@tangle-network/agent-runtime 0.353.3 → 2.0.1

package/dist/{journal-store-BJPMUydp.js → journal-store-BpCOCDoO.js}

@@ -1,26 +1,16 @@
 import { m as ValidationError, r as BackendTransportError } from "./errors-AzSuGI23.js";
-import { D as assertResources, E as addResourceSpend, T as zeroTokenUsage, i as chargedTokens, k as withBudgetResources, l as fnv1a32Hex, m as promptCacheTokenClasses, o as cloneTokenUsage, r as addTokenUsage, u as hasCompleteCacheBreakdown } from "./util-ebWMWzY0.js";
+import { D as assertResources, E as addResourceSpend, T as zeroTokenUsage, i as chargedTokens, k as withBudgetResources, l as fnv1a32Hex, m as promptCacheTokenClasses, o as cloneTokenUsage, r as addTokenUsage, u as hasCompleteCacheBreakdown } from "./util-BX20UJ9X.js";
+import { d as detachedSnapshot, m as errMessage, n as isNoEntError, o as readCommittedJsonLines, p as causeChain, t as appendCommittedJsonLine } from "./jsonl-file-BBP9Dz9w.js";
+import { n as assertNoSymlinkDescendant, o as captureRunWriteContext, r as publishExclusiveDurableFile } from "./durable-file-DstVeHcj.js";
+import { a as withPursuitContext } from "./runtime-hooks-CsW2pfFk.js";
 import { AgentTurnResultSchema, CanonicalStreamEventSchema, RuntimeEventEnvelopeSchema } from "@tangle-network/agent-interface";
 import { isRecord } from "@tangle-network/agent-core";
 import { collectAgentFinalMessageText, collectAgentResponseText } from "@tangle-network/sandbox";
 import { z } from "zod";
-import { REDACTION_VERSION, redact } from "@tangle-network/agent-eval/traces";
-import { createHash, randomUUID } from "node:crypto";
-import { LedgerCanonicalizationError, canonicalString, jsonDocument, merkleLeafHash, merkleRoot, merkleSalt, tryAcquireAtomicFileLock } from "@tangle-network/agent-eval/ledger-core";
-import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, ftruncateSync, linkSync, lstatSync, openSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
-import { dirname, join, relative, resolve } from "node:path";
-import { AsyncLocalStorage } from "node:async_hooks";
-// \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
+import { createHash } from "node:crypto";
+import { LedgerCanonicalizationError, canonicalString, jsonDocument, merkleLeafHash, merkleRoot, merkleSalt } from "@tangle-network/agent-eval/ledger-core";
+import { fstatSync, statSync } from "node:fs";
+import { resolve } from "node:path";
 // src/record-value.ts
 function recordValue(value) {
 	return isRecord(value) ? value : void 0;
@@ -1993,123 +1983,6 @@ function describeLeakedReservation(leak) {
 	parts.push(`stage ${leak.stage}`);
 	return parts.join(", ");
 }
-// src/redact.ts
-/**
-* Redaction for values that may leave the Runtime process. The built-in
-* redactor is agent-eval's redaction core (`@tangle-network/agent-eval/traces`,
-* default profile): credentials found by field name or value shape are
-* replaced whole, email, card, SSN and phone values in place, and token counts
-* such as `inputTokens` or `max_tokens` are kept. A customer with
-* domain-specific PII supplies their own `redact` hook.
-*
-* This is narrower than `src/sanitize.ts`, which drops fields of the runtime's
-* *event envelope* unless the caller opts in: here the value is opaque customer
-* payload, so the scrub is value-shaped, not schema-shaped.
-*
-* @experimental
-*/
-/**
-* The built-in redactor. Cycle-safe, depth-bounded and total: it never throws
-* on customer input and never mutates it.
-*/
-function defaultRedactor(value) {
-	return redact(value).value;
-}
-/** Stable identity input for saved work that depends on built-in redaction behavior. */
-function defaultRedactorIdentityMaterial() {
-	return {
-		core: "@tangle-network/agent-eval/traces redact",
-		profile: "default",
-		version: REDACTION_VERSION
-	};
-}
-/**
-* Resolve the redactor a client uses. A caller-supplied hook handles
-* domain-specific values first, then the built-in scrubber still removes
-* credentials and personal data. Returning `false` is the explicit opt-out for
-* already-reviewed public values.
-*/
-function resolveRedactor(redact) {
-	if (redact === false) return (value) => value;
-	if (!redact) return defaultRedactor;
-	return (value) => defaultRedactor(redact(value));
-}
-// src/runtime/supervise/error-message.ts
-const maxCauseDepth = 4;
-const maxMessageLength = 32768;
-const maxPartLength = 2048;
-/** A persisted failure must explain its wrappers without exporting credentials or unbounded data. */
-function errorText(value) {
-	let text;
-	try {
-		text = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
-	} catch {
-		text = "[unprintable rejection]";
-	}
-	return String(defaultRedactor(text)).slice(0, maxMessageLength);
-}
-function errorProperty(error, field) {
-	try {
-		const value = error[field];
-		return value === void 0 ? void 0 : errorText(value).slice(0, field === "name" ? 256 : maxMessageLength);
-	} catch {
-		return `[unreadable error ${field}]`;
-	}
-}
-/** An HTTP status carried on a thrown error, read without trusting its getter. Provider SDKs put
-*  one on their own error classes, so this is how a refusal is recognised outside the transport
-*  taxonomy — for the persisted message here, and for the driver's retry verdict. */
-function errorHttpStatus(error) {
-	try {
-		const status = Reflect.get(error, "status");
-		return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : void 0;
-	} catch {
-		return;
-	}
-}
-/** Shared by child settlements, driver attempts, and the final no-winner result. */
-function errMessage(error) {
-	const parts = [];
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	for (let depth = 0; depth <= maxCauseDepth; depth += 1) try {
-		if (!(current instanceof Error)) {
-			parts.push(errorText(current).slice(0, maxPartLength));
-			break;
-		}
-		if (seen.has(current)) {
-			parts.push("[circular]");
-			break;
-		}
-		seen.add(current);
-		const status = errorHttpStatus(current);
-		const message = (status === void 0 ? "" : `HTTP ${status}: `) + (errorProperty(current, "message") ?? "");
-		parts.push((depth === 0 ? message : `${errorProperty(current, "name")}: ${message}`).slice(0, maxPartLength));
-		current = current.cause;
-		if (current === void 0 || current === null) break;
-		if (depth === maxCauseDepth) parts.push("[cause chain truncated]");
-	} catch {
-		parts.push("[unreadable error cause]");
-		break;
-	}
-	return parts.join(": caused by ").slice(0, maxMessageLength);
-}
-/** The error and its causes (`cause`, and `errors` members), bounded and cycle-safe. */
-function causeChain(error) {
-	const chain = [];
-	const queue = [error];
-	while (queue.length > 0 && chain.length < 12) {
-		const value = queue.shift();
-		if (typeof value !== "object" || value === null || chain.includes(value)) continue;
-		chain.push(value);
-		try {
-			const errors = Reflect.get(value, "errors");
-			if (Array.isArray(errors)) queue.push(...errors);
-			queue.push(Reflect.get(value, "cause"));
-		} catch {}
-	}
-	return chain;
-}
 // src/runtime/supervise/credential-refusal.ts
 /**
 * The account owner refused an unsupported credential route before dispatch. This is the
@@ -2264,91 +2137,6 @@ function stableStringify(value) {
 	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
 	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
 }
-// src/runtime/supervise/snapshot.ts
-/** Deeply detach and freeze untrusted data at a runtime decision boundary. The clone prevents the
-* caller from mutating it later; the freeze prevents downstream code from mutating the snapshot.
-* Strings are immutable, so the snapshot shares the caller's strings instead of copying them. */
-function detachedSnapshot(value, context) {
-	let clone;
-	try {
-		clone = structuredClone(value);
-	} catch (error) {
-		throw new ValidationError(`${context}: input must be structured-cloneable`, { cause: error });
-	}
-	return deepFreeze(shareSourceStrings(value, clone));
-}
-/** Detach a value from its caller and freeze it, without the `ValidationError` framing
-*  {@link detachedSnapshot} adds. For a boundary that has already validated its input. */
-function detachedFrozen(value) {
-	return deepFreeze(shareSourceStrings(value, structuredClone(value)));
-}
-/**
-* Point each string in a fresh structured clone at the equal string in its source.
-*
-* `structuredClone` copies every string, and a copied string buys no isolation: only objects and
-* arrays can change through a shared reference. A spawned profile passes several boundaries, and
-* each one kept its own copy: in a reproduction of Discovery's hosted coordinator, a child profile
-* that mounts a 5.3 MB file packet was held four times per spawned child. A scope keeps every
-* child it spawned, so the heap grew about 22 MB per spawn, and hosted coordinators died with V8
-* heap OOM after 37 spawns.
-*
-* The walk pairs only own data properties of plain objects and arrays. Accessors, Maps, Sets and
-* other cloned types keep the clone's values. A string is replaced only by a string equal to it,
-* so the snapshot holds exactly the clone's value. The snapshot keeps the source's strings alive.
-*/
-function shareSourceStrings(source, clone) {
-	const visited = /* @__PURE__ */ new Set();
-	const visit = (from, to) => {
-		if (from === null || to === null || typeof from !== "object" || typeof to !== "object") return;
-		const array = Array.isArray(to);
-		if (array !== Array.isArray(from)) return;
-		if (!array && Object.getPrototypeOf(to) !== Object.prototype) return;
-		if (visited.has(to)) return;
-		visited.add(to);
-		const target = to;
-		for (const key of Object.keys(target)) {
-			const own = Object.getOwnPropertyDescriptor(from, key);
-			if (own === void 0 || !("value" in own)) continue;
-			const cloned = target[key];
-			if (typeof cloned === "string") {
-				if (own.value === cloned) target[key] = own.value;
-			} else visit(own.value, cloned);
-		}
-	};
-	visit(source, clone);
-	return clone;
-}
-/**
-* Replace each string in a freshly parsed JSON value with an equal string already in `pool`, and
-* add the new ones. One recovery pass parses every interrupted child's profile from its own blob,
-* so children that carry the same file packet would otherwise hold one copy each. The value is
-* updated in place, so it must belong to the caller; frozen objects are left as they are.
-*/
-function shareParsedStrings(value, pool) {
-	const visit = (node) => {
-		if (node === null || typeof node !== "object" || Object.isFrozen(node)) return;
-		if (!Array.isArray(node) && Object.getPrototypeOf(node) !== Object.prototype) return;
-		const target = node;
-		for (const key of Object.keys(target)) {
-			const item = target[key];
-			if (typeof item !== "string") {
-				visit(item);
-				continue;
-			}
-			const shared = pool.get(item);
-			if (shared === void 0) pool.set(item, item);
-			else target[key] = shared;
-		}
-	};
-	visit(value);
-	return value;
-}
-function deepFreeze(value, seen = /* @__PURE__ */ new Set()) {
-	if (value === null || typeof value !== "object" || ArrayBuffer.isView(value) || seen.has(value)) return value;
-	seen.add(value);
-	for (const child of Object.values(value)) deepFreeze(child, seen);
-	return Object.freeze(value);
-}
 // src/runtime/supervise/trace-root.ts
 /**
 * Trace roots: one Merkle root over the events a turn archived, so a single event can be proven
@@ -3107,236 +2895,157 @@ function settlementFailureCause(down) {
 		...down.failure?.providerCode === void 0 ? {} : { providerCode: down.failure.providerCode }
 	};
 }
-// src/content-digest.ts
-function sha256(value) {
-	return createHash("sha256").update(value).digest("hex");
-}
-// src/durable/run-fence.ts
-const claims = new AsyncLocalStorage();
-const publications = new AsyncLocalStorage();
-/** Bind asynchronous work, including callbacks, to the generation that admitted it. @internal */
-function runWithWriteClaim(claim, operation) {
-	return claims.run(claim, operation);
-}
-/** Capture a store's acquisition once, even when later called from an unrelated emitter. @internal */
-function captureRunWriteContext() {
-	let claim = claims.getStore();
-	return (operation) => {
-		claim ??= claims.getStore();
-		return claims.run(claim, operation);
-	};
-}
-/** Serialize claim changes and file mutations under the same cross-process guard. @internal */
-function mutateRunClaim(path, operation) {
-	const legacyGuard = `${path}.guard`;
-	if (existsSync(legacyGuard)) throw new Error(`supervisePursuit: cannot mutate ${path}; inspect ${legacyGuard} and remove it only after confirming no lock mutation is active`);
-	const deadline = performance.now() + 5e3;
-	const sleeper = new Int32Array(new SharedArrayBuffer(4));
-	for (;;) {
-		const acquisition = tryAcquireAtomicFileLock({ lockPath: `${path}.mutation` });
-		if (acquisition.acquired) try {
-			return operation();
-		} finally {
-			acquisition.lock.release();
-		}
-		if (performance.now() >= deadline) throw new Error(`run directory mutation is held: ${path}`);
-		Atomics.wait(sleeper, 0, 0, 10);
-	}
-}
+// src/durable/observer-journal.ts
 /**
-* Fence an actual file mutation, not an earlier advisory check. No await occurs between the
-* ownership check and publication, and acquire/release use this same guard. Unclaimed standalone
-* stores retain their existing single-writer contract; pursuit-owned work always carries a claim.
-* @internal
-*/
-function fenceRunWrite(operation) {
-	const claim = claims.getStore();
-	if (claim === void 0) return operation();
-	const publication = publications.getStore();
-	if (publication?.active && publication.claim.path === claim.path && publication.claim.generation === claim.generation) return operation();
-	return mutateRunClaim(claim.path, () => {
-		let holder;
-		try {
-			const fd = openSync(claim.path, "r");
-			try {
-				const stat = fstatSync(fd, { bigint: true });
-				if (stat.dev.toString() !== claim.lock.dev || stat.ino.toString() !== claim.lock.ino || stat.birthtimeNs.toString() !== claim.lock.birthtimeNs) throw new Error("run lock inode changed");
-				holder = JSON.parse(readFileSync(fd, "utf8"));
-			} finally {
-				closeSync(fd);
-			}
-		} catch (cause) {
-			throw new Error(`run directory generation ${claim.generation} lost its claim`, { cause });
-		}
-		if (holder?.generation !== claim.generation || holder.lock?.dev !== claim.lock.dev || holder.lock?.ino !== claim.lock.ino || holder.lock?.birthtimeNs !== claim.lock.birthtimeNs) throw new Error(`run directory generation ${claim.generation} lost its claim`);
-		const publication = {
-			claim,
-			active: true
-		};
-		try {
-			return publications.run(publication, operation);
-		} finally {
-			publication.active = false;
-		}
-	});
-}
-/** Persistent generation counter survives a clean release of supervise.lock. @internal */
-function runGenerationPath(runDir) {
-	return resolve(runDir, "supervise.generation");
-}
-// src/runtime/supervise/durable-file.ts
-/**
-* Small filesystem durability primitives for Runtime-owned state.
-*
-* Callers must validate their path and parent directory before invoking these functions.
-* The exclusive writer protects a no-clobber publication race; the atomic writer replaces one
-* state file after its temporary contents reach stable storage.
+* Durable, append-only third-person history for one concrete Runtime execution.
+* It consumes Runtime's existing hook stream and does not participate in execution
+* decisions. A broken observer therefore cannot change what an agent is allowed to do.
 *
-* @internal
-*/
-var durable_file_exports = /* @__PURE__ */ __exportAll({
-	appendDurableFile: () => appendDurableFile,
-	assertNoSymlinkDescendant: () => assertNoSymlinkDescendant,
-	publishExclusiveDurableFile: () => publishExclusiveDurableFile,
-	syncDurableDirectory: () => syncDurableDirectory,
-	writeAtomicDurableFile: () => writeAtomicDurableFile
-});
-/**
-* Publish a new file without replacing a concurrent winner. The published entry is a hard link
-* of the temporary file, so a content function sees the published file's inode.
+* The write discipline deliberately matches `FileSpawnJournal`: serialized appends,
+* torn-tail recovery, short-write handling, and fsync before acknowledgement. One
+* execution owns one journal file; higher-level pursuit aggregation joins isolated
+* journals by `pursuitId` instead of making independent processes share a write head.
 */
-function publishExclusiveDurableFile(filePath, content, options = {}) {
-	return fenceRunWrite(() => publishExclusiveDurableFileUnchecked(filePath, content, options));
-}
-function publishExclusiveDurableFileUnchecked(filePath, content, options = {}) {
-	const temporaryPath = `${filePath}.${randomUUID()}.tmp`;
-	let operationFailed = false;
-	let operationError;
-	let published = false;
-	try {
-		writeExclusiveDurableFile(temporaryPath, content, options);
-		try {
-			linkSync(temporaryPath, filePath);
-			syncDurableDirectory(dirname(filePath));
-			published = true;
-		} catch (error) {
-			if (!isAlreadyExistsError(error)) throw error;
+var FileObserverJournal = class FileObserverJournal {
+	path;
+	pursuitId;
+	writeContext = captureRunWriteContext();
+	tail = Promise.resolve();
+	initialized = false;
+	sequence = 0;
+	previousDigest;
+	appendFailure;
+	constructor(path, pursuitId) {
+		const stableId = pursuitId.trim();
+		if (stableId.length === 0) throw new TypeError("FileObserverJournal: pursuitId must be non-empty");
+		this.path = resolve(path);
+		this.pursuitId = stableId;
+	}
+	/** Open existing committed history by its recorded identity; never creates a file. */
+	static async open(path) {
+		for await (const record of readCommittedJsonLines(path, { allowMissing: true })) {
+			if (typeof record?.pursuitId !== "string") throw new TypeError("observer journal: missing pursuit identity");
+			const journal = new FileObserverJournal(path, record.pursuitId);
+			verifyObserverRecords([record], journal.pursuitId);
+			return journal;
 		}
-	} catch (error) {
-		operationFailed = true;
-		operationError = error;
 	}
-	let cleanupError;
-	try {
-		unlinkSync(temporaryPath);
-	} catch (error) {
-		if (!isNoEntryError(error)) cleanupError = error;
+	hooks() {
+		return withPursuitContext(this.pursuitId, {
+			onEvent: (event) => this.appendEvent(event).then(() => void 0),
+			onDecisionPoint: (point) => this.appendDecision(point).then(() => void 0)
+		});
 	}
-	if (operationFailed) throw operationError;
-	if (cleanupError !== void 0) throw cleanupError;
-	return published;
-}
-/** Fsync a directory after publishing a durable file entry. */
-function syncDurableDirectory(directoryPath) {
-	const fd = openSync(directoryPath, "r");
-	try {
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
+	appendEvent(event) {
+		return this.enqueue("event", event);
 	}
-}
-/** Fsync one durable file after its contents reach stable storage. */
-function syncDurableFile(filePath, exactMode) {
-	const fd = openSync(filePath, "r");
-	try {
-		if (exactMode !== void 0 && process.platform !== "win32") fchmodSync(fd, exactMode);
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
+	appendDecision(point) {
+		return this.enqueue("decision", point);
 	}
-}
-/** Append one record with O_APPEND, then fsync the file and containing directory. */
-function appendDurableFile(filePath, content, options = {}) {
-	fenceRunWrite(() => appendDurableFileUnchecked(filePath, content, options));
-}
-function appendDurableFileUnchecked(filePath, content, options = {}) {
-	const flags = constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0);
-	const fd = openSync(filePath, flags, options.mode ?? 384);
-	try {
-		if (process.platform !== "win32") fchmodSync(fd, options.mode ?? 384);
-		const expectedBytes = Buffer.byteLength(content, "utf8");
-		const writtenBytes = writeSync(fd, content, void 0, "utf8");
-		if (writtenBytes !== expectedBytes) throw new Error(`durable append wrote ${writtenBytes} of ${expectedBytes} bytes to '${filePath}'`);
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
-	}
-	syncDurableDirectory(dirname(filePath));
-}
-/** Reject a path that escapes its run directory or traverses a symbolic link. */
-function assertNoSymlinkDescendant(root, target, label = "path") {
-	const base = resolve(root);
-	const exact = resolve(target);
-	const rel = relative(base, exact);
-	if (rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) throw new Error(`${label} path escapes its run directory`);
-	if (existsSync(base) && lstatSync(base).isSymbolicLink()) throw new Error(`${label} path contains a symbolic link: ${base}`);
-	let current = base;
-	for (const part of rel.split(/[\\/]/u).filter(Boolean)) {
-		current = join(current, part);
-		if (!existsSync(current)) continue;
-		if (lstatSync(current).isSymbolicLink()) throw new Error(`${label} path contains a symbolic link: ${current}`);
-	}
-}
-/** Write, fsync, atomically replace, and fsync one Runtime-owned state file.
-* preserveMode retains ordinary access permissions despite the current umask; a new
-* file keeps normal creation semantics. Callers still own path validation and write exclusion. */
-function writeAtomicDurableFile(filePath, content, options = {}) {
-	fenceRunWrite(() => writeAtomicDurableFileUnchecked(filePath, content, options));
-}
-function writeAtomicDurableFileUnchecked(filePath, content, options = {}) {
-	const temporaryPath = `${filePath}.${randomUUID()}.tmp`;
-	let operationFailed = false;
-	let operationError;
-	try {
-		let mode = options.mode;
-		let exactMode = false;
-		if (options.preserveMode) try {
-			mode = statSync(filePath).mode & 511;
-			exactMode = true;
-		} catch (error) {
-			if (!isNoEntryError(error)) throw error;
+	async read() {
+		await this.tail;
+		this.assertComplete();
+		const records = [];
+		const verify = observerVerifier(this.pursuitId);
+		for await (const record of this.readExistingUnsafe()) {
+			verify(record);
+			records.push(record);
 		}
-		writeExclusiveDurableFile(temporaryPath, content, { mode }, exactMode);
-		renameSync(temporaryPath, filePath);
-		syncDurableDirectory(dirname(filePath));
-	} catch (error) {
-		operationFailed = true;
-		operationError = error;
+		return Object.freeze(records);
+	}
+	async enqueue(kind, value) {
+		if (value.pursuitId !== this.pursuitId) throw new Error(`FileObserverJournal: ${kind} pursuitId ${String(value.pursuitId)} does not match ${this.pursuitId}`);
+		const snapshot = detachedSnapshot(value, "observer record");
+		const operation = this.tail.then(() => this.writeContext(async () => {
+			this.assertComplete();
+			await this.initialize();
+			const unsigned = {
+				schemaVersion: 1,
+				pursuitId: this.pursuitId,
+				sequence: this.sequence + 1,
+				kind,
+				observedAt: Date.now(),
+				...this.previousDigest ? { previousDigest: this.previousDigest } : {},
+				...kind === "event" ? { event: snapshot } : { decision: snapshot }
+			};
+			const record = Object.freeze({
+				...unsigned,
+				digest: observerRecordDigest(unsigned)
+			});
+			const fs = await import("node:fs/promises");
+			const { dirname } = await import("node:path");
+			await fs.mkdir(dirname(this.path), { recursive: true });
+			await appendCommittedJsonLine(this.path, record);
+			this.sequence = record.sequence;
+			this.previousDigest = record.digest;
+			return record;
+		})).catch((error) => {
+			this.appendFailure ??= toError(error);
+			throw error;
+		});
+		this.tail = operation.then(() => void 0, () => void 0);
+		return operation;
+	}
+	async initialize() {
+		if (this.initialized) return;
+		const verify = observerVerifier(this.pursuitId);
+		let tail;
+		for await (const record of this.readExistingUnsafe()) {
+			verify(record);
+			tail = record;
+		}
+		this.sequence = tail?.sequence ?? 0;
+		this.previousDigest = tail?.digest;
+		this.initialized = true;
 	}
-	let cleanupError;
-	try {
-		unlinkSync(temporaryPath);
-	} catch (error) {
-		if (!isNoEntryError(error)) cleanupError = error;
+	readExistingUnsafe() {
+		return readCommittedJsonLines(this.path, { allowMissing: true });
 	}
-	if (operationFailed) throw operationError;
-	if (cleanupError !== void 0) throw cleanupError;
-}
-function writeExclusiveDurableFile(filePath, content, options, exactMode = false) {
-	const fd = openSync(filePath, "wx", options.mode ?? 438);
-	try {
-		const text = typeof content === "string" ? content : content(fstatSync(fd, { bigint: true }));
-		writeFileSync(fd, text, "utf8");
-	} finally {
-		closeSync(fd);
+	assertComplete() {
+		if (!this.appendFailure) return;
+		throw new Error("FileObserverJournal: a prior durable append failed; observer completeness is unknown", { cause: this.appendFailure });
 	}
-	syncDurableFile(filePath, exactMode ? options.mode : void 0);
+};
+/** Verify identity, monotonic sequence, payload shape, and the complete digest chain. */
+function verifyObserverRecords(records, pursuitId) {
+	const verify = observerVerifier(pursuitId);
+	for (const record of records) verify(record);
+	return Object.freeze([...records]);
+}
+/** The same full chain validation is used for replay, startup and in-memory evidence. */
+function observerVerifier(pursuitId) {
+	let previousDigest;
+	let expectedSequence = 1;
+	return (record) => {
+		if (record.schemaVersion !== 1) throw new Error("observer journal: unsupported schemaVersion");
+		if (pursuitId !== void 0 && record.pursuitId !== pursuitId) throw new Error(`observer journal: pursuit identity mismatch at sequence ${record.sequence}`);
+		if (record.sequence !== expectedSequence) throw new Error(`observer journal: non-contiguous sequence ${record.sequence}; expected ${expectedSequence}`);
+		if (record.previousDigest !== previousDigest) throw new Error(`observer journal: digest-chain break at sequence ${record.sequence}`);
+		for (const kind of ["event", "decision"]) {
+			const payload = record[kind];
+			if (record.kind === kind === (payload === void 0)) throw new Error(`observer journal: invalid ${kind} payload at sequence ${record.sequence}`);
+			if (payload !== void 0 && payload.pursuitId !== record.pursuitId) throw new Error(`observer journal: nested ${kind} pursuit mismatch at sequence ${record.sequence}`);
+		}
+		const { digest, ...unsigned } = record;
+		if (digest !== observerRecordDigest(unsigned)) throw new Error(`observer journal: digest mismatch at sequence ${record.sequence}`);
+		previousDigest = digest;
+		expectedSequence += 1;
+	};
 }
-function isAlreadyExistsError(error) {
-	return error !== null && typeof error === "object" && "code" in error && error.code === "EEXIST";
+/** Compute the canonical SHA-256 digest for an unsigned observer record. */
+function observerRecordDigest(record) {
+	return createHash("sha256").update(JSON.stringify(record)).digest("hex");
 }
-function isNoEntryError(error) {
-	return error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT";
+/** Build the canonical durable observer hook in one call. */
+function createFileObserverHooks(path, pursuitId) {
+	const journal = new FileObserverJournal(path, pursuitId);
+	return {
+		journal,
+		hooks: journal.hooks()
+	};
+}
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
 }
 // src/durable/spawn-journal/event-index.ts
 /**
@@ -3545,210 +3254,74 @@ function outsideCursorNamespace(ev) {
 function insideCursorNamespace(ev) {
 	return !outsideKinds.has(ev.kind);
 }
-// src/durable/jsonl-append.ts
-/** Commit JSONL bytes and validate their descriptor under one generation fence. @internal */
-function commitJsonLine(path, record, acknowledge) {
-	const encoded = JSON.stringify(record);
-	if (encoded === void 0) throw new TypeError("JSONL records must be JSON serializable");
-	return fenceRunWrite(() => {
-		const separator = prepareJsonlTail(path);
-		const fd = openSync(path, "a");
-		try {
-			const bytes = Buffer.from(`${separator ? "\n" : ""}${encoded}\n`);
-			let offset = 0;
-			while (offset < bytes.length) {
-				const written = writeSync(fd, bytes, offset, bytes.length - offset);
-				if (written <= 0) throw new Error(`append-only file write made no progress at byte ${offset}`);
-				offset += written;
-			}
-			fsyncSync(fd);
-			return acknowledge?.(fd);
-		} finally {
-			closeSync(fd);
-		}
-	});
-}
-/** Recover only an uncommitted tail. Caller holds the generation fence. @internal */
-function prepareJsonlTail(path) {
-	let fd;
-	try {
-		fd = openSync(path, "r+");
-	} catch (error) {
-		if (error.code === "ENOENT") return false;
-		throw error;
-	}
-	try {
-		const size = fstatSync(fd).size;
-		if (size === 0) return false;
-		const last = Buffer.allocUnsafe(1);
-		readAt(fd, last, size - 1);
-		if (last[0] === 10) return false;
-		const chunks = [];
-		let end = size;
-		let tailStart = 0;
-		while (end > 0) {
-			const start = Math.max(0, end - 65536);
-			const chunk = Buffer.allocUnsafe(end - start);
-			readAt(fd, chunk, start);
-			const newline = chunk.lastIndexOf(10);
-			chunks.push(chunk.subarray(newline + 1));
-			if (newline >= 0) {
-				tailStart = start + newline + 1;
-				break;
-			}
-			end = start;
-		}
-		try {
-			JSON.parse(Buffer.concat(chunks.reverse()).toString("utf8"));
-			return true;
-		} catch (error) {
-			if (!(error instanceof SyntaxError)) throw error;
-			ftruncateSync(fd, tailStart);
-			fsyncSync(fd);
-			return false;
-		}
-	} finally {
-		closeSync(fd);
-	}
-}
-function readAt(fd, buffer, position) {
-	let offset = 0;
-	while (offset < buffer.length) {
-		const read = readSync(fd, buffer, offset, buffer.length - offset, position + offset);
-		if (read === 0) throw new Error("journal changed while preparing its append tail");
-		offset += read;
-	}
-}
-// src/durable/jsonl-file.ts
-/** Read a fixed file prefix one record at a time, never allocating the whole journal as a string.
-* A reader cannot chase concurrent appends forever. Missing files are empty only when requested;
-* corruption, short reads, and other I/O errors remain failures. Closing the iterator closes the fd. */
-async function* readCommittedJsonLines(path, options = {}) {
-	const fs = await import("node:fs/promises");
-	let handle;
-	try {
-		handle = await fs.open(path, "r");
-	} catch (error) {
-		if (options.allowMissing && isNoEntError(error)) return;
-		throw error;
-	}
-	try {
-		const { size } = await handle.stat();
-		if (size === 0) return;
-		const { StringDecoder } = await import("node:string_decoder");
-		const decoder = new StringDecoder("utf8");
-		const stream = handle.createReadStream({
-			autoClose: false,
-			end: size - 1
+// src/durable/spawn-journal/result-blob-store.ts
+/**
+* FS `ResultBlobStore`. One JSON file per artifact under `dir`, named by a
+* filesystem-safe encoding of the `outRef` (`sha256:<hex>` → `sha256-<hex>.json`).
+* `put` fsyncs so a crash between writes never loses an acknowledged blob.
+*
+* @stable
+*/
+var FileResultBlobStore = class {
+	dir;
+	writeContext = captureRunWriteContext();
+	constructor(dir) {
+		this.dir = dir;
+	}
+	async put(outRef, artifact) {
+		return this.writeContext(async () => {
+			const { text } = encodeResultBlob(outRef, artifact);
+			const filePath = this.blobPath(outRef);
+			assertNoSymlinkDescendant(this.dir, filePath, "result blob");
+			await (await import("node:fs/promises")).mkdir(this.dir, { recursive: true });
+			assertNoSymlinkDescendant(this.dir, filePath, "result blob");
+			if (!publishExclusiveDurableFile(filePath, text, { mode: 384 })) assertContentAddress(outRef, await this.get(outRef));
 		});
-		const fragments = [];
-		let lineNumber = 1;
+	}
+	async get(outRef) {
+		const filePath = this.blobPath(outRef);
+		assertNoSymlinkDescendant(this.dir, filePath, "result blob");
+		const fs = await import("node:fs/promises");
+		const { constants } = await import("node:fs");
+		let text;
 		try {
-			for await (const chunk of stream) {
-				options.onBytes?.(chunk);
-				const text = decoder.write(chunk);
-				let start = 0;
-				let end = text.indexOf("\n", start);
-				while (end !== -1) {
-					fragments.push(text.slice(start, end));
-					const record = parseRecord(fragments.join(""), path, lineNumber++, true, options.allowWhitespaceLines);
-					fragments.length = 0;
-					if (record !== void 0) yield record.value;
-					start = end + 1;
-					end = text.indexOf("\n", start);
-				}
-				if (start < text.length) fragments.push(text.slice(start));
+			const handle = await fs.open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+			try {
+				if (!(await handle.stat()).isFile()) throw new Error("result blob must be a regular file");
+				text = await handle.readFile("utf8");
+			} finally {
+				await handle.close();
 			}
-			if (stream.bytesRead !== size) throw new Error(`${path}: journal changed while reading its committed prefix`);
-			fragments.push(decoder.end());
-			const record = parseRecord(fragments.join(""), path, lineNumber, false, options.allowWhitespaceLines);
-			if (record !== void 0) yield record.value;
-		} finally {
-			stream.destroy();
+		} catch (err) {
+			if (isNoEntError(err)) return void 0;
+			throw err;
 		}
-	} finally {
-		await handle.close();
+		const artifact = JSON.parse(text);
+		assertContentAddress(outRef, artifact);
+		return artifact;
 	}
-}
-/** An invalid unterminated tail may be a torn write; other parse failures are not evidence of one. */
-function parseRecord(line, source, lineNumber, terminated, allowWhitespaceLines = false) {
-	if (line.length === 0 || allowWhitespaceLines && line.trim().length === 0) return void 0;
-	try {
-		return { value: JSON.parse(line) };
-	} catch (cause) {
-		if (!(cause instanceof SyntaxError)) throw cause;
-		if (!terminated) return void 0;
-		throw new Error(`${source}: malformed JSONL record at line ${lineNumber}`, { cause });
-	}
-}
-async function appendCommittedJsonLine(path, record, acknowledge) {
-	return commitJsonLine(path, record, acknowledge);
-}
-/** Serialize JSONL file updates across processes and aliases using Eval's existing file lock.
-* The caller owns validation and the record format. The lock path names the canonical file,
-* including its first write, so two directory aliases cannot acquire different write heads.
-* @internal
-*/
-async function withJsonlFileLock(path, operation) {
-	const fs = await import("node:fs/promises");
-	const { dirname } = await import("node:path");
-	const { tryAcquireAtomicFileLock } = await import("@tangle-network/agent-eval/ledger-core");
-	await fs.mkdir(dirname(path), { recursive: true });
-	await (await fs.open(path, "a")).close();
-	const canonicalPath = await fs.realpath(path);
-	const deadline = Date.now() + 5e3;
-	for (;;) {
-		const acquisition = tryAcquireAtomicFileLock({ lockPath: `${canonicalPath}.lock` });
-		if (!acquisition.acquired) {
-			if (Date.now() >= deadline) throw new Error(`journal file lock unavailable after 5000ms: ${canonicalPath}`);
-			await new Promise((resolve) => setTimeout(resolve, 25));
-			continue;
-		}
-		try {
-			return await operation(canonicalPath);
-		} finally {
-			acquisition.lock.release();
-		}
+	blobPath(outRef) {
+		if (!/^sha256:[0-9a-f]{64}$/.test(outRef)) throw new Error("invalid result blob content address");
+		return `${this.dir}/${outRef.replace(/:/g, "-")}.json`;
 	}
+};
+/** @internal shared with the SQL-backed store. */
+function encodeResultBlob(outRef, artifact) {
+	const detached = detachedSnapshot(artifact, "result blob");
+	assertContentAddress(outRef, detached);
+	const text = JSON.stringify(detached);
+	if (text === void 0) throw new Error("result blob must contain JSON");
+	const snapshot = JSON.parse(text);
+	assertContentAddress(outRef, snapshot);
+	return {
+		snapshot,
+		text
+	};
 }
-/** Read one keyed registry snapshot without an extra whole-file text allocation.
-* Historical registry files allow whitespace-only separators; append journals remain strict.
-* @internal
-*/
-async function readCommittedJsonFile(path) {
-	const records = [];
-	for await (const record of readCommittedJsonLines(path, {
-		allowMissing: true,
-		allowWhitespaceLines: true
-	})) records.push(record);
-	return records;
-}
-/** Replace one keyed row and publish one durable snapshot. The caller holds the file lock.
-* Keep unrelated rows in order and put the replacement last. No revision archive is retained.
-* @internal
-*/
-async function upsertCommittedJsonLine(path, record, key) {
-	const encoded = JSON.stringify(record);
-	if (encoded === void 0) throw new Error("JSONL records must be JSON serializable");
-	const snapshot = JSON.parse(encoded);
-	const id = key(snapshot);
-	const updated = [];
-	for await (const prior of readCommittedJsonLines(path, {
-		allowMissing: true,
-		allowWhitespaceLines: true
-	})) if (key(prior) !== id) updated.push(prior);
-	updated.push(snapshot);
-	const { writeAtomicDurableFile } = await Promise.resolve().then(() => durable_file_exports);
-	writeAtomicDurableFile(path, `${updated.map((row) => JSON.stringify(row)).join("\n")}\n`, { preserveMode: true });
-}
-/** Recover a torn tail under the same generation fence as durable publications. @internal */
-async function prepareJsonlAppend(path) {
-	return fenceRunWrite(() => prepareJsonlTail(path));
-}
-/** True for a filesystem error meaning "the file is not there yet" — the one condition an
-*  append-only reader treats as an empty log rather than a fault. */
-function isNoEntError(error) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+/** @internal shared with the SQL-backed store. */
+function assertContentAddress(outRef, artifact) {
+	const expected = contentAddress(artifact);
+	if (outRef !== expected) throw new Error(`blob outRef '${outRef}' does not match the artifact content hash '${expected}'; a content-addressed store refuses a mismatched ref (breaks the replay invariant)`);
 }
 // src/durable/spawn-journal/record-events.ts
 /** Decode the file journal's historical single-event and atomic-group envelopes. @internal */
@@ -3920,6 +3493,6 @@ var FileSpawnJournal = class {
 function journalFileStamp(stat) {
 	return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
 }
-export { traceRootWriter as $, runtimeProviderCode as A, sandboxLeafOutputFromEvents as At, retainedExecutorContext as B, createSandboxUsageLedger as Bt, runGenerationPath as C, spendFromUsageEvents as Ct, runtimeFailureCause as D, createSandboxToolPartState as Dt, reportedFailureCause as E, assertValidSpend as Et, executorEvidenceWriter as F, extractTransportEventIdentity as Ft, cappedDoublingMs as G, sandboxTerminalUsageField as Gt, workspaceCaptureWriter as H, isSandboxTerminalEvent as Ht, isProvisioningRefusal as I, parseCanonicalTransportEvent as It, unavailableResumeAt as J, parseCodexUsageRecord as Jt, jitteredMs as K, sumSandboxUsage as Kt, leafContinuationExecutionId as L, assertSandboxServedModel as Lt, BUDGET_CONTINUATION_TASK as M, sandboxProgressEvents as Mt, DISPATCH_NOT_ADMITTED_CODE as N, terminalTextFromSandboxEvent as Nt, runtimeFailureCauseSchema as O, mapSandboxEvent as Ot, RetainedExecutionPendingError as P, canonicalStreamEventFromSandboxEvent as Pt, TRACE_SUMMARY_SCHEMA as Q, prepareRetainedExecutor as R, canonicalSandboxUsageMode as Rt, mutateRunClaim as S, newUsageTotals as St, sha256 as T, assertValidBudget as Tt, UNAVAILABLE_CODES as U, notifySandboxEventObserver as Ut, retainedExecutorSeamKey as V, extractLlmCallEvent as Vt, UNAVAILABLE_STATUSES as W, sandboxEventServedBackend as Wt, unavailableSignalOfFailure as X, __exportAll as Xt, unavailableSignalInText as Y, recordValue as Yt, TRACE_ROOT_SCHEMA as Z, publishExclusiveDurableFile as _, defaultRedactorIdentityMaterial as _t, isNoEntError as a, executorFailure as at, captureRunWriteContext as b, createBudgetPool as bt, readCommittedJsonLines as c, hashJson as ct, SpawnEventIndex as d, causeChain as dt, detachedFrozen as et, closesCursorSlot as f, errMessage as ft, assertNoSymlinkDescendant as g, defaultRedactor as gt, appendDurableFile as h, errorText as ht, appendCommittedJsonLine as i, contentRef as it, settlementFailureCause as j, sandboxOutputMarker as jt, runtimeFailureRemediationSchema as k, mapSandboxToolEvent as kt, upsertCommittedJsonLine as l, credentialCommandExit as lt, outsideCursorNamespace as m, errorProperty as mt, appendSpawnEvents as n, shareParsedStrings as nt, prepareJsonlAppend as o, executorFailureInfra as ot, insideCursorNamespace as p, errorHttpStatus as pt, unavailablePauseMs as q, decodeHarnessUsage as qt, spawnJournalRecordEvents as r, contentAddress as rt, readCommittedJsonFile as s, executorFailureReason as st, FileSpawnJournal as t, detachedSnapshot as tt, withJsonlFileLock as u, isCredentialRefusal as ut, syncDurableDirectory as v, resolveRedactor as vt, runWithWriteClaim as w, spendFromUsageTotals as wt, fenceRunWrite as x, meterUsageEvent as xt, writeAtomicDurableFile as y, BudgetReconcileFault as yt, registerRetainedExecutorPreparation as z, createSandboxTurnEventCollector as zt };
+export { newUsageTotals as $, workspaceCaptureWriter as A, TRACE_SUMMARY_SCHEMA as B, executorEvidenceWriter as C, sumSandboxUsage as Ct, registerRetainedExecutorPreparation as D, prepareRetainedExecutor as E, recordValue as Et, unavailablePauseMs as F, executorFailureInfra as G, contentAddress as H, unavailableResumeAt as I, credentialCommandExit as J, executorFailureReason as K, unavailableSignalInText as L, UNAVAILABLE_STATUSES as M, cappedDoublingMs as N, retainedExecutorContext as O, jitteredMs as P, meterUsageEvent as Q, unavailableSignalOfFailure as R, RetainedExecutionPendingError as S, sandboxTerminalUsageField as St, leafContinuationExecutionId as T, parseCodexUsageRecord as Tt, contentRef as U, traceRootWriter as V, executorFailure as W, BudgetReconcileFault as X, isCredentialRefusal as Y, createBudgetPool as Z, runtimeFailureRemediationSchema as _, createSandboxUsageLedger as _t, encodeResultBlob as a, mapSandboxEvent as at, BUDGET_CONTINUATION_TASK as b, notifySandboxEventObserver as bt, insideCursorNamespace as c, sandboxOutputMarker as ct, createFileObserverHooks as d, canonicalStreamEventFromSandboxEvent as dt, spendFromUsageEvents as et, observerRecordDigest as f, extractTransportEventIdentity as ft, runtimeFailureCauseSchema as g, createSandboxTurnEventCollector as gt, runtimeFailureCause as h, canonicalSandboxUsageMode as ht, FileResultBlobStore as i, createSandboxToolPartState as it, UNAVAILABLE_CODES as j, retainedExecutorSeamKey as k, outsideCursorNamespace as l, sandboxProgressEvents as lt, reportedFailureCause as m, assertSandboxServedModel as mt, appendSpawnEvents as n, assertValidBudget as nt, SpawnEventIndex as o, mapSandboxToolEvent as ot, verifyObserverRecords as p, parseCanonicalTransportEvent as pt, hashJson as q, spawnJournalRecordEvents as r, assertValidSpend as rt, closesCursorSlot as s, sandboxLeafOutputFromEvents as st, FileSpawnJournal as t, spendFromUsageTotals as tt, FileObserverJournal as u, terminalTextFromSandboxEvent as ut, runtimeProviderCode as v, extractLlmCallEvent as vt, isProvisioningRefusal as w, decodeHarnessUsage as wt, DISPATCH_NOT_ADMITTED_CODE as x, sandboxEventServedBackend as xt, settlementFailureCause as y, isSandboxTerminalEvent as yt, TRACE_ROOT_SCHEMA as z };
 
-//# sourceMappingURL=journal-store-BJPMUydp.js.map
+//# sourceMappingURL=journal-store-BpCOCDoO.js.map