@unson/brainbase-mcp 0.6.0 → 0.7.0

package/dist/foundation-store.js

@@ -0,0 +1,654 @@
+import { assertFoundationCatalog, cloneFoundationCatalog, cloneFoundationDefinition, digestFoundationDefinition, findFoundationRecord, findLatestFoundationRecord, foundationCatalogOrEmpty, foundationKey, foundationRef, nextFoundationRevision } from './foundation-catalog.js';
+import { validateFoundationDefinition, validateFoundationRelation } from './ontology-foundation.js';
+import { loadPersonalOs, mutatePersonalOs } from './ssot.js';
+export class FoundationStoreError extends Error {
+    code;
+    currentRevision;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = 'FoundationStoreError';
+        this.code = code;
+        this.currentRevision = options.currentRevision;
+    }
+}
+/**
+ * Canonical foundation persistence over the existing Graph SSOT aggregate.
+ * There is intentionally no separate objectives/world-model file or writer.
+ */
+export class GraphFoundationRevisionStore {
+    dataDir;
+    policy;
+    endpointResolver;
+    constructor(options) {
+        if (!options.dataDir)
+            throw new FoundationStoreError('invalid_input', 'dataDir is required');
+        this.dataDir = options.dataDir;
+        this.policy = options.policy;
+        this.endpointResolver = options.endpointResolver;
+    }
+    async create(definition, context) {
+        const candidate = prepareDefinition(definition, 'create');
+        if (candidate.revision !== '1') {
+            throw new FoundationStoreError('invalid_input', 'A new foundation definition must start at revision 1');
+        }
+        validateForDraft(candidate);
+        assertContext(context);
+        await this.authorize({ action: 'create', context, next: candidate });
+        const ref = await mutatePersonalOs(this.dataDir, async (current) => {
+            const catalog = readCatalog(current);
+            if (catalog.records.some((record) => (record.definition.id === candidate.id && record.definition.type === candidate.type))) {
+                throw new FoundationStoreError('revision_conflict', `Foundation resource ${candidate.type}/${candidate.id} already exists`);
+            }
+            const record = makeRecord(candidate);
+            await this.authorize({
+                action: 'read',
+                context,
+                reference: foundationRef(record),
+                current: candidate
+            });
+            const nextCatalog = appendRecord(catalog, record);
+            return withFoundationCatalog(current, nextCatalog);
+        }).then(() => foundationRef(makeRecord(candidate)));
+        return this.readback(ref, context);
+    }
+    async read(reference, context) {
+        assertReferenceInput(reference);
+        assertContext(context);
+        const os = await this.load();
+        const catalog = readCatalog(os);
+        const record = findFoundationRecord(catalog, reference);
+        if (!record)
+            return null;
+        const latest = findLatestFoundationRecord(catalog, reference.type, reference.id);
+        if (!latest) {
+            throw new FoundationStoreError('corrupt_catalog', `Latest pointer is missing for ${reference.type}/${reference.id}`);
+        }
+        // Historical content is immutable, but access is evaluated against the
+        // current revision.  A principal removed from the current ACL must not
+        // regain access merely by requesting an older revision.
+        await this.authorize({ action: 'read', context, reference, current: latest.definition });
+        return cloneRecord(record);
+    }
+    async readLatest(type, id, context) {
+        if (!isFoundationType(type) || !id) {
+            throw new FoundationStoreError('invalid_input', 'type and id are required');
+        }
+        assertContext(context);
+        const os = await this.load();
+        const catalog = readCatalog(os);
+        const record = findLatestFoundationRecord(catalog, type, id);
+        if (!record)
+            return null;
+        await this.authorize({ action: 'read', context, reference: foundationRef(record), current: record.definition });
+        return cloneRecord(record);
+    }
+    async update(input, context) {
+        assertContext(context);
+        assertReferenceInput(input.reference);
+        if (input.expectedRevision !== undefined && input.expectedRevision !== input.reference.revision) {
+            throw new FoundationStoreError('revision_conflict', 'expectedRevision must match reference.revision', {
+                currentRevision: input.reference.revision
+            });
+        }
+        const reference = { ...input.reference };
+        const nextInput = cloneFoundationDefinition(input.next);
+        if (nextInput.id !== reference.id || nextInput.type !== reference.type) {
+            throw new FoundationStoreError('invalid_input', 'An update cannot change the logical id or type');
+        }
+        const candidate = {
+            ...nextInput,
+            revision: nextFoundationRevision(reference.revision)
+        };
+        validateForDraft(candidate);
+        let savedRef;
+        await mutatePersonalOs(this.dataDir, async (current) => {
+            const catalog = readCatalog(current);
+            const latest = findLatestFoundationRecord(catalog, reference.type, reference.id);
+            if (!latest)
+                throw new FoundationStoreError('not_found', `Foundation resource ${reference.type}/${reference.id} was not found`);
+            if (latest.definition.revision !== reference.revision) {
+                throw new FoundationStoreError('revision_conflict', `Expected ${reference.type}/${reference.id}@${reference.revision}, current is @${latest.definition.revision}`, {
+                    currentRevision: latest.definition.revision
+                });
+            }
+            await this.authorize({ action: 'update', context, reference, current: latest.definition, next: candidate });
+            const record = makeRecord(candidate);
+            await this.authorize({
+                action: 'read',
+                context,
+                reference: foundationRef(record),
+                current: candidate
+            });
+            const nextCatalog = appendRecord(catalog, record);
+            savedRef = foundationRef(record);
+            return withFoundationCatalog(current, nextCatalog);
+        });
+        if (!savedRef)
+            throw new FoundationStoreError('readback_mismatch', 'Foundation update did not produce a revision reference');
+        return this.readback(savedRef, context);
+    }
+    async list(type, context) {
+        assertContext(context);
+        if (type !== undefined && !isFoundationType(type)) {
+            throw new FoundationStoreError('invalid_input', `Unknown foundation type ${String(type)}`);
+        }
+        const os = await this.load();
+        const catalog = readCatalog(os);
+        const records = catalog.records.filter((record) => record.definition.revision === catalog.latest[foundationKey(record.definition)]?.revision)
+            .filter((record) => type === undefined || record.definition.type === type);
+        const visible = [];
+        for (const record of records) {
+            await this.authorize({ action: 'list', context, reference: foundationRef(record), current: record.definition });
+            visible.push(cloneRecord(record));
+        }
+        return visible;
+    }
+    async addRelation(relation, context) {
+        assertContext(context);
+        validateRelationInput(relation);
+        await mutatePersonalOs(this.dataDir, async (current) => {
+            const catalog = readCatalog(current);
+            const resolved = await resolveFoundationRelationResources({
+                catalog,
+                relation,
+                context,
+                current,
+                endpointResolver: this.endpointResolver
+            });
+            // A trusted context scope is a store-level boundary.  The injected
+            // policy may add organization-specific role checks, but it cannot turn
+            // a resolved cross-scope endpoint into an in-scope one.
+            for (const resource of resolved.resources)
+                assertScopeAccess(resource, context);
+            await this.authorize({ action: 'link', context, relation: resolved.relation, resources: resolved.resources });
+            const serialized = JSON.stringify(resolved.relation);
+            if (catalog.relations.some((existing) => JSON.stringify(existing) === serialized))
+                return current;
+            return withFoundationCatalog(current, {
+                ...cloneFoundationCatalog(catalog),
+                relations: [...catalog.relations, JSON.parse(serialized)]
+            });
+        });
+    }
+    async load() {
+        try {
+            return await loadPersonalOs(this.dataDir);
+        }
+        catch (error) {
+            throw normalizeStorageError(error);
+        }
+    }
+    async authorize(request) {
+        if (this.policy) {
+            try {
+                const allowed = await this.policy.authorize({
+                    ...request,
+                    ...(request.current ? { current: cloneFoundationDefinition(request.current) } : {}),
+                    ...(request.next ? { next: cloneFoundationDefinition(request.next) } : {}),
+                    ...(request.resources ? { resources: request.resources.map(cloneAuthorizationResource) } : {})
+                });
+                if (allowed === false)
+                    throw new FoundationStoreError('authorization_denied', 'Foundation policy denied the operation');
+            }
+            catch (error) {
+                if (error instanceof FoundationStoreError)
+                    throw error;
+                throw new FoundationStoreError('authorization_denied', formatError(error));
+            }
+            return;
+        }
+        if (request.action === 'create') {
+            if (!request.next)
+                throw new FoundationStoreError('invalid_input', 'Create authorization requires a definition');
+            assertScopeAccess(request.next, request.context);
+            assertAclWrite(request.next, request.context.principal);
+            return;
+        }
+        if (request.current) {
+            assertScopeAccess(request.current, request.context);
+            if (request.action === 'read' || request.action === 'list') {
+                assertAclRead(request.current, request.context.principal);
+            }
+            else {
+                assertAclWrite(request.current, request.context.principal);
+            }
+            return;
+        }
+        if (request.action === 'link') {
+            if (!request.resources || request.resources.length === 0) {
+                throw new FoundationStoreError('authorization_denied', 'A foundation relation requires resolved endpoint resources');
+            }
+            // The relation itself is stored in the shared catalog.  Without an
+            // injected tenant policy, require write access to every local foundation
+            // endpoint so a caller cannot link an object it cannot modify.
+            for (const resource of request.resources) {
+                assertScopeAccess(resource, request.context);
+                assertAclWrite(resource, request.context.principal);
+            }
+        }
+    }
+    async readback(reference, context) {
+        const saved = await this.read(reference, context);
+        if (!saved || saved.digest !== reference.digest || saved.definition.revision !== reference.revision) {
+            throw new FoundationStoreError('readback_mismatch', `Foundation readback failed for ${reference.type}/${reference.id}@${reference.revision}`);
+        }
+        return foundationRef(saved);
+    }
+}
+export function createFoundationRevisionStore(options) {
+    return new GraphFoundationRevisionStore(options);
+}
+export const createFoundationStore = createFoundationRevisionStore;
+/**
+ * Creates a concrete, in-memory Story endpoint adapter for OSS consumers.
+ * Only immutable revision/security metadata is supplied; no Story body is
+ * duplicated into the foundation catalog.  Current ACL and scope are taken
+ * from the greatest registered revision while the requested revision is only
+ * checked for existence and retained in the relation.
+ */
+export function createLocalStoryResolver(records) {
+    const grouped = new Map();
+    for (const record of records) {
+        validateLocalStoryRevision(record);
+        const revisions = grouped.get(record.id) ?? [];
+        if (revisions.some((candidate) => candidate.revision === record.revision)) {
+            throw new TypeError(`Duplicate Story revision ${record.id}@${record.revision}`);
+        }
+        revisions.push(cloneLocalStoryRevision(record));
+        grouped.set(record.id, revisions);
+    }
+    for (const revisions of grouped.values()) {
+        revisions.sort((left, right) => compareRevisions(left.revision, right.revision));
+    }
+    return {
+        resolve({ endpoint }) {
+            if (endpoint.type !== 'story')
+                return null;
+            const revisions = grouped.get(endpoint.id);
+            if (!revisions)
+                return null;
+            const current = revisions[revisions.length - 1];
+            const requested = endpoint.revision === undefined
+                ? current
+                : revisions.find((candidate) => candidate.revision === endpoint.revision);
+            if (!requested)
+                return null;
+            return {
+                id: endpoint.id,
+                type: 'story',
+                revision: requested.revision,
+                currentRevision: current.revision,
+                acl: cloneAcl(current.acl),
+                scope: cloneScope(current.scope)
+            };
+        }
+    };
+}
+/** Descriptive alias for consumers that use the generic endpoint terminology. */
+export const createStoryEndpointResolver = createLocalStoryResolver;
+function prepareDefinition(definition, operation) {
+    if (!definition || typeof definition !== 'object') {
+        throw new FoundationStoreError('invalid_input', `${operation} requires a foundation definition`);
+    }
+    const clone = cloneFoundationDefinition(definition);
+    if (!clone.id || !isFoundationType(clone.type) || !clone.revision) {
+        throw new FoundationStoreError('invalid_input', `${operation} requires id, type, and revision`);
+    }
+    return clone;
+}
+function validateForDraft(definition) {
+    try {
+        const result = validateFoundationDefinition(definition, { use: 'draft' });
+        if (!result.valid) {
+            throw new FoundationStoreError('invalid_input', result.issues.map((issue) => `${issue.path}: ${issue.message}`).join('; '));
+        }
+    }
+    catch (error) {
+        if (error instanceof FoundationStoreError)
+            throw error;
+        throw new FoundationStoreError('invalid_input', formatError(error));
+    }
+}
+function validateRelationInput(relation) {
+    try {
+        const result = validateFoundationRelation(relation);
+        if (!result.valid)
+            throw new FoundationStoreError('invalid_input', result.issues.map((issue) => issue.message).join('; '));
+    }
+    catch (error) {
+        if (error instanceof FoundationStoreError)
+            throw error;
+        throw new FoundationStoreError('invalid_input', formatError(error));
+    }
+}
+function makeRecord(definition) {
+    return { definition: cloneFoundationDefinition(definition), digest: digestFoundationDefinition(definition) };
+}
+function cloneRecord(record) {
+    return { definition: cloneFoundationDefinition(record.definition), digest: record.digest };
+}
+function appendRecord(catalog, record) {
+    const next = cloneFoundationCatalog(catalog);
+    next.records.push(cloneRecord(record));
+    next.latest[foundationKey(record.definition)] = {
+        id: record.definition.id,
+        type: record.definition.type,
+        revision: record.definition.revision
+    };
+    return next;
+}
+function readCatalog(os) {
+    if (os.graph.version !== 2) {
+        throw new FoundationStoreError('unsupported_graph', 'Foundation catalog writes require canonical Graph v2');
+    }
+    try {
+        assertFoundationCatalog(os.graph.foundation);
+        return foundationCatalogOrEmpty(os.graph.foundation);
+    }
+    catch (error) {
+        throw new FoundationStoreError('corrupt_catalog', formatError(error));
+    }
+}
+async function resolveFoundationRelationResources(input) {
+    const resources = [];
+    const seen = new Set();
+    const endpoints = ['source', 'target'];
+    const resolvedEndpoints = {};
+    for (const position of endpoints) {
+        const endpoint = input.relation[position];
+        if (isFoundationType(endpoint.type)) {
+            if (!endpoint.revision) {
+                throw new FoundationStoreError('invalid_input', `Foundation relation endpoint ${endpoint.type}/${endpoint.id} requires a revision`);
+            }
+            const requested = findFoundationRecord(input.catalog, {
+                id: endpoint.id,
+                type: endpoint.type,
+                revision: endpoint.revision
+            });
+            if (!requested) {
+                throw new FoundationStoreError('not_found', `Foundation relation endpoint ${endpoint.type}/${endpoint.id}@${endpoint.revision} was not found`);
+            }
+            const latest = findLatestFoundationRecord(input.catalog, endpoint.type, endpoint.id);
+            if (!latest) {
+                throw new FoundationStoreError('corrupt_catalog', `Latest pointer is missing for ${endpoint.type}/${endpoint.id}`);
+            }
+            const key = foundationKey(latest.definition);
+            if (!seen.has(key)) {
+                seen.add(key);
+                resources.push(cloneFoundationDefinition(latest.definition));
+            }
+            resolvedEndpoints[position] = { ...endpoint };
+            continue;
+        }
+        if (!input.endpointResolver) {
+            // Do not authorize an external endpoint from an ID alone.  Returning a
+            // generic denial also avoids turning an absent resolver into a lookup
+            // oracle for private Story/project identifiers.
+            throw new FoundationStoreError('authorization_denied', `No trusted endpoint resolver is configured for ${endpoint.type}/${endpoint.id}`);
+        }
+        let resource;
+        try {
+            resource = await input.endpointResolver.resolve({
+                endpoint: {
+                    id: endpoint.id,
+                    type: endpoint.type,
+                    ...(endpoint.revision === undefined ? {} : { revision: endpoint.revision })
+                },
+                context: input.context,
+                // This callback executes within mutatePersonalOs's canonical lock.
+                current: input.current
+            });
+        }
+        catch (error) {
+            if (error instanceof FoundationStoreError)
+                throw error;
+            throw new FoundationStoreError('authorization_denied', 'The trusted endpoint resolver failed closed');
+        }
+        if (!resource) {
+            throw new FoundationStoreError('not_found', `Relation endpoint ${endpoint.type}/${endpoint.id} was not found`);
+        }
+        validateEndpointResource(resource, endpoint);
+        const key = endpointResourceKey(resource);
+        if (!seen.has(key)) {
+            seen.add(key);
+            resources.push(cloneEndpointResource(resource));
+        }
+        // Persist a concrete revision even when the caller referred to the
+        // current Story by ID only.  This makes the link historically reproducible.
+        resolvedEndpoints[position] = {
+            id: resource.id,
+            type: resource.type,
+            revision: resource.revision
+        };
+    }
+    if (resources.length === 0) {
+        throw new FoundationStoreError('authorization_denied', 'A foundation relation requires resolved endpoint resources');
+    }
+    return {
+        relation: {
+            ...input.relation,
+            source: resolvedEndpoints.source ?? input.relation.source,
+            target: resolvedEndpoints.target ?? input.relation.target
+        },
+        resources
+    };
+}
+function withFoundationCatalog(os, foundation) {
+    if (os.graph.version !== 2) {
+        throw new FoundationStoreError('unsupported_graph', 'Foundation catalog writes require canonical Graph v2');
+    }
+    return {
+        ...os,
+        graph: {
+            ...os.graph,
+            foundation
+        }
+    };
+}
+function assertReferenceInput(reference) {
+    if (!reference || typeof reference !== 'object' || !reference.id || !isFoundationType(reference.type) || !/^[1-9]\d*$/.test(reference.revision)) {
+        throw new FoundationStoreError('invalid_input', 'A revision reference requires id, type, and a positive revision');
+    }
+}
+function assertContext(context) {
+    if (!context || typeof context.principal !== 'string' || context.principal.length === 0) {
+        throw new FoundationStoreError('authorization_denied', 'A trusted principal is required');
+    }
+    if (context.scope !== undefined && !isValidScope(context.scope)) {
+        throw new FoundationStoreError('authorization_denied', 'A trusted context scope is invalid');
+    }
+}
+function assertAclRead(definition, principal) {
+    const acl = definition.acl;
+    if (acl.visibility === 'public' || acl.ownerId === principal || acl.readerIds.includes(principal) || acl.writerIds.includes(principal))
+        return;
+    throw new FoundationStoreError('authorization_denied', `Principal ${principal} cannot read ${definition.type}/${definition.id}`);
+}
+function assertAclWrite(resource, principal) {
+    const acl = resource.acl;
+    if (acl.ownerId === principal || acl.writerIds.includes(principal))
+        return;
+    throw new FoundationStoreError('authorization_denied', `Principal ${principal} cannot write ${resource.type}/${resource.id}`);
+}
+function assertScopeAccess(resource, context) {
+    if (!context.scope)
+        return;
+    const allowed = new Set(context.scope.subjectIds);
+    if (resource.scope.subjectIds.some((subjectId) => allowed.has(subjectId)))
+        return;
+    throw new FoundationStoreError('scope_violation', `Principal ${context.principal} cannot access ${resource.type}/${resource.id} outside the trusted scope`);
+}
+function cloneAuthorizationResource(resource) {
+    return isFoundationDefinitionResource(resource)
+        ? cloneFoundationDefinition(resource)
+        : cloneEndpointResource(resource);
+}
+function isFoundationDefinitionResource(resource) {
+    return isFoundationType(resource.type) && 'adoptionState' in resource;
+}
+function cloneEndpointResource(resource) {
+    return {
+        id: resource.id,
+        type: resource.type,
+        revision: resource.revision,
+        currentRevision: resource.currentRevision,
+        acl: cloneAcl(resource.acl),
+        scope: cloneScope(resource.scope)
+    };
+}
+function endpointResourceKey(resource) {
+    return JSON.stringify([resource.type, resource.id]);
+}
+function validateEndpointResource(resource, endpoint) {
+    if (resource.id !== endpoint.id || resource.type !== endpoint.type) {
+        throw new FoundationStoreError('authorization_denied', 'The endpoint resolver returned a mismatched resource');
+    }
+    if (isFoundationType(resource.type)) {
+        throw new FoundationStoreError('authorization_denied', 'Foundation endpoints must be resolved by the canonical catalog');
+    }
+    if (!isPositiveRevision(resource.revision) || !isPositiveRevision(resource.currentRevision)) {
+        throw new FoundationStoreError('authorization_denied', 'The endpoint resolver returned an invalid revision');
+    }
+    if (endpoint.revision !== undefined && endpoint.revision !== resource.revision) {
+        throw new FoundationStoreError('authorization_denied', 'The endpoint resolver did not resolve the requested revision');
+    }
+    if (endpoint.revision === undefined && resource.revision !== resource.currentRevision) {
+        throw new FoundationStoreError('authorization_denied', 'An ID-only endpoint must resolve to its current revision');
+    }
+    if (compareRevisions(resource.currentRevision, resource.revision) < 0) {
+        throw new FoundationStoreError('authorization_denied', 'The endpoint resolver returned a revision newer than current');
+    }
+    if (!isValidAcl(resource.acl) || !isValidScope(resource.scope)) {
+        throw new FoundationStoreError('authorization_denied', 'The endpoint resolver returned invalid authorization metadata');
+    }
+}
+function validateLocalStoryRevision(record) {
+    if (!record || typeof record !== 'object' || !record.id || !isPositiveRevision(record.revision)) {
+        throw new TypeError('A local Story revision requires a non-empty id and positive revision');
+    }
+    if (!isValidAcl(record.acl) || !isValidScope(record.scope)) {
+        throw new TypeError(`Local Story ${record.id}@${record.revision} has invalid ACL or scope metadata`);
+    }
+}
+function cloneLocalStoryRevision(record) {
+    return {
+        id: record.id,
+        revision: record.revision,
+        acl: cloneAcl(record.acl),
+        scope: cloneScope(record.scope)
+    };
+}
+function cloneAcl(acl) {
+    return {
+        ownerId: acl.ownerId,
+        visibility: acl.visibility,
+        readerIds: [...acl.readerIds],
+        writerIds: [...acl.writerIds]
+    };
+}
+function cloneScope(scope) {
+    return {
+        subjectIds: [...scope.subjectIds],
+        validFrom: scope.validFrom,
+        ...(scope.validUntil === undefined ? {} : { validUntil: scope.validUntil })
+    };
+}
+function isValidAcl(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return typeof candidate.ownerId === 'string'
+        && candidate.ownerId.length > 0
+        && (candidate.visibility === 'private'
+            || candidate.visibility === 'project'
+            || candidate.visibility === 'organization'
+            || candidate.visibility === 'public')
+        && Array.isArray(candidate.readerIds)
+        && candidate.readerIds.every((id) => typeof id === 'string' && id.length > 0)
+        && Array.isArray(candidate.writerIds)
+        && candidate.writerIds.every((id) => typeof id === 'string' && id.length > 0);
+}
+function isValidScope(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    if (!Array.isArray(candidate.subjectIds))
+        return false;
+    if (candidate.subjectIds.length === 0 || !candidate.subjectIds.every((id) => typeof id === 'string' && id.length > 0)) {
+        return false;
+    }
+    if (typeof candidate.validFrom !== 'string' || parseStrictRfc3339(candidate.validFrom) === undefined) {
+        return false;
+    }
+    if (candidate.validUntil === undefined)
+        return true;
+    if (typeof candidate.validUntil !== 'string')
+        return false;
+    const from = parseStrictRfc3339(candidate.validFrom);
+    const until = parseStrictRfc3339(candidate.validUntil);
+    return from !== undefined && until !== undefined && until > from;
+}
+/**
+ * Keep resolver metadata validation aligned with the foundation ontology.
+ * Date.parse accepts malformed calendar values by normalizing them (for
+ * example, February 30), so endpoint authorization must use strict RFC3339
+ * parsing before comparing scope boundaries.
+ */
+function parseStrictRfc3339(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+    if (!match)
+        return undefined;
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const hour = Number(match[4]);
+    const minute = Number(match[5]);
+    const second = Number(match[6]);
+    const fraction = match[7] ?? '';
+    const zone = match[8];
+    if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month))
+        return undefined;
+    if (hour > 23 || minute > 59 || second > 59)
+        return undefined;
+    let offsetMinutes = 0;
+    if (zone !== 'Z') {
+        const sign = zone[0] === '-' ? -1 : 1;
+        const offsetHour = Number(zone.slice(1, 3));
+        const offsetMinute = Number(zone.slice(4, 6));
+        if (offsetHour > 23 || offsetMinute > 59)
+            return undefined;
+        offsetMinutes = sign * (offsetHour * 60 + offsetMinute);
+    }
+    const milliseconds = Number((fraction + '000').slice(0, 3));
+    const timestamp = Date.UTC(year, month - 1, day, hour, minute, second, milliseconds)
+        - offsetMinutes * 60_000;
+    return Number.isFinite(timestamp) ? timestamp : undefined;
+}
+function daysInMonth(year, month) {
+    if (month === 2) {
+        return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28;
+    }
+    return [4, 6, 9, 11].includes(month) ? 30 : 31;
+}
+function isPositiveRevision(value) {
+    return typeof value === 'string' && /^[1-9]\d*$/.test(value);
+}
+function compareRevisions(left, right) {
+    const leftValue = BigInt(left);
+    const rightValue = BigInt(right);
+    return leftValue < rightValue ? -1 : leftValue > rightValue ? 1 : 0;
+}
+function isFoundationType(value) {
+    return value === 'objective' || value === 'variable' || value === 'model' || value === 'constraint';
+}
+function normalizeStorageError(error) {
+    if (error instanceof FoundationStoreError)
+        return error;
+    const message = formatError(error);
+    if (message.includes('FOUNDATION-CATALOG-CORRUPT'))
+        return new FoundationStoreError('corrupt_catalog', message);
+    return new FoundationStoreError('corrupt_catalog', message);
+}
+function formatError(error) {
+    return error instanceof Error ? error.message : String(error);
+}