niceeval 0.13.2 → 0.13.3

package/dist/record/platform/services.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"services.js","sourceRoot":"","sources":["services.ts"],"names":[],"mappings":";;;AAWA,gDAEC;AAbD,mCAAiD;AAWjD,SAAgB,kBAAkB,CAAC,IAAgB,EAAE,GAAG,QAA2B;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AA4ED,MAAa,gBAAiB,SAAQ,gBAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,EAA6C;CAClI;AADD,4CACC;AAKD,MAAa,aAAc,SAAQ,gBAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAuC;CACtH;AADD,sCACC;AAyBD,MAAa,SAAU,SAAQ,gBAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAA+B;CACtG;AADD,8BACC","sourcesContent":["import { Context, Effect, Stream } from \"effect\";\nimport type { RecordFileSystemError, RecordGitError, RecordPathKind, } from \"./errors.ts\";\nimport type { RecordRoot } from \"./root.ts\";\n/**\n * A portable root-relative path request. It is not a capability: every live\n * platform operation validates these data again, including forged JS objects.\n */\nexport interface RecordPortablePath {\n    readonly root: RecordRoot;\n    readonly segments: readonly string[];\n}\nexport function recordPortablePath(root: RecordRoot, ...segments: readonly string[]): RecordPortablePath {\n    return Object.freeze({ root, segments: Object.freeze([...segments]) });\n}\nexport interface RecordDirectoryEntry {\n    readonly name: string;\n    readonly kind: Exclude<RecordPathKind, \"missing\">;\n}\nexport interface RecordListDirectoryInput {\n    readonly directory: RecordPortablePath;\n    readonly maximumEntries: number;\n}\nexport interface RecordReadFileInput {\n    readonly file: RecordPortablePath;\n    readonly maximumBytes: number;\n}\nexport interface RecordReadFileStreamInput extends RecordReadFileInput {\n    readonly chunkBytes?: number;\n}\nexport type RecordFileWriteMode = \"exclusive\" | \"replace\" | \"replace-no-follow\";\nexport interface RecordWriteFileInput {\n    readonly file: RecordPortablePath;\n    readonly bytes: Uint8Array;\n    readonly maximumBytes: number;\n    readonly mode: RecordFileWriteMode;\n}\nexport interface RecordWriteFileStreamInput<E, R> {\n    readonly file: RecordPortablePath;\n    readonly stream: Stream.Stream<Uint8Array, E, R>;\n    readonly maximumBytes: number;\n    readonly mode: RecordFileWriteMode;\n}\nexport type RecordIncompleteRunDelete = {\n    readonly state: \"deleted\";\n} | {\n    readonly state: \"missing\";\n} | {\n    readonly state: \"skipped-complete\";\n};\n/**\n * Portable Record file operations only. Lock files and other live operation\n * state are intentionally owned by the separate lease services below.\n */\nexport interface RecordFileSystemService {\n    readonly pathKind: (path: RecordPortablePath) => Effect.Effect<RecordPathKind, RecordFileSystemError>;\n    readonly ensureDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;\n    readonly createDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;\n    readonly listDirectory: (input: RecordListDirectoryInput) => Effect.Effect<readonly RecordDirectoryEntry[], RecordFileSystemError>;\n    readonly readFile: (input: RecordReadFileInput) => Effect.Effect<Uint8Array | undefined, RecordFileSystemError>;\n    readonly readFileStream: (input: RecordReadFileStreamInput) => Stream.Stream<Uint8Array, RecordFileSystemError>;\n    readonly writeFile: (input: RecordWriteFileInput) => Effect.Effect<void, RecordFileSystemError>;\n    readonly writeFileStream: <E, R>(input: RecordWriteFileStreamInput<E, R>) => Effect.Effect<void, RecordFileSystemError | E, R>;\n    readonly syncDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;\n    /** Creates `runs/<RunId>` without publishing it. */\n    readonly createRunDirectory: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<void, RecordFileSystemError>;\n    /** The only platform operation that creates `runs/<RunId>/complete`. */\n    readonly createCompleteMarker: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<void, RecordFileSystemError>;\n    /** True only for the zero-byte regular file created by `createCompleteMarker`. */\n    readonly isCompleteMarker: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<boolean, RecordFileSystemError>;\n    readonly migrationSentinelPresent: (root: RecordRoot) => Effect.Effect<boolean, RecordFileSystemError>;\n    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string) => Effect.Effect<void, RecordFileSystemError>;\n    /** Returns the bounded restore commit recorded by a current migration sentinel. */\n    readonly readMigrationSentinelRestoreCommit: (root: RecordRoot) => Effect.Effect<string | undefined, RecordFileSystemError>;\n    readonly removeMigrationSentinel: (root: RecordRoot) => Effect.Effect<void, RecordFileSystemError>;\n    /** The caller already owns the exclusive maintenance lease before deletion. */\n    readonly deleteIncompleteRun: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<RecordIncompleteRunDelete, RecordFileSystemError>;\n}\nexport class RecordFileSystem extends Context.Tag(\"@niceeval/record/RecordFileSystem\")<RecordFileSystem, RecordFileSystemService>() {\n}\n/** Entropy is a writer-only capability, not a reader requirement. */\nexport interface RecordEntropyService {\n    readonly uuid: Effect.Effect<string>;\n}\nexport class RecordEntropy extends Context.Tag(\"@niceeval/record/RecordEntropy\")<RecordEntropy, RecordEntropyService>() {\n}\n/**\n * A migration asks whether local Git can restore the current portable root;\n * absence of proof is data for the CLI confirmation flow, not an implicit OK.\n */\nexport type RecordBackupState = {\n    readonly state: \"git-restore-point\";\n    readonly commit: string;\n} | {\n    readonly state: \"not-git-worktree\";\n} | {\n    readonly state: \"root-outside-worktree\";\n} | {\n    readonly state: \"portable-root-dirty\";\n    readonly entries: readonly string[];\n};\nexport interface RecordGitService {\n    readonly inspectBackupState: (root: RecordRoot) => Effect.Effect<RecordBackupState, RecordGitError>;\n    /** Proves HEAD is unchanged and every dirty path is an expected migration write. */\n    readonly recoveryChangesAreExpected: (input: {\n        readonly root: RecordRoot;\n        readonly restoreCommit: string;\n        readonly expectedPaths: readonly RecordPortablePath[];\n    }) => Effect.Effect<boolean, RecordGitError | RecordFileSystemError>;\n}\nexport class RecordGit extends Context.Tag(\"@niceeval/record/RecordGit\")<RecordGit, RecordGitService>() {\n}\n"]}
+{"version":3,"file":"services.js","sourceRoot":"","sources":["services.ts"],"names":[],"mappings":";;;AAWA,gDAEC;AAbD,mCAAiD;AAWjD,SAAgB,kBAAkB,CAAC,IAAgB,EAAE,GAAG,QAA2B;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAiFD,MAAa,gBAAiB,SAAQ,gBAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,EAA6C;CAClI;AADD,4CACC;AAKD,MAAa,aAAc,SAAQ,gBAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAuC;CACtH;AADD,sCACC;AAyBD,MAAa,SAAU,SAAQ,gBAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAA+B;CACtG;AADD,8BACC","sourcesContent":["import { Context, Effect, Stream } from \"effect\";\nimport type { RecordFileSystemError, RecordGitError, RecordPathKind, } from \"./errors.ts\";\nimport type { RecordRoot } from \"./root.ts\";\n/**\n * A portable root-relative path request. It is not a capability: every live\n * platform operation validates these data again, including forged JS objects.\n */\nexport interface RecordPortablePath {\n    readonly root: RecordRoot;\n    readonly segments: readonly string[];\n}\nexport function recordPortablePath(root: RecordRoot, ...segments: readonly string[]): RecordPortablePath {\n    return Object.freeze({ root, segments: Object.freeze([...segments]) });\n}\nexport interface RecordDirectoryEntry {\n    readonly name: string;\n    readonly kind: Exclude<RecordPathKind, \"missing\">;\n}\nexport interface RecordListDirectoryInput {\n    readonly directory: RecordPortablePath;\n    readonly maximumEntries: number;\n}\nexport interface RecordReadFileInput {\n    readonly file: RecordPortablePath;\n    readonly maximumBytes: number;\n}\nexport interface RecordReadFileStreamInput extends RecordReadFileInput {\n    readonly chunkBytes?: number;\n}\nexport type RecordFileWriteMode = \"exclusive\" | \"replace\" | \"replace-no-follow\";\nexport interface RecordWriteFileInput {\n    readonly file: RecordPortablePath;\n    readonly bytes: Uint8Array;\n    readonly maximumBytes: number;\n    readonly mode: RecordFileWriteMode;\n}\nexport interface RecordWriteFileStreamInput<E, R> {\n    readonly file: RecordPortablePath;\n    readonly stream: Stream.Stream<Uint8Array, E, R>;\n    readonly maximumBytes: number;\n    readonly mode: RecordFileWriteMode;\n}\nexport type RecordIncompleteRunDelete = {\n    readonly state: \"deleted\";\n} | {\n    readonly state: \"missing\";\n} | {\n    readonly state: \"skipped-complete\";\n};\n/**\n * Portable Record file operations only. Lock files and other live operation\n * state are intentionally owned by the separate lease services below.\n */\nexport interface RecordFileSystemService {\n    readonly pathKind: (path: RecordPortablePath) => Effect.Effect<RecordPathKind, RecordFileSystemError>;\n    readonly ensureDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;\n    readonly createDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;\n    readonly listDirectory: (input: RecordListDirectoryInput) => Effect.Effect<readonly RecordDirectoryEntry[], RecordFileSystemError>;\n    readonly readFile: (input: RecordReadFileInput) => Effect.Effect<Uint8Array | undefined, RecordFileSystemError>;\n    readonly readFileStream: (input: RecordReadFileStreamInput) => Stream.Stream<Uint8Array, RecordFileSystemError>;\n    readonly writeFile: (input: RecordWriteFileInput) => Effect.Effect<void, RecordFileSystemError>;\n    readonly writeFileStream: <E, R>(input: RecordWriteFileStreamInput<E, R>) => Effect.Effect<void, RecordFileSystemError | E, R>;\n    readonly syncDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;\n    /** Maintenance-only exact portable file removal; missing is idempotent success. */\n    readonly removeFile: (file: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;\n    /** Creates `runs/<RunId>` without publishing it. */\n    readonly createRunDirectory: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<void, RecordFileSystemError>;\n    /** The only platform operation that creates `runs/<RunId>/complete`. */\n    readonly createCompleteMarker: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<void, RecordFileSystemError>;\n    /** True only for the zero-byte regular file created by `createCompleteMarker`. */\n    readonly isCompleteMarker: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<boolean, RecordFileSystemError>;\n    readonly migrationSentinelPresent: (root: RecordRoot) => Effect.Effect<boolean, RecordFileSystemError>;\n    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string, expectedRelativePaths: readonly string[]) => Effect.Effect<void, RecordFileSystemError>;\n    /** Returns the exact physical plan recorded by a current migration sentinel. */\n    readonly readMigrationSentinel: (root: RecordRoot) => Effect.Effect<{\n        readonly restoreCommit: string;\n        readonly expectedRelativePaths: readonly string[];\n    } | undefined, RecordFileSystemError>;\n    readonly removeMigrationSentinel: (root: RecordRoot) => Effect.Effect<void, RecordFileSystemError>;\n    /** The caller already owns the exclusive maintenance lease before deletion. */\n    readonly deleteIncompleteRun: (input: {\n        readonly root: RecordRoot;\n        readonly runId: string;\n    }) => Effect.Effect<RecordIncompleteRunDelete, RecordFileSystemError>;\n}\nexport class RecordFileSystem extends Context.Tag(\"@niceeval/record/RecordFileSystem\")<RecordFileSystem, RecordFileSystemService>() {\n}\n/** Entropy is a writer-only capability, not a reader requirement. */\nexport interface RecordEntropyService {\n    readonly uuid: Effect.Effect<string>;\n}\nexport class RecordEntropy extends Context.Tag(\"@niceeval/record/RecordEntropy\")<RecordEntropy, RecordEntropyService>() {\n}\n/**\n * A migration asks whether local Git can restore the current portable root;\n * absence of proof is data for the CLI confirmation flow, not an implicit OK.\n */\nexport type RecordBackupState = {\n    readonly state: \"git-restore-point\";\n    readonly commit: string;\n} | {\n    readonly state: \"not-git-worktree\";\n} | {\n    readonly state: \"root-outside-worktree\";\n} | {\n    readonly state: \"portable-root-dirty\";\n    readonly entries: readonly string[];\n};\nexport interface RecordGitService {\n    readonly inspectBackupState: (root: RecordRoot) => Effect.Effect<RecordBackupState, RecordGitError>;\n    /** Proves HEAD is unchanged and every dirty path is an expected migration write. */\n    readonly recoveryChangesAreExpected: (input: {\n        readonly root: RecordRoot;\n        readonly restoreCommit: string;\n        readonly expectedPaths: readonly RecordPortablePath[];\n    }) => Effect.Effect<boolean, RecordGitError | RecordFileSystemError>;\n}\nexport class RecordGit extends Context.Tag(\"@niceeval/record/RecordGit\")<RecordGit, RecordGitService>() {\n}\n"]}

package/dist/record/platform/services.d.cts

@@ -59,6 +59,8 @@ export interface RecordFileSystemService {
     readonly writeFile: (input: RecordWriteFileInput) => Effect.Effect<void, RecordFileSystemError>;
     readonly writeFileStream: <E, R>(input: RecordWriteFileStreamInput<E, R>) => Effect.Effect<void, RecordFileSystemError | E, R>;
     readonly syncDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;
+    /** Maintenance-only exact portable file removal; missing is idempotent success. */
+    readonly removeFile: (file: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;
     /** Creates `runs/<RunId>` without publishing it. */
     readonly createRunDirectory: (input: {
         readonly root: RecordRoot;
@@ -75,9 +77,12 @@ export interface RecordFileSystemService {
         readonly runId: string;
     }) => Effect.Effect<boolean, RecordFileSystemError>;
     readonly migrationSentinelPresent: (root: RecordRoot) => Effect.Effect<boolean, RecordFileSystemError>;
-    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string) => Effect.Effect<void, RecordFileSystemError>;
-    /** Returns the bounded restore commit recorded by a current migration sentinel. */
-    readonly readMigrationSentinelRestoreCommit: (root: RecordRoot) => Effect.Effect<string | undefined, RecordFileSystemError>;
+    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string, expectedRelativePaths: readonly string[]) => Effect.Effect<void, RecordFileSystemError>;
+    /** Returns the exact physical plan recorded by a current migration sentinel. */
+    readonly readMigrationSentinel: (root: RecordRoot) => Effect.Effect<{
+        readonly restoreCommit: string;
+        readonly expectedRelativePaths: readonly string[];
+    } | undefined, RecordFileSystemError>;
     readonly removeMigrationSentinel: (root: RecordRoot) => Effect.Effect<void, RecordFileSystemError>;
     /** The caller already owns the exclusive maintenance lease before deletion. */
     readonly deleteIncompleteRun: (input: {

package/dist/record/platform/services.d.mts

@@ -59,6 +59,8 @@ export interface RecordFileSystemService {
     readonly writeFile: (input: RecordWriteFileInput) => Effect.Effect<void, RecordFileSystemError>;
     readonly writeFileStream: <E, R>(input: RecordWriteFileStreamInput<E, R>) => Effect.Effect<void, RecordFileSystemError | E, R>;
     readonly syncDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;
+    /** Maintenance-only exact portable file removal; missing is idempotent success. */
+    readonly removeFile: (file: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;
     /** Creates `runs/<RunId>` without publishing it. */
     readonly createRunDirectory: (input: {
         readonly root: RecordRoot;
@@ -75,9 +77,12 @@ export interface RecordFileSystemService {
         readonly runId: string;
     }) => Effect.Effect<boolean, RecordFileSystemError>;
     readonly migrationSentinelPresent: (root: RecordRoot) => Effect.Effect<boolean, RecordFileSystemError>;
-    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string) => Effect.Effect<void, RecordFileSystemError>;
-    /** Returns the bounded restore commit recorded by a current migration sentinel. */
-    readonly readMigrationSentinelRestoreCommit: (root: RecordRoot) => Effect.Effect<string | undefined, RecordFileSystemError>;
+    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string, expectedRelativePaths: readonly string[]) => Effect.Effect<void, RecordFileSystemError>;
+    /** Returns the exact physical plan recorded by a current migration sentinel. */
+    readonly readMigrationSentinel: (root: RecordRoot) => Effect.Effect<{
+        readonly restoreCommit: string;
+        readonly expectedRelativePaths: readonly string[];
+    } | undefined, RecordFileSystemError>;
     readonly removeMigrationSentinel: (root: RecordRoot) => Effect.Effect<void, RecordFileSystemError>;
     /** The caller already owns the exclusive maintenance lease before deletion. */
     readonly deleteIncompleteRun: (input: {

package/dist/record/platform/services.d.ts

@@ -59,6 +59,8 @@ export interface RecordFileSystemService {
     readonly writeFile: (input: RecordWriteFileInput) => Effect.Effect<void, RecordFileSystemError>;
     readonly writeFileStream: <E, R>(input: RecordWriteFileStreamInput<E, R>) => Effect.Effect<void, RecordFileSystemError | E, R>;
     readonly syncDirectory: (directory: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;
+    /** Maintenance-only exact portable file removal; missing is idempotent success. */
+    readonly removeFile: (file: RecordPortablePath) => Effect.Effect<void, RecordFileSystemError>;
     /** Creates `runs/<RunId>` without publishing it. */
     readonly createRunDirectory: (input: {
         readonly root: RecordRoot;
@@ -75,9 +77,12 @@ export interface RecordFileSystemService {
         readonly runId: string;
     }) => Effect.Effect<boolean, RecordFileSystemError>;
     readonly migrationSentinelPresent: (root: RecordRoot) => Effect.Effect<boolean, RecordFileSystemError>;
-    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string) => Effect.Effect<void, RecordFileSystemError>;
-    /** Returns the bounded restore commit recorded by a current migration sentinel. */
-    readonly readMigrationSentinelRestoreCommit: (root: RecordRoot) => Effect.Effect<string | undefined, RecordFileSystemError>;
+    readonly createMigrationSentinel: (root: RecordRoot, restoreCommit: string, expectedRelativePaths: readonly string[]) => Effect.Effect<void, RecordFileSystemError>;
+    /** Returns the exact physical plan recorded by a current migration sentinel. */
+    readonly readMigrationSentinel: (root: RecordRoot) => Effect.Effect<{
+        readonly restoreCommit: string;
+        readonly expectedRelativePaths: readonly string[];
+    } | undefined, RecordFileSystemError>;
     readonly removeMigrationSentinel: (root: RecordRoot) => Effect.Effect<void, RecordFileSystemError>;
     /** The caller already owns the exclusive maintenance lease before deletion. */
     readonly deleteIncompleteRun: (input: {

package/dist/record/reader/format.cjs

@@ -5,8 +5,7 @@ exports.readCurrentRecordFormat = readCurrentRecordFormat;
 exports.readRecordFormatForMaintenance = readRecordFormatForMaintenance;
 const effect_1 = require("effect");
 const core_ts_1 = require("../codec/core.cjs");
-const identifiers_ts_1 = require("../codec/identifiers.cjs");
-const identifiers_ts_2 = require("../model/identifiers.cjs");
+const identifiers_ts_1 = require("../model/identifiers.cjs");
 const services_ts_1 = require("../platform/services.cjs");
 const errors_ts_1 = require("./errors.cjs");
 /** `record.json` contains only root identity, so its read has a hard small cap. */
@@ -32,64 +31,34 @@ function formatOf(value) {
         ? descriptor.value
         : undefined;
 }
-function schemaVersionOf(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return undefined;
-    const descriptor = Object.getOwnPropertyDescriptor(value, "schemaVersion");
-    return descriptor !== undefined && "value" in descriptor &&
-        Number.isSafeInteger(descriptor.value) && descriptor.value > 0
-        ? descriptor.value
-        : undefined;
-}
 function classifyRecordDocument(value) {
     const format = formatOf(value);
     if (format === undefined)
         return effect_1.Either.left(bootstrapInvalid("record-document-invalid"));
-    if (format !== identifiers_ts_2.RECORD_FORMAT) {
+    if (format !== identifiers_ts_1.RECORD_FORMAT) {
         return effect_1.Either.left(new errors_ts_1.RecordFormatUnsupported({ code: "record-format-unsupported", format }));
     }
-    const schemaVersion = schemaVersionOf(value);
-    if (schemaVersion === 1) {
-        return effect_1.Either.left(new errors_ts_1.RecordMigrationRequired({
-            code: "record-migration-required",
-            source: `${identifiers_ts_2.RECORD_FORMAT}@1`,
-            target: `${identifiers_ts_2.RECORD_FORMAT}@${identifiers_ts_2.RECORD_SCHEMA_VERSION}`,
-            command: "niceeval migrate",
-        }));
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return effect_1.Either.left(bootstrapInvalid("record-document-invalid"));
     }
-    if (schemaVersion !== identifiers_ts_2.RECORD_SCHEMA_VERSION) {
-        return effect_1.Either.left(new errors_ts_1.RecordFormatUnsupported({ code: "record-format-unsupported", format }));
+    const record = value;
+    const projected = {};
+    for (const key of Object.keys(record)) {
+        if (key !== "schemaVersion")
+            projected[key] = record[key];
     }
-    const decoded = (0, core_ts_1.decodeRecordDocument)(value);
+    const decoded = (0, core_ts_1.decodeRecordDocument)(projected);
     return effect_1.Either.isLeft(decoded)
         ? effect_1.Either.left(bootstrapInvalid("record-document-invalid"))
         : effect_1.Either.right(Object.freeze({ document: decoded.right }));
 }
-function legacyRecordDocument(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return undefined;
-    const record = value;
-    if (Object.keys(record).length !== 3 ||
-        record.format !== identifiers_ts_2.RECORD_FORMAT ||
-        record.schemaVersion !== 1)
-        return undefined;
-    const recordId = effect_1.Schema.decodeUnknownEither(identifiers_ts_1.RecordIdSchema, core_ts_1.RecordExactParseOptions)(record.recordId);
-    return effect_1.Either.isLeft(recordId) ? undefined : Object.freeze({
-        format: identifiers_ts_2.RECORD_FORMAT,
-        schemaVersion: identifiers_ts_2.RECORD_SCHEMA_VERSION,
-        recordId: recordId.right,
-    });
-}
 function readFormatBytes(fileSystem, root) {
     return fileSystem.readFile({
         file: (0, services_ts_1.recordPortablePath)(root, "record.json"),
         maximumBytes: exports.RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES,
     }).pipe(effect_1.Effect.catchTag("RecordResourceLimitExceeded", () => effect_1.Effect.fail(bootstrapInvalid("record-format-document-limit-exceeded"))));
 }
-/**
- * Reads only the bounded exact-current root header. The one published
- * predecessor is reported as migration-required but is never decoded as current.
- */
+/** Reads the bounded versionless root after dropping the reserved boundary-noise key. */
 function readCurrentRecordFormat(fileSystem, root) {
     return effect_1.Effect.gen(function* () {
         const bytes = yield* readFormatBytes(fileSystem, root);
@@ -104,7 +73,7 @@ function readCurrentRecordFormat(fileSystem, root) {
         return classified.right;
     });
 }
-/** Maintenance-only exact recognition of the one published root predecessor. */
+/** Maintenance uses the same versionless root boundary as ordinary readers. */
 function readRecordFormatForMaintenance(fileSystem, root) {
     return effect_1.Effect.gen(function* () {
         const bytes = yield* readFormatBytes(fileSystem, root);
@@ -113,28 +82,10 @@ function readRecordFormatForMaintenance(fileSystem, root) {
         const parsed = parseRecordJson(bytes);
         if (effect_1.Either.isLeft(parsed))
             return yield* effect_1.Effect.fail(parsed.left);
-        const version = schemaVersionOf(parsed.right);
-        if (version === identifiers_ts_2.RECORD_SCHEMA_VERSION) {
-            const decoded = (0, core_ts_1.decodeRecordDocument)(parsed.right);
-            if (effect_1.Either.isLeft(decoded))
-                return yield* effect_1.Effect.fail(bootstrapInvalid("record-document-invalid"));
-            return Object.freeze({
-                document: decoded.right,
-                sourceSchemaVersion: identifiers_ts_2.RECORD_SCHEMA_VERSION,
-                sourceBytes: bytes,
-            });
-        }
-        if (version === 1) {
-            const document = legacyRecordDocument(parsed.right);
-            if (document === undefined)
-                return yield* effect_1.Effect.fail(bootstrapInvalid("record-document-invalid"));
-            return Object.freeze({ document, sourceSchemaVersion: 1, sourceBytes: bytes });
-        }
-        const format = formatOf(parsed.right);
-        return yield* effect_1.Effect.fail(new errors_ts_1.RecordFormatUnsupported({
-            code: "record-format-unsupported",
-            format: format ?? "unknown",
-        }));
+        const classified = classifyRecordDocument(parsed.right);
+        if (effect_1.Either.isLeft(classified))
+            return yield* effect_1.Effect.fail(classified.left);
+        return Object.freeze({ ...classified.right, sourceBytes: bytes });
     });
 }
 //# sourceMappingURL=format.cjs.map

package/dist/record/reader/format.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"format.js","sourceRoot":"","sources":["format.ts"],"names":[],"mappings":";;;AAiGA,0DAaC;AAED,wEA+BC;AA/ID,mCAAgD;AAChD,8CAAiF;AACjF,4DAAyD;AAEzD,4DAA+E;AAE/E,yDAA4F;AAE5F,2CAAwG;AACxG,mFAAmF;AACtE,QAAA,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ9D,SAAS,gBAAgB,CAAC,MAA2E;IACjG,OAAO,IAAI,kCAAsB,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC,CAAC;AACpF,CAAC;AACD,SAAS,eAAe,CAAC,KAAiB;IACtC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,eAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,CAAC;QACH,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACpE,CAAC;AACL,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;QAC5F,CAAC,CAAC,UAAU,CAAC,KAAK;QAClB,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,SAAS,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC3E,OAAO,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU;QACpD,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,GAAG,CAAC;QAC9D,CAAC,CAAC,UAAU,CAAC,KAAK;QAClB,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AACD,SAAS,sBAAsB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QACpB,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,8BAAa,EAAE,CAAC;QAC3B,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,mCAAuB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,mCAAuB,CAAC;YAC3C,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,GAAG,8BAAa,IAAI;YAC5B,MAAM,EAAE,GAAG,8BAAa,IAAI,sCAAqB,EAAE;YACnD,OAAO,EAAE,kBAAkB;SAC9B,CAAC,CAAC,CAAC;IACR,CAAC;IACD,IAAI,aAAa,KAAK,sCAAqB,EAAE,CAAC;QAC1C,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,mCAAuB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,8BAAoB,EAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,eAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC,CAAC,eAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AACD,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,SAAS,CAAC;IACrB,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,CAAC,MAAM,KAAK,8BAAa;QAC/B,MAAM,CAAC,aAAa,KAAK,CAAC;QAC1B,OAAO,SAAS,CAAC;IACrB,MAAM,QAAQ,GAAG,eAAM,CAAC,mBAAmB,CAAC,+BAAc,EAAE,iCAAuB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtG,OAAO,eAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QACvD,MAAM,EAAE,8BAAyC;QACjD,aAAa,EAAE,sCAAqB;QACpC,QAAQ,EAAE,QAAQ,CAAC,KAAK;KAC3B,CAAC,CAAC;AACP,CAAC;AACD,SAAS,eAAe,CAAC,UAAmC,EAAE,IAAgB;IAC1E,OAAO,UAAU,CAAC,QAAQ,CAAC;QACvB,IAAI,EAAE,IAAA,gCAAkB,EAAC,IAAI,EAAE,aAAa,CAAC;QAC7C,YAAY,EAAE,4CAAoC;KACrD,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,uCAAuC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1I,CAAC;AACD;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,UAAmC,EAAE,IAAgB;IACzF,OAAO,eAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YACnB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,eAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,UAAU,CAAC,KAAK,CAAC;IAC5B,CAAC,CAAC,CAAC;AACP,CAAC;AACD,gFAAgF;AAChF,SAAgB,8BAA8B,CAAC,UAAmC,EAAE,IAAgB;IAChG,OAAO,eAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YACnB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,sCAAqB,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAA,8BAAoB,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,eAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACtB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC,MAAM,CAAC;gBACjB,QAAQ,EAAE,OAAO,CAAC,KAAK;gBACvB,mBAAmB,EAAE,sCAAqB;gBAC1C,WAAW,EAAE,KAAK;aACrB,CAAC,CAAC;QACP,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,QAAQ,KAAK,SAAS;gBACtB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,mCAAuB,CAAC;YAClD,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,MAAM,IAAI,SAAS;SAC9B,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Effect, Either, Schema } from \"effect\";\nimport { decodeRecordDocument, RecordExactParseOptions } from \"../codec/core.ts\";\nimport { RecordIdSchema } from \"../codec/identifiers.ts\";\nimport type { RecordDocument } from \"../model/core.ts\";\nimport { RECORD_FORMAT, RECORD_SCHEMA_VERSION } from \"../model/identifiers.ts\";\nimport type { RecordFileSystemError } from \"../platform/errors.ts\";\nimport { recordPortablePath, type RecordFileSystemService, } from \"../platform/services.ts\";\nimport type { RecordRoot } from \"../platform/root.ts\";\nimport { RecordBootstrapInvalid, RecordFormatUnsupported, RecordMigrationRequired, } from \"./errors.ts\";\n/** `record.json` contains only root identity, so its read has a hard small cap. */\nexport const RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES = 64 * 1024;\nexport interface CurrentRecordFormatRead {\n    readonly document: RecordDocument;\n}\nexport interface MaintenanceRecordFormatRead extends CurrentRecordFormatRead {\n    readonly sourceSchemaVersion: 1 | typeof RECORD_SCHEMA_VERSION;\n    readonly sourceBytes: Uint8Array;\n}\nfunction bootstrapInvalid(reason: \"record-document-invalid\" | \"record-format-document-limit-exceeded\"): RecordBootstrapInvalid {\n    return new RecordBootstrapInvalid({ code: \"record-bootstrap-invalid\", reason });\n}\nfunction parseRecordJson(bytes: Uint8Array): Either.Either<unknown, RecordBootstrapInvalid> {\n    try {\n        const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n        return Either.right(JSON.parse(text) as unknown);\n    }\n    catch {\n        return Either.left(bootstrapInvalid(\"record-document-invalid\"));\n    }\n}\nfunction formatOf(value: unknown): string | undefined {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n        return undefined;\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(value, \"format\");\n    return descriptor !== undefined && \"value\" in descriptor && typeof descriptor.value === \"string\"\n        ? descriptor.value\n        : undefined;\n}\nfunction schemaVersionOf(value: unknown): number | undefined {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value))\n        return undefined;\n    const descriptor = Object.getOwnPropertyDescriptor(value, \"schemaVersion\");\n    return descriptor !== undefined && \"value\" in descriptor &&\n        Number.isSafeInteger(descriptor.value) && descriptor.value > 0\n        ? descriptor.value\n        : undefined;\n}\nfunction classifyRecordDocument(value: unknown): Either.Either<CurrentRecordFormatRead, RecordBootstrapInvalid | RecordFormatUnsupported | RecordMigrationRequired> {\n    const format = formatOf(value);\n    if (format === undefined)\n        return Either.left(bootstrapInvalid(\"record-document-invalid\"));\n    if (format !== RECORD_FORMAT) {\n        return Either.left(new RecordFormatUnsupported({ code: \"record-format-unsupported\", format }));\n    }\n    const schemaVersion = schemaVersionOf(value);\n    if (schemaVersion === 1) {\n        return Either.left(new RecordMigrationRequired({\n            code: \"record-migration-required\",\n            source: `${RECORD_FORMAT}@1`,\n            target: `${RECORD_FORMAT}@${RECORD_SCHEMA_VERSION}`,\n            command: \"niceeval migrate\",\n        }));\n    }\n    if (schemaVersion !== RECORD_SCHEMA_VERSION) {\n        return Either.left(new RecordFormatUnsupported({ code: \"record-format-unsupported\", format }));\n    }\n    const decoded = decodeRecordDocument(value);\n    return Either.isLeft(decoded)\n        ? Either.left(bootstrapInvalid(\"record-document-invalid\"))\n        : Either.right(Object.freeze({ document: decoded.right }));\n}\nfunction legacyRecordDocument(value: unknown): RecordDocument | undefined {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value))\n        return undefined;\n    const record = value as Record<string, unknown>;\n    if (Object.keys(record).length !== 3 ||\n        record.format !== RECORD_FORMAT ||\n        record.schemaVersion !== 1)\n        return undefined;\n    const recordId = Schema.decodeUnknownEither(RecordIdSchema, RecordExactParseOptions)(record.recordId);\n    return Either.isLeft(recordId) ? undefined : Object.freeze({\n        format: RECORD_FORMAT as RecordDocument[\"format\"],\n        schemaVersion: RECORD_SCHEMA_VERSION,\n        recordId: recordId.right,\n    });\n}\nfunction readFormatBytes(fileSystem: RecordFileSystemService, root: RecordRoot) {\n    return fileSystem.readFile({\n        file: recordPortablePath(root, \"record.json\"),\n        maximumBytes: RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES,\n    }).pipe(Effect.catchTag(\"RecordResourceLimitExceeded\", () => Effect.fail(bootstrapInvalid(\"record-format-document-limit-exceeded\"))));\n}\n/**\n * Reads only the bounded exact-current root header. The one published\n * predecessor is reported as migration-required but is never decoded as current.\n */\nexport function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported | RecordMigrationRequired> {\n    return Effect.gen(function* () {\n        const bytes = yield* readFormatBytes(fileSystem, root);\n        if (bytes === undefined)\n            return yield* Effect.fail(bootstrapInvalid(\"record-document-invalid\"));\n        const parsed = parseRecordJson(bytes);\n        if (Either.isLeft(parsed))\n            return yield* Effect.fail(parsed.left);\n        const classified = classifyRecordDocument(parsed.right);\n        if (Either.isLeft(classified))\n            return yield* Effect.fail(classified.left);\n        return classified.right;\n    });\n}\n/** Maintenance-only exact recognition of the one published root predecessor. */\nexport function readRecordFormatForMaintenance(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<MaintenanceRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported> {\n    return Effect.gen(function* () {\n        const bytes = yield* readFormatBytes(fileSystem, root);\n        if (bytes === undefined)\n            return yield* Effect.fail(bootstrapInvalid(\"record-document-invalid\"));\n        const parsed = parseRecordJson(bytes);\n        if (Either.isLeft(parsed))\n            return yield* Effect.fail(parsed.left);\n        const version = schemaVersionOf(parsed.right);\n        if (version === RECORD_SCHEMA_VERSION) {\n            const decoded = decodeRecordDocument(parsed.right);\n            if (Either.isLeft(decoded))\n                return yield* Effect.fail(bootstrapInvalid(\"record-document-invalid\"));\n            return Object.freeze({\n                document: decoded.right,\n                sourceSchemaVersion: RECORD_SCHEMA_VERSION,\n                sourceBytes: bytes,\n            });\n        }\n        if (version === 1) {\n            const document = legacyRecordDocument(parsed.right);\n            if (document === undefined)\n                return yield* Effect.fail(bootstrapInvalid(\"record-document-invalid\"));\n            return Object.freeze({ document, sourceSchemaVersion: 1 as const, sourceBytes: bytes });\n        }\n        const format = formatOf(parsed.right);\n        return yield* Effect.fail(new RecordFormatUnsupported({\n            code: \"record-format-unsupported\",\n            format: format ?? \"unknown\",\n        }));\n    });\n}\n"]}
+{"version":3,"file":"format.js","sourceRoot":"","sources":["format.ts"],"names":[],"mappings":";;;AAkEA,0DAaC;AAED,wEAaC;AA9FD,mCAAwC;AACxC,8CAAwD;AAExD,4DAAwD;AAExD,yDAA4F;AAE5F,2CAA+E;AAC/E,mFAAmF;AACtE,QAAA,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ9D,SAAS,gBAAgB,CAAC,MAA2E;IACjG,OAAO,IAAI,kCAAsB,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC,CAAC;AACpF,CAAC;AACD,SAAS,eAAe,CAAC,KAAiB;IACtC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,eAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,CAAC;QACH,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACpE,CAAC;AACL,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;QAC5F,CAAC,CAAC,UAAU,CAAC,KAAK;QAClB,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AACD,SAAS,sBAAsB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QACpB,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,8BAAa,EAAE,CAAC;QAC3B,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,mCAAuB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,eAAe;YACvB,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,8BAAoB,EAAC,SAAS,CAAC,CAAC;IAChD,OAAO,eAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC,CAAC,eAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AACD,SAAS,eAAe,CAAC,UAAmC,EAAE,IAAgB;IAC1E,OAAO,UAAU,CAAC,QAAQ,CAAC;QACvB,IAAI,EAAE,IAAA,gCAAkB,EAAC,IAAI,EAAE,aAAa,CAAC;QAC7C,YAAY,EAAE,4CAAoC;KACrD,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,uCAAuC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1I,CAAC;AACD,yFAAyF;AACzF,SAAgB,uBAAuB,CAAC,UAAmC,EAAE,IAAgB;IACzF,OAAO,eAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YACnB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,eAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,UAAU,CAAC,KAAK,CAAC;IAC5B,CAAC,CAAC,CAAC;AACP,CAAC;AACD,+EAA+E;AAC/E,SAAgB,8BAA8B,CAAC,UAAmC,EAAE,IAAgB;IAChG,OAAO,eAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YACnB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,eAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Effect, Either } from \"effect\";\nimport { decodeRecordDocument } from \"../codec/core.ts\";\nimport type { RecordDocument } from \"../model/core.ts\";\nimport { RECORD_FORMAT } from \"../model/identifiers.ts\";\nimport type { RecordFileSystemError } from \"../platform/errors.ts\";\nimport { recordPortablePath, type RecordFileSystemService, } from \"../platform/services.ts\";\nimport type { RecordRoot } from \"../platform/root.ts\";\nimport { RecordBootstrapInvalid, RecordFormatUnsupported, } from \"./errors.ts\";\n/** `record.json` contains only root identity, so its read has a hard small cap. */\nexport const RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES = 64 * 1024;\nexport interface CurrentRecordFormatRead {\n    readonly document: RecordDocument;\n}\nexport interface MaintenanceRecordFormatRead extends CurrentRecordFormatRead {\n    /** Identity/stale precondition only; maintenance never rewrites this file. */\n    readonly sourceBytes: Uint8Array;\n}\nfunction bootstrapInvalid(reason: \"record-document-invalid\" | \"record-format-document-limit-exceeded\"): RecordBootstrapInvalid {\n    return new RecordBootstrapInvalid({ code: \"record-bootstrap-invalid\", reason });\n}\nfunction parseRecordJson(bytes: Uint8Array): Either.Either<unknown, RecordBootstrapInvalid> {\n    try {\n        const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n        return Either.right(JSON.parse(text) as unknown);\n    }\n    catch {\n        return Either.left(bootstrapInvalid(\"record-document-invalid\"));\n    }\n}\nfunction formatOf(value: unknown): string | undefined {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n        return undefined;\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(value, \"format\");\n    return descriptor !== undefined && \"value\" in descriptor && typeof descriptor.value === \"string\"\n        ? descriptor.value\n        : undefined;\n}\nfunction classifyRecordDocument(value: unknown): Either.Either<CurrentRecordFormatRead, RecordBootstrapInvalid | RecordFormatUnsupported> {\n    const format = formatOf(value);\n    if (format === undefined)\n        return Either.left(bootstrapInvalid(\"record-document-invalid\"));\n    if (format !== RECORD_FORMAT) {\n        return Either.left(new RecordFormatUnsupported({ code: \"record-format-unsupported\", format }));\n    }\n    if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n        return Either.left(bootstrapInvalid(\"record-document-invalid\"));\n    }\n    const record = value as Record<string, unknown>;\n    const projected: Record<string, unknown> = {};\n    for (const key of Object.keys(record)) {\n        if (key !== \"schemaVersion\")\n            projected[key] = record[key];\n    }\n    const decoded = decodeRecordDocument(projected);\n    return Either.isLeft(decoded)\n        ? Either.left(bootstrapInvalid(\"record-document-invalid\"))\n        : Either.right(Object.freeze({ document: decoded.right }));\n}\nfunction readFormatBytes(fileSystem: RecordFileSystemService, root: RecordRoot) {\n    return fileSystem.readFile({\n        file: recordPortablePath(root, \"record.json\"),\n        maximumBytes: RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES,\n    }).pipe(Effect.catchTag(\"RecordResourceLimitExceeded\", () => Effect.fail(bootstrapInvalid(\"record-format-document-limit-exceeded\"))));\n}\n/** Reads the bounded versionless root after dropping the reserved boundary-noise key. */\nexport function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported> {\n    return Effect.gen(function* () {\n        const bytes = yield* readFormatBytes(fileSystem, root);\n        if (bytes === undefined)\n            return yield* Effect.fail(bootstrapInvalid(\"record-document-invalid\"));\n        const parsed = parseRecordJson(bytes);\n        if (Either.isLeft(parsed))\n            return yield* Effect.fail(parsed.left);\n        const classified = classifyRecordDocument(parsed.right);\n        if (Either.isLeft(classified))\n            return yield* Effect.fail(classified.left);\n        return classified.right;\n    });\n}\n/** Maintenance uses the same versionless root boundary as ordinary readers. */\nexport function readRecordFormatForMaintenance(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<MaintenanceRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported> {\n    return Effect.gen(function* () {\n        const bytes = yield* readFormatBytes(fileSystem, root);\n        if (bytes === undefined)\n            return yield* Effect.fail(bootstrapInvalid(\"record-document-invalid\"));\n        const parsed = parseRecordJson(bytes);\n        if (Either.isLeft(parsed))\n            return yield* Effect.fail(parsed.left);\n        const classified = classifyRecordDocument(parsed.right);\n        if (Either.isLeft(classified))\n            return yield* Effect.fail(classified.left);\n        return Object.freeze({ ...classified.right, sourceBytes: bytes });\n    });\n}\n"]}

package/dist/record/reader/format.d.cts

@@ -1,23 +1,19 @@
 import { Effect } from "effect";
 import type { RecordDocument } from "../model/core.cjs";
-import { RECORD_SCHEMA_VERSION } from "../model/identifiers.cjs";
 import type { RecordFileSystemError } from "../platform/errors.cjs";
 import { type RecordFileSystemService } from "../platform/services.cjs";
 import type { RecordRoot } from "../platform/root.cjs";
-import { RecordBootstrapInvalid, RecordFormatUnsupported, RecordMigrationRequired } from "./errors.cjs";
+import { RecordBootstrapInvalid, RecordFormatUnsupported } from "./errors.cjs";
 /** `record.json` contains only root identity, so its read has a hard small cap. */
 export declare const RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES: number;
 export interface CurrentRecordFormatRead {
     readonly document: RecordDocument;
 }
 export interface MaintenanceRecordFormatRead extends CurrentRecordFormatRead {
-    readonly sourceSchemaVersion: 1 | typeof RECORD_SCHEMA_VERSION;
+    /** Identity/stale precondition only; maintenance never rewrites this file. */
     readonly sourceBytes: Uint8Array;
 }
-/**
- * Reads only the bounded exact-current root header. The one published
- * predecessor is reported as migration-required but is never decoded as current.
- */
-export declare function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported | RecordMigrationRequired>;
-/** Maintenance-only exact recognition of the one published root predecessor. */
+/** Reads the bounded versionless root after dropping the reserved boundary-noise key. */
+export declare function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported>;
+/** Maintenance uses the same versionless root boundary as ordinary readers. */
 export declare function readRecordFormatForMaintenance(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<MaintenanceRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported>;

package/dist/record/reader/format.d.mts

@@ -1,23 +1,19 @@
 import { Effect } from "effect";
 import type { RecordDocument } from "../model/core.mjs";
-import { RECORD_SCHEMA_VERSION } from "../model/identifiers.mjs";
 import type { RecordFileSystemError } from "../platform/errors.mjs";
 import { type RecordFileSystemService } from "../platform/services.mjs";
 import type { RecordRoot } from "../platform/root.mjs";
-import { RecordBootstrapInvalid, RecordFormatUnsupported, RecordMigrationRequired } from "./errors.mjs";
+import { RecordBootstrapInvalid, RecordFormatUnsupported } from "./errors.mjs";
 /** `record.json` contains only root identity, so its read has a hard small cap. */
 export declare const RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES: number;
 export interface CurrentRecordFormatRead {
     readonly document: RecordDocument;
 }
 export interface MaintenanceRecordFormatRead extends CurrentRecordFormatRead {
-    readonly sourceSchemaVersion: 1 | typeof RECORD_SCHEMA_VERSION;
+    /** Identity/stale precondition only; maintenance never rewrites this file. */
     readonly sourceBytes: Uint8Array;
 }
-/**
- * Reads only the bounded exact-current root header. The one published
- * predecessor is reported as migration-required but is never decoded as current.
- */
-export declare function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported | RecordMigrationRequired>;
-/** Maintenance-only exact recognition of the one published root predecessor. */
+/** Reads the bounded versionless root after dropping the reserved boundary-noise key. */
+export declare function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported>;
+/** Maintenance uses the same versionless root boundary as ordinary readers. */
 export declare function readRecordFormatForMaintenance(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<MaintenanceRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported>;

package/dist/record/reader/format.d.ts

@@ -1,23 +1,19 @@
 import { Effect } from "effect";
 import type { RecordDocument } from "../model/core.js";
-import { RECORD_SCHEMA_VERSION } from "../model/identifiers.js";
 import type { RecordFileSystemError } from "../platform/errors.js";
 import { type RecordFileSystemService } from "../platform/services.js";
 import type { RecordRoot } from "../platform/root.js";
-import { RecordBootstrapInvalid, RecordFormatUnsupported, RecordMigrationRequired } from "./errors.js";
+import { RecordBootstrapInvalid, RecordFormatUnsupported } from "./errors.js";
 /** `record.json` contains only root identity, so its read has a hard small cap. */
 export declare const RECORD_FORMAT_DOCUMENT_MAXIMUM_BYTES: number;
 export interface CurrentRecordFormatRead {
     readonly document: RecordDocument;
 }
 export interface MaintenanceRecordFormatRead extends CurrentRecordFormatRead {
-    readonly sourceSchemaVersion: 1 | typeof RECORD_SCHEMA_VERSION;
+    /** Identity/stale precondition only; maintenance never rewrites this file. */
     readonly sourceBytes: Uint8Array;
 }
-/**
- * Reads only the bounded exact-current root header. The one published
- * predecessor is reported as migration-required but is never decoded as current.
- */
-export declare function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported | RecordMigrationRequired>;
-/** Maintenance-only exact recognition of the one published root predecessor. */
+/** Reads the bounded versionless root after dropping the reserved boundary-noise key. */
+export declare function readCurrentRecordFormat(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<CurrentRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported>;
+/** Maintenance uses the same versionless root boundary as ordinary readers. */
 export declare function readRecordFormatForMaintenance(fileSystem: RecordFileSystemService, root: RecordRoot): Effect.Effect<MaintenanceRecordFormatRead, RecordFileSystemError | RecordBootstrapInvalid | RecordFormatUnsupported>;

package/dist/record/reader/index.js

@@ -37,12 +37,14 @@ const __niceevalExport16 = __niceevalCanonical["RecordReaderClosed"];
 export { __niceevalExport16 as RecordReaderClosed };
 const __niceevalExport17 = __niceevalCanonical["frozenRecordAttemptBrand"];
 export { __niceevalExport17 as frozenRecordAttemptBrand };
-const __niceevalExport18 = __niceevalCanonical["readCurrentRecordFormat"];
-export { __niceevalExport18 as readCurrentRecordFormat };
-const __niceevalExport19 = __niceevalCanonical["readFixedRecordAttachment"];
-export { __niceevalExport19 as readFixedRecordAttachment };
-const __niceevalExport20 = __niceevalCanonical["readRecordFormatForMaintenance"];
-export { __niceevalExport20 as readRecordFormatForMaintenance };
-const __niceevalExport21 = __niceevalCanonical["validateFixedRecordAttachmentMigrationSource"];
-export { __niceevalExport21 as validateFixedRecordAttachmentMigrationSource };
+const __niceevalExport18 = __niceevalCanonical["inspectFixedRecordAttachmentEnvelope"];
+export { __niceevalExport18 as inspectFixedRecordAttachmentEnvelope };
+const __niceevalExport19 = __niceevalCanonical["readCurrentRecordFormat"];
+export { __niceevalExport19 as readCurrentRecordFormat };
+const __niceevalExport20 = __niceevalCanonical["readFixedRecordAttachment"];
+export { __niceevalExport20 as readFixedRecordAttachment };
+const __niceevalExport21 = __niceevalCanonical["readRecordFormatForMaintenance"];
+export { __niceevalExport21 as readRecordFormatForMaintenance };
+const __niceevalExport22 = __niceevalCanonical["validateFixedRecordAttachmentMigrationSource"];
+export { __niceevalExport22 as validateFixedRecordAttachmentMigrationSource };
 //# sourceMappingURL=index.js.map

package/dist/record/reader/runtime.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RECORD_DURABLE_BLOB_REF_KEY = exports.RECORD_READER_MAXIMUM_ATTACHMENT_DOCUMENT_BYTES = exports.RECORD_READER_MAXIMUM_ATTACHMENT_TOTAL_BYTES = exports.RECORD_READER_MAXIMUM_ATTACHMENT_BLOB_BYTES = exports.RECORD_READER_MAXIMUM_ATTACHMENT_BLOB_ENTRIES = void 0;
+exports.inspectFixedRecordAttachmentEnvelope = inspectFixedRecordAttachmentEnvelope;
 exports.readFixedRecordAttachment = readFixedRecordAttachment;
 exports.validateFixedRecordAttachmentMigrationSource = validateFixedRecordAttachmentMigrationSource;
 const effect_1 = require("effect");
@@ -22,6 +23,12 @@ function attachmentInvalid(path) {
         throw new Error("Attachment invalid state requires one issue");
     return Object.freeze({ state: "invalid", issues });
 }
+function attachmentEnvelopeInvalid(path) {
+    const issues = (0, record_errors_ts_1.nonEmptyRecordIssues)([(0, record_errors_ts_1.recordIssue)("record-schema-invalid", path)]);
+    if (issues === undefined)
+        throw new Error("Attachment invalid state requires one issue");
+    return Object.freeze({ state: "invalid", issues });
+}
 function attachmentPath(root, location, family, ...segments) {
     return location.owner === "run"
         ? (0, services_ts_1.recordPortablePath)(root, "runs", location.runId, "attachments", family, ...segments)
@@ -117,31 +124,23 @@ function hasReachableAdjacentMigration(descriptor, fromSchemaVersion) {
     }
     return true;
 }
-/**
- * Reads precisely one known static family. Unknown sibling directories are
- * intentionally neither enumerated nor decoded, so future independent
- * families remain preserved and ignored by the normal graph.
- */
-function readFixedRecordAttachment(input) {
+/** Open-session gate: inspect only directory identity and exact envelope/version. */
+function inspectFixedRecordAttachmentEnvelope(input) {
     return effect_1.Effect.gen(function* () {
         const directory = attachmentPath(input.root, input.location, input.descriptor.family);
         const kind = yield* input.fileSystem.pathKind(directory);
         if (kind === "missing")
             return Object.freeze({ state: "unavailable" });
         if (kind !== "directory")
-            return attachmentInvalid(["attachment"]);
+            return attachmentEnvelopeInvalid(["attachment"]);
         const envelopeDocument = yield* readJson(input.fileSystem, attachmentPath(input.root, input.location, input.descriptor.family, "attachment.json"));
         if (envelopeDocument.state !== "available")
-            return attachmentInvalid(["attachment.json"]);
+            return attachmentEnvelopeInvalid(["attachment.json"]);
         const envelope = (0, core_ts_1.decodeRecordAttachmentEnvelope)(envelopeDocument.value);
         if (effect_1.Either.isLeft(envelope))
-            return attachmentInvalid(["attachment.json"]);
-        // We reached a directory for one known fixed family. Its envelope must
-        // declare that same family; treating a swapped envelope as an unknown
-        // sibling would let a corrupted known directory masquerade as tolerated
-        // future data.
+            return attachmentEnvelopeInvalid(["attachment.json"]);
         if (envelope.right.family !== input.descriptor.family) {
-            return attachmentInvalid(["attachment.json", "family"]);
+            return attachmentEnvelopeInvalid(["attachment.json", "family"]);
         }
         if (envelope.right.schemaVersion < input.descriptor.schemaVersion &&
             hasReachableAdjacentMigration(input.descriptor, envelope.right.schemaVersion)) {
@@ -153,17 +152,25 @@ function readFixedRecordAttachment(input) {
                 command: "niceeval migrate",
             });
         }
-        if (envelope.right.schemaVersion !== input.descriptor.schemaVersion) {
-            // A well-formed envelope for a known family can still carry a version
-            // this reader cannot interpret. Only a reachable older version asks for
-            // migration; all other non-current versions remain local unsupported
-            // data, rather than being misclassified as corrupt bytes.
-            return Object.freeze({
+        return envelope.right.schemaVersion === input.descriptor.schemaVersion
+            ? Object.freeze({ state: "current" })
+            : Object.freeze({
                 state: "unsupported",
                 family: input.descriptor.family,
                 schemaVersion: envelope.right.schemaVersion,
             });
-        }
+    });
+}
+/**
+ * Reads precisely one known static family. Unknown sibling directories are
+ * intentionally neither enumerated nor decoded, so future independent
+ * families remain preserved and ignored by the normal graph.
+ */
+function readFixedRecordAttachment(input) {
+    return effect_1.Effect.gen(function* () {
+        const envelope = yield* inspectFixedRecordAttachmentEnvelope(input);
+        if (envelope.state !== "current")
+            return envelope;
         const payloadDocument = yield* readJson(input.fileSystem, attachmentPath(input.root, input.location, input.descriptor.family, "payload.json"));
         if (payloadDocument.state !== "available")
             return attachmentInvalid(["payload.json"]);
@@ -204,9 +211,10 @@ function readFixedRecordAttachment(input) {
 }
 /**
  * Maintenance-only validation of one exact historical attachment before its
- * envelope advances. The durable payload and blob bytes are never rewritten:
- * the historical decoder proves the old shape, while the current descriptor
- * proves that the unchanged bytes and closure are valid after the step.
+ * envelope advances. The historical decoder proves the old shape, the pure
+ * adjacent migration constructs the current payload, and the current
+ * descriptor proves its exact shape and blob closure. Physical rewrite policy
+ * remains host-owned metadata; `rewritePayload` is only its consistency check.
  */
 function validateFixedRecordAttachmentMigrationSource(input) {
     return effect_1.Effect.gen(function* () {
@@ -239,18 +247,13 @@ function validateFixedRecordAttachmentMigrationSource(input) {
             [...hydrated.refsByKey.keys()].some((key) => !entriesByKey.has(key))) {
             return false;
         }
-        let migrated;
+        let historical;
         try {
-            migrated = input.migrate(input.decodeHistorical(hydrated.value));
+            historical = input.decodeHistorical(hydrated.value);
         }
         catch {
             return false;
         }
-        if (effect_1.Either.isLeft(input.descriptor.write.decodePayload(migrated)))
-            return false;
-        const payload = input.descriptor.write.decodePayload(hydrated.value);
-        if (effect_1.Either.isLeft(payload))
-            return false;
         let totalBytes = 0;
         const materialized = [];
         for (const [key, ref] of hydrated.refsByKey) {
@@ -262,7 +265,35 @@ function validateFixedRecordAttachmentMigrationSource(input) {
                 return false;
             materialized.push(Object.freeze({ ref, bytes }));
         }
-        return effect_1.Either.isRight((0, internal_ts_1.makeFixedRecordAttachmentValueFromDecoded)(input.descriptor.write, payload.right, materialized));
+        if (input.verifyHistorical !== undefined && !input.verifyHistorical(historical, materialized)) {
+            return false;
+        }
+        let migrated;
+        try {
+            migrated = input.migrate(historical);
+        }
+        catch {
+            return false;
+        }
+        const payload = input.descriptor.write.decodePayload(migrated);
+        if (effect_1.Either.isLeft(payload))
+            return false;
+        const currentRefs = new Set(input.descriptor.write.refs(payload.right));
+        const currentMaterialized = materialized.filter((blob) => currentRefs.has(blob.ref));
+        if (effect_1.Either.isLeft((0, internal_ts_1.makeFixedRecordAttachmentValueFromDecoded)(input.descriptor.write, payload.right, currentMaterialized)))
+            return false;
+        const bytesByRef = new Map(materialized.map((blob) => [blob.ref, blob.bytes]));
+        const removedBlobs = [...hydrated.refsByKey]
+            .filter(([, ref]) => !currentRefs.has(ref))
+            .map(([key, ref]) => Object.freeze({ key, bytes: bytesByRef.get(ref) }));
+        return Object.freeze({
+            payload: payload.right,
+            blobKeys: new Map([...hydrated.refsByKey]
+                .filter(([, ref]) => currentRefs.has(ref))
+                .map(([key, ref]) => [ref, key])),
+            removedBlobs: Object.freeze(removedBlobs),
+            rewritePayload: migrated !== historical,
+        });
     });
 }
 //# sourceMappingURL=runtime.cjs.map