@verax-ai/proxy 0.1.0 → 0.1.2

package/LICENSE

@@ -0,0 +1,192 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the
+      purposes of this License, Derivative Works shall not include works
+      that remain separable from, or merely link (or bind by name) to
+      the interfaces of, the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of,
+      the Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as
+      a result of this License or out of the use or inability to use
+      the Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      Copyright 2026 VERAX TEKNOLOJİ LİMİTED ŞİRKETİ
+
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.

package/README.md

@@ -0,0 +1,46 @@
+# @verax-ai/proxy
+
+The decision proxy behind Verax. Every tool call goes through a policy that
+denies what it does not name, leaves a signed decision record before the
+call runs, and an effect row after it did. The records live in a ledger on
+local disk, and `explain` reads that ledger back and reports what it finds,
+including a record whose effect does not match it.
+
+Part of [Verax](https://github.com/verax-ai/verax) by
+[VERAX Teknoloji](https://verax-ai.com). Most callers want
+[`@verax-ai/body`](https://www.npmjs.com/package/@verax-ai/body), the MCP
+server built on this package. What the code carries and what stays unproven
+is stated in
+[`docs/STATUS.md`](https://github.com/verax-ai/verax/blob/main/docs/STATUS.md).
+
+## Install
+
+```sh
+npm install @verax-ai/proxy
+```
+
+Node 22.6 or newer. Decision records use the Cedulon record format
+(`@cedulon/core`, `@cedulon/audit`).
+
+## Use
+
+```js
+import { createProxy, loadPolicy, FileLedger, explain } from "@verax-ai/proxy";
+```
+
+- `loadPolicy` reads a policy file. `policy/default.json` in this package is
+  the one the body starts from.
+- `createProxy` wraps tool functions: each call is decided and recorded, then
+  run or refused.
+- `FileLedger` and `MemoryLedger` hold the records, one `FileLedger` per
+  directory.
+- `explain` reads a ledger and reports the chain, its signatures and its
+  findings.
+- `approvePending`, `reconcile` and `parseCardCsv` are what the body's
+  `approve` and `reconcile` commands call.
+
+The exports map is the whole public surface; deep imports are not in it.
+
+## License
+
+Apache-2.0.

package/dist/approvals.d.ts

@@ -6,7 +6,7 @@ export declare const approvalFs: {
 export declare const drainMetrics: {
     renameBusy: number;
 };
-import type { ApprovalChannel, InputsLog, Ledger, RecordSigner } from "./types.ts";
+import type { ApprovalChannel, InputsLog, Ledger, Policy, RecordSigner } from "./types.ts";
 export type ApprovalRow = {
     ref: string;
     requestHash: string;
@@ -68,7 +68,25 @@ export type ApproveResult = {
 } | {
     ok: false;
     reason: string;
+    allowRef?: string;
 };
+export declare function spentTodayMinorOf(rows: Array<{
+    subject: string;
+    status: string;
+    createdAtMs?: number;
+    expiresAtMs: number;
+    args: Record<string, unknown>;
+}>, nowMs: number, currency: string, approvalTtlMs: number): number;
+export declare function createApprovalBudgetGuard(opts: {
+    policy: Policy;
+    approvals: ApprovalsLog;
+    now: () => number;
+}): (snap: ApprovalRow) => Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: "budget-exceeded";
+}>;
 export declare function approvePending(opts: {
     ledger: Ledger;
     recordSigner: RecordSigner;
@@ -81,6 +99,17 @@ export declare function approvePending(opts: {
     policyHash: string;
     approvals: ApprovalsLog;
     inputsLog?: InputsLog;
+    budgetGuard?: (snap: ApprovalRow) => {
+        ok: true;
+    } | {
+        ok: false;
+        reason: "budget-exceeded";
+    } | Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: "budget-exceeded";
+    }>;
 }): Promise<ApproveResult>;
 export type ApprovalCommand = {
     ref: string;

package/dist/approvals.js

@@ -9,6 +9,7 @@ import { signDecisionRecord } from "@cedulon/core";
 import { appendDurable, lookupDecisionByRef, lookupResolvedBy, noteResolution } from "./ledger.js";
 import { effectDescriptor, sha256Canonical } from "./hash.js";
 import { inputsLogFor } from "./inputs.js";
+import { SerialQueue } from "./serial-queue.js";
 function lastByRef(rows) {
     const map = new Map();
     for (const row of rows)
@@ -105,6 +106,56 @@ export function loadApprovalsFromDir(dir) {
         throw err;
     }
 }
+const APPROVAL_LOCK = Symbol.for("verax.approvalLock");
+function approvalLockFor(ledger) {
+    const bag = ledger;
+    if (!bag[APPROVAL_LOCK])
+        bag[APPROVAL_LOCK] = new SerialQueue();
+    return bag[APPROVAL_LOCK];
+}
+export function spentTodayMinorOf(rows, nowMs, currency, approvalTtlMs) {
+    const d = new Date(nowMs);
+    const start = Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
+    const end = start + 86_400_000;
+    let sum = 0;
+    for (const row of rows) {
+        if (row.subject !== "spend")
+            continue;
+        if (row.status !== "pending" && row.status !== "approved")
+            continue;
+        const created = row.createdAtMs ?? row.expiresAtMs - approvalTtlMs;
+        if (created < start || created >= end)
+            continue;
+        if (row.args.currency !== currency)
+            continue;
+        const amt = row.args.amountMinor;
+        if (typeof amt === "number")
+            sum += amt;
+    }
+    return sum;
+}
+export function createApprovalBudgetGuard(opts) {
+    return async (snap) => {
+        if (snap.subject !== "spend")
+            return { ok: true };
+        const dailyMax = opts.policy.rule(snap.ruleId)?.spend?.dailyMaxMinor;
+        if (dailyMax === undefined)
+            return { ok: true };
+        const currency = typeof snap.args.currency === "string" ? snap.args.currency : "";
+        const amount = typeof snap.args.amountMinor === "number" ? snap.args.amountMinor : 0;
+        // Sibling pending rows are not authorized yet. Counting them here would
+        // deadlock two 100-unit pendings against a later 150 cap; approved spend
+        // plus this amount is what the operator is about to commit.
+        const others = (await opts.approvals.listAll()).filter((row) => row.ref !== snap.ref && row.status === "approved");
+        const spent = spentTodayMinorOf(others, opts.now(), currency, opts.policy.approvalTtlMs);
+        if (spent + amount > dailyMax)
+            return { ok: false, reason: "budget-exceeded" };
+        return { ok: true };
+    };
+}
+function alreadyResolved(allowRef) {
+    return { ok: false, reason: "already-resolved", ...(allowRef ? { allowRef } : {}) };
+}
 async function hasResolves(inputsLog, ledger, deferRef) {
     const indexed = ledger;
     if (typeof indexed.lookupResolvedBy === "function") {
@@ -120,20 +171,25 @@ async function hasResolves(inputsLog, ledger, deferRef) {
     return false;
 }
 export async function approvePending(opts) {
+    return approvalLockFor(opts.ledger).enqueue(() => approvePendingUnlocked(opts));
+}
+async function approvePendingUnlocked(opts) {
     const inputsLog = opts.inputsLog ?? inputsLogFor(opts.ledger);
     const defer = await lookupDecisionByRef(opts.ledger, opts.ref);
     if (!defer || defer.decision !== "defer")
         return { ok: false, reason: "unknown-ref" };
     const snap = await opts.approvals.get(opts.ref);
-    if (snap && snap.status !== "pending")
-        return { ok: false, reason: "already-resolved" };
+    if (snap && snap.status !== "pending") {
+        const hit = lookupResolvedBy(opts.ledger, opts.ref);
+        return alreadyResolved(snap.allowRef ?? (hit?.kind === "allow" ? hit.ref : undefined));
+    }
     const resolved = lookupResolvedBy(opts.ledger, opts.ref);
     if (resolved || (await hasResolves(inputsLog, opts.ledger, opts.ref))) {
         const hit = resolved ?? lookupResolvedBy(opts.ledger, opts.ref);
         if (snap?.status === "pending" && hit) {
             await opts.approvals.updateStatus(opts.ref, hit.kind === "allow" ? "approved" : "expired", hit.kind === "allow" ? { allowRef: hit.ref } : undefined);
         }
-        return { ok: false, reason: "already-resolved" };
+        return alreadyResolved(hit?.kind === "allow" ? hit.ref : snap?.allowRef);
     }
     if (!snap)
         return { ok: false, reason: "snapshot-missing" };
@@ -172,6 +228,11 @@ export async function approvePending(opts) {
         await opts.approvals.updateStatus(opts.ref, "expired");
         return { ok: false, reason: "expired" };
     }
+    if (opts.budgetGuard) {
+        const guarded = await opts.budgetGuard(snap);
+        if (!guarded.ok)
+            return guarded;
+    }
     const allowRef = opts.nonce();
     const prior = await inputsLog.get(opts.ref);
     const inputs = {

package/dist/atomic-write.d.ts

@@ -0,0 +1 @@
+export declare function writeFileAtomic(path: string, text: string): void;

package/dist/atomic-write.js

@@ -0,0 +1,65 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * Replace a file's contents in one step, so a reader sees the old bytes or the
+ * new ones and never a half-written file.
+ *
+ * Writing in place is not that: measured on 11 Sep 2026, a reader polling this
+ * path every 20 ms while the file was rewritten 60 times got 12 unparseable
+ * reads. The listen file is read by another process — that is its whole job —
+ * and a torn read becomes `null`, which the caller cannot tell from "nothing
+ * is running".
+ *
+ * The rename needs the retry. On Windows it fails with EPERM while a reader
+ * holds the destination open, and in the same measurement 26 of 60 plain
+ * renames failed that way. Retrying briefly lost none of them and still let no
+ * torn read through.
+ *
+ * The temporary name carries this process and a random suffix. A fixed `.tmp`
+ * next to the destination is what two writers, or a crashed writer, collide
+ * on.
+ */
+const napper = new Int32Array(new SharedArrayBuffer(4));
+/**
+ * Sleep without spinning. An earlier retry burned the processor between
+ * attempts, which is the worst thing to do while waiting for another process
+ * to let go of a file: under the unit suite's own load the spin starved the
+ * reader it was waiting on, the retries ran out in 200 ms, and the write
+ * threw EPERM. Atomics.wait yields the core instead.
+ */
+function napSync(ms) {
+    Atomics.wait(napper, 0, 0, ms);
+}
+export function writeFileAtomic(path, text) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+    writeFileSync(tmp, text, { encoding: "utf8", mode: 0o600 });
+    try {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                renameSync(tmp, path);
+                chmodSync(path, 0o600);
+                return;
+            }
+            catch (err) {
+                const code = err.code;
+                // Two seconds of patience. A reader holds this file for microseconds
+                // when the machine is idle; the budget is for the machine that is not.
+                if (attempt >= 100 || (code !== "EPERM" && code !== "EACCES" && code !== "EBUSY")) {
+                    throw err;
+                }
+                napSync(20);
+            }
+        }
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // rename may already have moved it
+        }
+        throw err;
+    }
+}

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 export { createProxy, LedgerDenyUnrecorded } from "./proxy.ts";
 export { loadPolicy } from "./policy.ts";
-export { FileLedger, MemoryLedger } from "./ledger.ts";
+export { FileLedger, MemoryLedger, readLedgerTail } from "./ledger.ts";
+export { indexCoverage, listPieceFiles } from "./ledger-manifest.ts";
 export { explain } from "./explain.ts";
-export { approvePending, approvalsLogFor, enqueueApprovalCommand, loadApprovalsFromDir } from "./approvals.ts";
+export { approvePending, approvalsLogFor, createApprovalBudgetGuard, enqueueApprovalCommand, loadApprovalsFromDir, } from "./approvals.ts";
 export { loadEffectsFromDir, parseCardCsv, parseChannelJsonl, reconcile } from "./reconcile.ts";
 export { tenantKey } from "./tenant.ts";
 export { diskProbe } from "./disk.ts";
@@ -11,4 +12,5 @@ export { signEffectAttestation } from "./ledger.ts";
 export { spokenReason } from "./spoken-reason.ts";
 export type { ApprovalRow, ApproveResult } from "./approvals.ts";
 export type { CardCsvOpts, ChannelRow, ReconcileReport } from "./reconcile.ts";
+export type { FileLedgerOpts, LedgerCounts } from "./ledger.ts";
 export type { EffectSigner, ExplainChain, ExplainPair, ExplainFinding, ExplainOpts, ExplainResult, ExplainTrustRoot, ExplainWarning, ExtractWindow, Ledger, LedgerEffect, Policy, PolicyDecision, Principal, ProxyDeps, RecordSigner, ToolCall, ToolResult, WitnessClass, } from "./types.ts";

package/dist/index.js

@@ -1,8 +1,9 @@
 export { createProxy, LedgerDenyUnrecorded } from "./proxy.js";
 export { loadPolicy } from "./policy.js";
-export { FileLedger, MemoryLedger } from "./ledger.js";
+export { FileLedger, MemoryLedger, readLedgerTail } from "./ledger.js";
+export { indexCoverage, listPieceFiles } from "./ledger-manifest.js";
 export { explain } from "./explain.js";
-export { approvePending, approvalsLogFor, enqueueApprovalCommand, loadApprovalsFromDir } from "./approvals.js";
+export { approvePending, approvalsLogFor, createApprovalBudgetGuard, enqueueApprovalCommand, loadApprovalsFromDir, } from "./approvals.js";
 export { loadEffectsFromDir, parseCardCsv, parseChannelJsonl, reconcile } from "./reconcile.js";
 export { tenantKey } from "./tenant.js";
 // The body writes checkpoints and signs its own effect attestations. Both were

package/dist/inputs.d.ts

@@ -6,7 +6,13 @@ export declare class MemoryInputsLog implements InputsLog {
 }
 export declare class FileInputsLog implements InputsLog {
     private readonly dir;
-    constructor(dir: string);
+    private readonly resolve;
+    private readonly note;
+    constructor(dir: string, resolve?: () => {
+        active: string;
+        all: string[];
+    }, note?: (ref: string, inputs: DecisionInputs) => void);
+    private paths;
     append(ref: string, inputs: DecisionInputs): Promise<void>;
     get(ref: string): Promise<DecisionInputs | null>;
 }

package/dist/inputs.js

@@ -11,29 +11,44 @@ export class MemoryInputsLog {
 }
 export class FileInputsLog {
     dir;
-    constructor(dir) {
+    resolve;
+    note;
+    constructor(dir, resolve, note) {
         this.dir = dir;
+        this.resolve = resolve;
+        this.note = note;
+    }
+    paths() {
+        if (this.resolve)
+            return this.resolve();
+        const root = join(this.dir, "inputs.jsonl");
+        return { active: root, all: [root] };
     }
     async append(ref, inputs) {
-        await appendDurable(join(this.dir, "inputs.jsonl"), `${JSON.stringify({ ref, inputs })}\n`);
+        await appendDurable(this.paths().active, `${JSON.stringify({ ref, inputs })}\n`);
+        // Handed to the ledger in memory: the decision that follows needs the
+        // principal for its index line and must not read this file back.
+        this.note?.(ref, inputs);
     }
     async get(ref) {
-        let text;
-        try {
-            text = await ledgerFs.readFile(join(this.dir, "inputs.jsonl"), "utf8");
-        }
-        catch (err) {
-            if (err.code === "ENOENT")
-                return null;
-            throw err;
-        }
         let found = null;
-        for (const line of text.split("\n")) {
-            if (line === "")
-                continue;
-            const row = JSON.parse(line);
-            if (row.ref === ref)
-                found = row.inputs;
+        for (const path of this.paths().all) {
+            let text;
+            try {
+                text = await ledgerFs.readFile(path, "utf8");
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    continue;
+                throw err;
+            }
+            for (const line of text.split("\n")) {
+                if (line === "")
+                    continue;
+                const row = JSON.parse(line);
+                if (row.ref === ref)
+                    found = row.inputs;
+            }
         }
         return found;
     }
@@ -43,7 +58,9 @@ export function inputsLogFor(ledger) {
     const bag = ledger;
     if (bag[STASH])
         return bag[STASH];
-    const log = typeof bag.dir === "string" ? new FileInputsLog(bag.dir) : new MemoryInputsLog();
+    const resolve = typeof bag.inputsPaths === "function" ? () => bag.inputsPaths() : undefined;
+    const note = typeof bag.noteInputs === "function" ? (ref, inputs) => bag.noteInputs(ref, inputs) : undefined;
+    const log = typeof bag.dir === "string" ? new FileInputsLog(bag.dir, resolve, note) : new MemoryInputsLog();
     bag[STASH] = log;
     return log;
 }

package/dist/jsonl-tail.d.ts

@@ -0,0 +1,26 @@
+import { open as fsOpen } from "node:fs/promises";
+export type TailVisit = "take" | "skip" | "stop";
+export type TailOpts = {
+    /**
+     * Bytes read per step from the end. Default 64 KiB: measured on a 194 MB
+     * file, 64 KiB, 256 KiB and 1 MiB read the whole of it in the same time,
+     * and the small step keeps a small window's cost small.
+     */
+    chunkBytes?: number;
+    /** The file opener, so a seam or a test can count what was read. */
+    open?: typeof fsOpen;
+    /**
+     * Walk backwards from this byte instead of the file's end. A window that
+     * starts inside a piece uses this after a timestamp seek so the walk does
+     * not cross every later row.
+     */
+    endOffset?: number;
+};
+export declare function readJsonlTail<T>(path: string, visit: (row: T) => TailVisit, opts?: TailOpts): Promise<T[]>;
+/**
+ * The start of the first row whose stamp is at or after `targetMs`, or the
+ * file size when none is. Rows are treated as time-ordered (one writer, the
+ * clock's `now()`); a 60 s slack on the caller covers a clock set back.
+ * Each probe reads from the mid offset until the first complete line.
+ */
+export declare function seekOffsetByTimestamp<T>(path: string, targetMs: number, tsOf: (row: T) => number, opts?: TailOpts): Promise<number>;