@aligndottech/cli 0.49.0 → 0.51.0

package/dist/lib/share/envelope.d.ts

@@ -0,0 +1,61 @@
+import type { SharePayload } from './payload.js';
+/** The envelope column holds 262,144 bytes; IV and tag take 28 of them. */
+export declare const MAX_ENVELOPE_BYTES = 262144;
+export declare const ENVELOPE_OVERHEAD_BYTES = 28;
+export declare const MAX_PLAINTEXT_BYTES: number;
+export declare class PlaintextTooLargeError extends Error {
+    readonly bytes: number;
+    constructor(bytes: number);
+}
+export declare class UnkeyedItemError extends Error {
+    constructor(title: string);
+}
+/** The gateway's team-text hash: a lowercase hex SHA-256. Anything else is not one, and is never staged. */
+export declare const TEAM_TEXT_HASH_RE: RegExp;
+export declare class InvalidTeamTextHashError extends Error {
+    constructor();
+}
+export interface Binding {
+    envelopeId: string;
+    tenantId: string;
+    userId: string;
+    kind: RequestKind;
+}
+/**
+ * The AAD joins ids with `|`, so an id that contains one would make `v1|a|b|c|d` ambiguous (a tenant of `T|U` and a user of
+ * `V` would bind the same bytes as a tenant of `T` and a user of `U|V`). Real ids are UUIDs; this accepts any plain token with
+ * no separator, space or control character, and refuses everything else before anything is sealed.
+ */
+export declare const BINDING_PART_RE: RegExp;
+export declare class InvalidBindingError extends Error {
+    constructor(field: string);
+}
+export declare function aadFor(b: Binding): Buffer;
+export interface Sealed {
+    /** iv || ciphertext || tag, standard base64: what the server stores. */
+    envelopeB64: string;
+    /** 32 random bytes, 43 base64url characters: goes ONLY in the link's fragment and the local pending file. */
+    keyB64Url: string;
+    /** Lowercase hex SHA-256 of the plaintext bytes. */
+    sha256: string;
+}
+export declare function seal(plaintext: Buffer, bind: Binding): Sealed;
+export type RequestKind = 'share' | 'confirm_team_text';
+export interface PlaintextInput {
+    kind: RequestKind;
+    tenantId: string;
+    gatewayUrl: string;
+    payloads: readonly SharePayload[];
+    /** For kind confirm_team_text: the team decision whose text the person confirms, and the hash the judgements carry. */
+    confirm?: {
+        remoteId: string;
+        teamTextHash: string;
+    };
+}
+/**
+ * The plaintext (v1). `decisions` is the exact /ingest/batch decisions array; `display` is labels only (counterpart
+ * titles, who relayed each judgement, what stays local), so a lying display can mislabel a counterpart but cannot
+ * hide or add text that is sent. `tenant_id` and `gateway_url` let the page refuse a link aimed elsewhere.
+ */
+export declare function buildPlaintext(input: PlaintextInput): Buffer;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/lib/share/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../src/lib/share/envelope.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,mBAAmB,QAA+C,CAAC;AAEhF,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM;CAInC;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAElD,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,MAAM,WAAW,OAAO;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE;AAEpG;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAwC,CAAC;AAErE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,KAAK,EAAE,MAAM;CAI1B;AAED,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAKzC;AAED,MAAM,WAAW,MAAM;IACrB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAS7D;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,mBAAmB,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAClC,uHAAuH;IACvH,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAoB5D"}

package/dist/lib/share/envelope.js

@@ -0,0 +1,99 @@
+/**
+ * ALI-1540: seal what a share would send, so the team server holds only ciphertext until a person approves.
+ *
+ * The CLI seals the exact plaintext bytes with AES-256-GCM under a random 32-byte key the server never sees:
+ * the key travels only in the approve link's `#k=` fragment, which a browser does not send. The AAD is
+ * `v1|<envelope id>|<tenant id>|<user id>|<kind>`, so a ciphertext swapped onto another request, workspace, user or
+ * kind fails to open. The envelope id is made HERE, before sealing, and sent with the request; the gateway keeps its
+ * own row id (it is not the primary key, so a chosen id cannot squat a row or probe for one across tenants). The hash is over the plaintext bytes as sealed, never over a re-serialised object.
+ *
+ * Layout: iv (12) || ciphertext || tag (16). That is the order WebCrypto wants (it takes the tag appended to the
+ * ciphertext), so the browser opens it with no reshaping (spike S1: parity with Node and real Chromium).
+ */
+import { createCipheriv, createHash, randomBytes } from 'node:crypto';
+import { toBatchDecisions } from './payload.js';
+/** The envelope column holds 262,144 bytes; IV and tag take 28 of them. */
+export const MAX_ENVELOPE_BYTES = 262_144;
+export const ENVELOPE_OVERHEAD_BYTES = 28;
+export const MAX_PLAINTEXT_BYTES = MAX_ENVELOPE_BYTES - ENVELOPE_OVERHEAD_BYTES;
+export class PlaintextTooLargeError extends Error {
+    bytes;
+    constructor(bytes) {
+        super(`This share is ${bytes} bytes once sealed, over the ${MAX_PLAINTEXT_BYTES} byte limit for one approval.`);
+        this.bytes = bytes;
+        this.name = 'PlaintextTooLargeError';
+    }
+}
+export class UnkeyedItemError extends Error {
+    constructor(title) {
+        super(`"${title.slice(0, 80)}" has no client_key, so it cannot be staged for approval (a share item always carries one). Nothing was staged.`);
+        this.name = 'UnkeyedItemError';
+    }
+}
+/** The gateway's team-text hash: a lowercase hex SHA-256. Anything else is not one, and is never staged. */
+export const TEAM_TEXT_HASH_RE = /^[0-9a-f]{64}$/;
+export class InvalidTeamTextHashError extends Error {
+    constructor() {
+        super('The team text hash the gateway sent is not a 64-character lowercase hex SHA-256, so the confirmation was not staged.');
+        this.name = 'InvalidTeamTextHashError';
+    }
+}
+/**
+ * The AAD joins ids with `|`, so an id that contains one would make `v1|a|b|c|d` ambiguous (a tenant of `T|U` and a user of
+ * `V` would bind the same bytes as a tenant of `T` and a user of `U|V`). Real ids are UUIDs; this accepts any plain token with
+ * no separator, space or control character, and refuses everything else before anything is sealed.
+ */
+export const BINDING_PART_RE = /^[0-9A-Za-z][0-9A-Za-z_.:-]{0,127}$/;
+export class InvalidBindingError extends Error {
+    constructor(field) {
+        super(`The ${field} the gateway reported is not a plain identifier, so a request cannot be sealed to it. Nothing was staged.`);
+        this.name = 'InvalidBindingError';
+    }
+}
+export function aadFor(b) {
+    for (const [field, v] of [['envelope id', b.envelopeId], ['workspace id', b.tenantId], ['user id', b.userId]]) {
+        if (!BINDING_PART_RE.test(v))
+            throw new InvalidBindingError(field);
+    }
+    return Buffer.from(`v1|${b.envelopeId}|${b.tenantId}|${b.userId}|${b.kind}`, 'utf8');
+}
+export function seal(plaintext, bind) {
+    if (plaintext.length > MAX_PLAINTEXT_BYTES)
+        throw new PlaintextTooLargeError(plaintext.length);
+    const key = randomBytes(32);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(aadFor(bind));
+    const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const envelope = Buffer.concat([iv, body, cipher.getAuthTag()]);
+    return { envelopeB64: envelope.toString('base64'), keyB64Url: key.toString('base64url'), sha256: createHash('sha256').update(plaintext).digest('hex') };
+}
+/**
+ * The plaintext (v1). `decisions` is the exact /ingest/batch decisions array; `display` is labels only (counterpart
+ * titles, who relayed each judgement, what stays local), so a lying display can mislabel a counterpart but cannot
+ * hide or add text that is sent. `tenant_id` and `gateway_url` let the page refuse a link aimed elsewhere.
+ */
+export function buildPlaintext(input) {
+    // Only a KEYED item is promoted as written; one without a client_key can be rewritten by synthesis or upserted onto
+    // a teammate's row. Every share item carries one today, and anything else is refused here rather than staged.
+    if (input.confirm && !TEAM_TEXT_HASH_RE.test(input.confirm.teamTextHash))
+        throw new InvalidTeamTextHashError();
+    for (const p of input.payloads) {
+        if (typeof p.item.client_key !== 'string' || p.item.client_key === '')
+            throw new UnkeyedItemError(p.item.title);
+    }
+    const body = {
+        v: 1,
+        kind: input.kind,
+        tenant_id: input.tenantId,
+        gateway_url: input.gatewayUrl,
+        ...(input.confirm ? { confirm: { decision_id: input.confirm.remoteId, team_text_hash: input.confirm.teamTextHash } } : {}),
+        decisions: toBatchDecisions(input.payloads.map((p) => ({ ...p.item }))),
+        display: input.payloads.map((p) => ({
+            judgements: p.shown.map((s) => ({ via: s.via, agent: s.agentId, counterpart_title: s.counterpartTitle })),
+            left_local: p.leftLocal.map((l) => ({ kind: l.kind, why: l.why, counterpart_title: l.counterpartTitle })),
+        })),
+    };
+    return Buffer.from(JSON.stringify(body), 'utf8');
+}
+//# sourceMappingURL=envelope.js.map

package/dist/lib/share/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/lib/share/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,uBAAuB,CAAC;AAEhF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B;IAArB,YAAqB,KAAa;QAChC,KAAK,CAAC,iBAAiB,KAAK,gCAAgC,mBAAmB,+BAA+B,CAAC,CAAC;QAD7F,UAAK,GAAL,KAAK,CAAQ;QAEhC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAa;QACvB,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iHAAiH,CAAC,CAAC;QAC/I,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,4GAA4G;AAC5G,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAElD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,sHAAsH,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAID;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAErE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,KAAa;QACvB,KAAK,CAAC,OAAO,KAAK,2GAA2G,CAAC,CAAC;QAC/H,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,UAAU,MAAM,CAAC,CAAU;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAU,EAAE,CAAC;QACvH,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAWD,MAAM,UAAU,IAAI,CAAC,SAAiB,EAAE,IAAa;IACnD,IAAI,SAAS,CAAC,MAAM,GAAG,mBAAmB;QAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1J,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,oHAAoH;IACpH,8GAA8G;IAC9G,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,IAAI,GAAG;QACX,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACzG,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;SAC1G,CAAC,CAAC;KACJ,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC"}

package/dist/lib/share/ledger.d.ts

@@ -0,0 +1,59 @@
+export interface Promotion {
+    localId: string;
+    env: string;
+    tenantId: string;
+    remoteId: string;
+    contentHash: string;
+    /** The share attached to a decision the team already held. Retracting it must NOT archive that decision. */
+    matched: boolean;
+    /** The opaque idempotency key sent as `client_key` at the first share; reused for every later one. */
+    clientKey: string;
+    /** Hashes of judgements already stored in that workspace. */
+    sent: string[];
+    /** A matched share whose ratify/supersede still waits for the person to confirm the team's text. */
+    confirmPending: boolean;
+    sharedAt: string;
+    retractedAt: string | null;
+}
+/** The write side of a ledger row: the clock columns are the database's. */
+export interface PromotionWrite {
+    localId: string;
+    env: string;
+    tenantId: string;
+    remoteId: string;
+    contentHash: string;
+    matched: boolean;
+    clientKey: string;
+    sent: string[];
+    confirmPending: boolean;
+}
+export interface LedgerRow {
+    local_id: string;
+    env: string;
+    tenant_id: string;
+    remote_id: string;
+    content_hash: string;
+    matched: number;
+    client_key: string;
+    sent: string;
+    confirm_pending: number;
+    shared_at: string;
+    retracted_at: string | null;
+}
+export declare function getPromotion(dbPath: string, localId: string, env: string, tenantId: string): Promotion | null;
+/** A row `align push` left before the ledger existed: it names no workspace. */
+export declare function getLegacyPromotion(dbPath: string, localId: string, env: string): Promotion | null;
+/** Insert, or replace the hash and remote id of an existing row; a re-share clears an earlier retraction. */
+export declare function recordPromotion(dbPath: string, p: PromotionWrite): void;
+/** Several rows in ONE transaction: all of them land or none do. */
+export declare function recordPromotions(dbPath: string, rows: readonly PromotionWrite[]): void;
+export declare function markRetracted(dbPath: string, localId: string, env: string, tenantId: string): void;
+/** Every live (not retracted) share into one workspace, keyed by local id. */
+export declare function listPromotions(dbPath: string, env: string, tenantId: string): Map<string, Promotion>;
+/** Every ledger row, raw, so a reset can carry the record of what was shared across a wipe. [] when there is none. */
+export declare function exportLedger(dbPath: string): LedgerRow[];
+/** Put exported rows back (replay-safe: the key is the table's primary key). */
+export declare function restoreLedger(dbPath: string, rows: readonly LedgerRow[]): void;
+/** True when the ledger table has every column this code uses. A share checks it BEFORE any request. */
+export declare function ledgerReady(dbPath: string): boolean;
+//# sourceMappingURL=ledger.d.ts.map

package/dist/lib/share/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../src/lib/share/ledger.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,4GAA4G;IAC5G,OAAO,EAAE,OAAO,CAAC;IACjB,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oGAAoG;IACpG,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAsCpP,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAK7G;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjG;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,GAAG,IAAI,CAUvE;AAQD,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAUtF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIlG;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAKpG;AAED,sHAAsH;AACtH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CAExD;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAa9E;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMnD"}

package/dist/lib/share/ledger.js

@@ -0,0 +1,137 @@
+/**
+ * L9: reads and writes of `promotions` (schema v10), the record of what this machine shared where.
+ *
+ * Same pattern as curation/judgements-db.ts: every function opens its own short-lived handle so the
+ * MCP server, a sync child and the share command can all be live, and a reader never creates a
+ * missing graph file. A pre-v10 file reads as "nothing shared".
+ */
+import fs from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+import { tightenGraphFiles } from '../private-files.js';
+import { assertSchemaSupported } from '../local-db-migrate.js';
+import { LEDGER_COLUMNS } from '../local-db-v10.js';
+function parseSent(raw) {
+    try {
+        const v = JSON.parse(raw);
+        return Array.isArray(v) ? v.filter((x) => typeof x === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+const fromRow = (r) => ({
+    localId: r.local_id, env: r.env, tenantId: r.tenant_id, remoteId: r.remote_id, contentHash: r.content_hash,
+    matched: r.matched === 1, clientKey: r.client_key, sent: parseSent(r.sent), confirmPending: r.confirm_pending === 1, sharedAt: r.shared_at, retractedAt: r.retracted_at,
+});
+function withDb(dbPath, fn) {
+    tightenGraphFiles(dbPath); // owner-only on every open (private-files.ts)
+    const db = new DatabaseSync(dbPath);
+    try {
+        db.exec('PRAGMA busy_timeout = 30000');
+        assertSchemaSupported(db.prepare('PRAGMA user_version').get().user_version, db);
+        return fn(db);
+    }
+    finally {
+        db.close();
+    }
+}
+function readDb(dbPath, fallback, fn) {
+    if (dbPath === '' || !fs.existsSync(dbPath))
+        return fallback;
+    return withDb(dbPath, (db) => {
+        try {
+            return fn(db);
+        }
+        catch (e) {
+            if (/no such table/i.test(e.message))
+                return fallback;
+            throw e;
+        }
+    });
+}
+export function getPromotion(dbPath, localId, env, tenantId) {
+    return readDb(dbPath, null, (db) => {
+        const r = db.prepare('SELECT * FROM promotions WHERE local_id = ? AND env = ? AND tenant_id = ?').get(localId, env, tenantId);
+        return r ? fromRow(r) : null;
+    });
+}
+/** A row `align push` left before the ledger existed: it names no workspace. */
+export function getLegacyPromotion(dbPath, localId, env) {
+    return getPromotion(dbPath, localId, env, 'legacy');
+}
+/** Insert, or replace the hash and remote id of an existing row; a re-share clears an earlier retraction. */
+export function recordPromotion(dbPath, p) {
+    withDb(dbPath, (db) => {
+        db.prepare(`INSERT INTO promotions (local_id, env, tenant_id, remote_id, content_hash, matched, client_key, sent, confirm_pending) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (local_id, env, tenant_id) DO UPDATE SET
+         remote_id = excluded.remote_id, content_hash = excluded.content_hash, matched = excluded.matched,
+         client_key = excluded.client_key, sent = excluded.sent, confirm_pending = excluded.confirm_pending,
+         shared_at = datetime('now'), retracted_at = NULL`).run(p.localId, p.env, p.tenantId, p.remoteId, p.contentHash, p.matched ? 1 : 0, p.clientKey, JSON.stringify([...new Set(p.sent)]), p.confirmPending ? 1 : 0);
+    });
+}
+const UPSERT = `INSERT INTO promotions (local_id, env, tenant_id, remote_id, content_hash, matched, client_key, sent, confirm_pending) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (local_id, env, tenant_id) DO UPDATE SET
+         remote_id = excluded.remote_id, content_hash = excluded.content_hash, matched = excluded.matched,
+         client_key = excluded.client_key, sent = excluded.sent, confirm_pending = excluded.confirm_pending,
+         shared_at = datetime('now'), retracted_at = NULL`;
+/** Several rows in ONE transaction: all of them land or none do. */
+export function recordPromotions(dbPath, rows) {
+    if (rows.length === 0)
+        return;
+    withDb(dbPath, (db) => {
+        const up = db.prepare(UPSERT);
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            for (const p of rows)
+                up.run(p.localId, p.env, p.tenantId, p.remoteId, p.contentHash, p.matched ? 1 : 0, p.clientKey, JSON.stringify([...new Set(p.sent)]), p.confirmPending ? 1 : 0);
+            db.exec('COMMIT');
+        }
+        catch (e) {
+            db.exec('ROLLBACK');
+            throw e;
+        }
+    });
+}
+export function markRetracted(dbPath, localId, env, tenantId) {
+    withDb(dbPath, (db) => {
+        db.prepare(`UPDATE promotions SET retracted_at = datetime('now') WHERE local_id = ? AND env = ? AND tenant_id = ?`).run(localId, env, tenantId);
+    });
+}
+/** Every live (not retracted) share into one workspace, keyed by local id. */
+export function listPromotions(dbPath, env, tenantId) {
+    return readDb(dbPath, new Map(), (db) => new Map(db.prepare('SELECT * FROM promotions WHERE env = ? AND tenant_id = ? AND retracted_at IS NULL').all(env, tenantId)
+        .map((r) => [r.local_id, fromRow(r)])));
+}
+/** Every ledger row, raw, so a reset can carry the record of what was shared across a wipe. [] when there is none. */
+export function exportLedger(dbPath) {
+    return readDb(dbPath, [], (db) => db.prepare('SELECT * FROM promotions').all());
+}
+/** Put exported rows back (replay-safe: the key is the table's primary key). */
+export function restoreLedger(dbPath, rows) {
+    if (rows.length === 0)
+        return;
+    withDb(dbPath, (db) => {
+        const ins = db.prepare(`INSERT OR REPLACE INTO promotions (local_id, env, tenant_id, remote_id, content_hash, matched, client_key, sent, confirm_pending, shared_at, retracted_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            for (const r of rows)
+                ins.run(r.local_id, r.env, r.tenant_id, r.remote_id, r.content_hash, r.matched, r.client_key, r.sent, r.confirm_pending, r.shared_at, r.retracted_at);
+            db.exec('COMMIT');
+        }
+        catch (e) {
+            db.exec('ROLLBACK');
+            throw e;
+        }
+    });
+}
+/** True when the ledger table has every column this code uses. A share checks it BEFORE any request. */
+export function ledgerReady(dbPath) {
+    if (!fs.existsSync(dbPath))
+        return false;
+    return withDb(dbPath, (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(promotions)').all().map((c) => c.name));
+        return LEDGER_COLUMNS.every((c) => cols.has(c));
+    });
+}
+//# sourceMappingURL=ledger.js.map

package/dist/lib/share/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../../src/lib/share/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAmCpD,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACrC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAY,EAAa,EAAE,CAAC,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY;IAC1G,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,eAAe,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY;CACxK,CAAC,CAAC;AAEH,SAAS,MAAM,CAAI,MAAc,EAAE,EAA2B;IAC5D,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,8CAA8C;IACzE,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACvC,qBAAqB,CAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC9G,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAI,MAAc,EAAE,QAAW,EAAE,EAA2B;IACzE,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,gBAAgB,CAAC,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC;gBAAE,OAAO,QAAQ,CAAC;YACjE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,GAAW,EAAE,QAAgB;IACzF,OAAO,MAAM,CAAmB,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAA0B,CAAC;QACvJ,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAe,EAAE,GAAW;IAC7E,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,CAAiB;IAC/D,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,OAAO,CACR;;;;0DAIoD,CACrD,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjK,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,MAAM,GAAG;;;;0DAI2C,CAAC;AAE3D,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAA+B;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtL,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAe,EAAE,GAAW,EAAE,QAAgB;IAC1F,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,GAAW,EAAE,QAAgB;IAC1E,OAAO,MAAM,CAAyB,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CACrE,EAAE,CAAC,OAAO,CAAC,mFAAmF,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAA4B;SAC3I,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAU,CAAC,CACjD,CAAC,CAAC;AACL,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,CAAc,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAA4B,CAAC,CAAC;AACzH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,IAA0B;IACtE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB;gDAC0C,CAC3C,CAAC;QACF,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;YAC5K,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAE,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxH,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/share/payload.d.ts

@@ -0,0 +1,101 @@
+import type { DecisionRow } from '../local-db.js';
+import type { JudgementRow } from '../curation/judgements-db.js';
+/** The gateway's per-item cap (MAX_JUDGEMENTS_PER_ITEM). Over it the batch is refused whole, so we cut first. */
+export declare const MAX_SHARED_JUDGEMENTS = 50;
+export type WireKind = 'ratify' | 'conflict_verdict' | 'check_verdict' | 'supersede' | 'not_a_decision' | 'note';
+export interface WireJudgement {
+    kind: WireKind;
+    value?: 'true_positive' | 'false_positive';
+    note?: string;
+    counterpart_id?: string;
+    judged_at: string;
+    origin: 'local_share' | 'local_share_mcp';
+    agent?: string;
+    confirm_team_text_hash?: string;
+}
+export interface WireItem {
+    source_url: string;
+    platform: string;
+    title: string;
+    /** Sent explicitly: the server keeps the caller's summary only when it is given (its extraction may rewrite the title). */
+    summary: string;
+    raw_text: string;
+    client_key: string;
+    created_at?: string;
+    judgements: WireJudgement[];
+}
+/** A judgement as the preview lists it: the wire form plus what a person needs to read it. */
+export interface ShownJudgement {
+    wire: WireJudgement;
+    /** Identity of this judgement for "already sent" (never includes the confirmation hash). */
+    hash: string;
+    via: 'cli' | 'mcp';
+    agentId: string | null;
+    counterpartTitle: string | null;
+}
+export interface LeftLocal {
+    kind: WireKind;
+    why: 'counterpart_not_shared' | 'over_limit';
+    counterpartTitle: string | null;
+}
+export interface SharePayload {
+    localId: string;
+    item: WireItem;
+    shown: ShownJudgement[];
+    leftLocal: LeftLocal[];
+    /** Pair judgements whose counterpart is not on the team graph YET: sendable once it is. */
+    deferredPairs: Array<{
+        row: JudgementRow;
+        counterpartLocalId: string;
+    }>;
+    /** Hash of the item AS SENT (only judgements not already sent). Binds a confirmation code. */
+    hash: string;
+    /** Hash of the item with EVERY judgement: what the ledger remembers, so an unchanged share is "already shared". */
+    fullHash: string;
+}
+export interface BuildInput {
+    row: DecisionRow;
+    /** This judge's rows that name the decision (either end), tombstones already excluded by the reader. */
+    judgements: JudgementRow[];
+    /** The team graph's id for a local decision this machine already shared, if any. */
+    remoteIdOf: (localId: string) => string | undefined;
+    titleOf: (localId: string) => string | null;
+    /** The opaque idempotency key: the one stored at the first share, else clientKeyFor(...). */
+    clientKey: string;
+    /** The install's private share salt, for the opaque local-only source URL. */
+    salt: string;
+    /** Hashes of judgements this workspace already stored; they are not sent (or shown) again. */
+    alreadySent: ReadonlySet<string>;
+}
+/**
+ * The idempotency key the server wants (a UUID), as an opaque hash of this install's secret salt and the
+ * local id. The raw local id never leaves the machine and two installs cannot be linked by it. It is
+ * derived ONCE: the caller stores it in the ledger at the first share and reuses that value, so a later
+ * change of local id (a twin fold) cannot mint a second key and a second team decision.
+ */
+export declare function clientKeyFor(salt: string, localId: string): string;
+/**
+ * A local row with no source URL still needs one on the wire. The raw local id never leaves the machine, so it is
+ * `align-local://decision/<hash of the share salt and the id>`. Matching by source key ignores this form (it names
+ * no connector item), and the server's identity for a share is (workspace, user, client_key), not the URL, so
+ * changing this form from the older raw-id one cannot mint a second team decision for a decision shared before.
+ */
+export declare function shareSourceUrl(row: {
+    id: string;
+    sourceUrl: string | null;
+}, salt: string): string;
+/** sha256 of the item with its keys sorted: the same payload hashes the same wherever it was built. */
+export declare function hashItem(item: WireItem): string;
+/** A judgement's identity for "already sent": its wire form without the confirmation hash. */
+export declare function judgementHash(w: WireJudgement): string;
+export declare function buildSharePayload(input: BuildInput): SharePayload;
+/**
+ * The `decisions` array of POST /ingest/batch for share items: verbatim except the one rename `created_at` ->
+ * `decided_at` (the gateway's schema takes the second and strips the first). The ONE place that rename happens
+ * for a share: `shareBatch` (the typed path) and the sealed request (the browser path) both call it, so the
+ * bytes a person approves are the bytes the gateway ingests.
+ */
+export declare function toBatchDecisions(items: ReadonlyArray<Record<string, unknown> & {
+    created_at?: string;
+}>): Array<Record<string, unknown>>;
+//# sourceMappingURL=payload.d.ts.map

package/dist/lib/share/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/lib/share/payload.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,iHAAiH;AACjH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,kBAAkB,GAAG,eAAe,GAAG,WAAW,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEjH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,eAAe,GAAG,gBAAgB,CAAC;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,GAAG,iBAAiB,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2HAA2H;IAC3H,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,KAAK,GAAG,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,wBAAwB,GAAG,YAAY,CAAC;IAC7C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,2FAA2F;IAC3F,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,WAAW,CAAC;IACjB,wGAAwG;IACxG,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,oFAAoF;IACpF,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5C,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlG;AAYD,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAE/C;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAGtD;AAoBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY,CAuDjE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAExI"}

package/dist/lib/share/payload.js

@@ -0,0 +1,147 @@
+/**
+ * L9: the ONE builder of what `align share` sends. The preview, the confirmation code's hash and
+ * the request body all come from the object this returns, so the preview cannot show something other
+ * than what is sent (a test compares the previewed JSON with the ingest argument).
+ *
+ * What leaves the machine, per decision: the title, the text (the summary, sent as `raw_text`), the
+ * source URL and platform, when it was decided, and the judgements below. What never does:
+ * - `judge_id` and `judge_label` (the git email): the server takes the person from the token, and a
+ *   label is personal data nobody asked for (Decision 11).
+ * - `context_key`, file paths, or a check verdict's scope: a check verdict goes as kind, value, time.
+ * - the local id as such: `client_key` is an OPAQUE key, a hash of this install's secret salt and the id (see
+ *   clientKeyFor), stored at the first share and reused, so the team graph cannot link a share back to a local id.
+ * - a verdict whose other decision is not on the team graph (it stays local, and the preview says so).
+ * - a tombstone (a verdict taken back, `value` NULL): the person withdrew it.
+ *
+ * Judgement mapping: local `real` is `true_positive`, `false` is `false_positive`. Ratification is
+ * read from the decision's own columns (Decision 14), never from `local_judgements`. A row an agent
+ * relayed goes as `origin: local_share_mcp` with the registry id as `agent`; the id 'unknown' is omitted.
+ */
+import { createHash } from 'node:crypto';
+/** The gateway's per-item cap (MAX_JUDGEMENTS_PER_ITEM). Over it the batch is refused whole, so we cut first. */
+export const MAX_SHARED_JUDGEMENTS = 50;
+/**
+ * The idempotency key the server wants (a UUID), as an opaque hash of this install's secret salt and the
+ * local id. The raw local id never leaves the machine and two installs cannot be linked by it. It is
+ * derived ONCE: the caller stores it in the ledger at the first share and reuses that value, so a later
+ * change of local id (a twin fold) cannot mint a second key and a second team decision.
+ */
+export function clientKeyFor(salt, localId) {
+    const h = createHash('sha256').update(`align-share-key\n${salt}\n${localId}`).digest('hex');
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-5${h.slice(13, 16)}-a${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+/**
+ * A local row with no source URL still needs one on the wire. The raw local id never leaves the machine, so it is
+ * `align-local://decision/<hash of the share salt and the id>`. Matching by source key ignores this form (it names
+ * no connector item), and the server's identity for a share is (workspace, user, client_key), not the URL, so
+ * changing this form from the older raw-id one cannot mint a second team decision for a decision shared before.
+ */
+export function shareSourceUrl(row, salt) {
+    if (row.sourceUrl !== null)
+        return row.sourceUrl;
+    return `align-local://decision/${createHash('sha256').update(`align-share-url\n${salt}\n${row.id}`).digest('hex').slice(0, 32)}`;
+}
+const VALUE = { real: 'true_positive', false: 'false_positive' };
+function canonical(v) {
+    if (Array.isArray(v))
+        return `[${v.map(canonical).join(',')}]`;
+    if (v && typeof v === 'object') {
+        return `{${Object.entries(v).filter(([, x]) => x !== undefined).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([k, x]) => `${JSON.stringify(k)}:${canonical(x)}`).join(',')}}`;
+    }
+    return JSON.stringify(v) ?? 'null';
+}
+/** sha256 of the item with its keys sorted: the same payload hashes the same wherever it was built. */
+export function hashItem(item) {
+    return createHash('sha256').update(canonical(item)).digest('hex');
+}
+/** A judgement's identity for "already sent": its wire form without the confirmation hash. */
+export function judgementHash(w) {
+    const { confirm_team_text_hash: _c, ...rest } = w;
+    return createHash('sha256').update(canonical(rest)).digest('hex');
+}
+function wireFor(r, counterpart) {
+    const mcp = r.via === 'mcp';
+    const agent = mcp && r.agent_id && r.agent_id !== 'unknown' ? r.agent_id : undefined;
+    return {
+        kind: r.kind,
+        ...(r.value ? { value: VALUE[r.value] } : {}),
+        ...(r.kind === 'note' && r.note ? { note: r.note } : {}),
+        ...(counterpart ? { counterpart_id: counterpart } : {}),
+        judged_at: r.judged_at,
+        origin: mcp ? 'local_share_mcp' : 'local_share',
+        ...(agent ? { agent } : {}),
+    };
+}
+function shownOf(wire, via, agentId, counterpartTitle) {
+    return { wire, hash: judgementHash(wire), via, agentId, counterpartTitle };
+}
+export function buildSharePayload(input) {
+    const { row } = input;
+    const shown = [];
+    const leftLocal = [];
+    const deferredPairs = [];
+    if (row.ratifiedAt) {
+        shown.push(shownOf({ kind: 'ratify', judged_at: row.ratifiedAt, origin: 'local_share' }, 'cli', null, null));
+    }
+    const rows = [...input.judgements].sort((a, b) => (a.judged_at < b.judged_at ? -1 : a.judged_at > b.judged_at ? 1 : a.id < b.id ? -1 : 1));
+    for (const r of rows) {
+        // A withdrawn verdict is no verdict, whatever reader produced the list.
+        if (r.value === null && (r.kind === 'conflict_verdict' || r.kind === 'check_verdict'))
+            continue;
+        if (r.kind === 'conflict_verdict' || r.kind === 'supersede') {
+            if (r.counterpart_id === null)
+                continue;
+            // A supersede is directional: "decision_id replaces counterpart_id". It travels with the NEWER decision's share.
+            if (r.kind === 'supersede' && r.decision_id !== row.id)
+                continue;
+            const other = r.decision_id === row.id ? r.counterpart_id : r.decision_id;
+            const remote = input.remoteIdOf(other);
+            const counterpartTitle = input.titleOf(other);
+            if (!remote) {
+                leftLocal.push({ kind: r.kind, why: 'counterpart_not_shared', counterpartTitle });
+                deferredPairs.push({ row: r, counterpartLocalId: other });
+                continue;
+            }
+            shown.push(shownOf(wireFor(r, remote), r.via, r.agent_id, counterpartTitle));
+            continue;
+        }
+        if (r.decision_id !== row.id)
+            continue;
+        shown.push(shownOf(wireFor(r), r.via, r.agent_id, null));
+    }
+    // Everything the person has judged, whether or not it was sent before: the ledger's "unchanged" test reads this.
+    const everything = shown.map((x) => x.wire);
+    // What is SENT (and shown): only what this workspace has not stored yet, so a note is never posted twice.
+    const fresh = shown.filter((x) => !input.alreadySent.has(x.hash));
+    // The gateway refuses a whole batch over the cap, so cut here: the ratification first, then the newest.
+    let sending = fresh;
+    if (fresh.length > MAX_SHARED_JUDGEMENTS) {
+        const ratify = fresh.filter((x) => x.wire.kind === 'ratify');
+        const rest = fresh.filter((x) => x.wire.kind !== 'ratify');
+        const keep = new Set([...ratify, ...rest.slice(-(MAX_SHARED_JUDGEMENTS - ratify.length))]);
+        for (const dropped of fresh.filter((x) => !keep.has(x)))
+            leftLocal.push({ kind: dropped.wire.kind, why: 'over_limit', counterpartTitle: dropped.counterpartTitle });
+        sending = fresh.filter((x) => keep.has(x));
+    }
+    const base = {
+        source_url: shareSourceUrl(row, input.salt),
+        platform: row.platform,
+        title: row.title,
+        summary: row.summary,
+        raw_text: row.summary || row.title,
+        client_key: input.clientKey,
+        ...(row.decidedAt ? { created_at: row.decidedAt } : {}),
+    };
+    const item = { ...base, judgements: sending.map((x) => x.wire) };
+    return { localId: row.id, item, shown: sending, leftLocal, deferredPairs, hash: hashItem(item), fullHash: hashItem({ ...base, judgements: everything }) };
+}
+/**
+ * The `decisions` array of POST /ingest/batch for share items: verbatim except the one rename `created_at` ->
+ * `decided_at` (the gateway's schema takes the second and strips the first). The ONE place that rename happens
+ * for a share: `shareBatch` (the typed path) and the sealed request (the browser path) both call it, so the
+ * bytes a person approves are the bytes the gateway ingests.
+ */
+export function toBatchDecisions(items) {
+    return items.map(({ created_at, ...rest }) => ({ ...rest, ...(created_at ? { decided_at: created_at } : {}) }));
+}
+//# sourceMappingURL=payload.js.map