@youdie006/prodex 0.2.0

package/dist/store.js

@@ -0,0 +1,1402 @@
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { constants, existsSync } from "node:fs";
+import { link, lstat, mkdir, open, readdir, realpath, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import { assertRepoRelativePath } from "./repo.js";
+import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
+import { makeBridgeId, nowIso, ReceiptSchema, ResultSchema, SCHEMA_VERSION, SessionSchema, TaskSchema } from "./schema.js";
+let storeTestHooks = {};
+export function setBridgeStoreTestHooks(hooks) {
+    storeTestHooks = hooks;
+}
+const TASK_ID_PATTERN = /^task_\d{8}_\d{6}_[a-z0-9-]+$/;
+const SESSION_ID_PATTERN = /^sess_\d{8}_\d{6}_[a-z0-9-]+$/;
+const RECEIPT_ID_PATTERN = /^receipt_\d{8}_\d{6}_[a-z0-9-]+$/;
+const BRIDGE_DIRECTORY_MODE = 0o700;
+const BRIDGE_FILE_MODE = 0o600;
+const RECEIPT_INTEGRITY_KEY_BYTES = 32;
+const FETCHABLE_RESULT_ARTIFACT_PREFIXES = [".bridge/artifacts/pro-consults/", ".bridge/artifacts/results/"];
+export const MAX_FETCHABLE_RESULT_ARTIFACT_BYTES = 100_000;
+const MAX_BRIDGE_ARTIFACT_READ_BYTES = 1_000_000;
+export class BridgeStore {
+    root;
+    bridgeDir;
+    constructor(root = process.cwd()) {
+        this.root = root;
+        this.bridgeDir = path.join(root, ".bridge");
+    }
+    async ensure() {
+        await ensurePrivateDirectory(this.bridgeDir, "Bridge directory");
+        await Promise.all([
+            ensurePrivateDirectory(this.dir("tasks"), "Bridge storage directory .bridge/tasks"),
+            ensurePrivateDirectory(this.dir("results"), "Bridge storage directory .bridge/results"),
+            ensurePrivateDirectory(this.dir("sessions"), "Bridge storage directory .bridge/sessions"),
+            ensurePrivateDirectory(this.dir("artifacts"), "Bridge storage directory .bridge/artifacts"),
+            ensurePrivateDirectory(this.dir("receipts"), "Bridge storage directory .bridge/receipts")
+        ]);
+        await this.assertStorageDirsAreRealDirectories();
+        await this.ensureBridgeGitignore();
+        await this.ensureReceiptIntegrityKey();
+    }
+    dir(kind) {
+        return path.join(this.bridgeDir, kind);
+    }
+    receiptIntegrityKeyPath() {
+        return path.join(this.bridgeDir, "receipt-key.local");
+    }
+    async createTask(input) {
+        await this.ensure();
+        const timestamp = nowIso();
+        const taskFiles = validateTaskFiles(input.files ?? []);
+        const task = await this.createWithUniqueId("task", input.title, "tasks", (id) => TaskSchema.parse({
+            schema_version: SCHEMA_VERSION,
+            id,
+            source: input.source,
+            status: "new",
+            title: input.title,
+            prompt: input.prompt,
+            repo_id: input.repo_id ?? "default",
+            files: taskFiles,
+            provenance: input.provenance,
+            created_at: timestamp,
+            updated_at: timestamp
+        }));
+        try {
+            await this.writeReceipt({
+                kind: "task_created",
+                task_id: task.id,
+                summary: `Created task ${task.id}`
+            });
+        }
+        catch (error) {
+            try {
+                await this.deleteRecordIfPresent("tasks", task.id);
+            }
+            catch (cleanupError) {
+                throw new Error(`${errorMessage(error)} (also failed to clean up task record: ${errorMessage(cleanupError)})`);
+            }
+            throw error;
+        }
+        return task;
+    }
+    async listTasks(status) {
+        await this.ensure();
+        const tasks = await this.readAll("tasks", parseTaskRecord);
+        return tasks
+            .filter((task) => (status ? task.status === status : true))
+            .sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+    }
+    async listTasksReadOnly(status) {
+        if (!(await this.hasReadyStorageDirReadOnly("tasks")))
+            return [];
+        const tasks = await this.readAll("tasks", parseTaskRecord, { cleanupTempHardLinks: false });
+        return tasks
+            .filter((task) => (status ? task.status === status : true))
+            .sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+    }
+    async getTask(taskId) {
+        return this.parseRecord("tasks", taskId, await this.readRecordJson("tasks", taskId), parseTaskRecord);
+    }
+    async getTaskReadOnly(taskId) {
+        return this.parseRecord("tasks", taskId, await this.readRecordJson("tasks", taskId, { cleanupTempHardLinks: false }), parseTaskRecord);
+    }
+    async claimTask(taskId, claimedBy) {
+        const task = await this.getTask(taskId);
+        if (task.status !== "new") {
+            throw new Error(`Task ${taskId} is ${task.status}, not new`);
+        }
+        const updated = TaskSchema.parse({
+            ...task,
+            status: "claimed",
+            claimed_by: claimedBy,
+            claimed_at: nowIso(),
+            updated_at: nowIso()
+        });
+        await this.writeRecordJson("tasks", taskId, updated);
+        try {
+            await this.writeReceipt({
+                kind: "task_claimed",
+                task_id: taskId,
+                summary: `Claimed task ${taskId} by ${claimedBy}`
+            });
+        }
+        catch (error) {
+            try {
+                await this.writeRecordJson("tasks", taskId, task);
+            }
+            catch (cleanupError) {
+                throw new Error(`${errorMessage(error)} (also failed to restore task claim state: ${errorMessage(cleanupError)})`);
+            }
+            throw error;
+        }
+        return updated;
+    }
+    async completeTask(taskId, input) {
+        const task = await this.getTask(taskId);
+        assertFetchableResultArtifacts(input.artifacts ?? []);
+        const retryResult = ResultSchema.parse({
+            schema_version: SCHEMA_VERSION,
+            task_id: taskId,
+            status: input.status,
+            summary: input.summary,
+            artifacts: input.artifacts ?? [],
+            commands: input.commands ?? [],
+            warnings: input.warnings ?? [],
+            blocker: input.blocker,
+            created_at: nowIso()
+        });
+        if (task.status === "done" || task.status === "blocked") {
+            const existingResult = await this.getResult(taskId).catch((error) => {
+                if (isErrorCode(error, "ENOENT"))
+                    throw terminalTaskMissingResultError(task);
+                throw error;
+            });
+            if (await this.hasTrustedTaskCompletionReceipt(taskId, existingResult)) {
+                throw new Error(`Task ${taskId} is already ${task.status} and cannot be finalized again`);
+            }
+            assertResultMatchesRetry(taskId, existingResult, retryResult);
+            await this.assertResultArtifactsUnchanged(existingResult);
+            await this.writeTaskCompletionReceipt(taskId, existingResult);
+            return existingResult;
+        }
+        const existingResult = await this.getResult(taskId).catch((error) => {
+            if (isErrorCode(error, "ENOENT"))
+                return undefined;
+            throw error;
+        });
+        if (existingResult) {
+            assertResultMatchesRetry(taskId, existingResult, retryResult);
+            await this.assertResultArtifactsUnchanged(existingResult);
+            const updated = TaskSchema.parse({
+                ...task,
+                status: existingResult.status,
+                provenance: input.provenance ? { ...task.provenance, ...input.provenance } : task.provenance,
+                blocker: existingResult.blocker,
+                result_path: `.bridge/results/${taskId}.json`,
+                updated_at: nowIso()
+            });
+            await this.writeRecordJson("tasks", taskId, updated);
+            await this.writeTaskCompletionReceiptOrRestoreTask(taskId, existingResult, task);
+            return existingResult;
+        }
+        const artifacts = await this.withResultArtifactHashes(input.artifacts ?? []);
+        const result = ResultSchema.parse({
+            ...retryResult,
+            artifacts
+        });
+        const wroteResult = await this.writeNewRecordJson("results", taskId, result);
+        const finalResult = wroteResult ? result : await this.getResult(taskId);
+        if (!wroteResult) {
+            assertResultMatchesRetry(taskId, finalResult, retryResult);
+        }
+        await this.assertResultArtifactsUnchanged(finalResult);
+        const updated = TaskSchema.parse({
+            ...task,
+            status: finalResult.status,
+            provenance: input.provenance ? { ...task.provenance, ...input.provenance } : task.provenance,
+            blocker: finalResult.blocker,
+            result_path: `.bridge/results/${taskId}.json`,
+            updated_at: nowIso()
+        });
+        await this.writeRecordJson("tasks", taskId, updated);
+        await this.writeTaskCompletionReceiptOrRestoreTask(taskId, finalResult, task);
+        return finalResult;
+    }
+    async listResults() {
+        await this.ensure();
+        return (await this.readAll("results", parseResultRecord)).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.task_id.localeCompare(b.task_id));
+    }
+    async listResultsReadOnly() {
+        if (!(await this.hasReadyStorageDirReadOnly("results")))
+            return [];
+        return (await this.readAll("results", parseResultRecord, { cleanupTempHardLinks: false })).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.task_id.localeCompare(b.task_id));
+    }
+    async listFinalizedResultsReadOnly() {
+        const results = await this.listResultsReadOnly();
+        for (const result of results) {
+            await this.assertTrustedTaskCompletionReceiptReadOnly(result.task_id, result);
+        }
+        return results;
+    }
+    async getResult(taskId) {
+        return this.parseRecord("results", taskId, await this.readRecordJson("results", taskId), parseResultRecord);
+    }
+    async getResultReadOnly(taskId) {
+        return this.parseRecord("results", taskId, await this.readRecordJson("results", taskId, { cleanupTempHardLinks: false }), parseResultRecord);
+    }
+    async getFinalizedResultReadOnly(taskId) {
+        const result = await this.getResultReadOnly(taskId);
+        await this.assertTrustedTaskCompletionReceiptReadOnly(taskId, result);
+        return result;
+    }
+    async resealResult(taskId) {
+        const task = await this.getTask(taskId);
+        if (task.status !== "done" && task.status !== "blocked") {
+            throw new Error(`Task ${taskId} is ${task.status}, not done or blocked`);
+        }
+        const result = await this.getResult(taskId);
+        if (result.status !== task.status) {
+            throw new Error(`Result ${taskId} status ${result.status} does not match task status ${task.status}`);
+        }
+        await this.assertResultArtifactsUnchanged(result);
+        if (await this.hasTrustedTaskCompletionReceipt(taskId, result)) {
+            throw new Error(`Result ${taskId} already has a trusted task_completed receipt`);
+        }
+        await this.assertHasTrustedLegacyCompletionReceiptForReseal(taskId, result);
+        return {
+            result,
+            receipt: await this.writeTaskCompletionReceipt(taskId, result)
+        };
+    }
+    async readFinalizedResultArtifactText(taskId, artifactPath, options = {}) {
+        return this.readResultArtifactText(taskId, artifactPath, { ...options, readOnly: true });
+    }
+    async readResultArtifactText(taskId, artifactPath, options = {}) {
+        const result = options.readOnly ? await this.getResultReadOnly(taskId) : await this.getResult(taskId);
+        if (options.readOnly) {
+            await this.assertTrustedTaskCompletionReceiptReadOnly(taskId, result);
+        }
+        const artifacts = result.artifacts.filter((artifact) => artifact.role === "result");
+        const artifact = artifactPath ? artifacts.find((item) => item.path === artifactPath) : artifacts.length === 1 ? artifacts[0] : undefined;
+        if (!artifact) {
+            if (artifactPath)
+                throw new Error(`Result artifact not found for ${taskId}: ${artifactPath}`);
+            if (artifacts.length === 0)
+                throw new Error(`Result ${taskId} has no result artifacts`);
+            throw new Error(`Result ${taskId} has multiple result artifacts; pass one artifact path: ${artifacts.map((item) => item.path).join(", ")}`);
+        }
+        const normalizedArtifactPath = path.posix.normalize(artifact.path.replaceAll("\\", "/"));
+        if (!isFetchableResultArtifactPath(normalizedArtifactPath) || normalizedArtifactPath !== artifact.path) {
+            throw new Error(`Artifact is not a fetchable result artifact for ${taskId}: ${artifact.path}`);
+        }
+        const content = await this.readArtifactText(artifact.path, options);
+        if (artifact.sha256 && sha256(content) !== artifact.sha256) {
+            throw new Error(`Result artifact changed after finalization for ${taskId}: ${artifact.path} sha256 mismatch`);
+        }
+        return { artifact, content };
+    }
+    async withResultArtifactHashes(artifacts) {
+        const withHashes = [];
+        for (const artifact of artifacts) {
+            if (artifact.role !== "result") {
+                withHashes.push(artifact);
+                continue;
+            }
+            const content = await this.readArtifactText(artifact.path);
+            const bytes = Buffer.byteLength(content, "utf8");
+            if (bytes > MAX_FETCHABLE_RESULT_ARTIFACT_BYTES) {
+                throw new Error(`Result artifact is too large to fetch (${bytes} bytes > ${MAX_FETCHABLE_RESULT_ARTIFACT_BYTES} bytes): ${artifact.path}`);
+            }
+            withHashes.push({ ...artifact, bytes, sha256: sha256(content) });
+        }
+        return withHashes;
+    }
+    async assertResultArtifactsUnchanged(result) {
+        for (const artifact of result.artifacts) {
+            if (artifact.role !== "result" || !artifact.sha256)
+                continue;
+            const normalizedArtifactPath = path.posix.normalize(artifact.path.replaceAll("\\", "/"));
+            if (!isFetchableResultArtifactPath(normalizedArtifactPath) || normalizedArtifactPath !== artifact.path) {
+                throw new Error(`Artifact is not a fetchable result artifact for ${result.task_id}: ${artifact.path}`);
+            }
+            let content;
+            try {
+                content = await this.readArtifactText(artifact.path);
+            }
+            catch (error) {
+                throw new Error(`Result artifact changed after finalization for ${result.task_id}: ${artifact.path} ${errorMessage(error)}`);
+            }
+            if (sha256(content) !== artifact.sha256) {
+                throw new Error(`Result artifact changed after finalization for ${result.task_id}: ${artifact.path} sha256 mismatch`);
+            }
+        }
+    }
+    async writeSession(input) {
+        await this.ensure();
+        const timestamp = nowIso();
+        if (input.id === undefined) {
+            return this.createWithUniqueId("sess", input.task_id ?? input.direction, "sessions", (id) => SessionSchema.parse({
+                schema_version: SCHEMA_VERSION,
+                id,
+                direction: input.direction,
+                backend: input.backend,
+                project: input.project,
+                thread: input.thread,
+                task_id: input.task_id,
+                status: input.status ?? "preview",
+                blocker: input.blocker,
+                warnings: input.warnings ?? [],
+                created_at: timestamp,
+                last_used_at: timestamp
+            }));
+        }
+        const existing = await this.getSession(input.id).catch(() => undefined);
+        const session = SessionSchema.parse({
+            schema_version: SCHEMA_VERSION,
+            id: input.id,
+            direction: input.direction,
+            backend: input.backend,
+            project: input.project,
+            thread: input.thread,
+            task_id: input.task_id,
+            status: input.status ?? "preview",
+            blocker: input.blocker,
+            warnings: input.warnings ?? [],
+            created_at: existing?.created_at ?? timestamp,
+            last_used_at: timestamp
+        });
+        await this.writeRecordJson("sessions", input.id, session);
+        return session;
+    }
+    async getSession(sessionId) {
+        return this.parseRecord("sessions", sessionId, await this.readRecordJson("sessions", sessionId), parseSessionRecord);
+    }
+    async getSessionReadOnly(sessionId) {
+        return this.parseRecord("sessions", sessionId, await this.readRecordJson("sessions", sessionId, { cleanupTempHardLinks: false }), parseSessionRecord);
+    }
+    async listSessions(status) {
+        await this.ensure();
+        const sessions = await this.readAll("sessions", parseSessionRecord);
+        return sessions
+            .filter((session) => (status ? session.status === status : true))
+            .sort((a, b) => b.last_used_at.localeCompare(a.last_used_at) || b.id.localeCompare(a.id));
+    }
+    async listSessionsReadOnly(status) {
+        if (!(await this.hasReadyStorageDirReadOnly("sessions")))
+            return [];
+        const sessions = await this.readAll("sessions", parseSessionRecord, { cleanupTempHardLinks: false });
+        return sessions
+            .filter((session) => (status ? session.status === status : true))
+            .sort((a, b) => b.last_used_at.localeCompare(a.last_used_at) || b.id.localeCompare(a.id));
+    }
+    async getReceipt(receiptId) {
+        return this.parseRecord("receipts", receiptId, await this.readRecordJson("receipts", receiptId), parseReceiptRecord);
+    }
+    async getTrustedReceipt(receiptId) {
+        const receipt = await this.getReceipt(receiptId);
+        await this.assertReceiptIntegrity(receipt);
+        return receipt;
+    }
+    async deleteReceiptIfPresent(receiptId) {
+        await this.ensure();
+        await this.deleteRecordIfPresent("receipts", receiptId);
+    }
+    async getReceiptReadOnly(receiptId) {
+        return this.parseRecord("receipts", receiptId, await this.readRecordJson("receipts", receiptId, { cleanupTempHardLinks: false }), parseReceiptRecord);
+    }
+    async listReceipts(input = {}) {
+        await this.ensure();
+        const receipts = (await this.readAll("receipts", parseReceiptRecord))
+            .filter((receipt) => (input.kind ? receipt.kind === input.kind : true))
+            .filter((receipt) => (input.task_id ? receipt.task_id === input.task_id : true))
+            .sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id.localeCompare(a.id));
+        return Promise.all(receipts.map((receipt) => this.redactReceiptForDisplay(receipt)));
+    }
+    async listReceiptsReadOnly(input = {}) {
+        if (!(await this.hasReadyStorageDirReadOnly("receipts")))
+            return [];
+        const receipts = (await this.readAll("receipts", parseReceiptRecord, { cleanupTempHardLinks: false }))
+            .filter((receipt) => (input.kind ? receipt.kind === input.kind : true))
+            .filter((receipt) => (input.task_id ? receipt.task_id === input.task_id : true))
+            .sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id.localeCompare(a.id));
+        return Promise.all(receipts.map((receipt) => this.redactReceiptForDisplay(receipt)));
+    }
+    async getReceiptForDisplay(receiptId) {
+        return this.redactReceiptForDisplay(await this.getReceipt(receiptId));
+    }
+    async getReceiptForDisplayReadOnly(receiptId) {
+        return this.redactReceiptForDisplay(await this.getReceiptReadOnly(receiptId));
+    }
+    async hasTrustedTaskCompletionReceipt(taskId, result) {
+        const receipts = (await this.readAll("receipts", parseReceiptRecord)).filter((receipt) => receipt.kind === "task_completed" && receipt.task_id === taskId);
+        for (const receipt of receipts) {
+            try {
+                await this.assertReceiptIntegrity(receipt, {
+                    remediation: "Task completion receipts must be generated by this local bridge"
+                });
+                assertReceiptResultDigest(receipt, result);
+                return true;
+            }
+            catch {
+                continue;
+            }
+        }
+        return false;
+    }
+    async assertTrustedTaskCompletionReceiptReadOnly(taskId, result) {
+        if (!(await this.hasReadyStorageDirReadOnly("receipts"))) {
+            throw untrustedResultError(this.root, taskId, "has no trusted task_completed receipt");
+        }
+        const receipts = (await this.readAll("receipts", parseReceiptRecord, { cleanupTempHardLinks: false })).filter((receipt) => receipt.kind === "task_completed" && receipt.task_id === taskId);
+        if (receipts.length === 0) {
+            throw untrustedResultError(this.root, taskId, "has no trusted task_completed receipt");
+        }
+        const failures = [];
+        for (const receipt of receipts) {
+            try {
+                await this.assertReceiptIntegrity(receipt, {
+                    remediation: "Task completion receipts must be generated by this local bridge"
+                });
+                assertReceiptResultDigest(receipt, result);
+                return;
+            }
+            catch (error) {
+                failures.push(errorMessage(error));
+            }
+        }
+        throw untrustedResultError(this.root, taskId, `has an untrusted task_completed receipt: ${failures[0] ?? "local integrity unavailable"}`);
+    }
+    async writeTaskCompletionReceipt(taskId, result) {
+        return this.writeReceipt({
+            kind: "task_completed",
+            task_id: taskId,
+            summary: `${result.status === "done" ? "Completed" : "Blocked"} task ${taskId}`,
+            metadata: {
+                result_sha256: resultDigest(result)
+            }
+        });
+    }
+    async writeTaskCompletionReceiptOrRestoreTask(taskId, result, previousTask) {
+        try {
+            await this.writeTaskCompletionReceipt(taskId, result);
+        }
+        catch (error) {
+            try {
+                await this.writeRecordJson("tasks", taskId, previousTask);
+            }
+            catch (cleanupError) {
+                throw new Error(`${errorMessage(error)} (also failed to restore task completion state: ${errorMessage(cleanupError)})`);
+            }
+            throw error;
+        }
+    }
+    async assertHasTrustedLegacyCompletionReceiptForReseal(taskId, result) {
+        const receipts = (await this.readAll("receipts", parseReceiptRecord))
+            .filter((receipt) => receipt.kind === "task_completed" && receipt.task_id === taskId)
+            .sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id.localeCompare(a.id));
+        if (receipts.length === 0) {
+            throw untrustedResultError(this.root, taskId, "has no trusted task_completed receipt to reseal");
+        }
+        const failures = [];
+        const legacyReceiptIds = [];
+        for (const receipt of receipts) {
+            try {
+                await this.assertReceiptIntegrity(receipt, {
+                    remediation: "Only locally signed legacy task_completed receipts can be resealed"
+                });
+                assertLegacyCompletionReceiptCanBeResealed(receipt, result);
+                legacyReceiptIds.push(receipt.id);
+            }
+            catch (error) {
+                failures.push(errorMessage(error));
+            }
+        }
+        if (legacyReceiptIds.length === 1)
+            return;
+        if (legacyReceiptIds.length > 1) {
+            throw untrustedResultError(this.root, taskId, `has multiple locally signed legacy task_completed receipts to reseal (${legacyReceiptIds.join(", ")}); move extras aside, then retry`);
+        }
+        throw untrustedResultError(this.root, taskId, `has no locally trusted legacy task_completed receipt to reseal: ${failures[0] ?? "local integrity unavailable"}`);
+    }
+    async writeArtifactText(relativePath, content) {
+        await this.ensure();
+        await this.assertBridgeDirIsRealDirectory();
+        await this.assertArtifactsDirIsRealDirectory();
+        const artifactPath = this.resolveArtifactPath(relativePath);
+        await this.ensureArtifactParentDirectory(path.dirname(artifactPath));
+        await writeVerifiedUtf8File(artifactPath, content, async () => {
+            await this.assertArtifactParentDirectory(path.dirname(artifactPath));
+            await this.assertArtifactTargetInsideIfExists(artifactPath);
+        }, { create: true, mode: BRIDGE_FILE_MODE });
+        return this.relativeToRoot(artifactPath);
+    }
+    async hasArtifactText(relativePath) {
+        const artifactPath = this.resolveArtifactPath(relativePath);
+        try {
+            await this.assertBridgeDirIsRealDirectory();
+            await this.assertArtifactsDirIsRealDirectory();
+            await this.assertArtifactParentDirectory(path.dirname(artifactPath));
+            await this.assertArtifactTargetInside(artifactPath);
+            return true;
+        }
+        catch (error) {
+            if (isErrorCode(error, "ENOENT"))
+                return false;
+            throw error;
+        }
+    }
+    async deleteArtifactTextIfPresent(relativePath) {
+        await this.assertBridgeDirIsRealDirectory();
+        await this.assertArtifactsDirIsRealDirectory();
+        const artifactPath = this.resolveArtifactPath(relativePath);
+        const parentPath = path.dirname(artifactPath);
+        await this.assertArtifactParentDirectory(parentPath);
+        const parentHandle = await openNoFollowDirectory(parentPath, "Artifact directory");
+        try {
+            const targetPath = path.join(directoryFdPath(parentHandle.fd), path.basename(artifactPath));
+            let stat;
+            try {
+                stat = await lstat(targetPath);
+            }
+            catch (error) {
+                if (isErrorCode(error, "ENOENT"))
+                    return;
+                throw error;
+            }
+            if (stat.isSymbolicLink() || !stat.isFile()) {
+                throw new Error("Artifact path must be a regular file and must not be a symlink");
+            }
+            await rm(targetPath, { force: true });
+            await this.assertArtifactParentDirectory(parentPath);
+        }
+        finally {
+            await parentHandle.close();
+        }
+    }
+    async readArtifactText(relativePath, options = {}) {
+        await this.assertBridgeDirIsRealDirectory();
+        await this.assertArtifactsDirIsRealDirectory();
+        const artifactPath = this.resolveArtifactPath(relativePath);
+        await this.assertArtifactParentDirectory(path.dirname(artifactPath));
+        return readVerifiedUtf8File(artifactPath, () => this.assertArtifactTargetInside(artifactPath), {
+            maxBytes: options.maxBytes ?? MAX_BRIDGE_ARTIFACT_READ_BYTES
+        });
+    }
+    async writeReceipt(input) {
+        await this.ensure();
+        return this.createWithUniqueId("receipt", input.kind, "receipts", async (id) => {
+            const unsigned = ReceiptSchema.parse({
+                schema_version: SCHEMA_VERSION,
+                id,
+                created_at: nowIso(),
+                ...input
+            });
+            return ReceiptSchema.parse({
+                ...unsigned,
+                integrity: {
+                    algorithm: "hmac-sha256",
+                    digest: await this.receiptDigest(unsigned)
+                }
+            });
+        });
+    }
+    async assertReceiptIntegrity(receipt, options = {
+        remediation: "Recreate the write dry-run before applying or staging."
+    }) {
+        const remediation = options.remediation ?? "Recreate the write dry-run before applying or staging.";
+        if (receipt.integrity?.algorithm !== "hmac-sha256") {
+            throw new Error(`Receipt ${receipt.id} is missing local integrity seal. ${remediation}`);
+        }
+        const expected = await this.receiptDigest(receipt);
+        if (!safeHexEqual(receipt.integrity.digest, expected)) {
+            throw new Error(`Receipt ${receipt.id} failed local integrity verification. ${remediation}`);
+        }
+    }
+    async redactReceiptForDisplay(receipt) {
+        return redactReceiptForDisplay(receipt, await this.receiptIntegrityInspectionStatus(receipt));
+    }
+    async receiptIntegrityInspectionStatus(receipt) {
+        if (receipt.integrity?.algorithm !== "hmac-sha256") {
+            return { trusted: false, reason: "missing local integrity seal" };
+        }
+        try {
+            const expected = await this.receiptDigest(receipt);
+            if (!safeHexEqual(receipt.integrity.digest, expected)) {
+                return { trusted: false, reason: "local integrity verification failed" };
+            }
+            return undefined;
+        }
+        catch (error) {
+            if (isErrorCode(error, "ENOENT")) {
+                return { trusted: false, reason: "missing local integrity key" };
+            }
+            return { trusted: false, reason: `local integrity unavailable: ${errorMessage(error)}` };
+        }
+    }
+    async receiptDigest(receipt) {
+        const key = await this.readReceiptIntegrityKey();
+        return createHmac("sha256", Buffer.from(key, "hex")).update(canonicalJson(stripReceiptIntegrity(receipt))).digest("hex");
+    }
+    async ensureReceiptIntegrityKey() {
+        try {
+            return await this.readReceiptIntegrityKey();
+        }
+        catch (error) {
+            if (!isErrorCode(error, "ENOENT"))
+                throw error;
+        }
+        const key = randomBytes(RECEIPT_INTEGRITY_KEY_BYTES).toString("hex");
+        await writeVerifiedUtf8File(this.receiptIntegrityKeyPath(), `${key}\n`, () => this.assertReceiptIntegrityKeyTargetSafe(), {
+            create: true,
+            mode: BRIDGE_FILE_MODE
+        });
+        return key;
+    }
+    async readReceiptIntegrityKey() {
+        const key = (await readVerifiedUtf8File(this.receiptIntegrityKeyPath(), () => this.assertReceiptIntegrityKeyTargetSafe({ allowMissing: false }), {
+            mode: BRIDGE_FILE_MODE
+        })).trim();
+        if (!/^[a-f0-9]{64}$/.test(key)) {
+            throw new Error(".bridge/receipt-key.local is corrupt. Move it aside and recreate write receipts.");
+        }
+        return key;
+    }
+    async ensureBridgeGitignore() {
+        const ignorePath = path.join(this.bridgeDir, ".gitignore");
+        let current = "";
+        try {
+            current = await readVerifiedUtf8File(ignorePath, () => this.assertBridgeGitignoreTargetSafe());
+        }
+        catch (error) {
+            if (!isErrorCode(error, "ENOENT"))
+                throw error;
+        }
+        const required = [
+            "tasks/*.json",
+            "results/*.json",
+            "sessions/*.json",
+            "receipts/*.json",
+            "artifacts/*",
+            "config.local.json",
+            "receipt-key.local",
+            "!.gitignore"
+        ];
+        const lines = new Set(current.split(/\r?\n/).filter(Boolean));
+        for (const line of required)
+            lines.add(line);
+        await writeVerifiedUtf8File(ignorePath, `${Array.from(lines).join("\n")}\n`, () => this.assertBridgeGitignoreTargetSafe(), {
+            create: true
+        });
+    }
+    async hasReadyBridgeStorageReadOnly() {
+        try {
+            await this.assertStorageDirsAreRealDirectories();
+            return true;
+        }
+        catch (error) {
+            if (isErrorCode(error, "ENOENT"))
+                return false;
+            throw error;
+        }
+    }
+    async hasReadyStorageDirReadOnly(kind) {
+        try {
+            await this.assertStorageDirIsRealDirectory(kind);
+            return true;
+        }
+        catch (error) {
+            if (isErrorCode(error, "ENOENT"))
+                return false;
+            throw error;
+        }
+    }
+    // Allocate a record id and write it with an exclusive create, retrying with a -N suffix on
+    // collision, so id allocation and the write are a single atomic step. The previous check-then-
+    // write (exists() loop + overwrite) was a TOCTOU: two concurrent creates with the same
+    // timestamp+title both saw "absent" and resolved to the same id, silently overwriting one
+    // record under the normal Codex+Claude shared-.bridge mode. This mirrors the exclusive-create
+    // path already used for results.
+    async createWithUniqueId(prefix, title, kind, build) {
+        for (let attempt = 1;; attempt += 1) {
+            const base = makeBridgeId(prefix, title);
+            const id = attempt === 1 ? base : `${base}-${attempt}`;
+            const record = await build(id);
+            if (await this.writeNewRecordJson(kind, id, record))
+                return record;
+            if (attempt >= 10000) {
+                throw new Error(`Unable to allocate a unique ${prefix} id under .bridge/${kind} after ${attempt} attempts`);
+            }
+        }
+    }
+    pathFor(kind, id) {
+        assertBridgeRecordId(kind, id);
+        return path.join(this.dir(kind), `${id}.json`);
+    }
+    async readAll(kind, parseRecord, options = {}) {
+        const dir = this.dir(kind);
+        const entries = await readdir(dir, { withFileTypes: true });
+        const items = [];
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.endsWith(".json"))
+                continue;
+            const id = entry.name.replace(/\.json$/, "");
+            if (!isBridgeRecordId(kind, id))
+                continue;
+            items.push(this.parseRecord(kind, id, await this.readRecordJson(kind, id, options), parseRecord));
+        }
+        return items;
+    }
+    parseRecord(kind, id, value, parseRecord) {
+        try {
+            return parseRecord(id, value);
+        }
+        catch (error) {
+            throw recordCorruptError(kind, id, this.pathFor(kind, id), this.root, error);
+        }
+    }
+    async readRecordJson(kind, id, options = {}) {
+        const filePath = this.pathFor(kind, id);
+        try {
+            await this.assertStorageDirIsRealDirectory(kind);
+            if (options.cleanupTempHardLinks ?? true) {
+                await this.cleanupRecordTempHardLinks(kind, filePath);
+            }
+            const raw = await readVerifiedUtf8File(filePath, () => this.assertRecordTargetInside(kind, filePath));
+            try {
+                return JSON.parse(raw);
+            }
+            catch (error) {
+                throw recordCorruptError(kind, id, filePath, this.root, error);
+            }
+        }
+        catch (error) {
+            if (isErrorCode(error, "ENOENT")) {
+                throw recordNotFoundError(kind, id);
+            }
+            throw error;
+        }
+    }
+    async writeRecordJson(kind, id, value) {
+        const filePath = this.pathFor(kind, id);
+        await this.assertStorageDirIsRealDirectory(kind);
+        await this.assertRecordTargetInsideIfExists(kind, filePath);
+        await this.writeJson(kind, filePath, value);
+        await this.assertRecordTargetInside(kind, filePath);
+    }
+    async writeNewRecordJson(kind, id, value) {
+        const filePath = this.pathFor(kind, id);
+        await this.assertStorageDirIsRealDirectory(kind);
+        const wrote = await this.writeJsonIfAbsent(kind, filePath, value);
+        if (!wrote)
+            return false;
+        await this.assertRecordTargetInside(kind, filePath);
+        return true;
+    }
+    async writeJson(kind, filePath, value) {
+        await this.writeTextByRename(kind, filePath, `${JSON.stringify(value, null, 2)}\n`);
+    }
+    async writeJsonIfAbsent(kind, filePath, value) {
+        return await this.writeTextByCreateExclusive(kind, filePath, `${JSON.stringify(value, null, 2)}\n`);
+    }
+    async writeTextByRename(kind, filePath, content) {
+        if (hasStableDirectoryFdPaths()) {
+            await this.writeTextByStableStorageRename(kind, filePath, content);
+            return;
+        }
+        throw new Error("Bridge record writes require stable directory file descriptor paths on this platform.");
+    }
+    async writeTextByCreateExclusive(kind, filePath, content) {
+        if (hasStableDirectoryFdPaths()) {
+            return await this.writeTextByStableStorageLinkIfAbsent(kind, filePath, content);
+        }
+        throw new Error("Bridge record writes require stable directory file descriptor paths on this platform.");
+    }
+    async deleteRecordIfPresent(kind, id) {
+        const filePath = this.pathFor(kind, id);
+        const fileName = path.basename(filePath);
+        const expectedDir = this.dir(kind);
+        if (path.dirname(filePath) !== expectedDir) {
+            throw new Error(`Bridge record path must stay under .bridge/${kind}`);
+        }
+        const bridgeHandle = await openNoFollowDirectory(this.bridgeDir, "Bridge directory");
+        try {
+            const storageHandle = await openNoFollowDirectory(path.join(directoryFdPath(bridgeHandle.fd), kind), `Bridge storage directory .bridge/${kind}`);
+            try {
+                await this.assertStorageDirIsRealDirectory(kind);
+                const targetPath = path.join(directoryFdPath(storageHandle.fd), fileName);
+                let stat;
+                try {
+                    stat = await lstat(targetPath);
+                }
+                catch (error) {
+                    if (isErrorCode(error, "ENOENT"))
+                        return;
+                    throw error;
+                }
+                if (stat.isSymbolicLink() || !stat.isFile()) {
+                    throw new Error(`Bridge record path for .bridge/${kind} must be a regular file and must not be a symlink`);
+                }
+                await rm(targetPath, { force: true });
+                await this.assertStorageDirIsRealDirectory(kind);
+            }
+            finally {
+                await storageHandle.close();
+            }
+        }
+        finally {
+            await bridgeHandle.close();
+        }
+    }
+    async writeTextByStableStorageRename(kind, filePath, content) {
+        const fileName = path.basename(filePath);
+        const expectedDir = this.dir(kind);
+        if (path.dirname(filePath) !== expectedDir) {
+            throw new Error(`Bridge record path must stay under .bridge/${kind}`);
+        }
+        const bridgeHandle = await openNoFollowDirectory(this.bridgeDir, "Bridge directory");
+        try {
+            const storageHandle = await openNoFollowDirectory(path.join(directoryFdPath(bridgeHandle.fd), kind), `Bridge storage directory .bridge/${kind}`);
+            try {
+                await this.assertStorageDirIsRealDirectory(kind);
+                const storageFdPath = directoryFdPath(storageHandle.fd);
+                const targetPath = path.join(storageFdPath, fileName);
+                await assertRegularFileIfExists(targetPath, `Bridge record path for .bridge/${kind}`);
+                const tmpPath = path.join(storageFdPath, `.${fileName}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`);
+                try {
+                    await writeVerifiedUtf8File(tmpPath, content, async () => assertOpenDirectoryHandle(storageHandle), {
+                        create: true,
+                        mode: BRIDGE_FILE_MODE
+                    });
+                    await storeTestHooks.beforeRecordRename?.(kind, filePath);
+                    await rename(tmpPath, targetPath);
+                    await assertRegularFileIfExists(targetPath, `Bridge record path for .bridge/${kind}`);
+                    await this.assertStorageDirIsRealDirectory(kind);
+                }
+                catch (error) {
+                    await rm(tmpPath, { force: true }).catch(() => undefined);
+                    throw error;
+                }
+            }
+            finally {
+                await storageHandle.close();
+            }
+        }
+        finally {
+            await bridgeHandle.close();
+        }
+    }
+    async writeTextByStableStorageLinkIfAbsent(kind, filePath, content) {
+        const fileName = path.basename(filePath);
+        const expectedDir = this.dir(kind);
+        if (path.dirname(filePath) !== expectedDir) {
+            throw new Error(`Bridge record path must stay under .bridge/${kind}`);
+        }
+        const bridgeHandle = await openNoFollowDirectory(this.bridgeDir, "Bridge directory");
+        try {
+            const storageHandle = await openNoFollowDirectory(path.join(directoryFdPath(bridgeHandle.fd), kind), `Bridge storage directory .bridge/${kind}`);
+            try {
+                await this.assertStorageDirIsRealDirectory(kind);
+                const storageFdPath = directoryFdPath(storageHandle.fd);
+                const targetPath = path.join(storageFdPath, fileName);
+                const tmpPath = path.join(storageFdPath, `.${fileName}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`);
+                let linked = false;
+                try {
+                    await writeVerifiedUtf8File(tmpPath, content, async () => assertOpenDirectoryHandle(storageHandle), {
+                        create: true,
+                        exclusive: true,
+                        mode: BRIDGE_FILE_MODE
+                    });
+                    try {
+                        await storeTestHooks.beforeRecordRename?.(kind, filePath);
+                        await link(tmpPath, targetPath);
+                    }
+                    catch (error) {
+                        if (isErrorCode(error, "EEXIST")) {
+                            await rm(tmpPath, { force: true }).catch(() => undefined);
+                            return false;
+                        }
+                        throw error;
+                    }
+                    linked = true;
+                    await rm(tmpPath, { force: true });
+                    await assertRegularFileIfExists(targetPath, `Bridge record path for .bridge/${kind}`);
+                    await this.assertStorageDirIsRealDirectory(kind);
+                }
+                catch (error) {
+                    if (!linked)
+                        await rm(tmpPath, { force: true }).catch(() => undefined);
+                    throw error;
+                }
+            }
+            finally {
+                await storageHandle.close();
+            }
+        }
+        finally {
+            await bridgeHandle.close();
+        }
+        return true;
+    }
+    async cleanupRecordTempHardLinks(kind, filePath) {
+        const fileName = path.basename(filePath);
+        const expectedDir = this.dir(kind);
+        if (path.dirname(filePath) !== expectedDir) {
+            throw new Error(`Bridge record path must stay under .bridge/${kind}`);
+        }
+        const bridgeHandle = await openNoFollowDirectory(this.bridgeDir, "Bridge directory");
+        try {
+            const storageHandle = await openNoFollowDirectory(path.join(directoryFdPath(bridgeHandle.fd), kind), `Bridge storage directory .bridge/${kind}`);
+            try {
+                const storageFdPath = directoryFdPath(storageHandle.fd);
+                const targetPath = path.join(storageFdPath, fileName);
+                let targetStat;
+                try {
+                    targetStat = await lstat(targetPath);
+                }
+                catch (error) {
+                    if (isErrorCode(error, "ENOENT"))
+                        return;
+                    throw error;
+                }
+                if (targetStat.isSymbolicLink() || !targetStat.isFile() || targetStat.nlink <= 1)
+                    return;
+                await storeTestHooks.beforeRecordTempCleanup?.(kind, filePath);
+                const tempPrefix = `.${fileName}.`;
+                const entries = await readdir(storageFdPath, { withFileTypes: true });
+                for (const entry of entries) {
+                    if (!entry.isFile() || !entry.name.startsWith(tempPrefix) || !entry.name.endsWith(".tmp"))
+                        continue;
+                    const tempPath = path.join(storageFdPath, entry.name);
+                    const tempStat = await lstat(tempPath).catch(() => undefined);
+                    if (!tempStat?.isFile() || tempStat.isSymbolicLink())
+                        continue;
+                    if (tempStat.dev === targetStat.dev && tempStat.ino === targetStat.ino) {
+                        await rm(tempPath, { force: true });
+                    }
+                }
+            }
+            finally {
+                await storageHandle.close();
+            }
+        }
+        finally {
+            await bridgeHandle.close();
+        }
+    }
+    resolveArtifactPath(relativePath) {
+        const normalized = relativePath.replaceAll("\\", "/");
+        if (!normalized.startsWith(".bridge/artifacts/")) {
+            throw new Error("Artifact path must be under .bridge/artifacts");
+        }
+        const resolved = path.resolve(this.root, normalized);
+        const relative = path.relative(this.dir("artifacts"), resolved);
+        if (relative.startsWith("..") || path.isAbsolute(relative)) {
+            throw new Error("Artifact path must stay under .bridge/artifacts");
+        }
+        return resolved;
+    }
+    relativeToRoot(filePath) {
+        return path.relative(this.root, filePath).replaceAll(path.sep, "/");
+    }
+    async assertArtifactTargetInside(filePath) {
+        const stat = await lstat(filePath);
+        if (stat.isSymbolicLink()) {
+            throw new Error("Artifact path must not be a symlink");
+        }
+        await this.assertRealPathInsideArtifacts(filePath);
+    }
+    async assertArtifactsDirIsRealDirectory() {
+        await this.assertStorageDirIsRealDirectory("artifacts");
+    }
+    async ensureArtifactParentDirectory(parentPath) {
+        await this.walkArtifactParentDirectory(parentPath, true);
+    }
+    async assertArtifactParentDirectory(parentPath) {
+        await this.walkArtifactParentDirectory(parentPath, false);
+    }
+    async walkArtifactParentDirectory(parentPath, createMissing) {
+        const artifactsDir = this.dir("artifacts");
+        const relative = path.relative(artifactsDir, parentPath);
+        if (relative.startsWith("..") || path.isAbsolute(relative)) {
+            throw new Error("Artifact path must stay under .bridge/artifacts");
+        }
+        let current = artifactsDir;
+        for (const segment of relative.split(path.sep).filter(Boolean)) {
+            current = path.join(current, segment);
+            if (createMissing) {
+                await this.ensureRealDirectorySegment(current);
+            }
+            else {
+                await this.assertRealDirectorySegment(current);
+            }
+        }
+    }
+    async ensureRealDirectorySegment(dirPath) {
+        try {
+            const stat = await lstat(dirPath);
+            if (stat.isSymbolicLink() || !stat.isDirectory()) {
+                throw new Error("Artifact path must stay under .bridge/artifacts");
+            }
+        }
+        catch (error) {
+            const maybe = error;
+            if (maybe.code !== "ENOENT")
+                throw error;
+            await mkdir(dirPath, { mode: BRIDGE_DIRECTORY_MODE });
+            const stat = await lstat(dirPath);
+            if (stat.isSymbolicLink() || !stat.isDirectory()) {
+                throw new Error("Artifact path must stay under .bridge/artifacts");
+            }
+        }
+        await chmodPrivateDirectory(dirPath, "Artifact directory");
+    }
+    async assertRealDirectorySegment(dirPath) {
+        const stat = await lstat(dirPath);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error("Artifact path must stay under .bridge/artifacts");
+        }
+    }
+    async assertBridgeDirIsRealDirectory() {
+        const stat = await lstat(this.bridgeDir);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error("Bridge directory must be a real directory");
+        }
+    }
+    async assertBridgeGitignoreTargetSafe(options = { allowMissing: true }) {
+        await this.assertBridgeDirIsRealDirectory();
+        const ignorePath = path.join(this.bridgeDir, ".gitignore");
+        try {
+            const stat = await lstat(ignorePath);
+            if (stat.isSymbolicLink()) {
+                throw new Error(".bridge/.gitignore must not be a symlink");
+            }
+            if (!stat.isFile()) {
+                throw new Error(".bridge/.gitignore must be a regular file");
+            }
+        }
+        catch (error) {
+            if (isErrorCode(error, "ENOENT") && options.allowMissing !== false)
+                return;
+            throw error;
+        }
+    }
+    async assertReceiptIntegrityKeyTargetSafe(options = { allowMissing: true }) {
+        await this.assertBridgeDirIsRealDirectory();
+        const keyPath = this.receiptIntegrityKeyPath();
+        try {
+            const stat = await lstat(keyPath);
+            if (stat.isSymbolicLink()) {
+                throw new Error(".bridge/receipt-key.local must not be a symlink");
+            }
+            if (!stat.isFile()) {
+                throw new Error(".bridge/receipt-key.local must be a regular file");
+            }
+        }
+        catch (error) {
+            if (isErrorCode(error, "ENOENT") && options.allowMissing !== false)
+                return;
+            throw error;
+        }
+    }
+    async assertStorageDirsAreRealDirectories() {
+        await Promise.all(["tasks", "results", "sessions", "artifacts", "receipts"].map((kind) => this.assertStorageDirIsRealDirectory(kind)));
+    }
+    async assertStorageDirIsRealDirectory(kind) {
+        await this.assertBridgeDirIsRealDirectory();
+        const stat = await lstat(this.dir(kind));
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Bridge storage directory .bridge/${kind} must be a real directory`);
+        }
+    }
+    async assertRecordTargetInside(kind, filePath) {
+        await this.assertStorageDirIsRealDirectory(kind);
+        const stat = await lstat(filePath);
+        if (stat.isSymbolicLink() || !stat.isFile()) {
+            throw new Error(`Bridge record path for .bridge/${kind} must be a regular file and must not be a symlink`);
+        }
+        await this.assertRealPathInsideStorageDir(kind, filePath);
+    }
+    async assertRecordTargetInsideIfExists(kind, filePath) {
+        try {
+            await this.assertRecordTargetInside(kind, filePath);
+        }
+        catch (error) {
+            const maybe = error;
+            if (maybe.code !== "ENOENT")
+                throw error;
+        }
+    }
+    async assertArtifactTargetInsideIfExists(filePath) {
+        try {
+            await this.assertArtifactTargetInside(filePath);
+        }
+        catch (error) {
+            const maybe = error;
+            if (maybe.code !== "ENOENT")
+                throw error;
+        }
+    }
+    async assertRealPathInsideArtifacts(filePath) {
+        const [realArtifacts, realTarget] = await Promise.all([realpath(this.dir("artifacts")), realpath(filePath)]);
+        const relative = path.relative(realArtifacts, realTarget);
+        if (relative.startsWith("..") || path.isAbsolute(relative)) {
+            throw new Error("Artifact path must stay under .bridge/artifacts");
+        }
+    }
+    async assertRealPathInsideStorageDir(kind, filePath) {
+        const [realStorageDir, realTarget] = await Promise.all([realpath(this.dir(kind)), realpath(filePath)]);
+        const relative = path.relative(realStorageDir, realTarget);
+        if (relative.startsWith("..") || path.isAbsolute(relative)) {
+            throw new Error(`Bridge record path must stay under .bridge/${kind}`);
+        }
+    }
+}
+function validateTaskFiles(files) {
+    for (const file of files) {
+        assertRepoRelativePath(file.path);
+    }
+    return files;
+}
+function recordNotFoundError(kind, id) {
+    const error = new Error(`${recordLabel(kind)} not found: ${id}`);
+    error.code = "ENOENT";
+    return error;
+}
+function recordCorruptError(kind, id, filePath, root, cause) {
+    assertBridgeRecordId(kind, id);
+    return new Error(`${recordLabel(kind)} record is corrupt: ${formatRecordPath(root, filePath)}. Move it aside or fix the JSON, then retry.`, {
+        cause
+    });
+}
+function untrustedResultError(root, taskId, reason) {
+    const error = new Error(`Result record is untrusted: ${formatRecordPath(root, path.join(root, ".bridge", "results", `${taskId}.json`))} ${reason}. If this is a locally signed legacy completion receipt, review .bridge/results/${taskId}.json, then run \`prodex results reseal ${taskId} --confirm-current-result\`. Retry the completion path or move the result record aside, then retry.`);
+    error.code = "EUNTRUSTED_RESULT";
+    error.taskId = taskId;
+    return error;
+}
+function formatRecordPath(root, filePath) {
+    const relative = path.relative(root, filePath);
+    if (!relative || relative.startsWith("..") || path.isAbsolute(relative))
+        return filePath;
+    return relative.split(path.sep).join("/");
+}
+function recordLabel(kind) {
+    switch (kind) {
+        case "tasks":
+            return "Task";
+        case "results":
+            return "Result";
+        case "sessions":
+            return "Session";
+        case "receipts":
+            return "Receipt";
+    }
+}
+function isErrorCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isFetchableResultArtifactPath(normalizedPath) {
+    return FETCHABLE_RESULT_ARTIFACT_PREFIXES.some((prefix) => normalizedPath.startsWith(prefix));
+}
+function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function assertFetchableResultArtifacts(artifacts) {
+    for (const artifact of artifacts) {
+        if (artifact.role !== "result")
+            continue;
+        const normalizedPath = path.posix.normalize(artifact.path.replaceAll("\\", "/"));
+        if (!isFetchableResultArtifactPath(normalizedPath) || normalizedPath !== artifact.path) {
+            throw new Error(`Artifact is not a fetchable result artifact: ${artifact.path}`);
+        }
+    }
+}
+function parseTaskRecord(expectedId, value) {
+    const task = TaskSchema.parse(value);
+    assertMatchingRecordIdentity("task", expectedId, task.id);
+    return task;
+}
+function parseResultRecord(expectedTaskId, value) {
+    const result = ResultSchema.parse(value);
+    assertMatchingRecordIdentity("result", expectedTaskId, result.task_id, "task_id");
+    return result;
+}
+function parseSessionRecord(expectedId, value) {
+    const session = SessionSchema.parse(value);
+    assertMatchingRecordIdentity("session", expectedId, session.id);
+    return session;
+}
+function parseReceiptRecord(expectedId, value) {
+    const receipt = ReceiptSchema.parse(value);
+    assertMatchingRecordIdentity("receipt", expectedId, receipt.id);
+    return receipt;
+}
+function assertMatchingRecordIdentity(kind, expectedId, actualId, field = "id") {
+    if (actualId !== expectedId) {
+        throw new Error(`${kind} ${field} ${actualId} does not match ${kind} record ${expectedId}`);
+    }
+}
+function stripReceiptIntegrity(receipt) {
+    const { integrity: _integrity, ...unsigned } = receipt;
+    return unsigned;
+}
+function assertReceiptResultDigest(receipt, result) {
+    const expected = resultDigest(result);
+    const actual = receipt.metadata?.result_sha256;
+    if (actual === undefined) {
+        throw new Error(`Receipt ${receipt.id} is missing result_sha256`);
+    }
+    if (typeof actual !== "string" || !safeHexEqual(actual, expected)) {
+        throw new Error(`Receipt ${receipt.id} does not match current result payload: result_sha256 mismatch`);
+    }
+}
+function assertLegacyCompletionReceiptCanBeResealed(receipt, result) {
+    const actual = receipt.metadata?.result_sha256;
+    if (actual === undefined)
+        return;
+    if (typeof actual === "string" && safeHexEqual(actual, resultDigest(result))) {
+        throw new Error(`Receipt ${receipt.id} already matches current result payload`);
+    }
+    throw new Error(`Receipt ${receipt.id} is not a legacy completion receipt: result_sha256 is already present`);
+}
+function resultDigest(result) {
+    return sha256(canonicalJson(result));
+}
+function canonicalJson(value) {
+    return JSON.stringify(canonicalize(value));
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map((item) => canonicalize(item));
+    if (value && typeof value === "object") {
+        const record = value;
+        const canonical = {};
+        for (const key of Object.keys(record).sort()) {
+            if (record[key] !== undefined)
+                canonical[key] = canonicalize(record[key]);
+        }
+        return canonical;
+    }
+    return value;
+}
+function safeHexEqual(left, right) {
+    if (!/^[a-f0-9]{64}$/.test(left) || !/^[a-f0-9]{64}$/.test(right))
+        return false;
+    return timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
+}
+function assertResultMatchesRetry(taskId, existing, retry) {
+    if (JSON.stringify(resultRetryFingerprint(existing)) !== JSON.stringify(resultRetryFingerprint(retry))) {
+        throw new Error(`Task ${taskId} already has a different result and cannot be finalized again`);
+    }
+}
+function terminalTaskMissingResultError(task) {
+    return new Error(`Task ${task.id} is ${task.status} but .bridge/results/${task.id}.json is missing. Restore the result file, retry with the original completion record if you have it, or move the terminal task record aside, then retry.`);
+}
+function resultRetryFingerprint(result) {
+    return {
+        task_id: result.task_id,
+        status: result.status,
+        summary: result.summary,
+        artifacts: result.artifacts.map(resultArtifactRetryFingerprint),
+        commands: result.commands,
+        warnings: result.warnings,
+        blocker: result.blocker
+    };
+}
+function resultArtifactRetryFingerprint(artifact) {
+    return {
+        path: artifact.path,
+        role: artifact.role
+    };
+}
+async function openNoFollowDirectory(dirPath, label) {
+    const noFollowFlag = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+    const directoryFlag = typeof constants.O_DIRECTORY === "number" ? constants.O_DIRECTORY : 0;
+    try {
+        const handle = await open(dirPath, constants.O_RDONLY | directoryFlag | noFollowFlag);
+        try {
+            await assertOpenDirectoryHandle(handle);
+            return handle;
+        }
+        catch (error) {
+            await handle.close().catch(() => undefined);
+            throw error;
+        }
+    }
+    catch (error) {
+        const maybe = error;
+        if (maybe.code === "ELOOP" || maybe.code === "ENOTDIR") {
+            throw new Error(`${label} must be a real directory and must not be a symlink`);
+        }
+        throw error;
+    }
+}
+async function ensurePrivateDirectory(dirPath, label) {
+    await mkdir(dirPath, { recursive: true, mode: BRIDGE_DIRECTORY_MODE });
+    await chmodPrivateDirectory(dirPath, label);
+}
+async function chmodPrivateDirectory(dirPath, label) {
+    const handle = await openNoFollowDirectory(dirPath, label);
+    try {
+        await handle.chmod(BRIDGE_DIRECTORY_MODE);
+        await assertOpenDirectoryHandle(handle);
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function assertOpenDirectoryHandle(handle) {
+    const stat = await handle.stat();
+    if (!stat.isDirectory()) {
+        throw new Error("Bridge storage directory handle must remain a real directory");
+    }
+}
+async function assertRegularFileIfExists(filePath, label) {
+    try {
+        const stat = await lstat(filePath);
+        if (stat.isSymbolicLink() || !stat.isFile()) {
+            throw new Error(`${label} must be a regular file and must not be a symlink`);
+        }
+    }
+    catch (error) {
+        const maybe = error;
+        if (maybe.code !== "ENOENT")
+            throw error;
+    }
+}
+function hasStableDirectoryFdPaths() {
+    return directoryFdPathBase() !== undefined;
+}
+function directoryFdPath(fd) {
+    const base = directoryFdPathBase();
+    if (!base) {
+        throw new Error("Bridge record writes require stable directory file descriptor paths on this platform.");
+    }
+    return `${base}/${fd}`;
+}
+function directoryFdPathBase() {
+    if (storeTestHooks.disableDirectoryFdPaths)
+        return undefined;
+    if (existsSync("/proc/self/fd"))
+        return "/proc/self/fd";
+    if (existsSync("/dev/fd"))
+        return "/dev/fd";
+    return undefined;
+}
+function assertBridgeRecordId(kind, id) {
+    if (!isBridgeRecordId(kind, id)) {
+        throw new Error(`Invalid bridge record id for ${kind}: ${id}`);
+    }
+}
+function isBridgeRecordId(kind, id) {
+    const pattern = kind === "receipts" ? RECEIPT_ID_PATTERN : kind === "sessions" ? SESSION_ID_PATTERN : TASK_ID_PATTERN;
+    return pattern.test(id);
+}
+function redactReceiptForDisplay(receipt, integrityStatus) {
+    const metadata = { ...receipt.metadata };
+    delete metadata.integrity_status;
+    if (Object.hasOwn(metadata, "new_content")) {
+        const inlineContent = metadata.new_content;
+        delete metadata.new_content;
+        metadata.new_content_redacted = {
+            reason: "legacy inline replacement content",
+            ...(typeof inlineContent === "string" ? { bytes: Buffer.byteLength(inlineContent, "utf8") } : {})
+        };
+    }
+    if (Object.hasOwn(metadata, "diff")) {
+        const diff = metadata.diff;
+        delete metadata.diff;
+        metadata.diff_redacted = {
+            reason: "write preview diff",
+            ...(typeof diff === "string" ? { bytes: Buffer.byteLength(diff, "utf8") } : {})
+        };
+    }
+    if (integrityStatus) {
+        metadata.integrity_status = integrityStatus;
+    }
+    return ReceiptSchema.parse({ ...receipt, metadata });
+}
+//# sourceMappingURL=store.js.map