeJsonProperty(text, scan, property);\n  }\n  const rendered = renderJsonValue(value, style.indent, style.newline);\n  return property !== undefined\n    ? `${text.slice(0, property.valueStart)}${rendered}${text.slice(property.valueEnd)}`\n    : insertJsonProperty(text, scan, key, rendered, style.indent, style.newline);\n}\n\n/** One top-level property of a JSON object, located by offsets in its source text. */\ninterface JsonTopLevelProperty {\n  readonly key: string;\n  /** Offset of the key's opening quote. */\n  readonly keyStart: number;\n  /** Offset of the value's first byte. */\n  readonly valueStart: number;\n  /** Offset one past the value's last byte. */\n  readonly valueEnd: number;\n}\n\ninterface JsonTopLevelScan {\n  /** Offset of the root object's `{`. */\n  readonly open: number;\n  /** Offset of the root object's `}`. */\n  readonly close: number;\n  readonly properties: readonly JsonTopLevelProperty[];\n}\n\n/**\n * Locate the top-level properties of a JSON object *in its source text*, so one\n * property can be replaced, inserted or removed while every other byte of the file\n * rides through verbatim. `undefined` when the text is not an object.\n */\nfunction scanJsonTopLevel(text: string): JsonTopLevelScan | undefined {\n  let i = skipJsonWhitespace(text, 0);\n  if (text[i] !== '{') return undefined;\n  const open = i;\n  i = skipJsonWhitespace(text, i + 1);\n  const properties: JsonTopLevelProperty[] = [];\n  if (text[i] === '}') return { open, close: i, properties };\n  for (;;) {\n    if (text[i] !== '\"') return undefined;\n    const keyStart = i;\n    const keyEnd = skipJsonString(text, i);\n    if (keyEnd === undefined) return undefined;\n    const key = JSON.parse(text.slice(keyStart, keyEnd)) as string;\n    i = skipJsonWhitespace(text, keyEnd);\n    if (text[i] !== ':') return undefined;\n    const valueStart = skipJsonWhitespace(text, i + 1);\n    const valueEnd = skipJsonValue(text, valueStart);\n    if (valueEnd === undefined) return undefined;\n    properties.push({ key, keyStart, valueStart, valueEnd });\n    i = skipJsonWhitespace(text, valueEnd);\n    if (text[i] === ',') {\n      i = skipJsonWhitespace(text, i + 1);\n      continue;\n    }\n    if (text[i] === '}') return { open, close: i, properties };\n    return undefined;\n  }\n}\n\nfunction skipJsonWhitespace(text: string, from: number): number {\n  let i = from;\n  while (i < text.length && ' \\t\\r\\n'.includes(text[i]!)) i += 1;\n  return i;\n}\n\n/** `from` points at `\"`; returns the offset one past the closing quote. */\nfunction skipJsonString(text: string, from: number): number | undefined {\n  let i = from + 1;\n  while (i < text.length) {\n    if (text[i] === '\\\\') i += 2;\n    else if (text[i] === '\"') return i + 1;\n    else i += 1;\n  }\n  return undefined;\n}\n\nfunction skipJsonValue(text: string, from: number): number | undefined {\n  const first = text[from];\n  if (first === '\"') return skipJsonString(text, from);\n  if (first === '{' || first === '[') {\n    let depth = 0;\n    let i = from;\n    while (i < text.length) {\n      const ch = text[i]!;\n      if (ch === '\"') {\n        const end = skipJsonString(text, i);\n        if (end === undefined) return undefined;\n        i = end;\n        continue;\n      }\n      if (ch === '{' || ch === '[') depth += 1;\n      else if (ch === '}' || ch === ']') {\n        depth -= 1;\n        if (depth === 0) return i + 1;\n      }\n      i += 1;\n    }\n    return undefined;\n  }\n  // number / true / false / null\n  let i = from;\n  while (i < text.length && !',}] \\t\\r\\n'.includes(text[i]!)) i += 1;\n  return i > from ? i : undefined;\n}\n\n/** A JSON value indented for embedding at a top-level property position. */\nfunction renderJsonValue(value: unknown, indent: string, newline: string): string {\n  return JSON.stringify(value, null, indent).split('\\n').join(`${newline}${indent}`);\n}\n\nfunction removeJsonProperty(\n  text: string,\n  scan: JsonTopLevelScan,\n  property: JsonTopLevelProperty,\n): string {\n  const index = scan.properties.indexOf(property);\n  const next = scan.properties[index + 1];\n  if (next !== undefined) {\n    // Delete through the separating comma and whitespace, up to the next key.\n    return text.slice(0, property.keyStart) + text.slice(next.keyStart);\n  }\n  const previous = scan.properties[index - 1];\n  // Last (or only) property: delete the preceding comma (if any) with it.\n  const from = previous !== undefined ? previous.valueEnd : scan.open + 1;\n  return text.slice(0, from) + text.slice(property.valueEnd);\n}\n\nfunction insertJsonProperty(\n  text: string,\n  scan: JsonTopLevelScan,\n  key: string,\n  renderedValue: string,\n  indent: string,\n  newline: string,\n): string {\n  const entry = `${JSON.stringify(key)}: ${renderedValue}`;\n  if (scan.properties.length === 0) {\n    return `${text.slice(0, scan.open + 1)}${newline}${indent}${entry}${newline}${text.slice(scan.close)}`;\n  }\n  const last = scan.properties[scan.properties.length - 1]!;\n  return `${text.slice(0, last.valueEnd)},${newline}${indent}${entry}${text.slice(last.valueEnd)}`;\n}\n\n/* ------------------------------------------------------------------------------------\n * Marker blocks\n * ---------------------------------------------------------------------------------- */\n\n/**\n * Replace the block delimited by `start` … `end` in `existingText`, or append it.\n *\n * An absent or blank file becomes exactly `block`. A file that carries the block has\n * it replaced in place (one newline after `end` is absorbed, so a block that ends in\n * its own newline does not grow a blank line per re-run). A file without it gets the\n * block appended after exactly one blank line, whatever trailing newlines it had.\n */\nexport function upsertMarkerBlock(\n  existingText: string | undefined,\n  block: string,\n  start: string,\n  end: string,\n): string {\n  if (existingText === undefined || existingText.trim() === '') return block;\n  const startIndex = existingText.indexOf(start);\n  const endIndex = existingText.indexOf(end);\n  if (startIndex !== -1 && endIndex !== -1 && endIndex > startIndex) {\n    const before = existingText.slice(0, startIndex);\n    const after = existingText.slice(endIndex + end.length).replace(/^\\n/, '');\n    return `${before}${block}${after}`;\n  }\n  return `${existingText.replace(/\\n*$/, '\\n\\n')}${block}`;\n}\n\n/**\n * Remove the block delimited by `start` … `end`. The text comes back unchanged when\n * the block is not there; `undefined` when nothing (or only whitespace) remains — the\n * file was entirely the block, and the caller decides whether to delete it.\n */\nexport function stripMarkerBlock(\n  existingText: string,\n  start: string,\n  end: string,\n): string | undefined {\n  const startIndex = existingText.indexOf(start);\n  const endIndex = existingText.indexOf(end);\n  if (startIndex === -1 || endIndex === -1 || endIndex <= startIndex) return existingText;\n  const stripped =\n    existingText.slice(0, startIndex).replace(/\\n+$/, '\\n') +\n    existingText.slice(endIndex + end.length).replace(/^\\n+/, '');\n  return stripped.trim() === '' ? undefined : stripped;\n}\n"]}
+{"version":3,"file":"json-edit.d.ts","sourceRoot":"","sources":["../../src/text/json-edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kFAAkF;AAClF,MAAM,WAAW,SAAS;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAKjD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,SAA2B,EAClC,WAAW,GAAE,MAAqB,GACjC,MAAM,GAAG,SAAS,CAWpB;AAuJD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,EAC/C,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,SAA2B,GACjC,MAAM,GAAG,SAAS,CAEpB;AA+DD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAQpB","sourcesContent":["/**\n * Byte-faithful edits to somebody else's text file.\n *\n * Two editors, one contract: **change the one thing you were asked to change and\n * leave every other byte alone.** An installer that reformats a settings file has\n * edited what it was never asked to — key order, indentation, string escapes, number\n * spellings and unknown keys are all somebody's choices, and `JSON.parse` →\n * `JSON.stringify` erases every one of them.\n *\n *  - {@link editTopLevelProperty}: replace, insert or remove **one top-level property**\n *    of a JSON object, in its source text. The value is rendered fresh; nothing\n *    outside its bytes moves. Callers have already `JSON.parse`d the text and decided\n *    what the new value is; this module holds only the tokenising.\n *  - {@link upsertMarkerBlock} / {@link stripMarkerBlock}: the same idea over a\n *    delimited block in a plain-text file (an instruction file, a Markdown snippet\n *    between two marker lines).\n *\n * Neither knows what a harness or a hook is. `cli/hooks.ts` is the consumer today; the\n * module lives under `src/text/` rather than `cli/` because its whole interface is\n * strings in, strings out — it reads no argv, prints nothing and imports nothing from\n * the CLI, and the next byte-faithful editor (an instruction-file rewrite) wants a\n * sibling here, not a CLI import.\n */\n\n/** How a JSON file is laid out — what a rendered value must match to blend in. */\nexport interface JsonStyle {\n  /** The indentation unit — the whitespace before a top-level key. */\n  readonly indent: string;\n  /** `'\\r\\n'` when the file uses it anywhere, `'\\n'` otherwise. */\n  readonly newline: string;\n}\n\n/**\n * The layout an existing file uses: its first indented key's leading whitespace (two\n * spaces when nothing is indented) and its newline convention. Detected once, before\n * any edit, so a sequence of edits renders consistently even after an earlier one has\n * changed the first indented line.\n */\nexport function jsonStyle(text: string): JsonStyle {\n  return {\n    newline: text.includes('\\r\\n') ? '\\r\\n' : '\\n',\n    indent: /\\n([ \\t]+)\"/.exec(text)?.[1] ?? '  ',\n  };\n}\n\n/**\n * Replace, insert or remove one top-level property of the JSON object in `text`,\n * leaving every other byte verbatim.\n *\n *  - `value` defined: the property's value is replaced in place when the key exists,\n *    otherwise the property is appended after the last one (or into an empty object).\n *  - `value === undefined`: the property is removed, with its separating comma and\n *    whitespace; a key that is not there is a no-op and the text comes back unchanged.\n *\n * The rendered value is `JSON.stringify(value, null, indent)`, re-indented to sit at\n * top level. `style` defaults to {@link jsonStyle} of `text`; pass it explicitly when\n * making several edits to one file.\n *\n * Returns `undefined` when `text` is not a JSON object the scanner can walk — an\n * array, a scalar, or something that is not JSON at all. Callers should have\n * `JSON.parse`d first and refused; this is belt and braces, not a validator.\n */\nexport function editTopLevelProperty(\n  text: string,\n  key: string,\n  value: unknown,\n  style: JsonStyle = jsonStyle(text),\n  valueIndent: string = style.indent,\n): string | undefined {\n  const scan = scanJsonTopLevel(text);\n  if (scan === undefined) return undefined;\n  const property = scan.properties.find((candidate) => candidate.key === key);\n  if (value === undefined) {\n    return property === undefined ? text : removeJsonProperty(text, scan, property);\n  }\n  const rendered = renderJsonValue(value, valueIndent, style.indent, style.newline);\n  return property !== undefined\n    ? `${text.slice(0, property.valueStart)}${rendered}${text.slice(property.valueEnd)}`\n    : insertJsonProperty(text, scan, key, rendered, style.indent, style.newline);\n}\n\n/** One top-level property of a JSON object, located by offsets in its source text. */\ninterface JsonTopLevelProperty {\n  readonly key: string;\n  /** Offset of the key's opening quote. */\n  readonly keyStart: number;\n  /** Offset of the value's first byte. */\n  readonly valueStart: number;\n  /** Offset one past the value's last byte. */\n  readonly valueEnd: number;\n}\n\ninterface JsonTopLevelScan {\n  /** Offset of the root object's `{`. */\n  readonly open: number;\n  /** Offset of the root object's `}`. */\n  readonly close: number;\n  readonly properties: readonly JsonTopLevelProperty[];\n}\n\n/**\n * Locate the top-level properties of a JSON object *in its source text*, so one\n * property can be replaced, inserted or removed while every other byte of the file\n * rides through verbatim. `undefined` when the text is not an object.\n */\nfunction scanJsonTopLevel(text: string): JsonTopLevelScan | undefined {\n  let i = skipJsonWhitespace(text, 0);\n  if (text[i] !== '{') return undefined;\n  const open = i;\n  i = skipJsonWhitespace(text, i + 1);\n  const properties: JsonTopLevelProperty[] = [];\n  if (text[i] === '}') return { open, close: i, properties };\n  for (;;) {\n    if (text[i] !== '\"') return undefined;\n    const keyStart = i;\n    const keyEnd = skipJsonString(text, i);\n    if (keyEnd === undefined) return undefined;\n    const key = JSON.parse(text.slice(keyStart, keyEnd)) as string;\n    i = skipJsonWhitespace(text, keyEnd);\n    if (text[i] !== ':') return undefined;\n    const valueStart = skipJsonWhitespace(text, i + 1);\n    const valueEnd = skipJsonValue(text, valueStart);\n    if (valueEnd === undefined) return undefined;\n    properties.push({ key, keyStart, valueStart, valueEnd });\n    i = skipJsonWhitespace(text, valueEnd);\n    if (text[i] === ',') {\n      i = skipJsonWhitespace(text, i + 1);\n      continue;\n    }\n    if (text[i] === '}') return { open, close: i, properties };\n    return undefined;\n  }\n}\n\nfunction skipJsonWhitespace(text: string, from: number): number {\n  let i = from;\n  while (i < text.length && ' \\t\\r\\n'.includes(text[i]!)) i += 1;\n  return i;\n}\n\n/** `from` points at `\"`; returns the offset one past the closing quote. */\nfunction skipJsonString(text: string, from: number): number | undefined {\n  let i = from + 1;\n  while (i < text.length) {\n    if (text[i] === '\\\\') i += 2;\n    else if (text[i] === '\"') return i + 1;\n    else i += 1;\n  }\n  return undefined;\n}\n\nfunction skipJsonValue(text: string, from: number): number | undefined {\n  const first = text[from];\n  if (first === '\"') return skipJsonString(text, from);\n  if (first === '{' || first === '[') {\n    let depth = 0;\n    let i = from;\n    while (i < text.length) {\n      const ch = text[i]!;\n      if (ch === '\"') {\n        const end = skipJsonString(text, i);\n        if (end === undefined) return undefined;\n        i = end;\n        continue;\n      }\n      if (ch === '{' || ch === '[') depth += 1;\n      else if (ch === '}' || ch === ']') {\n        depth -= 1;\n        if (depth === 0) return i + 1;\n      }\n      i += 1;\n    }\n    return undefined;\n  }\n  // number / true / false / null\n  let i = from;\n  while (i < text.length && !',}] \\t\\r\\n'.includes(text[i]!)) i += 1;\n  return i > from ? i : undefined;\n}\n\n/**\n * A JSON value rendered for embedding at a property position. `stringifyIndent` is\n * the unit its own members nest by; `joinIndent` is where the value sits — for a\n * top-level property they are the same, and for a member of a nested container the\n * value sits at the member's indent while its members keep nesting by the file's\n * unit, which is the difference between `command` landing one level under `smelt`\n * or two under it.\n */\nfunction renderJsonValue(\n  value: unknown,\n  stringifyIndent: string,\n  joinIndent: string,\n  newline: string,\n): string {\n  return JSON.stringify(value, null, stringifyIndent).split('\\n').join(`${newline}${joinIndent}`);\n}\n\nfunction removeJsonProperty(\n  text: string,\n  scan: JsonTopLevelScan,\n  property: JsonTopLevelProperty,\n): string {\n  const index = scan.properties.indexOf(property);\n  const next = scan.properties[index + 1];\n  if (next !== undefined) {\n    // Delete through the separating comma and whitespace, up to the next key.\n    return text.slice(0, property.keyStart) + text.slice(next.keyStart);\n  }\n  const previous = scan.properties[index - 1];\n  // Last (or only) property: delete the preceding comma (if any) with it.\n  const from = previous !== undefined ? previous.valueEnd : scan.open + 1;\n  return text.slice(0, from) + text.slice(property.valueEnd);\n}\n\nfunction insertJsonProperty(\n  text: string,\n  scan: JsonTopLevelScan,\n  key: string,\n  renderedValue: string,\n  indent: string,\n  newline: string,\n): string {\n  const entry = `${JSON.stringify(key)}: ${renderedValue}`;\n  if (scan.properties.length === 0) {\n    return `${text.slice(0, scan.open + 1)}${newline}${indent}${entry}${newline}${text.slice(scan.close)}`;\n  }\n  const last = scan.properties[scan.properties.length - 1]!;\n  return `${text.slice(0, last.valueEnd)},${newline}${indent}${entry}${text.slice(last.valueEnd)}`;\n}\n\n/**\n * `editJsonProperty`: the same contract, one level deeper. Replace, insert or remove\n * the property at `path` — e.g. `['mcpServers', 'smelt']` — where the *container* is a\n * top-level property whose value is itself a JSON object. Everything outside the\n * edited bytes rides through verbatim, including sibling entries inside the container.\n *\n * When the container key is absent and a value is given, the container is created\n * fresh around the entry. When a removal empties the container, the container is\n * lifted out too — a file that never carried the key comes back byte-identical after\n * an apply → remove round trip, and one that carried other entries keeps them\n * untouched. Returns `undefined` when the container's value is not a JSON object the\n * scanner can walk (the caller refuses or skips, as with {@link editTopLevelProperty}).\n */\nexport function editJsonProperty(\n  text: string,\n  path: readonly [string, ...(readonly string[])],\n  value: unknown,\n  style: JsonStyle = jsonStyle(text),\n): string | undefined {\n  return editJsonPropertyAt(text, path, value, style, style.indent);\n}\n\n/** The walker: same body, `path` as a plain (runtime-checked) array. */\nfunction editJsonPropertyAt(\n  text: string,\n  path: readonly string[],\n  value: unknown,\n  style: JsonStyle,\n  baseIndent: string,\n): string | undefined {\n  const head = path[0]!;\n  const rest = path.slice(1);\n  if (rest.length === 0) return editTopLevelProperty(text, head, value, style, baseIndent);\n  const scan = scanJsonTopLevel(text);\n  if (scan === undefined) return undefined;\n  const property = scan.properties.find((candidate) => candidate.key === head);\n  if (property === undefined) {\n    if (value === undefined) return text; // nothing to remove under an absent container\n    // Build the fresh container from the tail of the path, then hand it to the\n    // top-level editor as a plain value — one renderer, one indent story.\n    const container: Record<string, unknown> = {};\n    let cursor = container;\n    for (const key of rest.slice(0, -1)) {\n      const next: Record<string, unknown> = {};\n      cursor[key] = next;\n      cursor = next;\n    }\n    cursor[rest[rest.length - 1]!] = value;\n    return editTopLevelProperty(text, head, container, style);\n  }\n  const inner = text.slice(property.valueStart, property.valueEnd);\n  // The container's members sit one unit deeper than the file's top level — read\n  // that unit off the container's own first key, so a fresh member lands beside its\n  // siblings and the member's *value* keeps nesting by the file's unit (passed as\n  // valueIndent), which is what one level deeper actually means.\n  const memberIndent = /\\n([ \\t]+)\"/.exec(inner)?.[1] ?? style.indent + style.indent;\n  const edited = editJsonPropertyAt(\n    inner,\n    rest,\n    value,\n    { ...style, indent: memberIndent },\n    baseIndent,\n  );\n  if (edited === undefined) return undefined; // the container's value is not an object\n  if (edited === inner) return text;\n  if (value === undefined && removesToEmptyObject(edited)) {\n    // The container is now `{}` and it only got that way because of this removal —\n    // lift it out, so a file that never carried the key round-trips byte-identical.\n    return editTopLevelProperty(text, head, undefined, style) ?? text;\n  }\n  return `${text.slice(0, property.valueStart)}${edited}${text.slice(property.valueEnd)}`;\n}\n\n/** True when `text` is exactly a JSON object with no properties. */\nfunction removesToEmptyObject(text: string): boolean {\n  const scan = scanJsonTopLevel(text);\n  return scan !== undefined && scan.properties.length === 0;\n}\n\n/* ------------------------------------------------------------------------------------\n * Marker blocks\n * ---------------------------------------------------------------------------------- */\n\n/**\n * Replace the block delimited by `start` … `end` in `existingText`, or append it.\n *\n * An absent or blank file becomes exactly `block`. A file that carries the block has\n * it replaced in place (one newline after `end` is absorbed, so a block that ends in\n * its own newline does not grow a blank line per re-run). A file without it gets the\n * block appended after exactly one blank line, whatever trailing newlines it had.\n */\nexport function upsertMarkerBlock(\n  existingText: string | undefined,\n  block: string,\n  start: string,\n  end: string,\n): string {\n  if (existingText === undefined || existingText.trim() === '') return block;\n  const startIndex = existingText.indexOf(start);\n  const endIndex = existingText.indexOf(end);\n  if (startIndex !== -1 && endIndex !== -1 && endIndex > startIndex) {\n    const before = existingText.slice(0, startIndex);\n    const after = existingText.slice(endIndex + end.length).replace(/^\\n/, '');\n    return `${before}${block}${after}`;\n  }\n  return `${existingText.replace(/\\n*$/, '\\n\\n')}${block}`;\n}\n\n/**\n * Remove the block delimited by `start` … `end`. The text comes back unchanged when\n * the block is not there; `undefined` when nothing (or only whitespace) remains — the\n * file was entirely the block, and the caller decides whether to delete it.\n */\nexport function stripMarkerBlock(\n  existingText: string,\n  start: string,\n  end: string,\n): string | undefined {\n  const startIndex = existingText.indexOf(start);\n  const endIndex = existingText.indexOf(end);\n  if (startIndex === -1 || endIndex === -1 || endIndex <= startIndex) return existingText;\n  const stripped =\n    existingText.slice(0, startIndex).replace(/\\n+$/, '\\n') +\n    existingText.slice(endIndex + end.length).replace(/^\\n+/, '');\n  return stripped.trim() === '' ? undefined : stripped;\n}\n"]}

package/dist/text/json-edit.js

@@ -50,7 +50,7 @@ export function jsonStyle(text) {
  * array, a scalar, or something that is not JSON at all. Callers should have
  * `JSON.parse`d first and refused; this is belt and braces, not a validator.
  */
-export function editTopLevelProperty(text, key, value, style = jsonStyle(text)) {
+export function editTopLevelProperty(text, key, value, style = jsonStyle(text), valueIndent = style.indent) {
     const scan = scanJsonTopLevel(text);
     if (scan === undefined)
         return undefined;
@@ -58,7 +58,7 @@ export function editTopLevelProperty(text, key, value, style = jsonStyle(text))
     if (value === undefined) {
         return property === undefined ? text : removeJsonProperty(text, scan, property);
     }
-    const rendered = renderJsonValue(value, style.indent, style.newline);
+    const rendered = renderJsonValue(value, valueIndent, style.indent, style.newline);
     return property !== undefined
         ? `${text.slice(0, property.valueStart)}${rendered}${text.slice(property.valueEnd)}`
         : insertJsonProperty(text, scan, key, rendered, style.indent, style.newline);
@@ -155,9 +155,16 @@ function skipJsonValue(text, from) {
         i += 1;
     return i > from ? i : undefined;
 }
-/** A JSON value indented for embedding at a top-level property position. */
-function renderJsonValue(value, indent, newline) {
-    return JSON.stringify(value, null, indent).split('\n').join(`${newline}${indent}`);
+/**
+ * A JSON value rendered for embedding at a property position. `stringifyIndent` is
+ * the unit its own members nest by; `joinIndent` is where the value sits — for a
+ * top-level property they are the same, and for a member of a nested container the
+ * value sits at the member's indent while its members keep nesting by the file's
+ * unit, which is the difference between `command` landing one level under `smelt`
+ * or two under it.
+ */
+function renderJsonValue(value, stringifyIndent, joinIndent, newline) {
+    return JSON.stringify(value, null, stringifyIndent).split('\n').join(`${newline}${joinIndent}`);
 }
 function removeJsonProperty(text, scan, property) {
     const index = scan.properties.indexOf(property);
@@ -179,6 +186,70 @@ function insertJsonProperty(text, scan, key, renderedValue, indent, newline) {
     const last = scan.properties[scan.properties.length - 1];
     return `${text.slice(0, last.valueEnd)},${newline}${indent}${entry}${text.slice(last.valueEnd)}`;
 }
+/**
+ * `editJsonProperty`: the same contract, one level deeper. Replace, insert or remove
+ * the property at `path` — e.g. `['mcpServers', 'smelt']` — where the *container* is a
+ * top-level property whose value is itself a JSON object. Everything outside the
+ * edited bytes rides through verbatim, including sibling entries inside the container.
+ *
+ * When the container key is absent and a value is given, the container is created
+ * fresh around the entry. When a removal empties the container, the container is
+ * lifted out too — a file that never carried the key comes back byte-identical after
+ * an apply → remove round trip, and one that carried other entries keeps them
+ * untouched. Returns `undefined` when the container's value is not a JSON object the
+ * scanner can walk (the caller refuses or skips, as with {@link editTopLevelProperty}).
+ */
+export function editJsonProperty(text, path, value, style = jsonStyle(text)) {
+    return editJsonPropertyAt(text, path, value, style, style.indent);
+}
+/** The walker: same body, `path` as a plain (runtime-checked) array. */
+function editJsonPropertyAt(text, path, value, style, baseIndent) {
+    const head = path[0];
+    const rest = path.slice(1);
+    if (rest.length === 0)
+        return editTopLevelProperty(text, head, value, style, baseIndent);
+    const scan = scanJsonTopLevel(text);
+    if (scan === undefined)
+        return undefined;
+    const property = scan.properties.find((candidate) => candidate.key === head);
+    if (property === undefined) {
+        if (value === undefined)
+            return text; // nothing to remove under an absent container
+        // Build the fresh container from the tail of the path, then hand it to the
+        // top-level editor as a plain value — one renderer, one indent story.
+        const container = {};
+        let cursor = container;
+        for (const key of rest.slice(0, -1)) {
+            const next = {};
+            cursor[key] = next;
+            cursor = next;
+        }
+        cursor[rest[rest.length - 1]] = value;
+        return editTopLevelProperty(text, head, container, style);
+    }
+    const inner = text.slice(property.valueStart, property.valueEnd);
+    // The container's members sit one unit deeper than the file's top level — read
+    // that unit off the container's own first key, so a fresh member lands beside its
+    // siblings and the member's *value* keeps nesting by the file's unit (passed as
+    // valueIndent), which is what one level deeper actually means.
+    const memberIndent = /\n([ \t]+)"/.exec(inner)?.[1] ?? style.indent + style.indent;
+    const edited = editJsonPropertyAt(inner, rest, value, { ...style, indent: memberIndent }, baseIndent);
+    if (edited === undefined)
+        return undefined; // the container's value is not an object
+    if (edited === inner)
+        return text;
+    if (value === undefined && removesToEmptyObject(edited)) {
+        // The container is now `{}` and it only got that way because of this removal —
+        // lift it out, so a file that never carried the key round-trips byte-identical.
+        return editTopLevelProperty(text, head, undefined, style) ?? text;
+    }
+    return `${text.slice(0, property.valueStart)}${edited}${text.slice(property.valueEnd)}`;
+}
+/** True when `text` is exactly a JSON object with no properties. */
+function removesToEmptyObject(text) {
+    const scan = scanJsonTopLevel(text);
+    return scan !== undefined && scan.properties.length === 0;
+}
 /* ------------------------------------------------------------------------------------
  * Marker blocks
  * ---------------------------------------------------------------------------------- */