botmux 2.111.0 → 2.112.0

package/dist/workflows/v3/distillation-store.js

@@ -0,0 +1,1127 @@
+/**
+ * Durable private store for Workflow v3 parameter-distillation proposals.
+ *
+ * The model-authored suggestion never reaches this module.  `proposal.json`
+ * contains only the host-compiled, parsed proposal body.  Immutable proposal
+ * material and mutable lifecycle state are deliberately separate so a state
+ * transition can never rewrite the object the user reviewed.
+ *
+ * Lock order is always identity-index -> proposal state.  The durable
+ * `replacing` index entry makes supersession recoverable without ever leaving
+ * two proposals eligible for approval.
+ */
+import { chmodSync, closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { createHash, randomBytes } from 'node:crypto';
+import { basename, dirname, join } from 'node:path';
+import { canonicalJsonStringify } from '../../utils/canonical-json.js';
+import { fsyncDirectorySyncPortable, fsyncRegularFileSync, } from '../../utils/fs-durability.js';
+import { withFileLockSync } from '../../utils/file-lock.js';
+import { SAVED_WORKFLOW_CONTENT_HASH_RE, SAVED_WORKFLOW_ID_RE, SAVED_WORKFLOW_REVISION_ID_RE, } from './library-schema.js';
+import { V3_DISTILLATION_COMPILER_VERSION, parseV3DistillationCompiledBody, } from './distillation-schema.js';
+const STORE_DIR = 'workflow-distillations';
+const PROPOSALS_DIR = 'proposals';
+const IDENTITY_INDEX_FILE = 'identity-index.json';
+const PREPARED_FILE = 'prepared.json';
+const PROPOSAL_FILE = 'proposal.json';
+const STATE_FILE = 'state.json';
+const STORE_SCHEMA_VERSION = 1;
+const PREPARED_SCHEMA_VERSION = 1;
+const PROPOSAL_SCHEMA_VERSION = 1;
+const STATE_SCHEMA_VERSION = 1;
+const INDEX_SCHEMA_VERSION = 1;
+const SHA256_RE = /^sha256:[0-9a-f]{64}$/;
+export const V3_DISTILLATION_PROPOSAL_ID_RE = /^dp_[0-9a-f]{32}$/;
+const SAFE_RUN_ID_RE = /^(?!\.\.?$)[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/;
+const ISO_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?(?:Z|[+-]\d{2}:\d{2})$/;
+const MAX_PRIVATE_JSON_BYTES = 16 * 1024 * 1024;
+const MAX_INDEX_BYTES = 4 * 1024 * 1024;
+const SAFE_ERROR_MESSAGES = {
+    INVALID_ARGUMENT: 'The distillation request is invalid.',
+    PROPOSAL_NOT_FOUND: 'The distillation proposal was not found.',
+    STORE_CORRUPT: 'The private distillation store failed integrity validation.',
+    CONTENT_CONFLICT: 'The distillation proposal content does not match its durable allocation.',
+    STATE_CONFLICT: 'The distillation proposal is not in a state that permits this operation.',
+    IDENTITY_BUSY: 'Another distillation request for this source is still in progress.',
+    STALE_PROPOSAL: 'This distillation proposal is no longer the active proposal for its source.',
+};
+/** Fixed-message error: private paths, values, and parser output are never reflected. */
+export class V3DistillationStoreError extends Error {
+    code;
+    constructor(code) {
+        super(SAFE_ERROR_MESSAGES[code]);
+        this.code = code;
+        this.name = 'V3DistillationStoreError';
+    }
+}
+function fail(code) {
+    throw new V3DistillationStoreError(code);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, i) => key === expected[i]);
+}
+function safeString(value, max = 512) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max && !value.includes('\0');
+}
+function validIso(value) {
+    return safeString(value, 128) && ISO_TIMESTAMP_RE.test(value) && Number.isFinite(Date.parse(value));
+}
+function withStoreLock(targetPath, fn) {
+    try {
+        return withFileLockSync(targetPath, fn);
+    }
+    catch (error) {
+        if (error instanceof V3DistillationStoreError)
+            throw error;
+        fail('STORE_CORRUPT');
+    }
+}
+function sha256Canonical(value) {
+    return `sha256:${createHash('sha256').update(canonicalJsonStringify(value)).digest('hex')}`;
+}
+function sameCanonical(left, right) {
+    return canonicalJsonStringify(left) === canonicalJsonStringify(right);
+}
+function normalizeSourceIdentity(raw) {
+    const keys = [
+        'runId',
+        'runEnvelopeSha256',
+        'dagSha256',
+        'specSha256',
+        'botSnapshotsSha256',
+        'baselineRevisionSha256',
+        'ownerOpenId',
+        'larkAppId',
+        'chatId',
+    ];
+    if (!isRecord(raw) || !hasExactKeys(raw, keys))
+        fail('INVALID_ARGUMENT');
+    if (typeof raw.runId !== 'string' || !SAFE_RUN_ID_RE.test(raw.runId))
+        fail('INVALID_ARGUMENT');
+    for (const key of [
+        'runEnvelopeSha256',
+        'dagSha256',
+        'specSha256',
+        'botSnapshotsSha256',
+        'baselineRevisionSha256',
+    ]) {
+        if (typeof raw[key] !== 'string' || !SHA256_RE.test(raw[key]))
+            fail('INVALID_ARGUMENT');
+    }
+    for (const key of ['ownerOpenId', 'larkAppId', 'chatId']) {
+        if (!safeString(raw[key]))
+            fail('INVALID_ARGUMENT');
+    }
+    return {
+        runId: raw.runId,
+        runEnvelopeSha256: raw.runEnvelopeSha256,
+        dagSha256: raw.dagSha256,
+        specSha256: raw.specSha256,
+        botSnapshotsSha256: raw.botSnapshotsSha256,
+        baselineRevisionSha256: raw.baselineRevisionSha256,
+        ownerOpenId: raw.ownerOpenId,
+        larkAppId: raw.larkAppId,
+        chatId: raw.chatId,
+    };
+}
+function normalizeReplyTarget(raw, sourceIdentity) {
+    if (!isRecord(raw) || typeof raw.kind !== 'string')
+        fail('INVALID_ARGUMENT');
+    if (raw.kind === 'chat') {
+        if (!hasExactKeys(raw, ['kind', 'chatId']) || !safeString(raw.chatId) ||
+            raw.chatId !== sourceIdentity.chatId)
+            fail('INVALID_ARGUMENT');
+        return { kind: 'chat', chatId: raw.chatId };
+    }
+    if (raw.kind === 'thread') {
+        if (!hasExactKeys(raw, ['kind', 'rootMessageId']) || !safeString(raw.rootMessageId)) {
+            fail('INVALID_ARGUMENT');
+        }
+        return { kind: 'thread', rootMessageId: raw.rootMessageId };
+    }
+    fail('INVALID_ARGUMENT');
+}
+export function computeV3DistillationLiveKey(sourceIdentity, compilerVersion) {
+    const normalized = normalizeSourceIdentity(sourceIdentity);
+    if (compilerVersion !== V3_DISTILLATION_COMPILER_VERSION)
+        fail('INVALID_ARGUMENT');
+    return sha256Canonical({ compilerVersion, sourceIdentity: normalized });
+}
+function proposalIdForPreparedContent(content) {
+    return `dp_${createHash('sha256').update(canonicalJsonStringify(content)).digest('hex').slice(0, 32)}`;
+}
+function parsePrepared(raw) {
+    const keys = [
+        'schemaVersion', 'proposalId', 'requestKey', 'liveKey', 'compilerVersion',
+        'sourceIdentity', 'replyTarget', 'displayName',
+    ];
+    if (!isRecord(raw) || !hasExactKeys(raw, keys))
+        fail('STORE_CORRUPT');
+    if (raw.schemaVersion !== PREPARED_SCHEMA_VERSION ||
+        typeof raw.proposalId !== 'string' || !V3_DISTILLATION_PROPOSAL_ID_RE.test(raw.proposalId) ||
+        !safeString(raw.requestKey) ||
+        typeof raw.liveKey !== 'string' || !SHA256_RE.test(raw.liveKey) ||
+        raw.compilerVersion !== V3_DISTILLATION_COMPILER_VERSION ||
+        !safeString(raw.displayName, 128))
+        fail('STORE_CORRUPT');
+    let sourceIdentity;
+    try {
+        sourceIdentity = normalizeSourceIdentity(raw.sourceIdentity);
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+    let replyTarget;
+    try {
+        replyTarget = normalizeReplyTarget(raw.replyTarget, sourceIdentity);
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+    const content = {
+        schemaVersion: PREPARED_SCHEMA_VERSION,
+        requestKey: raw.requestKey,
+        liveKey: raw.liveKey,
+        compilerVersion: raw.compilerVersion,
+        sourceIdentity,
+        replyTarget,
+        displayName: raw.displayName.normalize('NFC'),
+    };
+    if (raw.displayName !== content.displayName ||
+        computeV3DistillationLiveKey(sourceIdentity, raw.compilerVersion) !== raw.liveKey ||
+        proposalIdForPreparedContent(content) !== raw.proposalId)
+        fail('STORE_CORRUPT');
+    return { ...content, proposalId: raw.proposalId };
+}
+function proposalHashMaterial(value) {
+    return value;
+}
+function parseProposal(raw, prepared) {
+    const keys = [
+        'schemaVersion', 'proposalId', 'proposalHash', 'liveKey', 'compilerVersion',
+        'sourceIdentity', 'displayName', 'createdAt', 'compiled',
+    ];
+    if (!isRecord(raw) || !hasExactKeys(raw, keys))
+        fail('STORE_CORRUPT');
+    if (raw.schemaVersion !== PROPOSAL_SCHEMA_VERSION ||
+        raw.proposalId !== prepared.proposalId ||
+        typeof raw.proposalHash !== 'string' || !SHA256_RE.test(raw.proposalHash) ||
+        raw.liveKey !== prepared.liveKey ||
+        raw.compilerVersion !== prepared.compilerVersion ||
+        raw.displayName !== prepared.displayName ||
+        !validIso(raw.createdAt))
+        fail('STORE_CORRUPT');
+    let sourceIdentity;
+    let compiled;
+    try {
+        sourceIdentity = normalizeSourceIdentity(raw.sourceIdentity);
+        compiled = parseV3DistillationCompiledBody(raw.compiled);
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+    if (!sameCanonical(sourceIdentity, prepared.sourceIdentity) ||
+        compiled.compilerVersion !== prepared.compilerVersion ||
+        compiled.baselineRevisionSha256 !== sourceIdentity.baselineRevisionSha256)
+        fail('STORE_CORRUPT');
+    const material = proposalHashMaterial({
+        schemaVersion: PROPOSAL_SCHEMA_VERSION,
+        proposalId: prepared.proposalId,
+        liveKey: prepared.liveKey,
+        compilerVersion: prepared.compilerVersion,
+        sourceIdentity,
+        displayName: prepared.displayName,
+        createdAt: raw.createdAt,
+        compiled,
+    });
+    if (sha256Canonical(material) !== raw.proposalHash)
+        fail('STORE_CORRUPT');
+    return { ...material, proposalHash: raw.proposalHash };
+}
+function parseActor(raw, kind) {
+    const timestampKey = kind === 'approval' ? 'acceptedAt' : 'rejectedAt';
+    const keys = ['operatorOpenId', 'larkAppId', 'chatId', timestampKey];
+    if (!isRecord(raw) || !hasExactKeys(raw, keys))
+        fail('STORE_CORRUPT');
+    if (!safeString(raw.operatorOpenId) || !safeString(raw.larkAppId) || !safeString(raw.chatId) ||
+        !validIso(raw[timestampKey]))
+        fail('STORE_CORRUPT');
+    return {
+        operatorOpenId: raw.operatorOpenId,
+        larkAppId: raw.larkAppId,
+        chatId: raw.chatId,
+        [timestampKey]: raw[timestampKey],
+    };
+}
+function parseCommitAllocation(raw) {
+    if (!isRecord(raw) || !hasExactKeys(raw, ['workflowId', 'createdAt', 'startedAt']))
+        fail('STORE_CORRUPT');
+    if (typeof raw.workflowId !== 'string' || !SAVED_WORKFLOW_ID_RE.test(raw.workflowId) ||
+        !validIso(raw.createdAt) || !validIso(raw.startedAt))
+        fail('STORE_CORRUPT');
+    return { workflowId: raw.workflowId, createdAt: raw.createdAt, startedAt: raw.startedAt };
+}
+function parseCommitResult(raw) {
+    if (!isRecord(raw))
+        fail('STORE_CORRUPT');
+    const keys = raw.revisionContentHash === undefined
+        ? ['workflowId', 'revisionId', 'committedAt']
+        : ['workflowId', 'revisionId', 'revisionContentHash', 'committedAt'];
+    if (!hasExactKeys(raw, keys))
+        fail('STORE_CORRUPT');
+    if (typeof raw.workflowId !== 'string' || !SAVED_WORKFLOW_ID_RE.test(raw.workflowId) ||
+        typeof raw.revisionId !== 'string' || !SAVED_WORKFLOW_REVISION_ID_RE.test(raw.revisionId) ||
+        (raw.revisionContentHash !== undefined &&
+            (typeof raw.revisionContentHash !== 'string' || !SAVED_WORKFLOW_CONTENT_HASH_RE.test(raw.revisionContentHash))) ||
+        !validIso(raw.committedAt))
+        fail('STORE_CORRUPT');
+    return {
+        workflowId: raw.workflowId,
+        revisionId: raw.revisionId,
+        ...(typeof raw.revisionContentHash === 'string' ? { revisionContentHash: raw.revisionContentHash } : {}),
+        committedAt: raw.committedAt,
+    };
+}
+function parseState(raw, prepared) {
+    if (!isRecord(raw))
+        fail('STORE_CORRUPT');
+    const state = raw.state;
+    if (!['prepared', 'proposed', 'accepted', 'committing', 'committed', 'rejected', 'superseded'].includes(String(state))) {
+        fail('STORE_CORRUPT');
+    }
+    const common = ['schemaVersion', 'proposalId', 'liveKey', 'state', 'preparedAt', 'updatedAt'];
+    const extraByState = {
+        prepared: [],
+        proposed: ['proposalHash', 'proposedAt'],
+        accepted: ['proposalHash', 'proposedAt', 'approval'],
+        committing: ['proposalHash', 'proposedAt', 'approval', 'commit'],
+        committed: ['proposalHash', 'proposedAt', 'approval', 'commit', 'result'],
+        rejected: ['proposalHash', 'proposedAt', 'rejection'],
+        superseded: ['proposalHash', 'proposedAt', 'supersededByProposalId', 'supersededAt'],
+    };
+    if (!hasExactKeys(raw, [...common, ...extraByState[String(state)]]))
+        fail('STORE_CORRUPT');
+    if (raw.schemaVersion !== STATE_SCHEMA_VERSION ||
+        raw.proposalId !== prepared.proposalId || raw.liveKey !== prepared.liveKey ||
+        !validIso(raw.preparedAt) || !validIso(raw.updatedAt))
+        fail('STORE_CORRUPT');
+    const base = {
+        schemaVersion: STATE_SCHEMA_VERSION,
+        proposalId: prepared.proposalId,
+        liveKey: prepared.liveKey,
+        preparedAt: raw.preparedAt,
+        updatedAt: raw.updatedAt,
+    };
+    if (state === 'prepared')
+        return { ...base, state };
+    if (typeof raw.proposalHash !== 'string' || !SHA256_RE.test(raw.proposalHash) ||
+        !validIso(raw.proposedAt))
+        fail('STORE_CORRUPT');
+    const proposalFields = { proposalHash: raw.proposalHash, proposedAt: raw.proposedAt };
+    if (state === 'proposed')
+        return { ...base, state, ...proposalFields };
+    if (state === 'accepted') {
+        return { ...base, state, ...proposalFields, approval: parseActor(raw.approval, 'approval') };
+    }
+    if (state === 'rejected') {
+        return { ...base, state, ...proposalFields, rejection: parseActor(raw.rejection, 'rejection') };
+    }
+    if (state === 'superseded') {
+        if (typeof raw.supersededByProposalId !== 'string' ||
+            !V3_DISTILLATION_PROPOSAL_ID_RE.test(raw.supersededByProposalId) ||
+            !validIso(raw.supersededAt))
+            fail('STORE_CORRUPT');
+        return {
+            ...base,
+            state,
+            ...proposalFields,
+            supersededByProposalId: raw.supersededByProposalId,
+            supersededAt: raw.supersededAt,
+        };
+    }
+    const approval = parseActor(raw.approval, 'approval');
+    const commit = parseCommitAllocation(raw.commit);
+    if (state === 'committing')
+        return { ...base, state, ...proposalFields, approval, commit };
+    const result = parseCommitResult(raw.result);
+    if (result.workflowId !== commit.workflowId)
+        fail('STORE_CORRUPT');
+    return { ...base, state: 'committed', ...proposalFields, approval, commit, result };
+}
+function emptyIndex() {
+    return { schemaVersion: INDEX_SCHEMA_VERSION, entries: Object.create(null) };
+}
+function parseIndex(raw) {
+    if (!isRecord(raw) || !hasExactKeys(raw, ['schemaVersion', 'entries']) || raw.schemaVersion !== INDEX_SCHEMA_VERSION || !isRecord(raw.entries)) {
+        fail('STORE_CORRUPT');
+    }
+    const entries = Object.create(null);
+    for (const [key, value] of Object.entries(raw.entries)) {
+        if (!SHA256_RE.test(key) || !isRecord(value))
+            fail('STORE_CORRUPT');
+        if (value.state === 'active') {
+            if (!hasExactKeys(value, ['state', 'proposalId']) || typeof value.proposalId !== 'string' || !V3_DISTILLATION_PROPOSAL_ID_RE.test(value.proposalId)) {
+                fail('STORE_CORRUPT');
+            }
+            entries[key] = { state: 'active', proposalId: value.proposalId };
+        }
+        else if (value.state === 'replacing') {
+            const keys = value.previousProposalId === undefined
+                ? ['state', 'proposalId', 'prepared', 'preparedAt']
+                : ['state', 'proposalId', 'prepared', 'preparedAt', 'previousProposalId'];
+            let prepared;
+            try {
+                prepared = parsePrepared(value.prepared);
+            }
+            catch {
+                fail('STORE_CORRUPT');
+            }
+            if (!hasExactKeys(value, keys) || typeof value.proposalId !== 'string' ||
+                !V3_DISTILLATION_PROPOSAL_ID_RE.test(value.proposalId) ||
+                value.proposalId !== prepared.proposalId || prepared.liveKey !== key ||
+                !validIso(value.preparedAt) ||
+                (value.previousProposalId !== undefined &&
+                    (typeof value.previousProposalId !== 'string' ||
+                        !V3_DISTILLATION_PROPOSAL_ID_RE.test(value.previousProposalId) ||
+                        value.previousProposalId === value.proposalId)))
+                fail('STORE_CORRUPT');
+            entries[key] = {
+                state: 'replacing',
+                proposalId: value.proposalId,
+                prepared,
+                preparedAt: value.preparedAt,
+                ...(typeof value.previousProposalId === 'string' ? { previousProposalId: value.previousProposalId } : {}),
+            };
+        }
+        else {
+            fail('STORE_CORRUPT');
+        }
+    }
+    return { schemaVersion: INDEX_SCHEMA_VERSION, entries };
+}
+export function v3DistillationStoreRoot(dataDir) {
+    if (!safeString(dataDir, 4096))
+        fail('INVALID_ARGUMENT');
+    return join(dataDir, STORE_DIR);
+}
+export function v3DistillationProposalDir(dataDir, proposalId) {
+    if (!V3_DISTILLATION_PROPOSAL_ID_RE.test(proposalId))
+        fail('INVALID_ARGUMENT');
+    return join(v3DistillationStoreRoot(dataDir), PROPOSALS_DIR, proposalId);
+}
+function preparedPath(dataDir, proposalId) {
+    return join(v3DistillationProposalDir(dataDir, proposalId), PREPARED_FILE);
+}
+function proposalPath(dataDir, proposalId) {
+    return join(v3DistillationProposalDir(dataDir, proposalId), PROPOSAL_FILE);
+}
+function statePath(dataDir, proposalId) {
+    return join(v3DistillationProposalDir(dataDir, proposalId), STATE_FILE);
+}
+function indexPath(dataDir) {
+    return join(v3DistillationStoreRoot(dataDir), IDENTITY_INDEX_FILE);
+}
+function assertPrivateDirectory(path) {
+    let stat;
+    try {
+        stat = lstatSync(path);
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        fail('STORE_CORRUPT');
+    if (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o700)
+        fail('STORE_CORRUPT');
+}
+function ensurePrivateDirectory(path, recursive = false) {
+    if (existsSync(path)) {
+        assertPrivateDirectory(path);
+        return;
+    }
+    try {
+        mkdirSync(path, { recursive, mode: 0o700 });
+        if (process.platform !== 'win32')
+            chmodSync(path, 0o700);
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+    assertPrivateDirectory(path);
+    try {
+        fsyncDirectorySyncPortable(dirname(path));
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+}
+function ensureStore(dataDir) {
+    const root = v3DistillationStoreRoot(dataDir);
+    ensurePrivateDirectory(root, true);
+    ensurePrivateDirectory(join(root, PROPOSALS_DIR));
+}
+function assertPrivateRegularFile(path) {
+    let stat;
+    try {
+        stat = lstatSync(path);
+        if (stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 2 &&
+            (basename(path) === PREPARED_FILE || basename(path) === PROPOSAL_FILE)) {
+            // Immutable publication is link(temp,target) -> unlink(temp). A process
+            // crash between those syscalls leaves two names for the same already-
+            // fsynced inode. Recover only the writer-owned, exact temp-name shape in
+            // the same private directory; any other hard link remains corruption.
+            const parent = dirname(path);
+            const escaped = basename(path).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            const tempName = new RegExp(`^\\.${escaped}\\.[0-9]+\\.[0-9a-f]{16}\\.tmp$`);
+            const targetDev = stat.dev;
+            const targetIno = stat.ino;
+            const aliases = readdirSync(parent).filter((name) => {
+                if (!tempName.test(name))
+                    return false;
+                try {
+                    const alias = lstatSync(join(parent, name));
+                    return alias.isFile() && !alias.isSymbolicLink() &&
+                        alias.dev === targetDev && alias.ino === targetIno && alias.nlink === 2;
+                }
+                catch {
+                    return false;
+                }
+            });
+            if (aliases.length !== 1)
+                fail('STORE_CORRUPT');
+            unlinkSync(join(parent, aliases[0]));
+            fsyncDirectorySyncPortable(parent);
+            stat = lstatSync(path);
+        }
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
+        fail('STORE_CORRUPT');
+    if (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600)
+        fail('STORE_CORRUPT');
+}
+function readPrivateJson(path, maxBytes = MAX_PRIVATE_JSON_BYTES) {
+    assertPrivateRegularFile(path);
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const before = lstatSync(path);
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || before.dev !== opened.dev || before.ino !== opened.ino ||
+            opened.nlink !== 1 || opened.size > maxBytes)
+            fail('STORE_CORRUPT');
+        const bytes = readFileSync(fd);
+        const after = fstatSync(fd);
+        if (after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size ||
+            after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
+            fail('STORE_CORRUPT');
+        try {
+            return JSON.parse(bytes.toString('utf-8'));
+        }
+        catch {
+            fail('STORE_CORRUPT');
+        }
+    }
+    catch (error) {
+        if (error instanceof V3DistillationStoreError)
+            throw error;
+        fail('STORE_CORRUPT');
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+function writePrivateTemp(path, bytes) {
+    const parent = dirname(path);
+    const temp = join(parent, `.${basename(path)}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+    let fd;
+    try {
+        fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+        fchmodSync(fd, 0o600);
+        writeFileSync(fd, bytes, 'utf-8');
+        fsyncSync(fd);
+        return { temp, fd };
+    }
+    catch {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+        try {
+            unlinkSync(temp);
+        }
+        catch { /* best effort */ }
+        fail('STORE_CORRUPT');
+    }
+}
+function writeMutablePrivateJson(path, value, maxBytes = MAX_PRIVATE_JSON_BYTES) {
+    const bytes = `${canonicalJsonStringify(value)}\n`;
+    if (Buffer.byteLength(bytes) > maxBytes)
+        fail('INVALID_ARGUMENT');
+    if (existsSync(path))
+        assertPrivateRegularFile(path);
+    const { temp, fd } = writePrivateTemp(path, bytes);
+    let renamed = false;
+    try {
+        closeSync(fd);
+        renameSync(temp, path);
+        renamed = true;
+        assertPrivateRegularFile(path);
+        fsyncDirectorySyncPortable(dirname(path));
+    }
+    catch (error) {
+        if (error instanceof V3DistillationStoreError)
+            throw error;
+        fail('STORE_CORRUPT');
+    }
+    finally {
+        if (!renamed) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* already closed */ }
+            try {
+                unlinkSync(temp);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+function writeImmutablePrivateJson(path, value) {
+    const bytes = `${canonicalJsonStringify(value)}\n`;
+    if (Buffer.byteLength(bytes) > MAX_PRIVATE_JSON_BYTES)
+        fail('INVALID_ARGUMENT');
+    if (existsSync(path)) {
+        const existing = readPrivateJson(path);
+        if (!sameCanonical(existing, value))
+            fail('CONTENT_CONFLICT');
+        fsyncRegularFileSync(path);
+        fsyncDirectorySyncPortable(dirname(path));
+        return;
+    }
+    const { temp, fd } = writePrivateTemp(path, bytes);
+    let linked = false;
+    try {
+        closeSync(fd);
+        try {
+            linkSync(temp, path);
+            linked = true;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            const existing = readPrivateJson(path);
+            if (!sameCanonical(existing, value))
+                fail('CONTENT_CONFLICT');
+        }
+        // Persist the new target name before removing the already-fsynced temp
+        // name. A crash before unlink is recoverable as the recognized nlink=2
+        // writer-temp shape; unlink-before-fsync could instead lose both evidence
+        // of the target publication on power loss.
+        fsyncDirectorySyncPortable(dirname(path));
+        unlinkSync(temp);
+        assertPrivateRegularFile(path);
+        fsyncRegularFileSync(path);
+        fsyncDirectorySyncPortable(dirname(path));
+    }
+    catch (error) {
+        if (error instanceof V3DistillationStoreError)
+            throw error;
+        fail('STORE_CORRUPT');
+    }
+    finally {
+        if (linked && existsSync(temp)) {
+            try {
+                unlinkSync(temp);
+            }
+            catch { /* best effort */ }
+        }
+        else {
+            try {
+                closeSync(fd);
+            }
+            catch { /* already closed */ }
+            try {
+                unlinkSync(temp);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+function readIndex(dataDir) {
+    const path = indexPath(dataDir);
+    if (!existsSync(path))
+        return emptyIndex();
+    return parseIndex(readPrivateJson(path, MAX_INDEX_BYTES));
+}
+function writeIndex(dataDir, index) {
+    writeMutablePrivateJson(indexPath(dataDir), parseIndex(index), MAX_INDEX_BYTES);
+}
+function loadProposalUnlocked(dataDir, proposalId) {
+    const dir = v3DistillationProposalDir(dataDir, proposalId);
+    if (!existsSync(dir))
+        fail('PROPOSAL_NOT_FOUND');
+    assertPrivateDirectory(dir);
+    const prepared = parsePrepared(readPrivateJson(preparedPath(dataDir, proposalId)));
+    const state = parseState(readPrivateJson(statePath(dataDir, proposalId)), prepared);
+    let proposal;
+    if (existsSync(proposalPath(dataDir, proposalId))) {
+        proposal = parseProposal(readPrivateJson(proposalPath(dataDir, proposalId)), prepared);
+    }
+    // Publishing spans two durable files. A crash may leave the immutable body
+    // installed while state is still `prepared`; publishProposal recognizes and
+    // completes that one safe forward-recovery shape. Missing body after any
+    // later state remains an integrity failure.
+    if (state.state !== 'prepared' && (!proposal || proposal.proposalHash !== state.proposalHash ||
+        proposal.createdAt !== state.preparedAt)) {
+        fail('STORE_CORRUPT');
+    }
+    if (state.state === 'prepared' && proposal && proposal.createdAt !== state.preparedAt) {
+        fail('STORE_CORRUPT');
+    }
+    return { prepared, ...(proposal ? { proposal } : {}), state };
+}
+function writeState(dataDir, state) {
+    const prepared = parsePrepared(readPrivateJson(preparedPath(dataDir, state.proposalId)));
+    writeMutablePrivateJson(statePath(dataDir, state.proposalId), parseState(state, prepared));
+}
+function createOrRecoverPrepared(dataDir, prepared, preparedAt) {
+    const dir = v3DistillationProposalDir(dataDir, prepared.proposalId);
+    if (!existsSync(dir)) {
+        try {
+            mkdirSync(dir, { mode: 0o700 });
+            if (process.platform !== 'win32')
+                chmodSync(dir, 0o700);
+            fsyncDirectorySyncPortable(dirname(dir));
+        }
+        catch {
+            fail('STORE_CORRUPT');
+        }
+    }
+    assertPrivateDirectory(dir);
+    writeImmutablePrivateJson(preparedPath(dataDir, prepared.proposalId), prepared);
+    const path = statePath(dataDir, prepared.proposalId);
+    if (!existsSync(path)) {
+        writeMutablePrivateJson(path, {
+            schemaVersion: STATE_SCHEMA_VERSION,
+            proposalId: prepared.proposalId,
+            liveKey: prepared.liveKey,
+            state: 'prepared',
+            preparedAt,
+            updatedAt: preparedAt,
+        });
+    }
+    const loaded = loadProposalUnlocked(dataDir, prepared.proposalId);
+    if (!sameCanonical(loaded.prepared, prepared))
+        fail('CONTENT_CONFLICT');
+    return loaded;
+}
+/**
+ * Complete the transaction whose intent is already durable in the identity
+ * index. The entry carries the exact immutable allocation so recovery never
+ * depends on another delivery of the original Lark event.
+ *
+ * Caller owns the identity-index lock. Lock order remains index -> state.
+ */
+function recoverReplacingEntryUnlocked(dataDir, index, liveKey, entry) {
+    if (entry.prepared.liveKey !== liveKey ||
+        entry.prepared.proposalId !== entry.proposalId)
+        fail('STORE_CORRUPT');
+    const loaded = createOrRecoverPrepared(dataDir, entry.prepared, entry.preparedAt);
+    if (entry.previousProposalId) {
+        withStoreLock(statePath(dataDir, entry.previousProposalId), () => {
+            const previous = loadProposalUnlocked(dataDir, entry.previousProposalId);
+            if (previous.prepared.liveKey !== liveKey)
+                fail('STORE_CORRUPT');
+            if (previous.state.state === 'proposed') {
+                writeState(dataDir, {
+                    ...previous.state,
+                    state: 'superseded',
+                    supersededByProposalId: entry.proposalId,
+                    supersededAt: entry.preparedAt,
+                    updatedAt: entry.preparedAt,
+                });
+            }
+            else if (previous.state.state !== 'superseded' ||
+                previous.state.supersededByProposalId !== entry.proposalId) {
+                fail('STATE_CONFLICT');
+            }
+        });
+    }
+    index.entries[liveKey] = { state: 'active', proposalId: entry.proposalId };
+    writeIndex(dataDir, index);
+    return loaded;
+}
+function withCurrentProposalLock(dataDir, proposalId, fn) {
+    ensureStore(dataDir);
+    const identityTarget = indexPath(dataDir);
+    return withStoreLock(identityTarget, () => {
+        const prepared = parsePrepared(readPrivateJson(preparedPath(dataDir, proposalId)));
+        const index = readIndex(dataDir);
+        const entry = index.entries[prepared.liveKey];
+        return withStoreLock(statePath(dataDir, proposalId), () => {
+            const loaded = loadProposalUnlocked(dataDir, proposalId);
+            if (!entry || entry.state !== 'active' || entry.proposalId !== proposalId) {
+                return fnStaleIdempotentGuard(loaded, fn);
+            }
+            const result = fn(loaded);
+            const after = loadProposalUnlocked(dataDir, proposalId);
+            if (after.state.state === 'committed' || after.state.state === 'rejected') {
+                const current = index.entries[prepared.liveKey];
+                if (current?.state === 'active' && current.proposalId === proposalId) {
+                    delete index.entries[prepared.liveKey];
+                    writeIndex(dataDir, index);
+                }
+            }
+            return result;
+        });
+    });
+}
+/**
+ * A stale proposal may only acknowledge an already-approved commit recovery or
+ * a duplicate terminal transition. The callback decides this by returning
+ * normally; all non-idempotent stale attempts must throw from inside it.
+ */
+function fnStaleIdempotentGuard(loaded, fn) {
+    if (!['accepted', 'committing', 'rejected', 'superseded', 'committed'].includes(loaded.state.state)) {
+        fail('STALE_PROPOSAL');
+    }
+    return fn(loaded);
+}
+/** Prepare or idempotently recover a per-request proposal allocation. */
+export function prepareProposal(dataDir, input) {
+    ensureStore(dataDir);
+    if (!safeString(input.requestKey) || !safeString(input.displayName, 128) ||
+        input.displayName !== input.displayName.trim() || input.displayName !== input.displayName.normalize('NFC') ||
+        input.compilerVersion !== V3_DISTILLATION_COMPILER_VERSION)
+        fail('INVALID_ARGUMENT');
+    const sourceIdentity = normalizeSourceIdentity(input.sourceIdentity);
+    const replyTarget = normalizeReplyTarget(input.replyTarget, sourceIdentity);
+    const liveKey = computeV3DistillationLiveKey(sourceIdentity, input.compilerVersion);
+    const content = {
+        schemaVersion: PREPARED_SCHEMA_VERSION,
+        requestKey: input.requestKey,
+        liveKey,
+        compilerVersion: input.compilerVersion,
+        sourceIdentity,
+        replyTarget,
+        displayName: input.displayName,
+    };
+    const proposalId = proposalIdForPreparedContent(content);
+    const prepared = parsePrepared({ ...content, proposalId });
+    const preparedAt = (input.now ?? new Date()).toISOString();
+    if (!validIso(preparedAt))
+        fail('INVALID_ARGUMENT');
+    const target = indexPath(dataDir);
+    return withStoreLock(target, () => {
+        const index = readIndex(dataDir);
+        let existingEntry = index.entries[liveKey];
+        if (existingEntry?.state === 'replacing') {
+            const recovered = recoverReplacingEntryUnlocked(dataDir, index, liveKey, existingEntry);
+            if (existingEntry.proposalId === proposalId) {
+                if (!sameCanonical(recovered.prepared, prepared))
+                    fail('CONTENT_CONFLICT');
+                return recovered;
+            }
+            // Finish the older durable transaction before evaluating this new
+            // request. From here onward the normal active-entry rules decide whether
+            // to resume it, supersede it, or reject a conflicting redelivery.
+            existingEntry = index.entries[liveKey];
+        }
+        if (existingEntry?.proposalId === proposalId) {
+            const loaded = loadProposalUnlocked(dataDir, proposalId);
+            if (!sameCanonical(loaded.prepared, prepared))
+                fail('CONTENT_CONFLICT');
+            return loaded;
+        }
+        // A content-addressed allocation that already exists but is no longer the
+        // live index target is an old delivery, not a new request.  In particular:
+        // A proposed -> B proposed (A superseded) -> delayed redelivery of A must
+        // never reactivate A or supersede B.  The only legitimate adoption of an
+        // already-created replacement is handled by the `replacing` recovery arm
+        // above, where the index already names that exact proposal id.
+        if (existsSync(preparedPath(dataDir, proposalId))) {
+            withStoreLock(statePath(dataDir, proposalId), () => {
+                const stale = loadProposalUnlocked(dataDir, proposalId);
+                if (!sameCanonical(stale.prepared, prepared))
+                    fail('CONTENT_CONFLICT');
+                fail('STALE_PROPOSAL');
+            });
+        }
+        let previousProposalId;
+        if (existingEntry) {
+            const previous = loadProposalUnlocked(dataDir, existingEntry.proposalId);
+            if (previous.prepared.requestKey === input.requestKey) {
+                // The same inbound event must never allocate or supersede a second body.
+                fail('CONTENT_CONFLICT');
+            }
+            // A distinct inbound event always owns a fresh immutable reply target.
+            // Reusing an older same-name allocation would let crash recovery post a
+            // review card into the previous thread (and its deterministic delivery
+            // UUID could suppress the new reply). Exact redelivery is already handled
+            // by the content-addressed proposalId arm above; every genuinely new
+            // request replaces prepared/proposed work instead of mutating it.
+            if (previous.state.state === 'accepted' || previous.state.state === 'committing') {
+                fail('IDENTITY_BUSY');
+            }
+            if (previous.state.state === 'proposed')
+                previousProposalId = previous.prepared.proposalId;
+        }
+        index.entries[liveKey] = {
+            state: 'replacing',
+            proposalId,
+            prepared,
+            preparedAt,
+            ...(previousProposalId ? { previousProposalId } : {}),
+        };
+        writeIndex(dataDir, index);
+        const loaded = createOrRecoverPrepared(dataDir, prepared, preparedAt);
+        if (previousProposalId) {
+            withStoreLock(statePath(dataDir, previousProposalId), () => {
+                const previous = loadProposalUnlocked(dataDir, previousProposalId);
+                if (previous.state.state !== 'proposed')
+                    fail('STATE_CONFLICT');
+                writeState(dataDir, {
+                    ...previous.state,
+                    state: 'superseded',
+                    supersededByProposalId: proposalId,
+                    supersededAt: preparedAt,
+                    updatedAt: preparedAt,
+                });
+            });
+        }
+        index.entries[liveKey] = { state: 'active', proposalId };
+        writeIndex(dataDir, index);
+        return loaded;
+    });
+}
+/** Publish the immutable host-compiled proposal and enter `proposed`. */
+export function publishProposal(dataDir, proposalId, input) {
+    return withCurrentProposalLock(dataDir, proposalId, (loaded) => {
+        const compiled = parseV3DistillationCompiledBody(input.compiled);
+        if (compiled.compilerVersion !== loaded.prepared.compilerVersion ||
+            compiled.baselineRevisionSha256 !== loaded.prepared.sourceIdentity.baselineRevisionSha256)
+            fail('CONTENT_CONFLICT');
+        const createdAt = loaded.state.preparedAt;
+        const material = proposalHashMaterial({
+            schemaVersion: PROPOSAL_SCHEMA_VERSION,
+            proposalId,
+            liveKey: loaded.prepared.liveKey,
+            compilerVersion: loaded.prepared.compilerVersion,
+            sourceIdentity: loaded.prepared.sourceIdentity,
+            displayName: loaded.prepared.displayName,
+            createdAt,
+            compiled,
+        });
+        const body = parseProposal({ ...material, proposalHash: sha256Canonical(material) }, loaded.prepared);
+        if (loaded.proposal) {
+            if (!sameCanonical(loaded.proposal, body))
+                fail('CONTENT_CONFLICT');
+            writeImmutablePrivateJson(proposalPath(dataDir, proposalId), body);
+            if (loaded.state.state === 'prepared') {
+                const now = (input.now ?? new Date()).toISOString();
+                writeState(dataDir, {
+                    ...loaded.state,
+                    state: 'proposed',
+                    proposalHash: body.proposalHash,
+                    proposedAt: now,
+                    updatedAt: now,
+                });
+                return loadProposalUnlocked(dataDir, proposalId);
+            }
+            return loaded;
+        }
+        if (loaded.state.state !== 'prepared')
+            fail('STATE_CONFLICT');
+        writeImmutablePrivateJson(proposalPath(dataDir, proposalId), body);
+        const now = (input.now ?? new Date()).toISOString();
+        writeState(dataDir, {
+            ...loaded.state,
+            state: 'proposed',
+            proposalHash: body.proposalHash,
+            proposedAt: now,
+            updatedAt: now,
+        });
+        return loadProposalUnlocked(dataDir, proposalId);
+    });
+}
+function assertProposalHash(loaded, proposalHash) {
+    if (!SHA256_RE.test(proposalHash) || loaded.proposal?.proposalHash !== proposalHash)
+        fail('CONTENT_CONFLICT');
+}
+function sameActor(actor, input) {
+    return actor.operatorOpenId === input.operatorOpenId &&
+        actor.larkAppId === input.larkAppId && actor.chatId === input.chatId;
+}
+export function acceptProposal(dataDir, proposalId, input) {
+    return withCurrentProposalLock(dataDir, proposalId, (loaded) => {
+        assertProposalHash(loaded, input.proposalHash);
+        if (loaded.state.state === 'accepted' || loaded.state.state === 'committing' || loaded.state.state === 'committed') {
+            if (!sameActor(loaded.state.approval, input))
+                fail('CONTENT_CONFLICT');
+            return loaded;
+        }
+        if (loaded.state.state !== 'proposed')
+            fail('STATE_CONFLICT');
+        const now = (input.now ?? new Date()).toISOString();
+        writeState(dataDir, {
+            ...loaded.state,
+            state: 'accepted',
+            approval: {
+                operatorOpenId: input.operatorOpenId,
+                larkAppId: input.larkAppId,
+                chatId: input.chatId,
+                acceptedAt: now,
+            },
+            updatedAt: now,
+        });
+        return loadProposalUnlocked(dataDir, proposalId);
+    });
+}
+export function rejectProposal(dataDir, proposalId, input) {
+    return withCurrentProposalLock(dataDir, proposalId, (loaded) => {
+        assertProposalHash(loaded, input.proposalHash);
+        if (loaded.state.state === 'rejected') {
+            if (!sameActor(loaded.state.rejection, input))
+                fail('CONTENT_CONFLICT');
+            return loaded;
+        }
+        if (loaded.state.state !== 'proposed')
+            fail('STATE_CONFLICT');
+        const now = (input.now ?? new Date()).toISOString();
+        writeState(dataDir, {
+            ...loaded.state,
+            state: 'rejected',
+            rejection: {
+                operatorOpenId: input.operatorOpenId,
+                larkAppId: input.larkAppId,
+                chatId: input.chatId,
+                rejectedAt: now,
+            },
+            updatedAt: now,
+        });
+        return loadProposalUnlocked(dataDir, proposalId);
+    });
+}
+export function beginCommit(dataDir, proposalId, input) {
+    return withCurrentProposalLock(dataDir, proposalId, (loaded) => {
+        assertProposalHash(loaded, input.proposalHash);
+        if (!SAVED_WORKFLOW_ID_RE.test(input.workflowId) || !validIso(input.createdAt))
+            fail('INVALID_ARGUMENT');
+        if (loaded.state.state === 'committing' || loaded.state.state === 'committed') {
+            if (loaded.state.commit.workflowId !== input.workflowId || loaded.state.commit.createdAt !== input.createdAt) {
+                fail('CONTENT_CONFLICT');
+            }
+            return loaded;
+        }
+        if (loaded.state.state !== 'accepted')
+            fail('STATE_CONFLICT');
+        const now = (input.now ?? new Date()).toISOString();
+        writeState(dataDir, {
+            ...loaded.state,
+            state: 'committing',
+            commit: { workflowId: input.workflowId, createdAt: input.createdAt, startedAt: now },
+            updatedAt: now,
+        });
+        return loadProposalUnlocked(dataDir, proposalId);
+    });
+}
+export function markCommitted(dataDir, proposalId, input) {
+    return withCurrentProposalLock(dataDir, proposalId, (loaded) => {
+        assertProposalHash(loaded, input.proposalHash);
+        if (!SAVED_WORKFLOW_ID_RE.test(input.workflowId) ||
+            !SAVED_WORKFLOW_REVISION_ID_RE.test(input.revisionId) ||
+            (input.revisionContentHash !== undefined && !SAVED_WORKFLOW_CONTENT_HASH_RE.test(input.revisionContentHash)))
+            fail('INVALID_ARGUMENT');
+        if (loaded.state.state === 'committed') {
+            if (loaded.state.result.workflowId !== input.workflowId ||
+                loaded.state.result.revisionId !== input.revisionId ||
+                loaded.state.result.revisionContentHash !== input.revisionContentHash)
+                fail('CONTENT_CONFLICT');
+            return loaded;
+        }
+        if (loaded.state.state !== 'committing' || loaded.state.commit.workflowId !== input.workflowId) {
+            fail('STATE_CONFLICT');
+        }
+        const now = (input.now ?? new Date()).toISOString();
+        writeState(dataDir, {
+            ...loaded.state,
+            state: 'committed',
+            result: {
+                workflowId: input.workflowId,
+                revisionId: input.revisionId,
+                ...(input.revisionContentHash ? { revisionContentHash: input.revisionContentHash } : {}),
+                committedAt: now,
+            },
+            updatedAt: now,
+        });
+        return loadProposalUnlocked(dataDir, proposalId);
+    });
+}
+export function loadProposal(dataDir, proposalId) {
+    ensureStore(dataDir);
+    return loadProposalUnlocked(dataDir, proposalId);
+}
+/** Strict startup inventory for crash recovery. Unknown entries fail closed. */
+export function listV3DistillationProposals(dataDir) {
+    ensureStore(dataDir);
+    const root = join(v3DistillationStoreRoot(dataDir), PROPOSALS_DIR);
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true, encoding: 'utf8' });
+    }
+    catch {
+        fail('STORE_CORRUPT');
+    }
+    const ids = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink() || !V3_DISTILLATION_PROPOSAL_ID_RE.test(entry.name)) {
+            fail('STORE_CORRUPT');
+        }
+        ids.push(entry.name);
+    }
+    ids.sort();
+    return ids.map((proposalId) => loadProposalUnlocked(dataDir, proposalId));
+}
+/** Current active allocations only; used by daemon cold recovery. */
+export function listActiveV3DistillationProposals(dataDir) {
+    ensureStore(dataDir);
+    return withStoreLock(indexPath(dataDir), () => {
+        const index = readIndex(dataDir);
+        // A crash may leave only the durable replacing intent. Complete those
+        // transactions before building the active inventory so startup recovery
+        // never depends on the original message being delivered again.
+        for (const liveKey of Object.keys(index.entries).sort()) {
+            const entry = index.entries[liveKey];
+            if (entry?.state === 'replacing') {
+                recoverReplacingEntryUnlocked(dataDir, index, liveKey, entry);
+            }
+        }
+        const ids = Object.values(index.entries)
+            .filter((entry) => entry.state === 'active')
+            .map((entry) => entry.proposalId)
+            .sort();
+        if (new Set(ids).size !== ids.length)
+            fail('STORE_CORRUPT');
+        return ids.map((proposalId) => {
+            const loaded = loadProposalUnlocked(dataDir, proposalId);
+            if (index.entries[loaded.prepared.liveKey]?.proposalId !== proposalId)
+                fail('STORE_CORRUPT');
+            return loaded;
+        });
+    });
+}
+//# sourceMappingURL=distillation-store.js.map