oh-my-super-agent 0.1.0

package/dist/src/outbox/store.js

@@ -0,0 +1,834 @@
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, fsyncSync, linkSync, lstatSync, openSync, readdirSync, unlinkSync, writeFileSync, } from "node:fs";
+import { basename, join } from "node:path";
+import { assertActorId, assertOpaqueId } from "../domain/records.js";
+import { acquireDirectoryLock, readLockOwner, recoverDirectoryLock, } from "../runtime/lock.js";
+import { assertSchema } from "../runtime/schema.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { systemBootId, systemClockSample } from "../runtime/system-clock.js";
+import { processIsAlive } from "../runtime/process-identity.js";
+import { errorMessage, isRecord, readJsonFileNoFollow, validateExistingDirectory } from "../utils/fs.js";
+const MAX_OUTBOX_BYTES = 1024 * 1024;
+const OUTBOX_STORE = Symbol("OMS outbox store");
+const OUTBOX_STORES = new WeakSet();
+const OUTBOX_INTERNALS = new WeakMap();
+const CERTIFICATION_WRITER = Symbol("OMS run certification authority writer");
+const CERTIFICATION_RESOLVER = Symbol("OMS run certification authority resolver");
+const CERTIFICATION_REFERENCE = Symbol("OMS run certification authority reference");
+const CERTIFICATION_WRITERS = new WeakSet();
+const CERTIFICATION_RESOLVERS = new WeakSet();
+const CERTIFICATION_REFERENCES = new WeakSet();
+const CERTIFICATION_EVENT_KIND = "run-certification-authority";
+const CERTIFICATION_CONSUMER_ID = "run-ledger-authority";
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const RUN_ID_PATTERN = /^run-[a-f0-9]{48}$/;
+const ENTRY_ID_PATTERN = /^audit-[a-f0-9]{48}$/;
+export class ImmutableOutboxConflictError extends Error {
+    constructor(kind, id) {
+        super(`${kind} identity conflicts with immutable content: ${id}`);
+        this.name = "ImmutableOutboxConflictError";
+    }
+}
+const ID_SCHEMA = {
+    type: "string",
+    pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
+};
+const EVENT_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+        "schema_version",
+        "event_id",
+        "event_kind",
+        "source_id",
+        "source_version",
+        "dedupe_key",
+        "occurred_at",
+        "payload",
+    ],
+    properties: {
+        schema_version: { const: 1 },
+        event_id: ID_SCHEMA,
+        event_kind: ID_SCHEMA,
+        source_id: ID_SCHEMA,
+        source_version: { type: "integer", minimum: 0 },
+        dedupe_key: ID_SCHEMA,
+        occurred_at: { type: "string", minLength: 20, maxLength: 24 },
+        payload: { type: "object" },
+    },
+};
+const RECEIPT_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+        "schema_version",
+        "receipt_id",
+        "event_id",
+        "consumer_id",
+        "operation_nonce",
+        "processed_at",
+        "result",
+    ],
+    properties: {
+        schema_version: { const: 1 },
+        receipt_id: ID_SCHEMA,
+        event_id: ID_SCHEMA,
+        consumer_id: ID_SCHEMA,
+        operation_nonce: ID_SCHEMA,
+        processed_at: { type: "string", minLength: 20, maxLength: 24 },
+        result: { type: "object" },
+    },
+};
+export function createOutboxStore(options) {
+    const capturedOptions = {
+        eventsRoot: options.eventsRoot,
+        receiptsRoot: options.receiptsRoot,
+        locksRoot: options.locksRoot,
+    };
+    const eventsRoot = captureRoot(capturedOptions.eventsRoot, "outbox events root");
+    const receiptsRoot = captureRoot(capturedOptions.receiptsRoot, "outbox receipts root");
+    const locksRoot = captureRoot(capturedOptions.locksRoot, "outbox locks root");
+    if (new Set([eventsRoot.path, receiptsRoot.path, locksRoot.path]).size !== 3) {
+        throw new Error("outbox events, receipts, and locks roots must be different directories");
+    }
+    function readEvent(eventId) {
+        const normalizedId = assertOpaqueId(eventId, "event id");
+        eventsRoot.assertUnchanged();
+        const event = validateEvent(readJsonFileNoFollow(join(eventsRoot.path, `${normalizedId}.json`), MAX_OUTBOX_BYTES));
+        eventsRoot.assertUnchanged();
+        if (event.event_id !== normalizedId)
+            throw new Error("outbox event filename does not match its identity");
+        return event;
+    }
+    function readEventIfExists(eventId) {
+        const normalizedId = assertOpaqueId(eventId, "event id");
+        const path = join(eventsRoot.path, `${normalizedId}.json`);
+        eventsRoot.assertUnchanged();
+        if (!pathExistsNoFollow(path))
+            return undefined;
+        return readEvent(normalizedId);
+    }
+    function readReceipt(eventId, consumerId) {
+        const receiptId = deriveReceiptId(eventId, consumerId);
+        receiptsRoot.assertUnchanged();
+        const path = join(receiptsRoot.path, `${receiptId}.json`);
+        if (!pathExistsNoFollow(path)) {
+            receiptsRoot.assertUnchanged();
+            return undefined;
+        }
+        const receipt = validateReceipt(readJsonFileNoFollow(path, MAX_OUTBOX_BYTES));
+        receiptsRoot.assertUnchanged();
+        assertReceiptBinding(receipt, eventId, consumerId);
+        return receipt;
+    }
+    function listEvents() {
+        eventsRoot.assertUnchanged();
+        const entries = readdirSync(eventsRoot.path, { withFileTypes: true })
+            .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+        eventsRoot.assertUnchanged();
+        const events = [];
+        for (const entry of entries) {
+            if (!entry.name.endsWith(".json"))
+                continue;
+            eventsRoot.assertUnchanged();
+            if (!entry.isFile())
+                throw new Error(`unsafe outbox event directory entry: ${entry.name}`);
+            const eventId = assertOpaqueId(entry.name.slice(0, -".json".length), "event filename id");
+            if (`${eventId}.json` !== entry.name)
+                throw new Error(`invalid outbox event filename: ${entry.name}`);
+            events.push(readEvent(eventId));
+            eventsRoot.assertUnchanged();
+        }
+        eventsRoot.assertUnchanged();
+        return deepFreeze(events);
+    }
+    function listPending(consumerId) {
+        const consumer = assertActorId(consumerId, "consumer id");
+        const pending = listEvents().filter((event) => readReceipt(event.event_id, consumer) === undefined);
+        eventsRoot.assertUnchanged();
+        receiptsRoot.assertUnchanged();
+        return deepFreeze(pending);
+    }
+    function publish(input, certificationCapability) {
+        const event = prepareEvent(input);
+        if ((event.event_kind === CERTIFICATION_EVENT_KIND) !== certificationCapability) {
+            throw new Error(certificationCapability
+                ? "certification authority may publish only reserved certification events"
+                : "reserved certification events require a typed certification authority writer");
+        }
+        const lock = acquireDirectoryLock({
+            locksRoot: locksRoot.path,
+            lockId: `oe-${event.event_id}`,
+            ownerId: "outbox-publisher",
+            note: `publish:${event.event_id}`,
+        });
+        try {
+            eventsRoot.assertUnchanged();
+            const status = writeImmutableJson(eventsRoot, `${event.event_id}.json`, event, "event");
+            return deepFreeze({ status, event: readEvent(event.event_id) });
+        }
+        finally {
+            lock.release();
+        }
+    }
+    function commitReceipt(input, certificationCapability) {
+        const captured = {
+            eventId: input.eventId,
+            consumerId: input.consumerId,
+            processedAt: input.processedAt,
+            result: input.result,
+        };
+        const event = readEvent(captured.eventId);
+        const authorityReceipt = captured.consumerId === CERTIFICATION_CONSUMER_ID;
+        if (authorityReceipt !== certificationCapability || (certificationCapability && event.event_kind !== CERTIFICATION_EVENT_KIND)) {
+            throw new Error(certificationCapability
+                ? "certification authority receipts must acknowledge reserved certification events"
+                : "reserved certification receipts require a typed certification authority writer");
+        }
+        const receipt = prepareReceipt(captured);
+        receiptsRoot.assertUnchanged();
+        const status = writeImmutableJson(receiptsRoot, `${receipt.receipt_id}.json`, receipt, "receipt");
+        const stored = readReceipt(receipt.event_id, receipt.consumer_id);
+        if (!stored)
+            throw new Error(`outbox receipt was not durably stored: ${receipt.receipt_id}`);
+        return deepFreeze({ status, receipt: stored });
+    }
+    const store = Object.freeze({
+        [OUTBOX_STORE]: true,
+        publish(input) {
+            return publish(input, false);
+        },
+        readEvent,
+        readReceipt,
+        listEvents,
+        listPending,
+        acquireProcessingLock(eventId, consumerId) {
+            const event = assertOpaqueId(eventId, "event id");
+            const consumer = assertActorId(consumerId, "consumer id");
+            locksRoot.assertUnchanged();
+            return acquireDirectoryLock({
+                locksRoot: locksRoot.path,
+                lockId: deriveProcessingLockId(event, consumer),
+                ownerId: consumer,
+                note: `process:${event}:${consumer}`,
+            });
+        },
+        recoverProcessingLock(input) {
+            const captured = {
+                eventId: input.eventId,
+                consumerId: input.consumerId,
+                recoveredBy: input.recoveredBy,
+                reason: input.reason,
+                expectedGenerationId: input.expectedGenerationId,
+            };
+            locksRoot.assertUnchanged();
+            readEvent(captured.eventId);
+            if (typeof captured.reason !== "string" || captured.reason.length < 1 || captured.reason.length > 512) {
+                throw new Error("invalid outbox lock recovery reason");
+            }
+            const lockPath = join(locksRoot.path, deriveProcessingLockId(captured.eventId, captured.consumerId));
+            const owner = readLockOwner(lockPath);
+            if (owner?.created_nonce === captured.expectedGenerationId
+                && owner.boot_id === systemBootId()
+                && processIsAlive(owner.process_id)) {
+                throw new Error("refusing to recover an outbox processing lock whose owner process is alive");
+            }
+            return deepFreeze(recoverDirectoryLock({
+                locksRoot: locksRoot.path,
+                lockId: deriveProcessingLockId(captured.eventId, captured.consumerId),
+                recoveredBy: assertActorId(captured.recoveredBy, "outbox lock recovery actor"),
+                reason: captured.reason,
+                expectedGenerationId: captured.expectedGenerationId,
+            }));
+        },
+        commitReceipt(input) {
+            return commitReceipt(input, false);
+        },
+    });
+    OUTBOX_STORES.add(store);
+    OUTBOX_INTERNALS.set(store, {
+        publishCertification(input) {
+            return publish(input, true);
+        },
+        commitCertification(input) {
+            return commitReceipt(input, true);
+        },
+        readEventIfExists,
+    });
+    return store;
+}
+export function assertOutboxStore(value) {
+    if (typeof value !== "object" || value === null || !OUTBOX_STORES.has(value)) {
+        throw new Error("outbox operation requires a real OMS OutboxStore");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("outbox store lost its frozen authority boundary");
+}
+export function createRunCertificationAuthority(outbox) {
+    assertOutboxStore(outbox);
+    const internal = OUTBOX_INTERNALS.get(outbox);
+    if (!internal)
+        throw new Error("outbox certification internals are unavailable");
+    const resolver = Object.freeze({
+        [CERTIFICATION_RESOLVER]: true,
+        resolve(reference) {
+            assertRunCertificationAuthorityReference(reference);
+            return resolveCertificationAuthority(outbox, reference.eventId, reference.consumerId);
+        },
+        hydrate(reference) {
+            const captured = { eventId: reference.eventId, consumerId: reference.consumerId };
+            const hydrated = makeCertificationReference(captured.eventId, captured.consumerId);
+            resolveCertificationAuthority(outbox, hydrated.eventId, hydrated.consumerId);
+            return hydrated;
+        },
+        resolveStored(reference) {
+            const captured = { eventId: reference.event_id, consumerId: reference.consumer_id };
+            return resolveCertificationAuthority(outbox, captured.eventId, captured.consumerId);
+        },
+    });
+    CERTIFICATION_RESOLVERS.add(resolver);
+    const writer = Object.freeze({
+        [CERTIFICATION_WRITER]: true,
+        authorize(input) {
+            const captured = captureAuthorizationInput(input);
+            const binding = makeAuthorityBinding(captured);
+            const decisionId = assertOpaqueId(captured.decisionId, "certification authority decision id");
+            const authorizedBy = assertActorId(captured.authorizedBy, "certification authority actor");
+            const expectedEventId = deriveEventId({
+                eventKind: CERTIFICATION_EVENT_KIND,
+                sourceId: binding.run_id,
+                sourceVersion: 1,
+                dedupeKey: decisionId,
+            });
+            const existing = internal.readEventIfExists(expectedEventId);
+            const occurredAt = existing?.occurred_at ?? systemClockSample().wallTime;
+            const payload = {
+                authorized_by: authorizedBy,
+                binding,
+                binding_sha256: hashCanonical(binding),
+                decision_id: decisionId,
+            };
+            const published = internal.publishCertification({
+                eventKind: CERTIFICATION_EVENT_KIND,
+                sourceId: binding.run_id,
+                sourceVersion: 1,
+                dedupeKey: decisionId,
+                occurredAt,
+                payload,
+            });
+            const existingReceipt = outbox.readReceipt(published.event.event_id, CERTIFICATION_CONSUMER_ID);
+            internal.commitCertification({
+                eventId: published.event.event_id,
+                consumerId: CERTIFICATION_CONSUMER_ID,
+                processedAt: existingReceipt?.processed_at ?? systemClockSample().wallTime,
+                result: {
+                    authority_decision: "authorized",
+                    binding_sha256: hashCanonical(binding),
+                    decision_id: decisionId,
+                },
+            });
+            const reference = makeCertificationReference(published.event.event_id, CERTIFICATION_CONSUMER_ID);
+            resolver.resolve(reference);
+            return reference;
+        },
+    });
+    CERTIFICATION_WRITERS.add(writer);
+    return deepFreeze({ writer, resolver });
+}
+export function assertRunCertificationAuthorityWriter(value) {
+    if (typeof value !== "object" || value === null || !CERTIFICATION_WRITERS.has(value)) {
+        throw new Error("run authorization requires a real OMS RunCertificationAuthorityWriter");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("run certification authority writer lost its frozen boundary");
+}
+export function assertRunCertificationAuthorityResolver(value) {
+    if (typeof value !== "object" || value === null || !CERTIFICATION_RESOLVERS.has(value)) {
+        throw new Error("run authorization requires a real OMS RunCertificationAuthorityResolver");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("run certification authority resolver lost its frozen boundary");
+}
+export function assertRunCertificationAuthorityReference(value) {
+    if (typeof value !== "object" || value === null || !CERTIFICATION_REFERENCES.has(value)) {
+        throw new Error("run transition requires a resolved OMS certification authority reference");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("run certification authority reference lost its frozen boundary");
+}
+export function deriveEventId(input) {
+    const kind = assertOpaqueId(input.eventKind, "event kind");
+    const source = assertOpaqueId(input.sourceId, "event source id");
+    const dedupe = assertOpaqueId(input.dedupeKey, "event dedupe key");
+    assertNonNegativeInteger(input.sourceVersion, "event source version");
+    return createStableId("event", kind, source, String(input.sourceVersion), dedupe);
+}
+export function deriveReceiptId(eventId, consumerId) {
+    return createStableId("receipt", assertOpaqueId(eventId, "event id"), assertActorId(consumerId, "consumer id"));
+}
+export function deriveOperationNonce(eventId, consumerId) {
+    return createStableId("operation", assertOpaqueId(eventId, "event id"), assertActorId(consumerId, "consumer id"));
+}
+export function deriveProcessingLockId(eventId, consumerId) {
+    const processId = createStableId("process", assertOpaqueId(eventId, "event id"), assertActorId(consumerId, "consumer id"));
+    return `op-${processId}`;
+}
+function prepareEvent(input) {
+    const captured = {
+        eventKind: input.eventKind,
+        sourceId: input.sourceId,
+        sourceVersion: input.sourceVersion,
+        dedupeKey: input.dedupeKey,
+        occurredAt: input.occurredAt,
+        payload: input.payload,
+    };
+    const payload = canonicalizeObject(captured.payload, "event payload");
+    const event = {
+        schema_version: 1,
+        event_id: deriveEventId(captured),
+        event_kind: assertOpaqueId(captured.eventKind, "event kind"),
+        source_id: assertOpaqueId(captured.sourceId, "event source id"),
+        source_version: captured.sourceVersion,
+        dedupe_key: assertOpaqueId(captured.dedupeKey, "event dedupe key"),
+        occurred_at: assertOutboxTimestamp(captured.occurredAt, "event timestamp"),
+        payload,
+    };
+    return validateEvent(event);
+}
+function prepareReceipt(input) {
+    const captured = {
+        eventId: input.eventId,
+        consumerId: input.consumerId,
+        processedAt: input.processedAt,
+        result: input.result,
+    };
+    const eventId = assertOpaqueId(captured.eventId, "event id");
+    const consumerId = assertActorId(captured.consumerId, "consumer id");
+    return validateReceipt({
+        schema_version: 1,
+        receipt_id: deriveReceiptId(eventId, consumerId),
+        event_id: eventId,
+        consumer_id: consumerId,
+        operation_nonce: deriveOperationNonce(eventId, consumerId),
+        processed_at: assertOutboxTimestamp(captured.processedAt, "receipt timestamp"),
+        result: canonicalizeObject(captured.result, "receipt result"),
+    });
+}
+function validateEvent(value) {
+    assertSchema(value, EVENT_SCHEMA, "outbox event");
+    const event = value;
+    if (event.occurred_at !== assertOutboxTimestamp(event.occurred_at, "event timestamp")) {
+        throw new Error("event timestamp must use canonical ISO milliseconds");
+    }
+    assertJsonValue(event.payload, "event payload");
+    if (event.event_id !== deriveEventId({
+        eventKind: event.event_kind,
+        sourceId: event.source_id,
+        sourceVersion: event.source_version,
+        dedupeKey: event.dedupe_key,
+    })) {
+        throw new Error("outbox event id does not match its immutable identity");
+    }
+    return deepFreeze({ ...event, payload: canonicalizeObject(event.payload, "event payload") });
+}
+function validateReceipt(value) {
+    assertSchema(value, RECEIPT_SCHEMA, "outbox receipt");
+    const receipt = value;
+    if (receipt.processed_at !== assertOutboxTimestamp(receipt.processed_at, "receipt timestamp")) {
+        throw new Error("receipt timestamp must use canonical ISO milliseconds");
+    }
+    assertJsonValue(receipt.result, "receipt result");
+    assertReceiptBinding(receipt, receipt.event_id, receipt.consumer_id);
+    return deepFreeze({ ...receipt, result: canonicalizeObject(receipt.result, "receipt result") });
+}
+function assertReceiptBinding(receipt, eventId, consumerId) {
+    if (receipt.receipt_id !== deriveReceiptId(eventId, consumerId)) {
+        throw new Error("outbox receipt id does not match its event and consumer");
+    }
+    if (receipt.event_id !== eventId || receipt.consumer_id !== consumerId) {
+        throw new Error("outbox receipt is bound to a different event or consumer");
+    }
+    if (receipt.operation_nonce !== deriveOperationNonce(eventId, consumerId)) {
+        throw new Error("outbox receipt operation nonce does not match its event and consumer");
+    }
+}
+function writeImmutableJson(root, fileName, value, kind) {
+    root.assertUnchanged();
+    const bytes = Buffer.from(`${JSON.stringify(canonicalizeJson(value), null, 2)}\n`, "utf8");
+    if (bytes.byteLength > MAX_OUTBOX_BYTES)
+        throw new Error(`${kind} exceeds ${MAX_OUTBOX_BYTES} bytes`);
+    const destination = join(root.path, fileName);
+    const temporary = join(root.path, `.${basename(fileName)}.tmp.${process.pid}.${randomUUID()}`);
+    let descriptor;
+    try {
+        descriptor = openSync(temporary, "wx", 0o600);
+        writeFileSync(descriptor, bytes);
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        root.assertUnchanged();
+        linkSync(temporary, destination);
+        unlinkSync(temporary);
+        syncDirectory(root);
+        return "created";
+    }
+    catch (error) {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        removeTemporary(temporary);
+        const code = error instanceof Error && "code" in error ? String(error.code) : undefined;
+        if (code !== "EEXIST")
+            throw error;
+        const existing = readJsonFileNoFollow(destination, MAX_OUTBOX_BYTES);
+        const existingBytes = Buffer.from(`${JSON.stringify(canonicalizeJson(existing), null, 2)}\n`, "utf8");
+        if (!existingBytes.equals(bytes)) {
+            throw new ImmutableOutboxConflictError(kind, fileName.replace(/\.json$/u, ""));
+        }
+        syncDirectory(root);
+        return "replayed";
+    }
+}
+function removeTemporary(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? String(error.code) : undefined;
+        if (code !== "ENOENT")
+            throw error;
+    }
+}
+function captureRoot(path, label) {
+    const canonical = validateExistingDirectory(path, label);
+    const entry = lstatSync(canonical);
+    const identity = { path: canonical, device: entry.dev, inode: entry.ino };
+    return {
+        ...identity,
+        assertUnchanged() {
+            const currentPath = validateExistingDirectory(identity.path, label);
+            const current = lstatSync(currentPath);
+            if (currentPath !== identity.path || current.dev !== identity.device || current.ino !== identity.inode) {
+                throw new Error(`${label} changed after store creation`);
+            }
+        },
+    };
+}
+function syncDirectory(root) {
+    root.assertUnchanged();
+    const directoryFlag = typeof constants.O_DIRECTORY === "number" ? constants.O_DIRECTORY : 0;
+    const descriptor = openSync(root.path, constants.O_RDONLY | directoryFlag);
+    try {
+        const opened = fstatSync(descriptor);
+        if (!opened.isDirectory() || opened.dev !== root.device || opened.ino !== root.inode) {
+            throw new Error("outbox root changed while syncing");
+        }
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function pathExistsNoFollow(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? String(error.code) : undefined;
+        if (code === "ENOENT")
+            return false;
+        throw new Error(`unable to inspect outbox path ${path}: ${errorMessage(error)}`);
+    }
+}
+function canonicalizeObject(value, label) {
+    const canonical = canonicalizeJson(value, label);
+    if (!isPlainObject(canonical))
+        throw new Error(`${label} must be an object`);
+    return canonical;
+}
+function canonicalizeJson(value, label = "JSON value", seen = new Set(), depth = 0) {
+    if (depth > 32)
+        throw new Error(`${label} exceeds maximum nesting depth`);
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error(`${label} contains a non-finite number`);
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value))
+            throw new Error(`${label} contains a cycle`);
+        seen.add(value);
+        const result = value.map((entry) => canonicalizeJson(entry, label, seen, depth + 1));
+        seen.delete(value);
+        return result;
+    }
+    if (!isPlainObject(value))
+        throw new Error(`${label} contains a non-JSON value`);
+    if (seen.has(value))
+        throw new Error(`${label} contains a cycle`);
+    seen.add(value);
+    const result = {};
+    for (const key of Object.keys(value).sort()) {
+        const child = value[key];
+        if (child === undefined)
+            throw new Error(`${label} contains undefined`);
+        result[key] = canonicalizeJson(child, label, seen, depth + 1);
+    }
+    seen.delete(value);
+    return result;
+}
+function assertJsonValue(value, label) {
+    canonicalizeJson(value, label);
+}
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function deepFreeze(value, seen = new Set()) {
+    if (typeof value !== "object" || value === null || seen.has(value))
+        return value;
+    seen.add(value);
+    for (const child of Object.values(value))
+        deepFreeze(child, seen);
+    return Object.freeze(value);
+}
+function captureAuthorizationInput(input) {
+    const captured = {
+        action: input.action,
+        decisionId: input.decisionId,
+        authorizedBy: input.authorizedBy,
+        runId: input.runId,
+        operationId: input.operationId,
+        runKind: input.runKind,
+        policyDigest: input.policyDigest,
+        ticketSetDigest: input.ticketSetDigest,
+        servicePlanDigest: input.servicePlanDigest,
+        expectedHead: input.expectedHead,
+        previousCanary: input.previousCanary,
+    };
+    return {
+        action: captured.action,
+        decisionId: captured.decisionId,
+        authorizedBy: captured.authorizedBy,
+        runId: captured.runId,
+        operationId: captured.operationId,
+        runKind: captured.runKind,
+        policyDigest: captured.policyDigest,
+        ticketSetDigest: captured.ticketSetDigest,
+        servicePlanDigest: captured.servicePlanDigest,
+        expectedHead: captured.expectedHead === null ? null : captureCanonicalHead(captured.expectedHead),
+        previousCanary: captured.previousCanary === null
+            ? null
+            : captureCanonicalCertification(captured.previousCanary),
+    };
+}
+function makeAuthorityBinding(input) {
+    if (!isCertificationAction(input.action))
+        throw new Error("invalid run certification authority action");
+    const runId = assertRunId(input.runId);
+    const operationId = assertOpaqueId(input.operationId, "authorized run operation id");
+    const runKind = assertCertifyingRunKind(input.runKind);
+    const expectedHead = input.expectedHead === null ? null : captureCanonicalHead(input.expectedHead);
+    const previousCanary = input.previousCanary === null ? null : captureCanonicalCertification(input.previousCanary);
+    if ((input.action === "start") !== (expectedHead === null)) {
+        throw new Error("only run-start authority may omit the canonical expected head");
+    }
+    if (expectedHead && expectedHead.run_id !== runId) {
+        throw new Error("certification authority expected head belongs to another run");
+    }
+    if ((runKind === "12h") !== (previousCanary === null)) {
+        throw new Error("12h authority must have no prior canary and 24h authority must bind one");
+    }
+    if (previousCanary?.run_id === runId)
+        throw new Error("certification authority prior canary must be another run");
+    return deepFreeze({
+        schema_version: 1,
+        action: input.action,
+        completion_semantics: completionSemantics(input.action),
+        run_id: runId,
+        operation_id: operationId,
+        run_kind: runKind,
+        policy_sha256: assertSha256(input.policyDigest, "authorized run policy digest"),
+        ticket_set_digest: assertSha256(input.ticketSetDigest, "authorized ticket set digest"),
+        service_plan_digest: assertSha256(input.servicePlanDigest, "authorized service plan digest"),
+        expected_head: expectedHead,
+        previous_canary: previousCanary,
+    });
+}
+function resolveCertificationAuthority(outbox, eventIdValue, consumerIdValue) {
+    assertOutboxStore(outbox);
+    const eventId = assertOpaqueId(eventIdValue, "certification authority event id");
+    const consumerId = assertActorId(consumerIdValue, "certification authority consumer id");
+    if (consumerId !== CERTIFICATION_CONSUMER_ID)
+        throw new Error("invalid certification authority consumer");
+    const event = outbox.readEvent(eventId);
+    const receipt = outbox.readReceipt(eventId, consumerId);
+    if (!receipt)
+        throw new Error("certification authority event has no immutable decision receipt");
+    if (event.event_kind !== CERTIFICATION_EVENT_KIND)
+        throw new Error("event is not a certification authority decision");
+    assertExactObjectKeys(event.payload, ["authorized_by", "binding", "binding_sha256", "decision_id"], "certification authority event");
+    if (!isRecord(event.payload.binding))
+        throw new Error("certification authority binding must be an object");
+    const binding = parseAuthorityBinding(event.payload.binding);
+    const bindingDigest = hashCanonical(binding);
+    if (event.payload.binding_sha256 !== bindingDigest)
+        throw new Error("certification authority binding digest changed");
+    if (event.source_id !== binding.run_id)
+        throw new Error("certification authority event source changed");
+    const decisionId = assertOpaqueId(event.payload.decision_id, "certification authority decision id");
+    const authorizedBy = assertActorId(event.payload.authorized_by, "certification authority actor");
+    assertExactObjectKeys(receipt.result, ["authority_decision", "binding_sha256", "decision_id"], "certification authority receipt");
+    if (receipt.result.authority_decision !== "authorized"
+        || receipt.result.binding_sha256 !== bindingDigest
+        || receipt.result.decision_id !== decisionId) {
+        throw new Error("certification authority receipt does not bind the authorized transition");
+    }
+    if (Date.parse(receipt.processed_at) < Date.parse(event.occurred_at)) {
+        throw new Error("certification authority receipt predates its decision event");
+    }
+    return deepFreeze({
+        reference: { event_id: event.event_id, consumer_id: CERTIFICATION_CONSUMER_ID },
+        binding,
+        decision_id: decisionId,
+        authorized_by: authorizedBy,
+        event_sha256: hashCanonical(event),
+        receipt_sha256: hashCanonical(receipt),
+        occurred_at: event.occurred_at,
+        processed_at: receipt.processed_at,
+    });
+}
+function parseAuthorityBinding(value) {
+    assertExactObjectKeys(value, [
+        "action",
+        "completion_semantics",
+        "expected_head",
+        "operation_id",
+        "policy_sha256",
+        "previous_canary",
+        "run_id",
+        "run_kind",
+        "schema_version",
+        "service_plan_digest",
+        "ticket_set_digest",
+    ], "certification authority binding");
+    if (value.schema_version !== 1 || !isCertificationAction(value.action)) {
+        throw new Error("invalid certification authority binding identity");
+    }
+    const binding = makeAuthorityBinding({
+        action: value.action,
+        decisionId: "parse-binding",
+        authorizedBy: "parse-binding",
+        runId: value.run_id,
+        operationId: value.operation_id,
+        runKind: value.run_kind,
+        policyDigest: value.policy_sha256,
+        ticketSetDigest: value.ticket_set_digest,
+        servicePlanDigest: value.service_plan_digest,
+        expectedHead: value.expected_head,
+        previousCanary: value.previous_canary,
+    });
+    if (value.completion_semantics !== binding.completion_semantics) {
+        throw new Error("certification authority completion semantics changed");
+    }
+    return binding;
+}
+function captureCanonicalHead(value) {
+    const captured = {
+        entry_id: value.entry_id,
+        run_id: value.run_id,
+        sequence: value.sequence,
+        sha256: value.sha256,
+        file_name: value.file_name,
+    };
+    if (!ENTRY_ID_PATTERN.test(captured.entry_id))
+        throw new Error("invalid canonical run head entry id");
+    assertRunId(captured.run_id);
+    if (!Number.isSafeInteger(captured.sequence) || captured.sequence < 0)
+        throw new Error("invalid canonical run head sequence");
+    assertSha256(captured.sha256, "canonical run head digest");
+    if (captured.file_name !== `${captured.entry_id}.json`)
+        throw new Error("invalid canonical run head filename");
+    return deepFreeze(captured);
+}
+function captureCanonicalCertification(value) {
+    const captured = {
+        run_id: value.run_id,
+        head: captureCanonicalHead(value.head),
+        metrics_sha256: value.metrics_sha256,
+    };
+    assertRunId(captured.run_id);
+    if (captured.head.run_id !== captured.run_id)
+        throw new Error("canonical canary head belongs to another run");
+    assertSha256(captured.metrics_sha256, "canonical canary metrics digest");
+    return deepFreeze(captured);
+}
+function makeCertificationReference(eventIdValue, consumerIdValue) {
+    const eventId = assertOpaqueId(eventIdValue, "certification authority event id");
+    const consumerId = assertActorId(consumerIdValue, "certification authority consumer id");
+    if (consumerId !== CERTIFICATION_CONSUMER_ID)
+        throw new Error("invalid certification authority consumer");
+    const reference = Object.freeze({
+        [CERTIFICATION_REFERENCE]: true,
+        eventId,
+        consumerId: CERTIFICATION_CONSUMER_ID,
+    });
+    CERTIFICATION_REFERENCES.add(reference);
+    return reference;
+}
+function isCertificationAction(value) {
+    return value === "start" || value === "heartbeat" || value === "process-restart" || value === "complete";
+}
+function completionSemantics(action) {
+    switch (action) {
+        case "start": return "begin-run";
+        case "heartbeat": return "append-heartbeat";
+        case "process-restart": return "record-process-restart";
+        case "complete": return "terminal-run-completed";
+    }
+}
+function assertCertifyingRunKind(value) {
+    if (value !== "12h" && value !== "24h")
+        throw new Error("invalid certifying run kind");
+    return value;
+}
+function assertRunId(value) {
+    if (typeof value !== "string" || !RUN_ID_PATTERN.test(value))
+        throw new Error("invalid run id");
+    return value;
+}
+function assertSha256(value, label) {
+    if (typeof value !== "string" || !SHA256_PATTERN.test(value))
+        throw new Error(`invalid ${label}`);
+    return value;
+}
+function assertExactObjectKeys(value, expected, label) {
+    const actual = Object.keys(value).sort();
+    const sortedExpected = [...expected].sort();
+    if (actual.length !== sortedExpected.length || actual.some((key, index) => key !== sortedExpected[index])) {
+        throw new Error(`${label} has invalid fields`);
+    }
+}
+function hashCanonical(value) {
+    const bytes = Buffer.from(`${JSON.stringify(canonicalizeJson(value), null, 2)}\n`, "utf8");
+    return createHash("sha256").update(bytes).digest("hex");
+}
+export function assertOutboxTimestamp(value, label) {
+    if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value)) {
+        throw new Error(`invalid ${label}`);
+    }
+    const epoch = Date.parse(value);
+    const normalized = value.includes(".") ? value : value.replace("Z", ".000Z");
+    if (!Number.isFinite(epoch) || new Date(epoch).toISOString() !== normalized)
+        throw new Error(`invalid ${label}`);
+    return new Date(epoch).toISOString();
+}
+function assertNonNegativeInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error(`invalid ${label}`);
+}
+//# sourceMappingURL=store.js.map