stitchkit 0.103.8 → 0.103.9

package/dist/index-eeqmg7qm.js

@@ -0,0 +1,202 @@
+import {
+  raceAbort
+} from "./index-mbnnw3f2.js";
+
+// src/process/contract.ts
+import { z } from "zod";
+var NativeCommandOptionsSchema = z.strictObject({
+  executable: z.string().min(1),
+  args: z.array(z.string()).default([]),
+  cwd: z.string().optional(),
+  env: z.record(z.string(), z.string()).optional(),
+  envPolicy: z.enum(["declared-only", "ambient"]).default("declared-only"),
+  signal: z.custom((v) => v instanceof AbortSignal).optional(),
+  timeoutMs: z.number().int().positive().max(2147483647).optional(),
+  maxOutputBytes: z.number().int().positive().optional(),
+  capture: z.boolean().default(false),
+  stdin: z.custom((v) => v instanceof Uint8Array).optional(),
+  maxStdinBytes: z.number().int().positive().default(1024 * 1024),
+  onOutput: z.custom((v) => typeof v === "function").optional(),
+  killGraceMs: z.number().int().nonnegative().max(1e4).default(100),
+  cleanupTimeoutMs: z.number().int().positive().max(30000).default(2000)
+}).superRefine((input, ctx) => {
+  if (!input.signal && input.timeoutMs === undefined)
+    ctx.addIssue({ code: "custom", message: "Declare a caller signal or a finite timeout" });
+  if (input.capture && input.maxOutputBytes === undefined)
+    ctx.addIssue({
+      code: "custom",
+      message: "Capture requires a finite combined output budget"
+    });
+  if (input.stdin && input.stdin.byteLength > input.maxStdinBytes)
+    ctx.addIssue({ code: "custom", message: "stdin exceeds maxStdinBytes" });
+});
+var NativeCommandResultSchema = z.object({
+  exitCode: z.number().int().nullable(),
+  signal: z.string().nullable(),
+  stdout: z.instanceof(Uint8Array),
+  stderr: z.instanceof(Uint8Array)
+});
+
+class NativeCommandError2 extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "NativeCommandError";
+  }
+}
+
+// src/process/command-owner.ts
+import { spawn } from "node:child_process";
+
+// src/process/group.ts
+function signalGroup(pid, signal) {
+  if (pid === undefined)
+    return;
+  try {
+    process.kill(-pid, signal);
+  } catch (error) {
+    if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
+      throw error;
+  }
+}
+function exists(pid) {
+  if (pid === undefined)
+    return false;
+  try {
+    process.kill(-pid, 0);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ESRCH")
+      return false;
+    throw error;
+  }
+}
+async function stopCommandGroup(pid, graceMs) {
+  signalGroup(pid, "SIGTERM");
+  const until = Date.now() + graceMs;
+  while (Date.now() < until && exists(pid))
+    await new Promise((resolve) => setTimeout(resolve, Math.min(10, until - Date.now())));
+  signalGroup(pid, "SIGKILL");
+}
+function commandCleanupError(cause) {
+  return new NativeCommandError2("COMMAND_CLEANUP", "Command cleanup did not complete", {
+    cause
+  });
+}
+function waitForCommandClose(closed, timeoutMs) {
+  return raceAbort(closed, AbortSignal.timeout(timeoutMs));
+}
+
+// src/process/command-owner.ts
+function startNativeCommand(input, onSpawn) {
+  const options = NativeCommandOptionsSchema.parse(input);
+  options.signal?.throwIfAborted();
+  if (process.platform === "win32")
+    throw new NativeCommandError2("COMMAND_UNAVAILABLE", "POSIX process groups are required");
+  const controller = new AbortController;
+  const abort = () => controller.abort(options.signal?.reason);
+  options.signal?.addEventListener("abort", abort, { once: true });
+  if (options.signal?.aborted)
+    abort();
+  const timer = options.timeoutMs === undefined ? undefined : setTimeout(() => controller.abort(new NativeCommandError2("COMMAND_LIMIT", "Command deadline exceeded")), options.timeoutMs);
+  let child;
+  try {
+    child = spawn(options.executable, options.args, {
+      cwd: options.cwd,
+      env: options.envPolicy === "ambient" ? { ...process.env, ...options.env } : options.env ?? {},
+      detached: true,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch (cause) {
+    if (timer !== undefined)
+      clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abort);
+    throw new NativeCommandError2("COMMAND_UNAVAILABLE", "Command could not start", { cause });
+  }
+  const stdout = [];
+  const stderr = [];
+  let total = 0;
+  let finished = false;
+  let spawnFailure;
+  const closed = new Promise((resolve) => {
+    child.once("error", (error) => {
+      spawnFailure = new NativeCommandError2("COMMAND_UNAVAILABLE", "Command could not start", {
+        cause: error
+      });
+      controller.abort(spawnFailure);
+    });
+    child.once("close", (exitCode, signal) => resolve({ exitCode, signal }));
+  });
+  child.stdin.on("error", (error) => {
+    if (!(("code" in error) && error.code === "EPIPE"))
+      controller.abort(error);
+  });
+  const drain = async (stream, channel, captured) => {
+    for await (const chunk of stream) {
+      controller.signal.throwIfAborted();
+      if (!(chunk instanceof Uint8Array))
+        throw new TypeError("Expected binary command output");
+      total += chunk.byteLength;
+      if (options.maxOutputBytes !== undefined && total > options.maxOutputBytes)
+        throw new NativeCommandError2("COMMAND_LIMIT", "Command output budget exceeded");
+      if (options.capture)
+        captured.push(Uint8Array.from(chunk));
+      if (options.onOutput)
+        await raceAbort(Promise.resolve().then(() => {
+          controller.signal.throwIfAborted();
+          return options.onOutput?.(chunk, channel, controller.signal);
+        }), controller.signal);
+    }
+  };
+  const result = (async () => {
+    try {
+      onSpawn?.(child);
+      child.stdin.end(options.stdin);
+      const drains = Promise.all([
+        drain(child.stdout, "stdout", stdout),
+        drain(child.stderr, "stderr", stderr)
+      ]);
+      await raceAbort(drains, controller.signal);
+      const status = await raceAbort(closed, controller.signal);
+      if (spawnFailure !== undefined)
+        throw spawnFailure;
+      return { ...status, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) };
+    } catch (error) {
+      controller.abort(error);
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+      try {
+        await stopCommandGroup(child.pid, options.killGraceMs);
+        await waitForCommandClose(closed, options.cleanupTimeoutMs);
+      } catch (cleanup) {
+        throw commandCleanupError(new AggregateError([error, cleanup], "Command failed and cleanup failed"));
+      }
+      throw error;
+    } finally {
+      finished = true;
+      if (timer !== undefined)
+        clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
+      controller.abort(new Error("Command completed"));
+    }
+  })();
+  result.catch(() => {
+    return;
+  });
+  return {
+    result,
+    async stop() {
+      if (!finished)
+        controller.abort(new DOMException("Command stopped", "AbortError"));
+      await result.then(() => {
+        return;
+      }, () => {
+        return;
+      });
+    }
+  };
+}
+
+export { NativeCommandError2, startNativeCommand };

package/dist/index-mbnnw3f2.js

@@ -0,0 +1,25 @@
+// src/internal/abort-race.ts
+function raceAbort(operation, signal) {
+  if (signal.aborted) {
+    operation.catch(() => {
+      return;
+    });
+    return Promise.reject(signal.reason);
+  }
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      signal.removeEventListener("abort", abort);
+      reject(signal.reason);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    operation.then((value) => {
+      signal.removeEventListener("abort", abort);
+      resolve(value);
+    }, (error) => {
+      signal.removeEventListener("abort", abort);
+      reject(error);
+    });
+  });
+}
+
+export { raceAbort };

package/dist/{index-v4a2fjtk.js → index-sybedc8b.js}

@@ -2,15 +2,19 @@ import {
   ManagedFilePathSchema2,
   ManagedFileRefSchema2
 } from "./index-xqhede6x.js";
+import {
+  AtomicFilePublicationError2,
+  publishAtomicFile
+} from "./index-8a9ksm91.js";
 import {
   isWithinDir2
 } from "./index-5cc6r990.js";
 
 // src/files/boundary.ts
 import { randomUUID } from "node:crypto";
-import { constants } from "node:fs";
-import { link, mkdir, open, realpath, rename, stat, unlink } from "node:fs/promises";
-import { basename, dirname, resolve } from "node:path";
+import { constants as constants2 } from "node:fs";
+import { mkdir, open as open2, realpath, stat, unlink } from "node:fs/promises";
+import { basename as basename2, dirname, resolve } from "node:path";
 
 // src/files/file-io.ts
 var ManagedFileInspectionSchema = ManagedFileRefSchema2.pick({
@@ -70,22 +74,29 @@ function inspectedRef(path, size, inspection, fallback = {}) {
 async function readHandle(handle, maxBytes, signal) {
   const chunks = [];
   let total = 0;
-  while (true) {
-    signal?.throwIfAborted();
+  let ended = false;
+  while (!ended) {
     const capacity = Math.min(64 * 1024, maxBytes + 1 - total);
-    if (capacity <= 0) {
+    if (capacity <= 0)
       throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
-    }
     const chunk = new Uint8Array(capacity);
-    const { bytesRead } = await handle.read(chunk, 0, capacity);
-    if (bytesRead === 0)
-      break;
-    total += bytesRead;
-    if (total > maxBytes) {
-      throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
+    let filled = 0;
+    while (filled < capacity) {
+      signal?.throwIfAborted();
+      const { bytesRead } = await handle.read(chunk, filled, capacity - filled);
+      if (bytesRead === 0) {
+        ended = true;
+        break;
+      }
+      filled += bytesRead;
+      total += bytesRead;
+      if (total > maxBytes)
+        throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
     }
-    chunks.push(chunk.subarray(0, bytesRead));
+    if (filled > 0)
+      chunks.push(chunk.subarray(0, filled));
   }
+  signal?.throwIfAborted();
   const bytes = new Uint8Array(total);
   let offset = 0;
   for (const chunk of chunks) {
@@ -149,13 +160,77 @@ async function writeSource(handle, source, maxBytes, inspectionBytes, signal) {
   return { size, prefix };
 }
 
+// src/files/read.ts
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { basename } from "node:path";
+async function readManagedDescriptor(target, path, maxBytes, options, inspection, openDescriptor = open) {
+  if (options.rejectSymlinks && !constants.O_NOFOLLOW)
+    throw new ManagedFileError2("FILE_UNSUPPORTED", "strict leaf nofollow is unavailable");
+  const flags = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+  const handle = await openDescriptor(target, flags);
+  let failed = false;
+  let failure;
+  let source;
+  try {
+    options.signal?.throwIfAborted();
+    const before = await handle.stat();
+    if (!before.isFile())
+      throw new ManagedFileError2("FILE_NOT_REGULAR", "managed path is not a regular file");
+    if (options.singleLink && before.nlink !== 1)
+      throw new ManagedFileError2("FILE_UNSAFE_LINK", "managed file has multiple links");
+    if (before.size > maxBytes)
+      throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
+    const bytes = await readHandle(handle, maxBytes, options.signal);
+    const after = options.stable || options.observe ? await handle.stat() : before;
+    if (options.stable && (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || before.nlink !== after.nlink || bytes.length !== after.size))
+      throw new ManagedFileError2("FILE_CHANGED", "managed file changed during read");
+    options.signal?.throwIfAborted();
+    const inspected = await inspectFile(inspection.inspect, {
+      prefix: bytes.slice(0, inspection.bytes),
+      name: basename(path)
+    }, inspection.timeoutMs, options.signal);
+    source = {
+      ref: inspectedRef(path, bytes.byteLength, inspected),
+      bytes,
+      ...options.observe ? {
+        observation: {
+          dev: after.dev,
+          ino: after.ino,
+          size: after.size,
+          nlink: after.nlink,
+          mtimeMs: after.mtimeMs,
+          ctimeMs: after.ctimeMs
+        }
+      } : {}
+    };
+  } catch (error) {
+    failed = true;
+    failure = error;
+  } finally {
+    try {
+      await handle.close();
+    } catch (error) {
+      if (!failed) {
+        failed = true;
+        failure = error;
+      }
+    }
+  }
+  if (failed)
+    throw failure;
+  if (source === undefined)
+    throw new Error("Read completed without a result");
+  return source;
+}
+
 // src/files/boundary.ts
 var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
 var DEFAULT_INSPECTION_BYTES = 64 * 1024;
 var DEFAULT_INSPECTION_TIMEOUT_MS = 15000;
 var nofollowFlag;
 var noFollow = () => {
-  nofollowFlag ??= constants.O_NOFOLLOW ?? 0;
+  nofollowFlag ??= constants2.O_NOFOLLOW ?? 0;
   return nofollowFlag;
 };
 
@@ -271,41 +346,35 @@ async function createManagedFileBoundary2(config) {
     async read(path, options = {}) {
       const resolved = targetFor(path);
       options.signal?.throwIfAborted();
-      const realTarget = await realpathOrNull(resolved.target, "failed to resolve managed file");
-      if (realTarget === null) {
-        throw new ManagedFileError2("FILE_NOT_FOUND", "managed file not found");
-      }
-      if (!isWithinDir2(root, realTarget)) {
-        throw new ManagedFileError2("FILE_OUTSIDE_ROOT", "managed-file path escapes its boundary");
+      let readTarget;
+      if (options.rejectSymlinks) {
+        const parent = await existingParent(root, resolved.target);
+        readTarget = resolve(parent, basename2(resolved.target));
+      } else {
+        const realTarget = await realpathOrNull(resolved.target, "failed to resolve managed file");
+        if (realTarget === null)
+          throw new ManagedFileError2("FILE_NOT_FOUND", "managed file not found");
+        if (!isWithinDir2(root, realTarget))
+          throw new ManagedFileError2("FILE_OUTSIDE_ROOT", "managed-file path escapes its boundary");
+        readTarget = realTarget;
       }
       const maxBytes = positiveLimit(options.maxBytes, maxReadBytes, "maxBytes");
-      let handle;
       try {
-        handle = await open(realTarget, constants.O_RDONLY | noFollow());
-        const info = await handle.stat();
-        if (!info.isFile()) {
-          throw new ManagedFileError2("FILE_NOT_REGULAR", "managed path is not a regular file");
-        }
-        const bytes = await readHandle(handle, maxBytes, options.signal);
-        const inspection = await inspectFile(config.inspect, {
-          prefix: bytes.slice(0, inspectionBytes),
-          name: basename(resolved.path)
-        }, inspectionTimeoutMs, options.signal);
-        return {
-          ref: inspectedRef(resolved.path, bytes.byteLength, inspection),
-          bytes
-        };
+        return await readManagedDescriptor(readTarget, resolved.path, maxBytes, options, {
+          inspect: config.inspect,
+          bytes: inspectionBytes,
+          timeoutMs: inspectionTimeoutMs
+        });
       } catch (error) {
-        if (options.signal?.aborted && error === options.signal.reason)
-          throw error;
-        if (errorCode(error) === "ENOENT") {
+        if (options.signal?.aborted)
+          throw options.signal.reason;
+        if (errorCode(error) === "ELOOP")
+          throw new ManagedFileError2("FILE_UNSAFE_LINK", "managed file leaf is a symlink", {
+            cause: error
+          });
+        if (errorCode(error) === "ENOENT")
           throw new ManagedFileError2("FILE_NOT_FOUND", "managed file not found");
-        }
         throw ioError("failed to read managed file", error);
-      } finally {
-        await handle?.close().catch(() => {
-          return;
-        });
       }
     },
     async write(path, source, options = {}) {
@@ -318,7 +387,7 @@ async function createManagedFileBoundary2(config) {
       let committed = false;
       let size = 0;
       try {
-        handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | noFollow(), 384);
+        handle = await open2(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY | noFollow(), 384);
         const written = await writeSource(handle, source, maxBytes, inspectionBytes, options.signal);
         size = written.size;
         if (options.durable)
@@ -328,28 +397,28 @@ async function createManagedFileBoundary2(config) {
         const inspection = await inspectFile(config.inspect, {
           prefix: written.prefix,
           ...options.mediaType ? { declaredMediaType: options.mediaType } : {},
-          name: options.name ?? basename(resolved.path)
+          name: options.name ?? basename2(resolved.path)
         }, inspectionTimeoutMs, options.signal);
         options.signal?.throwIfAborted();
-        if (options.replace) {
-          await rename(temporary, resolved.target);
+        try {
+          await publishAtomicFile(temporary, resolved.target, options.replace ?? false, options.durable ?? false);
           committed = true;
-        } else {
-          try {
-            await link(temporary, resolved.target);
+        } catch (error) {
+          if (error instanceof AtomicFilePublicationError2) {
             committed = true;
-          } catch (error) {
-            if (errorCode(error) === "EEXIST") {
-              throw new ManagedFileError2("FILE_EXISTS", "managed file already exists");
-            }
             throw error;
           }
+          if (errorCode(error) === "EEXIST")
+            throw new ManagedFileError2("FILE_EXISTS", "managed file already exists");
+          throw error;
         }
         return inspectedRef(resolved.path, size, inspection, {
           mediaType: options.mediaType,
           name: options.name
         });
       } catch (error) {
+        if (error instanceof AtomicFilePublicationError2)
+          throw error;
         if (options.signal?.aborted && error === options.signal.reason)
           throw error;
         throw ioError("failed to write managed file", error);

package/dist/internal/abort-race.d.ts

@@ -0,0 +1,3 @@
+/** Releases an await on cancellation without assuming a callback cooperates with its signal. */
+export declare function raceAbort<T>(operation: Promise<T>, signal: AbortSignal): Promise<T>;
+//# sourceMappingURL=abort-race.d.ts.map

package/dist/internal/abort-race.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort-race.d.ts","sourceRoot":"","sources":["../../src/internal/abort-race.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,wBAAgB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAsBnF"}

package/dist/internal/atomic-file.d.ts

@@ -29,14 +29,32 @@ export interface WriteFileAtomicOptions {
      * caller states, never one a default makes for them.
      */
     mode?: number;
+    /** Replace by default; false atomically refuses any existing file or link. */
+    replace?: boolean;
+    /** Default file: fsync bytes. directory also syncs the parent after publication. */
+    durability?: 'none' | 'file' | 'directory';
 }
 /**
  * Write `data` to `target` atomically: a reader sees the old contents or the
  * new ones, never part of either, and the new file has `mode` from its first
- * visible moment. A failed write leaves the target untouched and no staging
- * file behind.
+ * visible moment. A failure before publication leaves the target untouched. Directory-sync or
+ * staging-link cleanup failure after publication throws AtomicFilePublicationError
+ * with published=true; do not blindly repeat an external action.
  */
 export declare function writeFileAtomic(target: string, data: Uint8Array | string, options?: WriteFileAtomicOptions): Promise<void>;
+interface AtomicFileWriteIO {
+    open(path: string, flags: 'wx', mode: number): Promise<{
+        writeFile(bytes: Uint8Array): Promise<void>;
+        chmod(mode: number): Promise<void>;
+        sync(): Promise<void>;
+        close(): Promise<void>;
+    }>;
+    unlink(path: string): Promise<void>;
+    publish(staged: string, target: string, replace: boolean, directorySync: boolean): Promise<void>;
+}
+/** Internal syscall seam for publication-order and precommit fault controls. */
+export declare function writeAtomicFileData(target: string, data: Uint8Array | string, options: WriteFileAtomicOptions, io?: AtomicFileWriteIO): Promise<void>;
 /** The synchronous form of {@link writeFileAtomic}, with the same guarantees in the same order. */
 export declare function writeFileAtomicSync(target: string, data: Uint8Array | string, options?: WriteFileAtomicOptions): void;
+export {};
 //# sourceMappingURL=atomic-file.d.ts.map

package/dist/internal/atomic-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-file.d.ts","sourceRoot":"","sources":["../../src/internal/atomic-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAeH,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAYD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,IAAI,CA6BN"}
+{"version":3,"file":"atomic-file.d.ts","sourceRoot":"","sources":["../../src/internal/atomic-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;CAC5C;AAYD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,UAAU,iBAAiB;IACzB,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,IAAI,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CACL,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,EAAE,sBAAsB,EAC/B,EAAE,GAAE,iBAAgE,GACnE,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,IAAI,CAiDN"}

package/dist/internal/atomic-publication.d.ts

@@ -0,0 +1,19 @@
+/** The new target is visible; failure is not evidence that publication did not occur. */
+export declare class AtomicFilePublicationError extends Error {
+    readonly phase: 'cleanup' | 'directory-sync' | 'directory-close';
+    readonly published = true;
+    constructor(phase: 'cleanup' | 'directory-sync' | 'directory-close', cause: unknown);
+}
+/** Native publication syscalls; injectable only at this internal IO boundary for fault controls. */
+export interface PublicationIO {
+    rename(from: string, to: string): Promise<void>;
+    link(from: string, to: string): Promise<void>;
+    unlink(path: string): Promise<void>;
+    open(path: string, flags: 'r'): Promise<{
+        sync(): Promise<void>;
+        close(): Promise<void>;
+    }>;
+}
+export declare function publishAtomicFile(staged: string, target: string, replace: boolean, directorySync: boolean, io?: PublicationIO): Promise<void>;
+export declare function publishAtomicFileSync(staged: string, target: string, replace: boolean, directorySync: boolean): void;
+//# sourceMappingURL=atomic-publication.d.ts.map

package/dist/internal/atomic-publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-publication.d.ts","sourceRoot":"","sources":["../../src/internal/atomic-publication.ts"],"names":[],"mappings":"AAIA,yFAAyF;AACzF,qBAAa,0BAA2B,SAAQ,KAAK;aAGjC,KAAK,EAAE,SAAS,GAAG,gBAAgB,GAAG,iBAAiB;IAFzE,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YACkB,KAAK,EAAE,SAAS,GAAG,gBAAgB,GAAG,iBAAiB,EACvE,KAAK,EAAE,OAAO,EAIf;CACF;AAED,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC,CAAC;CAC5F;AAGD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,EACtB,EAAE,GAAE,aAAsB,GACzB,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,GACrB,IAAI,CAmCN"}

package/dist/internal/json-data.d.ts

@@ -0,0 +1,8 @@
+/** Validation shared by durable JSON and canonical JSON; serialization has one separate owner. */
+export declare function isJsonData(value: unknown, limits: {
+    maxDepth: number;
+    maxNodes: number;
+    maxBytes: number;
+    omitObjectUndefined: boolean;
+}): boolean;
+//# sourceMappingURL=json-data.d.ts.map

package/dist/internal/json-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-data.d.ts","sourceRoot":"","sources":["../../src/internal/json-data.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,MAAM,EAAE;IACN,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,OAAO,CAAC;CAC9B,GACA,OAAO,CA0DT"}

package/dist/primitives/canonical-json.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+declare const CanonicalJsonOptionsSchema: z.ZodObject<{
+    maxDepth: z.ZodDefault<z.ZodNumber>;
+    maxNodes: z.ZodDefault<z.ZodNumber>;
+    maxBytes: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type CanonicalJsonOptions = z.input<typeof CanonicalJsonOptionsSchema>;
+/** Bounded plain JSON, UTF-16 sorted keys; undefined object members are omitted. */
+export declare function canonicalJson(value: unknown, options?: CanonicalJsonOptions): string;
+export {};
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/primitives/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../src/primitives/canonical-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,0BAA0B;;;;kBAQ9B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,CAOxF"}

package/dist/primitives/index.d.ts

@@ -1,4 +1,5 @@
 export { type AuditOmitPolicy, type AuditPolicy, type AuditRecord, type AuditRecordPolicy, AuditRecordSchema, assertAuditDeclared, audit, type CreateAuditRecordInput, createAuditRecord, } from './audit.js';
+export { type CanonicalJsonOptions, canonicalJson } from './canonical-json.js';
 export { type DeadlineResult, DeadlineResultSchema, defineDeadlinePolicy, } from './deadline.js';
 export { type DomainEventDeliveryClaim, DomainEventDeliveryClaimSchema, type DomainEventDeliveryOutcome, DomainEventDeliveryOutcomeSchema, type DomainEventDeliveryPlan, type DomainEventDestination, DomainEventDestinationSchema, type DomainEventDispatchResult, type DomainEventOutbox, type DomainEventRoute, type DomainEventTransport, defineDomainEventDelivery, } from './delivery.js';
 export { createDomainEventSchema, type DomainEvent, type DomainEventActor, DomainEventActorSchema, DomainEventSchema, type DomainEventSubject, DomainEventSubjectSchema, } from './event.js';

package/dist/primitives/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/primitives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,EACL,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,cAAc,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/primitives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,EACL,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,KAAK,oBAAoB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}

package/dist/process/command-owner.d.ts

@@ -0,0 +1,13 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import { type NativeCommandOptions } from './contract.js';
+/** One-shot native execution; sandbox policy/admission is composed above this owner. */
+export declare function startNativeCommand(input: NativeCommandOptions, onSpawn?: (child: ChildProcessWithoutNullStreams) => void): {
+    result: Promise<{
+        exitCode: number | null;
+        signal: string | null;
+        stdout: Uint8Array<ArrayBuffer>;
+        stderr: Uint8Array<ArrayBuffer>;
+    }>;
+    stop(): Promise<void>;
+};
+//# sourceMappingURL=command-owner.d.ts.map

package/dist/process/command-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,8BAA8B,EAAS,MAAM,oBAAoB,CAAC;AAGhF,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,YAAY,CAAC;AAGpB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI;;;;;;;;EA0H1D"}

package/dist/process/command.d.ts

@@ -0,0 +1,3 @@
+import type { NativeCommandOptions, NativeCommandResult } from './contract.js';
+export declare function runNativeCommand(input: NativeCommandOptions): Promise<NativeCommandResult>;
+//# sourceMappingURL=command.d.ts.map

package/dist/process/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/process/command.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE5E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE1F"}