tracegrove 0.0.0-stage → 0.3.0

package/dist/core/activationDecision.d.ts

@@ -0,0 +1,153 @@
+import { ScenarioProjection, type ScenarioActivationIntent, type ScenarioDefinition, type ScenarioReplayAssessment } from '../protocol/index.ts';
+import { z } from 'zod';
+export declare const ActivationActor: z.ZodObject<{
+    actorId: z.ZodString;
+    policyRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodString;
+        digest: z.ZodObject<{
+            algorithm: z.ZodLiteral<"sha256">;
+            hex: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare function assertActivationBindings(intent: ScenarioActivationIntent, scenario: ScenarioDefinition): void;
+/** Shared decision construction. The host must independently derive report and actor before calling. */
+export declare function deriveScenarioActivation(intent: ScenarioActivationIntent, projection: ScenarioProjection, scenario: ScenarioDefinition, report: ScenarioReplayAssessment, actor: z.infer<typeof ActivationActor>, activatedAt: string): {
+    activation: {
+        schemaVersion: "workflow.scenario-activation/v1";
+        ref: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        scope: {
+            ownerId: string;
+            tenantId: string | null;
+            visibility: "public" | "owner_private" | "tenant_private";
+        };
+        intent: {
+            snapshot: {
+                id: string;
+                scope: {
+                    ownerId: string;
+                    tenantId: string | null;
+                    visibility: "public" | "owner_private" | "tenant_private";
+                };
+                expectedAggregateVersion: number;
+                expectedDefinitionRef: {
+                    id: string;
+                    revision: string;
+                    digest: {
+                        algorithm: "sha256";
+                        hex: string;
+                    };
+                };
+                expectedInvalidationEpoch: number;
+                expectedLatestRoundSequence: number;
+            };
+            replayContractRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            qualificationPolicyRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            qualificationMatrixRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            targetProfileRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            roundRefs: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            }[];
+            idempotencyKey: string;
+        };
+        intentDigest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+        actorId: string;
+        authorizationPolicyRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        assessmentRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        activatedAt: string;
+    };
+    next: {
+        id: string;
+        scope: {
+            ownerId: string;
+            tenantId: string | null;
+            visibility: "public" | "owner_private" | "tenant_private";
+        };
+        aggregateVersion: number;
+        definitionRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        state: "proposed" | "validating" | "active" | "degraded" | "retired";
+        invalidationEpoch: number;
+        latestRoundSequence: number;
+        qualificationRoundRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        activationDecisionRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+    };
+};

package/dist/core/activationDecision.js

@@ -0,0 +1,34 @@
+import { IdString, RefSchema, ScenarioActivation, ScenarioProjection, digestOfValue, freeze, sameRef } from "../protocol/index.js";
+import { z } from 'zod';
+import { Blocked, Conflict } from "./errors.js";
+export const ActivationActor = z.object({ actorId: IdString, policyRef: RefSchema }).strict();
+export function assertActivationBindings(intent, scenario) {
+    if (!sameRef(intent.replayContractRef, scenario.replayContractRef) || !sameRef(intent.qualificationPolicyRef, scenario.qualificationPolicyRef) ||
+        !sameRef(intent.qualificationMatrixRef, scenario.qualificationMatrixRef) || !sameRef(intent.targetProfileRef, scenario.qualificationTargetProfileRef))
+        throw new Conflict('activation replay/policy/matrix/target bindings changed');
+}
+/** Shared decision construction. The host must independently derive report and actor before calling. */
+export function deriveScenarioActivation(intent, projection, scenario, report, actor, activatedAt) {
+    assertActivationBindings(intent, scenario);
+    if (projection.state !== 'validating' || digestOfValue(report.snapshot).hex !== digestOfValue(intent.snapshot).hex ||
+        !sameRef(report.policyRef, scenario.qualificationPolicyRef))
+        throw new Conflict('activation evidence snapshot or policy changed');
+    const latest = report.rounds.find(round => report.latestAdmissionRef && sameRef(round.admissionRef, report.latestAdmissionRef));
+    if (!report.qualifies || report.reasonCodes.length || intent.roundRefs.length < report.requiredRounds ||
+        new Set(intent.roundRefs.map(r => digestOfValue(r).hex)).size !== intent.roundRefs.length ||
+        !intent.roundRefs.every(ref => report.qualifyingRoundRefs.some(qualified => sameRef(ref, qualified)) &&
+            report.rounds.some(r => r.assessment?.qualifies && sameRef(r.assessment.roundRef, ref))) ||
+        !latest?.assessment || !intent.roundRefs.some(ref => sameRef(ref, latest.assessment.roundRef))) {
+        throw new Blocked([{ code: 'scenario_not_qualified', detail: 'Selected independent live rounds must satisfy current policy and include the latest admitted round',
+                owner: 'scenario owner', action: 'Complete qualification or review the current evidence and selection' }]);
+    }
+    const assessmentRefs = intent.roundRefs.map(ref => report.rounds.find(round => round.assessment && sameRef(round.assessment.roundRef, ref)).assessment.ref);
+    const intentDigest = digestOfValue(intent);
+    const activation = ScenarioActivation.parse(freeze({ schemaVersion: 'workflow.scenario-activation/v1',
+        ref: { id: `scenario-activation-${intentDigest.hex}`, revision: '1' }, scope: intent.snapshot.scope, intent, intentDigest,
+        actorId: actor.actorId, authorizationPolicyRef: actor.policyRef, assessmentRefs, activatedAt }));
+    const next = ScenarioProjection.parse({ ...projection, aggregateVersion: projection.aggregateVersion + 1, state: 'active',
+        qualificationRoundRefs: intent.roundRefs, activationDecisionRef: activation.ref });
+    return { activation, next };
+}
+//# sourceMappingURL=activationDecision.js.map

package/dist/core/activationDecision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activationDecision.js","sourceRoot":"","sources":["../../src/core/activationDecision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EACX,MAAM,sBAAsB,CAAC;AACtH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9F,MAAM,UAAU,wBAAwB,CAAC,MAAgC,EAAE,QAA4B;IACrG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB,CAAC;QAC1I,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,6BAA6B,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,yDAAyD,CAAC,CAAC;AAC3O,CAAC;AACD,wGAAwG;AACxG,MAAM,UAAU,wBAAwB,CAAC,MAAgC,EAAE,UAA8B,EAAE,QAA4B,EACrI,MAAgC,EAAE,KAAsC,EAAE,WAAmB;IAC7F,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,KAAK,KAAK,YAAY,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG;QAC9G,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,sBAAsB,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,gDAAgD,CAAC,CAAC;IACtI,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAChI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc;QACjG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,SAAS,CAAC,MAAM;QACzF,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAClG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1F,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,oGAAoG;gBAC/J,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAE,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC;IAC9J,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,iCAAiC;QACnG,GAAG,EAAE,EAAE,EAAE,EAAE,uBAAuB,YAAY,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY;QACzH,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ;QACvH,sBAAsB,EAAE,MAAM,CAAC,SAAS,EAAE,qBAAqB,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/core/artifacts.d.ts

@@ -0,0 +1,18 @@
+import { EvidenceArtifact, type Digest, type Ref } from '../protocol/index.ts';
+export declare class LocalArtifactStore {
+    readonly root: string;
+    constructor(root: string);
+    objectPath(hex: string): string;
+    /** Write bytes, read them back and verify the digest before returning the ref. */
+    put(input: {
+        id: string;
+        bytes: Buffer;
+        mediaType: string;
+        producerRef: Ref;
+        stepIds: string[];
+        from: string;
+        to: string;
+    }): EvidenceArtifact;
+    verify(digest: Digest): boolean;
+    read(digest: Digest): Buffer;
+}

package/dist/core/artifacts.js

@@ -0,0 +1,79 @@
+/** Local ArtifactStore: content-addressed objects under the execution-owned state directory. */
+import { linkSync, mkdtempSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { EvidenceArtifact, digestOfBytes, parseAs } from "../protocol/index.js";
+import { InfrastructureFailure } from "./errors.js";
+import { createDurableDirectory, syncDirectory, writeExclusiveDurable } from "./atomicFiles.js";
+import { readBoundedFile } from "./boundedFile.js";
+import { BUNDLE_LIMITS } from "./bundleSnapshot.js";
+export class LocalArtifactStore {
+    root;
+    constructor(root) {
+        this.root = root;
+        createDurableDirectory(join(root, 'objects', 'sha256'));
+    }
+    objectPath(hex) {
+        if (!/^[a-f0-9]{64}$/.test(hex))
+            throw new InfrastructureFailure('invalid artifact digest');
+        return join(this.root, 'objects', 'sha256', hex);
+    }
+    /** Write bytes, read them back and verify the digest before returning the ref. */
+    put(input) {
+        const digest = digestOfBytes(input.bytes);
+        const target = this.objectPath(digest.hex);
+        if (input.bytes.length > BUNDLE_LIMITS.fileBytes)
+            throw new InfrastructureFailure('artifact exceeds bounded file size');
+        const directory = join(this.root, 'objects', 'sha256');
+        const staging = mkdtempSync(join(directory, '.pending-'));
+        try {
+            const temporary = join(staging, 'object');
+            writeExclusiveDurable(temporary, input.bytes);
+            if (digestOfBytes(readBoundedFile(temporary, BUNDLE_LIMITS.fileBytes)).hex !== digest.hex)
+                throw new InfrastructureFailure('artifact staging digest mismatch');
+            // link is exclusive: a concurrent writer cannot replace any existing object.
+            try {
+                linkSync(temporary, target);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+            syncDirectory(directory);
+        }
+        finally {
+            rmSync(staging, { recursive: true, force: true });
+        }
+        const readBack = digestOfBytes(readBoundedFile(target, BUNDLE_LIMITS.fileBytes));
+        if (readBack.hex !== digest.hex)
+            throw new InfrastructureFailure(`artifact readback digest mismatch for ${input.id}`);
+        return parseAs(EvidenceArtifact, {
+            ref: { id: input.id, revision: '1', digest },
+            privateObject: { provider: 'local_fs', bucket: this.root, key: `objects/sha256/${digest.hex}` },
+            mediaType: input.mediaType,
+            byteCount: input.bytes.byteLength,
+            producerRef: input.producerRef,
+            stepIds: input.stepIds,
+            timeRange: { from: input.from, to: input.to },
+            redactionPolicyRef: null,
+            retentionPolicyRef: null,
+            accessPolicyRef: null,
+            derivativeOf: null,
+        }, 'evidence artifact');
+    }
+    verify(digest) {
+        try {
+            this.read(digest);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    read(digest) {
+        const bytes = readBoundedFile(this.objectPath(digest.hex), BUNDLE_LIMITS.fileBytes);
+        if (digestOfBytes(bytes).hex !== digest.hex)
+            throw new InfrastructureFailure(`artifact ${digest.hex} missing or corrupt`);
+        return bytes;
+    }
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/core/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../src/core/artifacts.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAyB,MAAM,sBAAsB,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,OAAO,kBAAkB;IACR;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QAC/B,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,kFAAkF;IAClF,GAAG,CAAC,KAAsH;QACxH,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAC;QACxH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC1C,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,aAAa,CAAC,eAAe,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;gBAAE,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAC;YAC/J,6EAA6E;YAC7E,IAAI,CAAC;gBAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YACpC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,qBAAqB,CAAC,yCAAyC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACtH,OAAO,OAAO,CAAC,gBAAgB,EAAE;YAC/B,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE;YAC5C,aAAa,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,kBAAkB,MAAM,CAAC,GAAG,EAAE,EAAE;YAC/F,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,kBAAkB,EAAE,IAAI;YACxB,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,IAAI;SACnB,EAAE,mBAAmB,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,MAAc;QACjB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,qBAAqB,CAAC,YAAY,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC;QAC1H,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/core/atomicFiles.d.ts

@@ -0,0 +1,9 @@
+export declare function syncDirectory(path: string): void;
+export declare function writeExclusiveDurable(path: string, bytes: Uint8Array): void;
+/** Persist an existing bounded-reader-checked payload without following a final symlink. */
+export declare function syncRegularFile(path: string): void;
+/** Caller owns this quiescent tree; reject preexisting symlink ancestors instead of following them. */
+export declare function requireRealDirectory(path: string): void;
+/** Anchor new directory entries as well as their contents; callers retain exclusive tree ownership. */
+export declare function syncDirectoryAncestors(path: string): void;
+export declare function createDurableDirectory(path: string): void;

package/dist/core/atomicFiles.js

@@ -0,0 +1,76 @@
+/** Local owned-filesystem durability primitives; not distributed fencing or hostile-parent confinement. */
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, writeFileSync } from 'node:fs';
+import { dirname, parse, resolve } from 'node:path';
+export function syncDirectory(path) {
+    const fd = openSync(path, 'r');
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function writeExclusiveDurable(path, bytes) {
+    const fd = openSync(path, 'wx', 0o600);
+    try {
+        writeFileSync(fd, bytes);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Persist an existing bounded-reader-checked payload without following a final symlink. */
+export function syncRegularFile(path) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        if (!fstatSync(fd).isFile())
+            throw new Error('artifact payload must be a regular file');
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Caller owns this quiescent tree; reject preexisting symlink ancestors instead of following them. */
+export function requireRealDirectory(path) {
+    let current = resolve(path);
+    while (true) {
+        const stat = lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('artifact parent must be a real owned directory');
+        if (current === parse(current).root)
+            return;
+        current = dirname(current);
+    }
+}
+/** Anchor new directory entries as well as their contents; callers retain exclusive tree ownership. */
+export function syncDirectoryAncestors(path) {
+    let current = resolve(path);
+    while (true) {
+        syncDirectory(current);
+        if (current === parse(current).root)
+            return;
+        current = dirname(current);
+    }
+}
+export function createDurableDirectory(path) {
+    let ancestor = resolve(path);
+    while (true) {
+        try {
+            lstatSync(ancestor);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            ancestor = dirname(ancestor);
+        }
+    }
+    // Check existing ancestors before recursive mkdir can follow a preexisting link.
+    requireRealDirectory(ancestor);
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    requireRealDirectory(path);
+    syncDirectoryAncestors(path);
+}
+//# sourceMappingURL=atomicFiles.js.map

package/dist/core/atomicFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomicFiles.js","sourceRoot":"","sources":["../../src/core/atomicFiles.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAiB;IACnE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC;QAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC7E,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,CAAC;QAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YACvG,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpH,IAAI,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI;YAAE,OAAO;QAC5C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI;YAAE,OAAO;QAC5C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QACnC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;IACtH,CAAC;IACD,iFAAiF;IACjF,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,sBAAsB,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/core/boundedFile.d.ts

@@ -0,0 +1,2 @@
+/** Read a bounded regular file without following its final symlink or allocating from unchecked size. */
+export declare function readBoundedFile(path: string, maxBytes: number, expectedBytes?: number): Buffer;

package/dist/core/boundedFile.js

@@ -0,0 +1,28 @@
+import { closeSync, constants, fstatSync, openSync, readSync } from 'node:fs';
+/** Read a bounded regular file without following its final symlink or allocating from unchecked size. */
+export function readBoundedFile(path, maxBytes, expectedBytes) {
+    const descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = fstatSync(descriptor);
+        if (!stat.isFile() || stat.size > maxBytes)
+            throw new Error('input is not a bounded regular file');
+        const size = expectedBytes ?? stat.size;
+        if (stat.size !== size)
+            throw new Error(`hash mismatch ${path}: byte count changed`);
+        const bytes = Buffer.alloc(size + 1);
+        let count = 0;
+        while (count < bytes.length) {
+            const read = readSync(descriptor, bytes, count, bytes.length - count, null);
+            if (!read)
+                break;
+            count += read;
+        }
+        if (count !== size)
+            throw new Error(`hash mismatch ${path}: byte count changed`);
+        return bytes.subarray(0, count);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+//# sourceMappingURL=boundedFile.js.map

package/dist/core/boundedFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundedFile.js","sourceRoot":"","sources":["../../src/core/boundedFile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE9E,yGAAyG;AACzG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB,EAAE,aAAsB;IACpF,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACpG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC,IAAI;gBAAE,MAAM;YACjB,KAAK,IAAI,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;AACtC,CAAC"}

package/dist/core/bundle.d.ts

@@ -0,0 +1,77 @@
+export { BUNDLE_SCHEMA_VERSION, BUNDLE_LIMITS } from './bundleSnapshot.ts';
+import { CampaignResult, ExecutionReceipt, RunRequest, SelectionManifest, type Digest } from '../protocol/index.ts';
+import type { FrozenBundle } from './planner.ts';
+import { type RunnerCompatibilityDiagnostic } from './runnerCapabilities.ts';
+export type { RunnerCompatibilityDiagnostic } from './runnerCapabilities.ts';
+export type CellRecords = {
+    id: string;
+    receipt: ExecutionReceipt;
+    environment: unknown;
+    fixtureManifest: unknown;
+    boundaryObservations: unknown[];
+    hostLease: unknown;
+    hostObservation: unknown;
+    attestations: unknown[];
+    credentialLease: unknown;
+    routing: unknown;
+    costs: unknown[];
+    eventsJsonl: string;
+    finalization: unknown;
+    media?: Array<{
+        digest: string;
+        bytes: Buffer;
+    }>;
+};
+/**
+ * Source commit under an owned quiescent local tree and the existing ledger writer.
+ * Payloads are exclusive and durable; candidate reduction precedes manifest publication.
+ * A crash/failure retains the local lock and incomplete records for explicit reconciliation.
+ */
+export declare function writeExecutionBundle(input: {
+    dir: string;
+    cell?: CellRecords;
+    bundle?: FrozenBundle;
+    request?: RunRequest;
+    selection?: SelectionManifest;
+    receipts?: ExecutionReceipt[];
+    campaign?: CampaignResult;
+}): void;
+export type BundleVerification = {
+    ok: boolean;
+    problems: string[];
+    outcome: CampaignResult['outcome'] | null;
+    receipts: number;
+    diagnostics?: RunnerCompatibilityDiagnostic[];
+};
+export type VerifiedBundleRecords = {
+    verification: BundleVerification & {
+        ok: true;
+    };
+    manifestDigest: Digest;
+    request: RunRequest;
+    selection: SelectionManifest;
+    campaign: CampaignResult;
+    receipts: ExecutionReceipt[];
+    documents: Record<string, unknown>;
+};
+export declare function verifyBundle(dir: string): BundleVerification;
+/**
+ * Publish only the verified snapshot's sealed bytes. The owned local parent must exist;
+ * cooperating writers share an exclusive lock, and existing outputs are never merged/overwritten.
+ * A crash leaves a private staging directory/lock to reconcile, or a complete verified output.
+ * No automatic stale-lock breaking, distributed fencing or hostile-parent race protection.
+ */
+export declare function exportVerifiedBundle(source: string, output: string): BundleVerification;
+export declare function readVerifiedBundle(dir: string): VerifiedBundleRecords;
+/** Copy/export from the exact bytes that passed reduction, never a second filesystem read. */
+export declare class VerifiedBundleSnapshot {
+    #private;
+    private constructor();
+    static open(dir: string): VerifiedBundleSnapshot;
+    get records(): VerifiedBundleRecords;
+    get manifestDigest(): Digest;
+    paths(): string[];
+    read(path: string): Buffer;
+}
+/** Read recording bytes from the same immutable snapshot that passed complete bundle verification. */
+export declare function readVerifiedVideo(dir: string, digest: string, caseId?: string): Buffer;