@allocator-one/rcl 4.4.19

package/dist/evidence/original-run/lock-scope.js

@@ -0,0 +1,61 @@
+import { execFile } from 'node:child_process';
+import { open, stat } from 'node:fs/promises';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+export const LOCK_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** Absolute system utilities only; no shell, caller environment or unbounded output. */
+export async function lockSystemCommand(file, args) {
+    const { stdout } = await exec(file, args, {
+        encoding: 'utf8', timeout: 1000, maxBuffer: 1024 * 1024,
+        env: { PATH: '/usr/bin:/bin:/usr/sbin:/sbin', LC_ALL: 'C' },
+    });
+    return stdout;
+}
+async function linuxBoot() {
+    // procfs reports size zero. A fixed read still bounds the bytes we accept.
+    const handle = await open('/proc/sys/kernel/random/boot_id', 'r');
+    try {
+        const bytes = Buffer.alloc(128);
+        const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+        return bytes.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+export function validLockScope(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const scope = value;
+    return typeof scope.boot === 'string' && LOCK_UUID.test(scope.boot) &&
+        ((scope.platform === 'darwin' && scope.namespace === 'native') ||
+            (scope.platform === 'linux' && typeof scope.namespace === 'string' && /^\d+:[1-9]\d*$/.test(scope.namespace)));
+}
+/** PID absence proves death only on this kernel boot and PID namespace. */
+export async function localLockScope(overrides = {}) {
+    const io = {
+        platform: process.platform, command: lockSystemCommand, boot: linuxBoot,
+        namespace: () => stat('/proc/self/ns/pid', { bigint: true }), ...overrides,
+    };
+    try {
+        let result;
+        if (io.platform === 'darwin') {
+            const boot = (await io.command('/usr/sbin/sysctl', ['-n', 'kern.bootsessionuuid'])).trim().toLowerCase();
+            result = { platform: 'darwin', boot, namespace: 'native' };
+        }
+        else if (io.platform === 'linux') {
+            const boot = (await io.boot()).trim().toLowerCase();
+            const ns = await io.namespace();
+            result = { platform: 'linux', boot, namespace: `${ns.dev}:${ns.ino}` };
+        }
+        else
+            throw new Error('unsupported');
+        if (!validLockScope(result))
+            throw new Error('invalid');
+        return result;
+    }
+    catch {
+        throw new Error('unsupported_recovery_lock_scope');
+    }
+}
+//# sourceMappingURL=lock-scope.js.map

package/dist/evidence/original-run/lock-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-scope.js","sourceRoot":"","sources":["../../../src/evidence/original-run/lock-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,CAAC,MAAM,SAAS,GAAG,gEAAgE,CAAC;AAG1F,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAc;IAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QACxC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI;QACvD,GAAG,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,GAAG,EAAE;KAC5D,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,2EAA2E;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpG,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAAkB,CAAC;IACjC,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;YAC5D,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,YAA8B,EAAE;IACnE,MAAM,EAAE,GAAY;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS;QACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS;KAC3E,CAAC;IACF,IAAI,CAAC;QACH,IAAI,MAAiB,CAAC;QACtB,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzG,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7D,CAAC;aAAM,IAAI,EAAE,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;YACrF,MAAM,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QACzE,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAAC,CAAC;AACjE,CAAC"}

package/dist/evidence/original-run/lock.d.ts

@@ -0,0 +1,33 @@
+import { type LockScope } from './lock-scope.js';
+export interface LockRegistration {
+    version: 1;
+    pid: number;
+    token: string;
+    scope: LockScope;
+    state: 'choosing' | 'ready';
+    ticket?: number;
+}
+type LockStage = 'legacy_reserved' | 'choosing_published' | 'ticket_selected' | 'ready_published' | 'before_reap' | 'after_reap' | 'scan_complete';
+/** Internal deterministic test seams. The CLI never accepts these overrides. */
+export interface LockHooks {
+    /** Test-only: exercises bakery mechanics independently of legacy bridging. */
+    legacy?: boolean;
+    scope?: () => Promise<LockScope>;
+    token?: () => string;
+    probe?: (pid: number) => void;
+    now?: () => number;
+    wait?: () => Promise<void>;
+    read?: (path: string) => Promise<string>;
+    onEvent?: (event: {
+        stage: LockStage;
+        registration: LockRegistration;
+        peer?: LockRegistration;
+    }) => Promise<void>;
+}
+/**
+ * Dynamic Lamport bakery on coherent local storage: choosing is visible before
+ * ticket selection, then one fixed (ticket, token) orders this acquisition.
+ * Each path is unique for all time. No shared reclaim guard or TTL is involved.
+ */
+export declare function withRecoveryLock<T>(root: string, identity: string, work: () => Promise<T>, hooks?: LockHooks): Promise<T>;
+export {};

package/dist/evidence/original-run/lock.js

@@ -0,0 +1,259 @@
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { link, lstat, mkdir, open, readdir, rename, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { withLegacyReservation } from '../../coordination/registry-lock.js';
+import { readStable, sha256 } from '../../telemetry/recovery/files.js';
+import { checkLockDirectory, prepareLockRoot } from './lock-path.js';
+import { localLockScope, LOCK_UUID, validLockScope } from './lock-scope.js';
+function code(error) { return error?.code; }
+async function sync(path) {
+    const handle = await open(path, 'r');
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Dynamic Lamport bakery on coherent local storage: choosing is visible before
+ * ticket selection, then one fixed (ticket, token) orders this acquisition.
+ * Each path is unique for all time. No shared reclaim guard or TTL is involved.
+ */
+export async function withRecoveryLock(root, identity, work, hooks = {}) {
+    const scope = await (hooks.scope ?? localLockScope)();
+    if (!validLockScope(scope))
+        throw new Error('unsupported_recovery_lock_scope');
+    root = await prepareLockRoot(root);
+    const key = sha256(identity);
+    const token = (hooks.token ?? randomUUID)();
+    if (!LOCK_UUID.test(token))
+        throw new Error('invalid_recovery_lock_token');
+    const acquire = async () => {
+        // Keep this directory permanently: removing it on release could split two
+        // contenders across different inodes of the same registry pathname.
+        const registry = join(root, `${key}.bakery`);
+        try {
+            await mkdir(registry, { mode: 0o700 });
+        }
+        catch (error) {
+            if (code(error) !== 'EEXIST')
+                throw error;
+        }
+        await sync(root);
+        checkLockDirectory(await lstat(registry), process.geteuid(), true);
+        // Includes inherited Darwin ACL and mount inspection for the registry itself.
+        await prepareLockRoot(registry);
+        const path = join(registry, `${token}.json`);
+        let owner = { version: 1, pid: process.pid, token, scope, state: 'choosing' };
+        const now = hooks.now ?? (() => performance.now());
+        const deadline = now() + 5000;
+        const wait = hooks.wait ?? (() => new Promise(resolve => setTimeout(resolve, 25)));
+        const checkTime = () => { if (now() >= deadline)
+            throw new Error('recovery_run_locked'); };
+        const read = hooks.read ?? (async (file) => (await readStable(file, 2048)).text);
+        let published = false;
+        const emit = (stage, peer) => hooks.onEvent?.({ stage, registration: owner, peer });
+        const readOwner = async (file) => {
+            for (;;) {
+                let text;
+                try {
+                    text = await read(file);
+                }
+                catch (error) {
+                    if (code(error) === 'ENOENT')
+                        return undefined;
+                    if (error instanceof Error && error.message === 'changing_source') {
+                        checkTime();
+                        await wait();
+                        continue;
+                    }
+                    throw error;
+                }
+                let value;
+                try {
+                    value = JSON.parse(text);
+                }
+                catch {
+                    throw new Error('incomplete_recovery_lock_requires_inspection');
+                }
+                if (!value || value.version !== 1 || !Number.isSafeInteger(value.pid) || value.pid < 1 ||
+                    typeof value.token !== 'string' || !LOCK_UUID.test(value.token) || file !== join(registry, `${value.token}.json`) ||
+                    !validLockScope(value.scope) || !['choosing', 'ready'].includes(value.state) ||
+                    (value.state === 'choosing' ? value.ticket !== undefined : !Number.isSafeInteger(value.ticket) || value.ticket < 1)) {
+                    throw new Error('invalid_recovery_lock_requires_inspection');
+                }
+                if (!isDeepStrictEqual(value.scope, scope))
+                    throw new Error('foreign_recovery_lock_scope');
+                return value;
+            }
+        };
+        const verifyOwned = async () => {
+            if (!isDeepStrictEqual(await readOwner(path), owner))
+                throw new Error('recovery_lock_owner_changed');
+        };
+        const publish = async (value, initial) => {
+            const temporary = join(registry, `${token}.${randomUUID()}.tmp`);
+            let created = false;
+            try {
+                const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
+                created = true;
+                try {
+                    await handle.writeFile(JSON.stringify(value) + '\n');
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+                if (initial)
+                    await link(temporary, path);
+                else {
+                    await verifyOwned();
+                    await rename(temporary, path);
+                    created = false;
+                }
+                // Set ownership before any fallible post-publication operation, including
+                // temp unlink and directory fsync, so the finally block can release it.
+                published = true;
+                owner = value;
+            }
+            finally {
+                if (created)
+                    await unlink(temporary);
+            }
+            await sync(registry);
+        };
+        const names = async () => {
+            const all = await readdir(registry);
+            const result = [];
+            for (const name of all) {
+                // An interrupted private write is not a choosing registration. Only
+                // atomic publication into the .json namespace joins the protocol.
+                const parts = name.split('.');
+                if (parts.length === 3 && parts[2] === 'tmp' && LOCK_UUID.test(parts[0]) && LOCK_UUID.test(parts[1]))
+                    continue;
+                if (!name.endsWith('.json') || !LOCK_UUID.test(name.slice(0, -5)))
+                    throw new Error('invalid_recovery_lock_registration');
+                result.push(name);
+            }
+            return result.sort();
+        };
+        const scan = async () => {
+            for (;;) {
+                checkTime();
+                const directory = await lstat(registry, { bigint: true });
+                const before = await names();
+                const peers = [];
+                for (const name of before) {
+                    checkTime();
+                    const peer = await readOwner(join(registry, name));
+                    if (peer)
+                        peers.push(peer);
+                }
+                // Under the supported local visibility contract, unchanged full name
+                // scans prevent a disappearing registration from hiding a chooser that
+                // predated our ready publication. A newly arriving chooser must see us.
+                const after = await names();
+                const current = await lstat(registry, { bigint: true });
+                if (peers.length === before.length && isDeepStrictEqual(before, after) &&
+                    directory.ino === current.ino && directory.dev === current.dev &&
+                    directory.ctimeNs === current.ctimeNs && directory.mtimeNs === current.mtimeNs)
+                    return peers;
+                await wait();
+            }
+        };
+        const release = async () => {
+            if (!published)
+                return;
+            await verifyOwned();
+            await unlink(path);
+            published = false;
+            await sync(registry);
+        };
+        let failed = false;
+        let failure;
+        try {
+            await emit('legacy_reserved');
+            await publish(owner, true);
+            await emit('choosing_published');
+            const peers = await scan();
+            const maximum = peers.reduce((max, peer) => Math.max(max, peer.ticket ?? 0), 0);
+            if (maximum >= Number.MAX_SAFE_INTEGER)
+                throw new Error('recovery_lock_ticket_exhausted');
+            const ready = { ...owner, state: 'ready', ticket: maximum + 1 };
+            // The hook observes the selected value without mutating the visible owner.
+            await hooks.onEvent?.({ stage: 'ticket_selected', registration: ready });
+            await publish(ready, false);
+            await emit('ready_published');
+            for (;;) {
+                const peers = await scan();
+                let blocked = false;
+                // Validate the entire scan's scopes before making any local PID probe.
+                for (const peer of peers) {
+                    if (peer.token === token)
+                        continue;
+                    let dead = false;
+                    try {
+                        (hooks.probe ?? (pid => process.kill(pid, 0)))(peer.pid);
+                    }
+                    catch (error) {
+                        if (code(error) !== 'ESRCH')
+                            throw new Error('recovery_lock_liveness_unknown');
+                        dead = true;
+                    }
+                    if (dead) {
+                        await emit('before_reap', peer);
+                        // This pathname is never reused, so another/delayed reaper can only
+                        // unlink this dead generation; ENOENT means it already did so.
+                        try {
+                            await unlink(join(registry, `${peer.token}.json`));
+                            await sync(registry);
+                        }
+                        catch (error) {
+                            if (code(error) !== 'ENOENT')
+                                throw error;
+                        }
+                        await emit('after_reap', peer);
+                    }
+                    else if (peer.state === 'choosing' || peer.ticket < owner.ticket ||
+                        (peer.ticket === owner.ticket && peer.token < token))
+                        blocked = true;
+                }
+                if (!blocked) {
+                    await verifyOwned();
+                    checkTime();
+                    await emit('scan_complete');
+                    return await work();
+                }
+                checkTime();
+                await wait();
+            }
+        }
+        catch (error) {
+            failed = true;
+            failure = error;
+            throw error;
+        }
+        finally {
+            try {
+                await release();
+            }
+            catch (error) {
+                if (failed)
+                    throw new AggregateError([failure, error], 'recovery_lock_cleanup_failed', { cause: failure });
+                throw error;
+            }
+        }
+    };
+    if (hooks.legacy === false) {
+        if (process.env.NODE_ENV !== 'test')
+            throw new Error('test_only_bakery_hook');
+        return acquire();
+    }
+    return withLegacyReservation(root, identity, { pid: process.pid, token, scope }, acquire, { sync, read: hooks.read, probe: hooks.probe, now: hooks.now, wait: hooks.wait, reclaimLegacy: false,
+        qualifiedLegacy: owner => validLockScope(owner.scope) &&
+            isDeepStrictEqual(owner.scope, scope) });
+}
+//# sourceMappingURL=lock.js.map

package/dist/evidence/original-run/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/evidence/original-run/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AAmB5F,SAAS,IAAI,CAAC,KAAc,IAAwB,OAAQ,KAA+B,EAAE,IAAI,CAAC,CAAC,CAAC;AACpG,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAI,IAAY,EAAE,QAAgB,EAAE,IAAsB,EAAE,QAAmB,EAAE;IACrH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/E,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QAC3B,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAC/C,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,kBAAkB,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,OAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QACpE,8EAA8E;QAC9E,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAChG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;QAClF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,KAAgB,EAAE,IAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAElH,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAyC,EAAE;YAC9E,SAAS,CAAC;gBACR,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBAAC,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAChC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;wBAAE,OAAO,SAAS,CAAC;oBAC/C,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;wBAAC,SAAS,EAAE,CAAC;wBAAC,MAAM,IAAI,EAAE,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAC3G,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,KAAuB,CAAC;gBAC5B,IAAI,CAAC;oBAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;gBAAC,CAAC;gBACrD,MAAM,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAAC,CAAC;gBAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC;oBAClF,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,OAAO,CAAC;oBACjH,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC5E,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAO,GAAG,CAAC,CAAC,EAAE,CAAC;oBACzH,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACvG,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAuB,EAAE,OAAgB,EAAE,EAAE;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAC9H,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;oBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;wBAC1E,CAAC;oBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBACjC,IAAI,OAAO;oBAAE,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;qBACpC,CAAC;oBAAC,MAAM,WAAW,EAAE,CAAC;oBAAC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,CAAC;gBAC7E,0EAA0E;gBAC1E,wEAAwE;gBACxE,SAAS,GAAG,IAAI,CAAC;gBAAC,KAAK,GAAG,KAAK,CAAC;YAClC,CAAC;oBAAS,CAAC;gBAAC,IAAI,OAAO;oBAAE,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YACnD,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,IAAuB,EAAE;YAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;gBACvB,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;oBAAE,SAAS;gBACjH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACzH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,IAAiC,EAAE;YACnD,SAAS,CAAC;gBACR,SAAS,EAAE,CAAC;gBAAC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;gBAAC,MAAM,KAAK,GAAuB,EAAE,CAAC;gBACnE,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;oBAC1B,SAAS,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;oBAAC,IAAI,IAAI;wBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,CAAC;gBACD,qEAAqE;gBACrE,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;gBAAC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC;oBAClE,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;oBAC9D,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACjG,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,MAAM,WAAW,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS,GAAG,KAAK,CAAC;YAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,CAAC,CAAC;QACF,IAAI,MAAM,GAAG,KAAK,CAAC;QAAC,IAAI,OAAgB,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChF,IAAI,OAAO,IAAI,MAAM,CAAC,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC1F,MAAM,KAAK,GAAqB,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC;YAClF,2EAA2E;YAC3E,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,MAAM,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3D,SAAS,CAAC;gBACR,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;gBAAC,IAAI,OAAO,GAAG,KAAK,CAAC;gBAChD,uEAAuE;gBACvE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;wBAAE,SAAS;oBACnC,IAAI,IAAI,GAAG,KAAK,CAAC;oBACjB,IAAI,CAAC;wBAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAAC,CAAC;oBACjE,OAAO,KAAK,EAAE,CAAC;wBACb,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO;4BAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;wBAC/E,IAAI,GAAG,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;wBAChC,oEAAoE;wBACpE,+DAA+D;wBAC/D,IAAI,CAAC;4BAAC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;4BAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAAC,CAAC;wBACjF,OAAO,KAAK,EAAE,CAAC;4BAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;gCAAE,MAAM,KAAK,CAAC;wBAAC,CAAC;wBAC5D,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;oBACjC,CAAC;yBAAM,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,MAAO,GAAG,KAAK,CAAC,MAAO;wBAChE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;wBAAE,OAAO,GAAG,IAAI,CAAC;gBAC3E,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,WAAW,EAAE,CAAC;oBAAC,SAAS,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC;oBAC9D,OAAO,MAAM,IAAI,EAAE,CAAC;gBACtB,CAAC;gBACD,SAAS,EAAE,CAAC;gBAAC,MAAM,IAAI,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO,GAAG,KAAK,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;gBACxD,CAAC;YACP,IAAI,CAAC;gBAAC,MAAM,OAAO,EAAE,CAAC;YAAC,CAAC;YACxB,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,MAAM;oBAAE,MAAM,IAAI,cAAc,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;QAC5I,CAAC;IACD,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC9E,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EACtF,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK;QAClG,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAE,KAA6B,CAAC,KAAK,CAAC;YAC5E,iBAAiB,CAAE,KAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC"}

package/dist/evidence/original-run/remote.d.ts

@@ -0,0 +1,23 @@
+import { HarnessSink, type SinkOutcome } from '../../telemetry/sink.js';
+import type { PreparedOriginal } from './source.js';
+import type { OriginalProseMode } from './decode.js';
+export interface Destination {
+    base_url: string;
+    org_id: string;
+}
+export declare function object(value: unknown): value is Record<string, unknown>;
+export declare const missing: (r: SinkOutcome<unknown>) => boolean;
+export declare function requireOk<T>(result: SinkOutcome<T>, label: string): T;
+export declare function destination(sink: HarnessSink, originalProse?: OriginalProseMode): Promise<Destination>;
+/** Backend timestamps retain microseconds, unlike Date's millisecond comparison. */
+export declare function instant(value: unknown): string;
+/** Compare every persisted immutable field; server-derived judgments are intentionally not receipts. */
+export declare function matchesOriginalRun(raw: unknown, prepared: PreparedOriginal): boolean;
+export declare function readOriginalRun(sink: HarnessSink, expected: Destination, prepared: PreparedOriginal): Promise<{
+    exists: false;
+} | {
+    exists: true;
+    projection_sha256: string;
+    raw: Record<string, unknown>;
+}>;
+export declare function readOriginalArtifacts(sink: HarnessSink, prepared: PreparedOriginal): Promise<Record<string, 'missing' | 'verified'>>;

package/dist/evidence/original-run/remote.js

@@ -0,0 +1,110 @@
+import { isDeepStrictEqual } from 'node:util';
+import { stableStringify } from '../../report/run-header.js';
+import { sha256 } from '../../telemetry/recovery/files.js';
+import { uuidSchema } from './source.js';
+export function object(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+export const missing = (r) => r.kind === 'rejected' && r.httpStatus === 404 && r.error === 'not_found';
+export function requireOk(result, label) {
+    if (result.kind !== 'ok')
+        throw new Error(`${label}_${result.kind}`);
+    return result.value;
+}
+export async function destination(sink, originalProse) {
+    if (sink.credentialSource === 'attest')
+        throw new Error('unsupported_attested_recovery');
+    const outcome = await sink.getJson('/api/v1/reviews/runs?page_size=1', (data, meta) => {
+        if (!Array.isArray(data) || !object(meta) || !uuidSchema.safeParse(meta.org_id).success || meta.original_report_recovery_version !== 1 || meta.evidence_protocol_version !== 2 ||
+            (originalProse === 'control-code-units-v1' && meta.original_prose_representation_version !== 1))
+            return null;
+        return { base_url: sink.baseUrl, org_id: meta.org_id };
+    });
+    return requireOk(outcome, 'recovery_capability_or_destination');
+}
+/** Backend timestamps retain microseconds, unlike Date's millisecond comparison. */
+export function instant(value) {
+    if (typeof value !== 'string')
+        throw new Error('invalid_receipt_timestamp');
+    const match = /^(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d)(?:\.(\d{1,6}))?(Z|[+-]\d\d:\d\d)$/.exec(value);
+    if (!match)
+        throw new Error('invalid_receipt_timestamp');
+    // Date.parse normalizes impossible dates such as February 30. Such input
+    // must not compare equal to a different, valid persisted timestamp.
+    const calendar = new Date(match[1] + 'Z');
+    if (!Number.isFinite(calendar.getTime()) || calendar.toISOString().slice(0, 19) !== match[1])
+        throw new Error('invalid_receipt_timestamp');
+    const seconds = Date.parse(match[1] + match[3]);
+    if (!Number.isFinite(seconds))
+        throw new Error('invalid_receipt_timestamp');
+    return (BigInt(seconds) * 1000n + BigInt((match[2] ?? '').padEnd(6, '0'))).toString();
+}
+const pick = (x, keys, defaults = {}) => Object.fromEntries(keys.map(k => [k, x[k] === undefined ? defaults[k] ?? null : x[k]]));
+const required = (x, keys) => keys.every(k => Object.hasOwn(x, k));
+const targetKeys = ['kind', 'repo', 'pr_number', 'url', 'head_sha', 'base_sha', 'head_ref', 'base_ref', 'diff_sha256', 'files', 'additions', 'deletions'];
+const headerKeys = ['id', 'command', 'rcl_version', 'config_sha256', 'roster', 'thresholds', 'gating', 'spec', 'context_files', 'plan', 'runner', 'duration_ms', 'ci_exit_code', 'provenance', 'historical_source'];
+const findingKeys = ['ref', 'identity_key', 'file', 'start_line', 'end_line', 'location_provenance', 'claim_descriptor', 'severity', 'category', 'title', 'description', 'suggested_fix', 'consensus', 'gating_reason', 'verification_verdict', 'verification_model', 'verification_note', 'below_threshold'];
+const callKeys = ['model', 'role', 'provider', 'lane', 'chunk_index', 'status', 'duration_ms', 'input_tokens', 'output_tokens', 'reasoning_tokens', 'dropped_findings', 'warnings', 'error', 'async'];
+function converge(v) { return object(v) ? pick(v, ['target', 'round', 'attempt']) : v ?? null; }
+const sorted = (rows) => rows.map(stableStringify).sort();
+/** Compare every persisted immutable field; server-derived judgments are intentionally not receipts. */
+export function matchesOriginalRun(raw, prepared) {
+    try {
+        if (!object(raw) || !required(raw, [...headerKeys, 'target', 'converge', 'started_at', 'finished_at', 'stats', 'delivery', 'findings', 'calls', 'artifacts', 'tier', 'credential_kind']))
+            return false;
+        if (raw.tier !== 'asserted' || !['cli', 'api_token'].includes(raw.credential_kind))
+            return false;
+        const expected = prepared.envelope;
+        if (!isDeepStrictEqual(pick(raw, headerKeys), pick(expected.run, headerKeys, { provenance: 'live' })))
+            return false;
+        if (!object(raw.target) || !required(raw.target, targetKeys) || !isDeepStrictEqual(pick(raw.target, targetKeys), pick(expected.run.target, targetKeys)))
+            return false;
+        if (!isDeepStrictEqual(converge(raw.converge), converge(expected.run.converge)) || instant(raw.started_at) !== instant(expected.run.started_at) || instant(raw.finished_at) !== instant(expected.run.finished_at))
+            return false;
+        if (!isDeepStrictEqual(raw.stats, expected.stats) || !isDeepStrictEqual(raw.delivery, expected.delivery))
+            return false;
+        if (!Array.isArray(raw.findings) || raw.findings.length !== expected.findings.length || raw.findings.some(f => !object(f) || !required(f, findingKeys)))
+            return false;
+        if (new Set(raw.findings.map(f => f.ref)).size !== raw.findings.length)
+            return false;
+        if (!isDeepStrictEqual(sorted(raw.findings.map(f => pick(f, findingKeys))), sorted(expected.findings.map(f => pick(f, findingKeys)))))
+            return false;
+        if (!Array.isArray(raw.calls) || raw.calls.some(c => !object(c) || !required(c, callKeys)))
+            return false;
+        if (!isDeepStrictEqual(sorted(raw.calls.map(c => pick(c, callKeys))), sorted(expected.calls.map(c => pick(c, callKeys)))))
+            return false;
+        if (!Array.isArray(raw.artifacts) || raw.artifacts.length !== expected.artifacts_declared.length || raw.artifacts.some(a => !object(a) || !required(a, ['kind', 'declared_sha256', 'declared_bytes', 'stored']) || typeof a.stored !== 'boolean'))
+            return false;
+        return isDeepStrictEqual(sorted(raw.artifacts.map(a => pick(a, ['kind', 'declared_sha256', 'declared_bytes']))), sorted(expected.artifacts_declared.map(a => ({ kind: a.kind, declared_sha256: a.sha256, declared_bytes: a.bytes }))));
+    }
+    catch {
+        return false;
+    }
+}
+export async function readOriginalRun(sink, expected, prepared) {
+    const result = await sink.getJson(`/api/v1/reviews/runs/${encodeURIComponent(prepared.selection.run)}`, (data, meta) => {
+        if (!object(data) || !object(meta) || meta.org_id !== expected.org_id || meta.original_report_recovery_version !== 1 || meta.evidence_protocol_version !== 2)
+            return null;
+        return data;
+    });
+    if (missing(result))
+        return { exists: false };
+    const raw = requireOk(result, 'run_read');
+    if (!matchesOriginalRun(raw, prepared))
+        throw new Error('existing_run_full_projection_conflict');
+    return { exists: true, raw, projection_sha256: sha256(stableStringify(raw)) };
+}
+export async function readOriginalArtifacts(sink, prepared) {
+    const states = {};
+    for (const a of prepared.envelope.artifacts_declared) {
+        const read = await sink.getArtifact(prepared.selection.run, a.kind, a.bytes);
+        if (missing(read)) {
+            states[a.kind] = 'missing';
+            continue;
+        }
+        const receipt = requireOk(read, 'artifact_read');
+        if (receipt.sha256 !== a.sha256 || receipt.bytes.length !== a.bytes || sha256(receipt.bytes) !== a.sha256)
+            throw new Error('original_artifact_conflict');
+        states[a.kind] = 'verified';
+    }
+    return states;
+}
+//# sourceMappingURL=remote.js.map

package/dist/evidence/original-run/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/evidence/original-run/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,UAAU,MAAM,CAAC,KAAc,IAAsC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzJ,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC;AAC7H,MAAM,UAAU,SAAS,CAAI,MAAsB,EAAE,KAAa;IAChE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB,EAAE,aAAiC;IACpF,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,gCAAgC,KAAK,CAAC,IAAI,IAAI,CAAC,yBAAyB,KAAK,CAAC;YAC1K,CAAC,aAAa,KAAK,uBAAuB,IAAI,IAAI,CAAC,qCAAqC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;AAClE,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACzD,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC5E,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxF,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAE,IAAc,EAAE,WAAoC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7L,MAAM,QAAQ,GAAG,CAAC,CAA0B,EAAE,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACtG,MAAM,UAAU,GAAG,CAAC,MAAM,EAAC,MAAM,EAAC,WAAW,EAAC,KAAK,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,aAAa,EAAC,OAAO,EAAC,WAAW,EAAC,WAAW,CAAC,CAAC;AAC/I,MAAM,UAAU,GAAG,CAAC,IAAI,EAAC,SAAS,EAAC,aAAa,EAAC,eAAe,EAAC,QAAQ,EAAC,YAAY,EAAC,QAAQ,EAAC,MAAM,EAAC,eAAe,EAAC,MAAM,EAAC,QAAQ,EAAC,aAAa,EAAC,cAAc,EAAC,YAAY,EAAC,mBAAmB,CAAC,CAAC;AACtM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAC,cAAc,EAAC,MAAM,EAAC,YAAY,EAAC,UAAU,EAAC,qBAAqB,EAAC,kBAAkB,EAAC,UAAU,EAAC,UAAU,EAAC,OAAO,EAAC,aAAa,EAAC,eAAe,EAAC,WAAW,EAAC,eAAe,EAAC,sBAAsB,EAAC,oBAAoB,EAAC,mBAAmB,EAAC,iBAAiB,CAAC,CAAC;AAC7R,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAC,MAAM,EAAC,UAAU,EAAC,MAAM,EAAC,aAAa,EAAC,QAAQ,EAAC,aAAa,EAAC,cAAc,EAAC,eAAe,EAAC,kBAAkB,EAAC,kBAAkB,EAAC,UAAU,EAAC,OAAO,EAAC,OAAO,CAAC,CAAC;AACzL,SAAS,QAAQ,CAAC,CAAU,IAAa,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AAChH,MAAM,MAAM,GAAG,CAAC,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,QAA0B;IACzE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,UAAU,EAAC,QAAQ,EAAC,UAAU,EAAC,YAAY,EAAC,aAAa,EAAC,OAAO,EAAC,UAAU,EAAC,UAAU,EAAC,OAAO,EAAC,WAAW,EAAC,MAAM,EAAC,iBAAiB,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5L,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAyB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1G,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAyC,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1J,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAA4C,EAAE,UAAU,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5M,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAChO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACvH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClH,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAA4B,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAuC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrN,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAA4B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAuC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,kBAAkB,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,MAAM,EAAC,iBAAiB,EAAC,gBAAgB,EAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7P,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAA4B,EAAE,CAAC,MAAM,EAAC,iBAAiB,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClQ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAiB,EAAE,QAAqB,EAAE,QAA0B;IACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACrH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,gCAAgC,KAAK,CAAC,IAAI,IAAI,CAAC,yBAAyB,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1K,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACjG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAiB,EAAE,QAA0B;IACvF,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzJ,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/evidence/original-run/source.d.ts

@@ -0,0 +1,61 @@
+import { z } from 'zod';
+import { type ArtifactBytes, type RunEnvelope } from '../../telemetry/envelope.js';
+import { type OriginalProseTransformation } from './decode.js';
+export declare const hashSchema: z.ZodString;
+export declare const uuidSchema: z.ZodString;
+export declare const selectionSchema: z.ZodObject<{
+    run: z.ZodString;
+    forPr: z.ZodString;
+    head: z.ZodString;
+    reportJson: z.ZodString;
+    reportSha256: z.ZodString;
+    reportMd: z.ZodOptional<z.ZodString>;
+    markdownSha256: z.ZodOptional<z.ZodString>;
+    originalMode: z.ZodLiteral<"asserted">;
+    originalProse: z.ZodOptional<z.ZodLiteral<"control-code-units-v1">>;
+}, z.core.$strict>;
+export type Selection = z.infer<typeof selectionSchema>;
+/** Static selection guidance only; never expose Zod issues or supplied values. */
+export declare class OriginalSelectionError extends Error {
+    readonly instruction: string;
+    constructor(reason: string, instruction: string);
+}
+export interface SourceFile {
+    path: string;
+    sha256: string;
+    bytes: number;
+}
+export interface PreparedOriginal {
+    selection: Selection;
+    sources: {
+        report_json: SourceFile;
+        report_md?: SourceFile;
+    };
+    envelope: RunEnvelope;
+    envelope_sha256: string;
+    transformations: OriginalProseTransformation[];
+    transport_derivations: Array<{
+        path: string;
+        rule: string;
+        original_sha256: string;
+        transport_sha256: string;
+    }>;
+    original_mode: {
+        value: 'asserted';
+        authority: 'operator_assertion';
+        retained_runner: unknown;
+    };
+    retained_content_limitations: {
+        report_sha256: string;
+        redacted_prose: Array<{
+            path: string;
+            count: number;
+        }>;
+        meaning: string;
+    };
+}
+/** Rebuild only the reviewed transport interpretation; artifact strings remain exact originals. */
+export declare function prepareOriginalRun(input: unknown): Promise<{
+    prepared: PreparedOriginal;
+    artifacts: ArtifactBytes;
+}>;