intentdna 1.9.0 → 1.9.3

package/dist/runtime/result-store.js

@@ -1,7 +1,14 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, link, lstat, mkdir, open, readFile, unlink, } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { CALLER_ATTESTATION_SCHEMA_VERSION, CANONICAL_RESULT_SCHEMA_VERSION, } from "./run-contracts.js";
+import { validateCanonicalAttemptOutcome } from "./canonical-attempt-outcome.js";
+import { canonicalizeJson } from "./canonical-json.js";
+import { workerStopReceiptDigest } from "./execution-authority.js";
 export class ResultStoreError extends Error {
     code;
-    constructor(code, message) {
-        super(message);
+    constructor(code, message, options) {
+        super(message, options);
         this.name = "ResultStoreError";
         this.code = code;
     }
@@ -128,3 +135,1067 @@ export class ImmutableResultStore {
         return results;
     }
 }
+const DIRECTORY_MODE = 0o700;
+const TEMPORARY_FILE_MODE = 0o600;
+const STORED_FILE_MODE = 0o400;
+const SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/u;
+function isErrno(error, code) {
+    return error instanceof Error
+        && "code" in error
+        && error.code === code;
+}
+function exactObjectKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    return actual.length === wanted.length
+        && actual.every((key, index) => key === wanted[index]);
+}
+function assertRecord(value, label) {
+    if (typeof value !== "object"
+        || value === null
+        || Array.isArray(value)
+        || Object.getPrototypeOf(value) !== Object.prototype) {
+        throw new ResultStoreError("invalid_result", `${label} must be an object`);
+    }
+}
+function assertExactKeys(value, expected, label) {
+    if (!exactObjectKeys(value, expected)) {
+        throw new ResultStoreError("invalid_result", `${label} has unexpected or missing fields`);
+    }
+}
+function assertCanonicalNonEmptyString(value, label) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ResultStoreError("invalid_result", `${label} must be a non-empty string`);
+    }
+}
+const RFC3339_PATTERN = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/u;
+function parseRfc3339(value, label) {
+    assertCanonicalNonEmptyString(value, label);
+    const match = value.match(RFC3339_PATTERN);
+    if (!match) {
+        throw new ResultStoreError("invalid_result", `${label} must be RFC3339`);
+    }
+    const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const hour = Number(hourText);
+    const minute = Number(minuteText);
+    const second = Number(secondText);
+    const offsetHour = Number(offsetHourText ?? 0);
+    const offsetMinute = Number(offsetMinuteText ?? 0);
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const monthDays = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    if (month < 1 || month > 12
+        || day < 1 || day > monthDays[month - 1]
+        || hour > 23
+        || minute > 59
+        || second > 59
+        || offsetHour > 23
+        || offsetMinute > 59) {
+        throw new ResultStoreError("invalid_result", `${label} must be valid RFC3339`);
+    }
+    const instant = Date.parse(value);
+    if (!Number.isFinite(instant)) {
+        throw new ResultStoreError("invalid_result", `${label} must be valid RFC3339`);
+    }
+    return instant;
+}
+function assertArtifactOutput(output, result, label) {
+    assertExactKeys(output, ["name", "kind", "capture"], label);
+    assertArtifactCapture(output.capture, result, `${label}.capture`, output.name);
+}
+function assertArtifactCapture(value, result, label, outputName) {
+    assertRecord(value, label);
+    const capture = value;
+    assertExactKeys(capture, [
+        "capture_id",
+        "artifact_id",
+        "artifact_kind",
+        "run_id",
+        "activation_id",
+        "attempt_id",
+        "output_name",
+        "source_workspace_id",
+        "source_path",
+        "captured_at",
+    ], label);
+    for (const field of [
+        "capture_id",
+        "artifact_id",
+        "run_id",
+        "activation_id",
+        "attempt_id",
+        "output_name",
+        "source_workspace_id",
+        "source_path",
+        "captured_at",
+    ]) {
+        assertCanonicalNonEmptyString(capture[field], `${label}.${field}`);
+    }
+    if (!SHA256_DIGEST_PATTERN.test(capture.artifact_id)) {
+        throw new ResultStoreError("invalid_result", `${label}.artifact_id must be a lowercase sha256 digest`);
+    }
+    if (!new Set(["file", "directory", "git_commit"]).has(capture.artifact_kind)) {
+        throw new ResultStoreError("invalid_result", `${label}.artifact_kind is invalid`);
+    }
+    const capturedAt = parseRfc3339(capture.captured_at, `${label}.captured_at`);
+    const committedAt = parseRfc3339(result.committed_at, "result.committed_at");
+    if (capture.run_id !== result.run_id
+        || capture.activation_id !== result.activation_id
+        || capture.attempt_id !== result.attempt_id
+        || (outputName !== undefined && capture.output_name !== outputName)) {
+        throw new ResultStoreError("invalid_result", `${label} does not match its result and output identity`);
+    }
+    if (capturedAt > committedAt) {
+        throw new ResultStoreError("invalid_result", `${label}.captured_at must not be later than result.committed_at`);
+    }
+}
+function assertCanonicalOutput(value, index, result) {
+    const label = `result.outputs[${index}]`;
+    assertRecord(value, label);
+    assertCanonicalNonEmptyString(value.name, `${label}.name`);
+    if (value.kind === "artifact") {
+        assertArtifactOutput(value, result, label);
+        return;
+    }
+    if (value.kind === "text") {
+        assertExactKeys(value, ["name", "kind", "text"], label);
+        if (typeof value.text !== "string") {
+            throw new ResultStoreError("invalid_result", `${label}.text must be a string`);
+        }
+        return;
+    }
+    if (value.kind === "structured") {
+        assertExactKeys(value, ["name", "kind", "value", "schema_ref"], label);
+        if (value.schema_ref !== null && typeof value.schema_ref !== "string") {
+            throw new ResultStoreError("invalid_result", `${label}.schema_ref must be a string or null`);
+        }
+        assertJsonValue(value.value, `${label}.value`);
+        return;
+    }
+    throw new ResultStoreError("invalid_result", `${label}.kind must be artifact, text, or structured`);
+}
+function assertWorkerStopReceipt(value, result, label) {
+    assertRecord(value, label);
+    assertExactKeys(value, ["receipt_digest", "payload"], label);
+    if (!SHA256_DIGEST_PATTERN.test(value.receipt_digest)) {
+        throw new ResultStoreError("invalid_result", `${label}.receipt_digest must be a lowercase sha256 digest`);
+    }
+    assertRecord(value.payload, `${label}.payload`);
+    assertExactKeys(value.payload, [
+        "schema_version",
+        "run_id",
+        "step_id",
+        "activation_id",
+        "attempt_id",
+        "claim_epoch",
+        "worker_session_id",
+        "execution_instance_id",
+        "authority_kind",
+        "authority_instance_id",
+        "fencing_epoch",
+        "started_at",
+        "stopped_at",
+        "terminal_outcome",
+        "process_tree_drained",
+        "source_evidence_digest",
+    ], `${label}.payload`);
+    const payload = value.payload;
+    if (payload.schema_version !== "intentdna.worker_stop_receipt.v1") {
+        throw new ResultStoreError("invalid_result", `${label}.payload.schema_version is unsupported`);
+    }
+    for (const field of [
+        "run_id",
+        "step_id",
+        "activation_id",
+        "attempt_id",
+        "worker_session_id",
+        "execution_instance_id",
+        "authority_instance_id",
+        "started_at",
+        "stopped_at",
+    ]) {
+        assertCanonicalNonEmptyString(payload[field], `${label}.payload.${field}`);
+    }
+    if (!Number.isSafeInteger(payload.claim_epoch) || payload.claim_epoch <= 0
+        || !Number.isSafeInteger(payload.fencing_epoch) || payload.fencing_epoch <= 0) {
+        throw new ResultStoreError("invalid_result", `${label}.payload epochs must be positive safe integers`);
+    }
+    if (!["local_process", "host_attested"].includes(payload.authority_kind)) {
+        throw new ResultStoreError("invalid_result", `${label}.payload.authority_kind is invalid`);
+    }
+    if (payload.process_tree_drained !== true) {
+        throw new ResultStoreError("invalid_result", `${label}.payload must prove a drained process tree`);
+    }
+    if (!SHA256_DIGEST_PATTERN.test(payload.source_evidence_digest)) {
+        throw new ResultStoreError("invalid_result", `${label}.payload.source_evidence_digest is invalid`);
+    }
+    if (payload.run_id !== result.run_id
+        || payload.step_id !== result.step_id
+        || payload.activation_id !== result.activation_id
+        || payload.attempt_id !== result.attempt_id
+        || result.executor.kind !== "worker"
+        || payload.worker_session_id !== result.executor.worker_session_id
+        || payload.started_at !== result.started_at
+        || payload.stopped_at !== result.completed_at
+        || canonicalizeJson(payload.terminal_outcome) !== canonicalizeJson(result.terminal_outcome)) {
+        throw new ResultStoreError("invalid_result", `${label} does not match its worker result`);
+    }
+    parseRfc3339(payload.started_at, `${label}.payload.started_at`);
+    parseRfc3339(payload.stopped_at, `${label}.payload.stopped_at`);
+    const receipt = value;
+    if (receipt.receipt_digest !== workerStopReceiptDigest(receipt.payload)) {
+        throw new ResultStoreError("invalid_result", `${label}.receipt_digest does not match its payload`);
+    }
+}
+function assertVerifierProcessOutcome(value, label) {
+    assertRecord(value, label);
+    assertExactKeys(value, ["kind", "exit_code", "signal", "timed_out", "launch_error"], label);
+    if (value.kind === "exited") {
+        if (!Number.isSafeInteger(value.exit_code)
+            || value.exit_code < 0
+            || value.signal !== null
+            || value.timed_out !== false
+            || value.launch_error !== null)
+            throw new ResultStoreError("invalid_result", `${label} has an invalid exited tuple`);
+        return;
+    }
+    if (value.kind === "signaled") {
+        if (value.exit_code !== null || value.timed_out !== false || value.launch_error !== null) {
+            throw new ResultStoreError("invalid_result", `${label} has an invalid signaled tuple`);
+        }
+        assertCanonicalNonEmptyString(value.signal, `${label}.signal`);
+        return;
+    }
+    if (value.kind === "timed_out") {
+        if ((value.exit_code !== null && (!Number.isSafeInteger(value.exit_code) || value.exit_code < 0))
+            || (value.exit_code === 0)
+            || (value.signal !== null && (typeof value.signal !== "string" || value.signal.length === 0))
+            || value.timed_out !== true
+            || value.launch_error !== null)
+            throw new ResultStoreError("invalid_result", `${label} has an invalid timed_out tuple`);
+        return;
+    }
+    if (value.kind === "launch_error") {
+        if (value.exit_code !== null || value.signal !== null || value.timed_out !== false) {
+            throw new ResultStoreError("invalid_result", `${label} has an invalid launch_error tuple`);
+        }
+        assertRecord(value.launch_error, `${label}.launch_error`);
+        assertExactKeys(value.launch_error, ["code", "message_digest"], `${label}.launch_error`);
+        assertCanonicalNonEmptyString(value.launch_error.code, `${label}.launch_error.code`);
+        if (!/^[A-Z][A-Z0-9_]*$/u.test(value.launch_error.code)
+            || !SHA256_DIGEST_PATTERN.test(value.launch_error.message_digest)) {
+            throw new ResultStoreError("invalid_result", `${label}.launch_error is invalid`);
+        }
+        return;
+    }
+    throw new ResultStoreError("invalid_result", `${label}.kind is invalid`);
+}
+function assertVerifierExecutionReceipt(value, verifierId, result, label) {
+    assertRecord(value, label);
+    assertExactKeys(value, [
+        "schema_version",
+        "evidence_mode",
+        "plan_id",
+        "verifier_id",
+        "verifier_definition_digest",
+        "resolved_command_digest",
+        "environment_binding_digest",
+        "cwd_identity",
+        "started_at",
+        "requested_at",
+        "completed_at",
+        "process_outcome",
+        "stdout",
+        "stderr",
+        "truncation_policy",
+        "observation_policy_digest",
+        "workspace_observation_digest",
+        "service_invocation",
+        "request_identity",
+        "supplied_environment",
+        "shell_policy",
+        "network_policy",
+        "execution_authority",
+    ], label);
+    if (value.schema_version !== "intentdna.verifier_execution_receipt.v1"
+        || value.evidence_mode !== "historical_execution") {
+        throw new ResultStoreError("invalid_result", `${label} has an unsupported receipt contract`);
+    }
+    assertCanonicalNonEmptyString(value.verifier_id, `${label}.verifier_id`);
+    if (value.verifier_id !== verifierId) {
+        throw new ResultStoreError("invalid_result", `${label}.verifier_id must match its evidence`);
+    }
+    for (const field of [
+        "plan_id",
+        "verifier_definition_digest",
+        "resolved_command_digest",
+        "environment_binding_digest",
+        "observation_policy_digest",
+        "workspace_observation_digest",
+    ]) {
+        if (!SHA256_DIGEST_PATTERN.test(value[field])) {
+            throw new ResultStoreError("invalid_result", `${label}.${field} must be a lowercase sha256 digest`);
+        }
+    }
+    assertRecord(value.cwd_identity, `${label}.cwd_identity`);
+    assertExactKeys(value.cwd_identity, ["workspace_id", "workspace_allocation_digest", "relative_working_directory", "absolute_path_digest"], `${label}.cwd_identity`);
+    assertCanonicalNonEmptyString(value.cwd_identity.workspace_id, `${label}.cwd_identity.workspace_id`);
+    assertCanonicalNonEmptyString(value.cwd_identity.relative_working_directory, `${label}.cwd_identity.relative_working_directory`);
+    if (value.cwd_identity.workspace_id !== result.attempt_id
+        || !SHA256_DIGEST_PATTERN.test(value.cwd_identity.workspace_allocation_digest)
+        || !SHA256_DIGEST_PATTERN.test(value.cwd_identity.absolute_path_digest)) {
+        throw new ResultStoreError("invalid_result", `${label}.cwd_identity does not match the attempt workspace`);
+    }
+    const relativeWorkingDirectory = value.cwd_identity.relative_working_directory;
+    if (relativeWorkingDirectory.startsWith("/")
+        || relativeWorkingDirectory.includes("\0")
+        || relativeWorkingDirectory.split(/[\\/]+/u).includes("..")) {
+        throw new ResultStoreError("invalid_result", `${label}.cwd_identity must be relative and contained`);
+    }
+    const requestedAt = parseRfc3339(value.requested_at, `${label}.requested_at`);
+    const startedAt = parseRfc3339(value.started_at, `${label}.started_at`);
+    const completedAt = parseRfc3339(value.completed_at, `${label}.completed_at`);
+    if (requestedAt > startedAt
+        || startedAt > completedAt
+        || startedAt < parseRfc3339(result.completed_at, "result.completed_at")
+        || completedAt > parseRfc3339(result.committed_at, "result.committed_at")) {
+        throw new ResultStoreError("invalid_result", `${label} must execute after worker stop and before result commit`);
+    }
+    assertVerifierProcessOutcome(value.process_outcome, `${label}.process_outcome`);
+    for (const streamName of ["stdout", "stderr"]) {
+        const stream = value[streamName];
+        assertRecord(stream, `${label}.${streamName}`);
+        assertExactKeys(stream, ["digest", "byte_length", "truncated"], `${label}.${streamName}`);
+        if (!SHA256_DIGEST_PATTERN.test(stream.digest)) {
+            throw new ResultStoreError("invalid_result", `${label}.${streamName}.digest is invalid`);
+        }
+        if (!Number.isSafeInteger(stream.byte_length) || stream.byte_length < 0) {
+            throw new ResultStoreError("invalid_result", `${label}.${streamName}.byte_length is invalid`);
+        }
+        if (stream.truncated !== (stream.byte_length > 0)) {
+            throw new ResultStoreError("invalid_result", `${label}.${streamName}.truncated violates retention policy`);
+        }
+    }
+    assertRecord(value.truncation_policy, `${label}.truncation_policy`);
+    assertExactKeys(value.truncation_policy, ["kind", "raw_output_retained_bytes", "diagnostic_summary_max_bytes", "diagnostic_line_max_bytes"], `${label}.truncation_policy`);
+    if (value.truncation_policy.kind !== "digest_full_stream_diagnostics_only"
+        || value.truncation_policy.raw_output_retained_bytes !== 0
+        || !Number.isSafeInteger(value.truncation_policy.diagnostic_summary_max_bytes)
+        || value.truncation_policy.diagnostic_summary_max_bytes <= 0
+        || !Number.isSafeInteger(value.truncation_policy.diagnostic_line_max_bytes)
+        || value.truncation_policy.diagnostic_line_max_bytes <= 0) {
+        throw new ResultStoreError("invalid_result", `${label}.truncation_policy is invalid`);
+    }
+    assertRecord(value.service_invocation, `${label}.service_invocation`);
+    assertExactKeys(value.service_invocation, ["service_instance_id", "invocation_id"], `${label}.service_invocation`);
+    assertCanonicalNonEmptyString(value.service_invocation.service_instance_id, `${label}.service_invocation.service_instance_id`);
+    assertCanonicalNonEmptyString(value.service_invocation.invocation_id, `${label}.service_invocation.invocation_id`);
+    assertRecord(value.request_identity, `${label}.request_identity`);
+    assertExactKeys(value.request_identity, ["request_digest", "command_digest", "environment_digest", "authority_descriptor_digest", "launch_descriptor_digest"], `${label}.request_identity`);
+    for (const field of ["request_digest", "command_digest", "environment_digest", "authority_descriptor_digest", "launch_descriptor_digest"]) {
+        if (!SHA256_DIGEST_PATTERN.test(value.request_identity[field])) {
+            throw new ResultStoreError("invalid_result", `${label}.request_identity.${field} is invalid`);
+        }
+    }
+    if (value.request_identity.command_digest !== value.resolved_command_digest
+        || value.request_identity.environment_digest !== value.environment_binding_digest) {
+        throw new ResultStoreError("invalid_result", `${label}.request_identity does not bind command and environment`);
+    }
+    assertRecord(value.supplied_environment, `${label}.supplied_environment`);
+    assertExactKeys(value.supplied_environment, ["inherit_parent", "startup_files", "variable_names"], `${label}.supplied_environment`);
+    if (value.supplied_environment.inherit_parent !== false
+        || value.supplied_environment.startup_files !== false
+        || !Array.isArray(value.supplied_environment.variable_names)
+        || value.supplied_environment.variable_names.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name))
+        || canonicalizeJson(value.supplied_environment.variable_names)
+            !== canonicalizeJson([...value.supplied_environment.variable_names].sort())) {
+        throw new ResultStoreError("invalid_result", `${label}.supplied_environment is invalid`);
+    }
+    assertRecord(value.shell_policy, `${label}.shell_policy`);
+    assertExactKeys(value.shell_policy, ["executable", "arguments"], `${label}.shell_policy`);
+    if (value.shell_policy.executable !== "bash"
+        || canonicalizeJson(value.shell_policy.arguments) !== canonicalizeJson(["--noprofile", "--norc", "-c"])) {
+        throw new ResultStoreError("invalid_result", `${label}.shell_policy is invalid`);
+    }
+    assertRecord(value.network_policy, `${label}.network_policy`);
+    assertExactKeys(value.network_policy, ["mode", "enforced", "enforcement_kind", "enforcement_digest", "enforcement_descriptor"], `${label}.network_policy`);
+    const denyAll = value.network_policy.mode === "deny_all";
+    const allow = value.network_policy.mode === "allow";
+    if ((!denyAll && !allow)
+        || (denyAll && (value.network_policy.enforced !== true
+            || value.network_policy.enforcement_kind !== "configured_adapter"
+            || !SHA256_DIGEST_PATTERN.test(value.network_policy.enforcement_digest)
+            || value.network_policy.enforcement_descriptor === null))
+        || (allow && (value.network_policy.enforced !== false
+            || value.network_policy.enforcement_kind !== "not_required"
+            || value.network_policy.enforcement_digest !== null
+            || value.network_policy.enforcement_descriptor !== null))) {
+        throw new ResultStoreError("invalid_result", `${label}.network_policy is invalid`);
+    }
+    if (denyAll) {
+        assertRecord(value.network_policy.enforcement_descriptor, `${label}.network_policy.enforcement_descriptor`);
+        const enforcementDescriptor = value.network_policy.enforcement_descriptor;
+        assertExactKeys(enforcementDescriptor, ["schema_version", "mode", "adapter_kind", "adapter_version", "configuration_digest", "authority_descriptor_digest", "request_digest"], `${label}.network_policy.enforcement_descriptor`);
+        if (enforcementDescriptor.schema_version !== "intentdna.verifier_network_enforcement.v1"
+            || enforcementDescriptor.mode !== "deny_all"
+            || !SHA256_DIGEST_PATTERN.test(enforcementDescriptor.configuration_digest)
+            || !SHA256_DIGEST_PATTERN.test(enforcementDescriptor.authority_descriptor_digest)
+            || !SHA256_DIGEST_PATTERN.test(enforcementDescriptor.request_digest)
+            || value.network_policy.enforcement_digest !== canonicalResultDigest(Buffer.from(canonicalizeJson(enforcementDescriptor), "utf8")))
+            throw new ResultStoreError("invalid_result", `${label}.network_policy.enforcement_descriptor is invalid`);
+    }
+    assertRecord(value.execution_authority, `${label}.execution_authority`);
+    assertExactKeys(value.execution_authority, ["authority_instance_id", "authority_descriptor_digest", "adapter_kind", "adapter_version", "configuration_digest", "process_tree_drained"], `${label}.execution_authority`);
+    assertCanonicalNonEmptyString(value.execution_authority.authority_instance_id, `${label}.execution_authority.authority_instance_id`);
+    assertCanonicalNonEmptyString(value.execution_authority.adapter_kind, `${label}.execution_authority.adapter_kind`);
+    assertCanonicalNonEmptyString(value.execution_authority.adapter_version, `${label}.execution_authority.adapter_version`);
+    if (!SHA256_DIGEST_PATTERN.test(value.execution_authority.authority_descriptor_digest)
+        || !SHA256_DIGEST_PATTERN.test(value.execution_authority.configuration_digest)
+        || value.execution_authority.process_tree_drained !== true
+        || value.execution_authority.authority_descriptor_digest !== value.request_identity.authority_descriptor_digest
+        || value.request_identity.launch_descriptor_digest !== value.request_identity.request_digest
+        || (denyAll && (value.network_policy.enforcement_descriptor.adapter_kind !== value.execution_authority.adapter_kind
+            || value.network_policy.enforcement_descriptor.adapter_version !== value.execution_authority.adapter_version
+            || value.network_policy.enforcement_descriptor.configuration_digest !== value.execution_authority.configuration_digest
+            || value.network_policy.enforcement_descriptor.authority_descriptor_digest !== value.request_identity.authority_descriptor_digest
+            || value.network_policy.enforcement_descriptor.request_digest !== value.request_identity.request_digest))) {
+        throw new ResultStoreError("invalid_result", `${label}.execution_authority is invalid`);
+    }
+}
+function assertWorkspaceObservation(value, evidenceDigest, label, artifactCapture, result, executionReceipt) {
+    if (value === null)
+        return;
+    assertRecord(value, `${label}.workspace_observation`);
+    assertExactKeys(value, [
+        "schema_version",
+        "workspace_id",
+        "scope",
+        "observed_digest",
+        "entry_count",
+        "byte_count",
+        "git",
+    ], `${label}.workspace_observation`);
+    if (value.schema_version !== "intentdna.workspace_observation.v2") {
+        throw new ResultStoreError("invalid_result", `${label}.workspace_observation.schema_version is unsupported`);
+    }
+    assertCanonicalNonEmptyString(value.workspace_id, `${label}.workspace_observation.workspace_id`);
+    if (value.workspace_id !== result.attempt_id) {
+        throw new ResultStoreError("invalid_result", `${label}.workspace_observation.workspace_id must match result.attempt_id`);
+    }
+    if (!SHA256_DIGEST_PATTERN.test(value.observed_digest)) {
+        throw new ResultStoreError("invalid_result", `${label}.workspace_observation.observed_digest must be a lowercase sha256 digest`);
+    }
+    const expectedObservationDigest = executionReceipt?.workspace_observation_digest
+        ?? (artifactCapture === null ? evidenceDigest : value.observed_digest);
+    if (value.observed_digest !== expectedObservationDigest) {
+        throw new ResultStoreError("invalid_result", `${label}.workspace_observation.observed_digest does not match its evidence binding`);
+    }
+    assertRecord(value.scope, `${label}.workspace_observation.scope`);
+    assertExactKeys(value.scope, ["kind", "relative_root", "excluded_relative_paths"], `${label}.workspace_observation.scope`);
+    if (value.scope.kind !== "attempt_workspace"
+        || value.scope.relative_root !== "."
+        || !Array.isArray(value.scope.excluded_relative_paths)
+        || canonicalizeJson(value.scope.excluded_relative_paths)
+            !== canonicalizeJson([".dna/runtime", ".dna/worktrees/runtime"])) {
+        throw new ResultStoreError("invalid_result", `${label}.workspace_observation.scope is not canonical`);
+    }
+    for (const field of ["entry_count", "byte_count"]) {
+        if (!Number.isSafeInteger(value[field]) || value[field] < 0) {
+            throw new ResultStoreError("invalid_result", `${label}.workspace_observation.${field} must be a non-negative safe integer`);
+        }
+    }
+    if (value.git !== null) {
+        assertRecord(value.git, `${label}.workspace_observation.git`);
+        assertExactKeys(value.git, [
+            "repository_identity_digest",
+            "head",
+            "symbolic_branch",
+            "porcelain_v2_digest",
+            "local_config_digest",
+        ], `${label}.workspace_observation.git`);
+        for (const field of [
+            "repository_identity_digest",
+            "porcelain_v2_digest",
+            "local_config_digest",
+        ]) {
+            if (!SHA256_DIGEST_PATTERN.test(value.git[field])) {
+                throw new ResultStoreError("invalid_result", `${label}.workspace_observation.git.${field} must be a lowercase sha256 digest`);
+            }
+        }
+        assertCanonicalNonEmptyString(value.git.head, `${label}.workspace_observation.git.head`);
+        if (value.git.symbolic_branch !== null) {
+            assertCanonicalNonEmptyString(value.git.symbolic_branch, `${label}.workspace_observation.git.symbolic_branch`);
+        }
+    }
+}
+function assertVerifierEvidence(value, label, result, expectedVerifierId) {
+    assertExactKeys(value, [
+        "kind",
+        "verifier_id",
+        "evidence_digest",
+        "artifact_capture",
+        "workspace_observation",
+        "execution_receipt",
+    ], label);
+    assertCanonicalNonEmptyString(value.verifier_id, `${label}.verifier_id`);
+    if (expectedVerifierId !== undefined && value.verifier_id !== expectedVerifierId) {
+        throw new ResultStoreError("invalid_result", `${label}.verifier_id must match its verification result`);
+    }
+    if (!SHA256_DIGEST_PATTERN.test(value.evidence_digest)) {
+        throw new ResultStoreError("invalid_result", `${label}.evidence_digest must be a lowercase sha256 digest`);
+    }
+    if (value.artifact_capture !== null) {
+        assertArtifactCapture(value.artifact_capture, result, `${label}.artifact_capture`);
+    }
+    if (value.execution_receipt !== null) {
+        if (value.artifact_capture !== null || value.workspace_observation === null) {
+            throw new ResultStoreError("invalid_result", `${label}.execution_receipt requires exactly one workspace observation`);
+        }
+        assertVerifierExecutionReceipt(value.execution_receipt, value.verifier_id, result, `${label}.execution_receipt`);
+        const expectedEvidenceDigest = canonicalResultDigest(Buffer.from(canonicalizeJson({
+            execution_receipt: value.execution_receipt,
+            workspace_observation: value.workspace_observation,
+        }), "utf8"));
+        if (value.evidence_digest !== expectedEvidenceDigest) {
+            throw new ResultStoreError("invalid_result", `${label}.evidence_digest does not bind its receipt and observation`);
+        }
+    }
+    if (value.execution_receipt === null
+        && value.artifact_capture !== null
+        && value.workspace_observation !== null) {
+        const expectedEvidenceDigest = canonicalResultDigest(Buffer.from(canonicalizeJson({
+            artifact_capture: value.artifact_capture,
+            workspace_observation: value.workspace_observation,
+        }), "utf8"));
+        if (value.evidence_digest !== expectedEvidenceDigest) {
+            throw new ResultStoreError("invalid_result", `${label}.evidence_digest does not bind its artifact capture and workspace observation`);
+        }
+    }
+    if (value.artifact_capture === null
+        && value.workspace_observation === null
+        && value.execution_receipt === null) {
+        throw new ResultStoreError("invalid_result", `${label} must bind immutable verifier evidence`);
+    }
+    assertWorkspaceObservation(value.workspace_observation, value.evidence_digest, label, value.artifact_capture, result, value.execution_receipt);
+}
+function assertEvidenceRef(value, index, result) {
+    const label = typeof index === "number"
+        ? `result.evidence_refs[${index}]`
+        : `result.${index}`;
+    assertRecord(value, label);
+    if (value.kind === "artifact_capture") {
+        assertExactKeys(value, ["kind", "capture"], label);
+        assertArtifactCapture(value.capture, result, `${label}.capture`);
+        return;
+    }
+    if (value.kind === "submission") {
+        assertExactKeys(value, ["kind", "submission_key_digest", "submission_digest"], label);
+        for (const field of [
+            "submission_key_digest",
+            "submission_digest",
+        ]) {
+            if (!SHA256_DIGEST_PATTERN.test(value[field])) {
+                throw new ResultStoreError("invalid_result", `${label}.${field} must be a lowercase sha256 digest`);
+            }
+        }
+        return;
+    }
+    if (value.kind === "result") {
+        assertExactKeys(value, ["kind", "result"], label);
+        assertRecord(value.result, `${label}.result`);
+        assertExactKeys(value.result, [
+            "result_id",
+            "run_id",
+            "step_id",
+            "activation_id",
+            "attempt_id",
+            "result_digest",
+        ], `${label}.result`);
+        for (const field of [
+            "result_id",
+            "run_id",
+            "step_id",
+            "activation_id",
+            "attempt_id",
+        ]) {
+            assertCanonicalNonEmptyString(value.result[field], `${label}.result.${field}`);
+        }
+        if (!SHA256_DIGEST_PATTERN.test(value.result.result_digest)) {
+            throw new ResultStoreError("invalid_result", `${label}.result.result_digest must be a lowercase sha256 digest`);
+        }
+        return;
+    }
+    if (value.kind === "caller_attestation") {
+        assertExactKeys(value, value.payload === undefined
+            ? ["kind", "attestation_ref", "attestation_digest"]
+            : ["kind", "attestation_ref", "attestation_digest", "payload"], label);
+        assertCanonicalNonEmptyString(value.attestation_ref, `${label}.attestation_ref`);
+        if (!SHA256_DIGEST_PATTERN.test(value.attestation_digest)) {
+            throw new ResultStoreError("invalid_result", `${label}.attestation_digest must be a lowercase sha256 digest`);
+        }
+        if (value.payload !== undefined) {
+            const payloadRecord = value.payload;
+            assertRecord(payloadRecord, `${label}.payload`);
+            assertExactKeys(payloadRecord, [
+                "schema_version",
+                "authority_id",
+                "agent_id",
+                "session_id",
+                "run_id",
+                "step_id",
+                "activation_id",
+                "attempt_id",
+                "claim_epoch",
+                "worker_session_id",
+                "submission_key_digest",
+                "execution_digest",
+            ], `${label}.payload`);
+            if (payloadRecord.schema_version !== CALLER_ATTESTATION_SCHEMA_VERSION) {
+                throw new ResultStoreError("invalid_result", `${label}.payload.schema_version is unsupported`);
+            }
+            for (const field of [
+                "authority_id",
+                "agent_id",
+                "session_id",
+                "run_id",
+                "step_id",
+                "activation_id",
+                "attempt_id",
+                "worker_session_id",
+            ]) {
+                assertCanonicalNonEmptyString(payloadRecord[field], `${label}.payload.${field}`);
+            }
+            if (!Number.isSafeInteger(payloadRecord.claim_epoch)
+                || payloadRecord.claim_epoch <= 0) {
+                throw new ResultStoreError("invalid_result", `${label}.payload.claim_epoch must be a positive safe integer`);
+            }
+            for (const field of ["submission_key_digest", "execution_digest"]) {
+                if (typeof payloadRecord[field] !== "string"
+                    || !SHA256_DIGEST_PATTERN.test(payloadRecord[field])) {
+                    throw new ResultStoreError("invalid_result", `${label}.payload.${field} must be a lowercase sha256 digest`);
+                }
+            }
+            const payload = payloadRecord;
+            if (payload.run_id !== result.run_id
+                || payload.step_id !== result.step_id
+                || payload.activation_id !== result.activation_id
+                || payload.attempt_id !== result.attempt_id
+                || result.executor.kind !== "worker"
+                || payload.worker_session_id !== result.executor.worker_session_id) {
+                throw new ResultStoreError("invalid_result", `${label}.payload does not match the committed worker result`);
+            }
+            const expectedDigest = canonicalResultDigest(Buffer.from(canonicalizeJson(payload), "utf8"));
+            if (value.attestation_digest !== expectedDigest) {
+                throw new ResultStoreError("invalid_result", `${label}.attestation_digest does not match its payload`);
+            }
+        }
+        return;
+    }
+    if (value.kind === "worker_stopped") {
+        assertExactKeys(value, ["kind", "receipt"], label);
+        assertWorkerStopReceipt(value.receipt, result, `${label}.receipt`);
+        return;
+    }
+    if (value.kind === "verifier_evidence") {
+        assertVerifierEvidence(value, label, result);
+        return;
+    }
+    throw new ResultStoreError("invalid_result", `${label}.kind is not a supported immutable evidence reference`);
+}
+function assertVerificationResult(value, index, result) {
+    const label = `result.verification_results[${index}]`;
+    assertRecord(value, label);
+    assertExactKeys(value, ["verifier_id", "authority", "passed", "reason_code", "evidence_refs", "domain_value"], label);
+    assertCanonicalNonEmptyString(value.verifier_id, `${label}.verifier_id`);
+    if (value.authority !== "service" && value.authority !== "additional") {
+        throw new ResultStoreError("invalid_result", `${label}.authority is invalid`);
+    }
+    if (typeof value.passed !== "boolean") {
+        throw new ResultStoreError("invalid_result", `${label}.passed must be a boolean`);
+    }
+    if (typeof value.reason_code !== "string") {
+        throw new ResultStoreError("invalid_result", `${label}.reason_code must be a string`);
+    }
+    assertJsonValue(value.domain_value, `${label}.domain_value`);
+    if (!Array.isArray(value.evidence_refs)) {
+        throw new ResultStoreError("invalid_result", `${label}.evidence_refs must be an array`);
+    }
+    value.evidence_refs.forEach((evidence, evidenceIndex) => {
+        const evidenceLabel = `${label}.evidence_refs[${evidenceIndex}]`;
+        assertRecord(evidence, evidenceLabel);
+        if (evidence.kind !== "verifier_evidence") {
+            throw new ResultStoreError("invalid_result", `${evidenceLabel}.kind must be verifier_evidence`);
+        }
+        assertVerifierEvidence(evidence, evidenceLabel, result, value.verifier_id);
+        const executionReceipt = evidence.execution_receipt;
+        if (executionReceipt !== null
+            && value.authority !== "service") {
+            throw new ResultStoreError("invalid_result", `${label}.execution_receipt requires service authority`);
+        }
+        if (executionReceipt !== null
+            && value.passed !== (executionReceipt.process_outcome.kind === "exited"
+                && executionReceipt.process_outcome.exit_code === 0)) {
+            throw new ResultStoreError("invalid_result", `${label}.passed contradicts its verifier execution receipt`);
+        }
+    });
+}
+function assertCanonicalCommittedResult(value) {
+    assertRecord(value, "result");
+    assertExactKeys(value, [
+        "schema_version",
+        "result_id",
+        "run_id",
+        "step_id",
+        "activation_id",
+        "attempt_id",
+        "executor",
+        "terminal_outcome",
+        "outputs",
+        "started_at",
+        "completed_at",
+        "committed_at",
+        "stdout_reference",
+        "stderr_reference",
+        "evidence_refs",
+        "verification_results",
+        ...(Object.prototype.hasOwnProperty.call(value, "system_origin") ? ["system_origin"] : []),
+    ], "result");
+    if (value.schema_version !== CANONICAL_RESULT_SCHEMA_VERSION) {
+        throw new ResultStoreError("invalid_result", `result.schema_version must be ${CANONICAL_RESULT_SCHEMA_VERSION}`);
+    }
+    for (const field of [
+        "result_id",
+        "run_id",
+        "step_id",
+        "activation_id",
+        "attempt_id",
+    ]) {
+        assertCanonicalNonEmptyString(value[field], `result.${field}`);
+    }
+    try {
+        validateCanonicalAttemptOutcome(value.executor, value.terminal_outcome);
+    }
+    catch (error) {
+        throw new ResultStoreError("invalid_result", "result executor and terminal_outcome are invalid", { cause: error });
+    }
+    const startedAt = parseRfc3339(value.started_at, "result.started_at");
+    const completedAt = parseRfc3339(value.completed_at, "result.completed_at");
+    const committedAt = parseRfc3339(value.committed_at, "result.committed_at");
+    if (startedAt > completedAt || completedAt > committedAt) {
+        throw new ResultStoreError("invalid_result", "result timestamps must satisfy started_at <= completed_at <= committed_at");
+    }
+    if (!Array.isArray(value.outputs)) {
+        throw new ResultStoreError("invalid_result", "result.outputs must be an array");
+    }
+    const result = value;
+    if (value.system_origin !== undefined && value.system_origin !== null) {
+        assertRecord(value.system_origin, "result.system_origin");
+        const origin = value.system_origin;
+        if (origin.kind === "run_input") {
+            assertExactKeys(origin, ["kind", "input_names"], "result.system_origin");
+            if (!Array.isArray(origin.input_names) || origin.input_names.length === 0) {
+                throw new ResultStoreError("invalid_result", "result.system_origin.input_names must be a non-empty array");
+            }
+            origin.input_names.forEach((item, index) => assertCanonicalNonEmptyString(item, `result.system_origin.input_names[${index}]`));
+        }
+        else if (origin.kind === "legacy_external") {
+            assertExactKeys(origin, ["kind", "sources"], "result.system_origin");
+            if (!Array.isArray(origin.sources) || origin.sources.length === 0) {
+                throw new ResultStoreError("invalid_result", "result.system_origin.sources must be a non-empty array");
+            }
+            origin.sources.forEach((source, index) => {
+                assertRecord(source, `result.system_origin.sources[${index}]`);
+                assertExactKeys(source, ["source_path", "expected_digest", "artifact_id"], `result.system_origin.sources[${index}]`);
+                assertCanonicalNonEmptyString(source.source_path, `result.system_origin.sources[${index}].source_path`);
+                assertCanonicalNonEmptyString(source.artifact_id, `result.system_origin.sources[${index}].artifact_id`);
+                if (!SHA256_DIGEST_PATTERN.test(source.expected_digest)) {
+                    throw new ResultStoreError("invalid_result", `result.system_origin.sources[${index}].expected_digest must be a lowercase sha256 digest`);
+                }
+            });
+        }
+        else if (origin.kind === "canonical_import") {
+            assertExactKeys(origin, ["kind", "origin_plan_id", "origin_run_ids", "origin_result_ids", "origin_artifact_ids", "policy_id"], "result.system_origin");
+            if (!SHA256_DIGEST_PATTERN.test(origin.origin_plan_id)) {
+                throw new ResultStoreError("invalid_result", "result.system_origin.origin_plan_id must be a lowercase sha256 digest");
+            }
+            for (const field of ["origin_run_ids", "origin_result_ids", "origin_artifact_ids"]) {
+                if (!Array.isArray(origin[field]) || origin[field].length === 0) {
+                    throw new ResultStoreError("invalid_result", `result.system_origin.${field} must be a non-empty array`);
+                }
+                origin[field].forEach((item, index) => assertCanonicalNonEmptyString(item, `result.system_origin.${field}[${index}]`));
+            }
+            if (origin.policy_id !== null)
+                assertCanonicalNonEmptyString(origin.policy_id, "result.system_origin.policy_id");
+        }
+        else if (origin.kind === "current_run_results") {
+            assertExactKeys(origin, ["kind", "source_result_ids"], "result.system_origin");
+            if (!Array.isArray(origin.source_result_ids) || origin.source_result_ids.length === 0) {
+                throw new ResultStoreError("invalid_result", "result.system_origin.source_result_ids must be a non-empty array");
+            }
+            origin.source_result_ids.forEach((item, index) => assertCanonicalNonEmptyString(item, `result.system_origin.source_result_ids[${index}]`));
+        }
+        else {
+            throw new ResultStoreError("invalid_result", "result.system_origin.kind is unsupported");
+        }
+    }
+    const names = new Set();
+    value.outputs.forEach((output, index) => {
+        assertCanonicalOutput(output, index, result);
+        if (names.has(output.name)) {
+            throw new ResultStoreError("invalid_result", `result has duplicate output ${output.name}`);
+        }
+        names.add(output.name);
+    });
+    if (!Array.isArray(value.evidence_refs)) {
+        throw new ResultStoreError("invalid_result", "result.evidence_refs must be an array");
+    }
+    value.evidence_refs.forEach((evidence, index) => {
+        assertEvidenceRef(evidence, index, result);
+    });
+    const workerStopEvidence = value.evidence_refs.filter((evidence) => (typeof evidence === "object" && evidence !== null && evidence.kind === "worker_stopped"));
+    if ((result.executor.kind === "worker" && workerStopEvidence.length !== 1)
+        || (result.executor.kind !== "worker" && workerStopEvidence.length !== 0)) {
+        throw new ResultStoreError("invalid_result", "worker results require exactly one service-owned stop receipt");
+    }
+    if (!Array.isArray(value.verification_results)) {
+        throw new ResultStoreError("invalid_result", "result.verification_results must be an array");
+    }
+    const verifierIds = new Set();
+    value.verification_results.forEach((verification, index) => {
+        assertVerificationResult(verification, index, result);
+        if (verifierIds.has(verification.verifier_id)) {
+            throw new ResultStoreError("invalid_result", `result has duplicate verifier ${verification.verifier_id}`);
+        }
+        verifierIds.add(verification.verifier_id);
+    });
+    if (value.stdout_reference !== null) {
+        assertEvidenceRef(value.stdout_reference, "stdout_reference", result);
+    }
+    if (value.stderr_reference !== null) {
+        assertEvidenceRef(value.stderr_reference, "stderr_reference", result);
+    }
+    try {
+        canonicalizeJson(value);
+    }
+    catch (error) {
+        throw new ResultStoreError("invalid_result", "result is not canonical JSON data", { cause: error });
+    }
+}
+function canonicalResultDigest(bytes) {
+    return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function resultFileName(resultId) {
+    return `${createHash("sha256").update(resultId, "utf8").digest("hex")}.json`;
+}
+function createCanonicalResultRef(result, resultDigest) {
+    return {
+        result_id: result.result_id,
+        run_id: result.run_id,
+        step_id: result.step_id,
+        activation_id: result.activation_id,
+        attempt_id: result.attempt_id,
+        result_digest: resultDigest,
+    };
+}
+function assertCanonicalResultRef(reference) {
+    if (typeof reference !== "object"
+        || reference === null
+        || Array.isArray(reference)
+        || Object.getPrototypeOf(reference) !== Object.prototype
+        || !exactObjectKeys(reference, [
+            "result_id",
+            "run_id",
+            "step_id",
+            "activation_id",
+            "attempt_id",
+            "result_digest",
+        ])) {
+        throw new ResultStoreError("invalid_reference", "reference has unexpected or missing fields");
+    }
+    for (const field of [
+        "result_id",
+        "run_id",
+        "step_id",
+        "activation_id",
+        "attempt_id",
+    ]) {
+        if (typeof reference[field] !== "string" || !reference[field]) {
+            throw new ResultStoreError("invalid_reference", `reference.${field} must be a non-empty string`);
+        }
+    }
+    if (!SHA256_DIGEST_PATTERN.test(reference.result_digest)) {
+        throw new ResultStoreError("invalid_reference", "reference.result_digest must be a lowercase sha256 digest");
+    }
+}
+async function ensurePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: DIRECTORY_MODE });
+    const metadata = await lstat(path);
+    if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+        throw new ResultStoreError("immutable_conflict", `canonical result store path is not a real directory: ${path}`);
+    }
+    await chmod(path, DIRECTORY_MODE);
+}
+function isUnsupportedDirectorySync(error) {
+    if (!(error instanceof Error) || !("code" in error))
+        return false;
+    const code = error.code;
+    return code === "EINVAL"
+        || code === "ENOTSUP"
+        || code === "EISDIR"
+        || (code === "EPERM" && process.platform === "win32");
+}
+async function syncDirectory(path) {
+    let handle;
+    try {
+        handle = await open(path, "r");
+        await handle.sync();
+    }
+    catch (error) {
+        if (!isUnsupportedDirectorySync(error))
+            throw error;
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+/**
+ * Independent immutable blob store for v2 canonical results.
+ *
+ * Publishing preserves bytes and returns a reference; it does not grant ledger
+ * authority. The run store/service must separately commit that reference.
+ */
+export class ImmutableCanonicalResultStore {
+    rootDirectory;
+    constructor(options) {
+        if (!options.root_directory.trim()) {
+            throw new ResultStoreError("invalid_options", "root_directory must not be empty");
+        }
+        this.rootDirectory = resolve(options.root_directory);
+    }
+    resultsDirectory() {
+        return join(this.rootDirectory, "results");
+    }
+    resultPath(resultId) {
+        return join(this.resultsDirectory(), resultFileName(resultId));
+    }
+    async readByResultId(resultId) {
+        const path = this.resultPath(resultId);
+        let metadata;
+        try {
+            metadata = await lstat(path);
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT"))
+                return null;
+            throw error;
+        }
+        if (!metadata.isFile() || metadata.isSymbolicLink()) {
+            throw new ResultStoreError("corrupt_result", `stored result ${resultId} is not a regular file`);
+        }
+        if ((metadata.mode & 0o222) !== 0) {
+            throw new ResultStoreError("corrupt_result", `stored result ${resultId} must be read-only`);
+        }
+        let bytes;
+        try {
+            bytes = await readFile(path);
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT"))
+                return null;
+            throw error;
+        }
+        let value;
+        try {
+            value = JSON.parse(bytes.toString("utf8"));
+            assertCanonicalCommittedResult(value);
+        }
+        catch (error) {
+            throw new ResultStoreError("corrupt_result", `stored result ${resultId} failed schema validation`, { cause: error });
+        }
+        const canonicalBytes = Buffer.from(canonicalizeJson(value), "utf8");
+        if (!bytes.equals(canonicalBytes)) {
+            throw new ResultStoreError("corrupt_result", `stored result ${resultId} is not encoded as canonical JSON`);
+        }
+        if (value.result_id !== resultId) {
+            throw new ResultStoreError("corrupt_result", `stored result identity ${value.result_id} does not match ${resultId}`);
+        }
+        return { result: value, bytes };
+    }
+    async publish(result) {
+        assertCanonicalCommittedResult(result);
+        const bytes = Buffer.from(canonicalizeJson(result), "utf8");
+        const reference = createCanonicalResultRef(result, canonicalResultDigest(bytes));
+        await ensurePrivateDirectory(this.rootDirectory);
+        await ensurePrivateDirectory(this.resultsDirectory());
+        const destination = this.resultPath(result.result_id);
+        const temporaryPath = join(this.resultsDirectory(), `.${resultFileName(result.result_id)}.tmp.${process.pid}.${randomUUID()}`);
+        let handle;
+        try {
+            handle = await open(temporaryPath, "wx", TEMPORARY_FILE_MODE);
+            await handle.writeFile(bytes);
+            await handle.chmod(STORED_FILE_MODE);
+            await handle.sync();
+            await handle.close();
+            handle = undefined;
+            while (true) {
+                try {
+                    await link(temporaryPath, destination);
+                    await syncDirectory(this.resultsDirectory());
+                    return { result, reference, published: true };
+                }
+                catch (error) {
+                    if (!isErrno(error, "EEXIST"))
+                        throw error;
+                    await syncDirectory(this.resultsDirectory());
+                    const existing = await this.readByResultId(result.result_id);
+                    if (!existing)
+                        continue;
+                    if (!existing.bytes.equals(bytes)) {
+                        throw new ResultStoreError("immutable_conflict", `result ${result.result_id} is already published with different bytes`);
+                    }
+                    return { result: existing.result, reference, published: false };
+                }
+            }
+        }
+        finally {
+            await handle?.close().catch(() => undefined);
+            await unlink(temporaryPath).catch((error) => {
+                if (!isErrno(error, "ENOENT"))
+                    throw error;
+            });
+        }
+    }
+    async loadPublished(resultId) {
+        assertCanonicalNonEmptyString(resultId, "result_id");
+        if (!resultId.trim()) {
+            throw new ResultStoreError("invalid_result", "result_id must be a non-empty string");
+        }
+        const stored = await this.readByResultId(resultId);
+        if (!stored)
+            return null;
+        return {
+            result: stored.result,
+            reference: createCanonicalResultRef(stored.result, canonicalResultDigest(stored.bytes)),
+        };
+    }
+    async read(reference) {
+        assertCanonicalResultRef(reference);
+        const stored = await this.readByResultId(reference.result_id);
+        if (!stored)
+            return null;
+        const actualReference = createCanonicalResultRef(stored.result, canonicalResultDigest(stored.bytes));
+        if (canonicalizeJson(actualReference) !== canonicalizeJson(reference)) {
+            throw new ResultStoreError("corrupt_result", `stored result ${reference.result_id} does not match its reference`);
+        }
+        return stored.result;
+    }
+    async require(reference) {
+        const result = await this.read(reference);
+        if (!result) {
+            throw new ResultStoreError("result_not_found", `canonical result ${reference.result_id} was not found`);
+        }
+        return result;
+    }
+}