@gitroll/tacitt-cli 0.1.0 → 0.3.0

package/dist/job-rK-Ho9OD.mjs

@@ -0,0 +1,613 @@
+import { B as writeLogicalJourneyOutput, C as readConfiguredSearchFields, E as prepareCollectionProduction, R as gitSeedsProvider, U as readConfiguredOutputInfo, d as verifyOutputShard, f as writeOutputShard, k as renderJobDigest, y as writeLogicalJourneyBase } from "./src-CPbdnGrk.mjs";
+import { Ht as ApplicationError, Jt as reviewFamilies, zt as filterInventoryByPeriod } from "./locate-U3-nkird.mjs";
+import { Fn as packHideIndex, Ir as staticSessionResourceSchema, Mn as addHideIndexTokens, Nn as hideKeyId, ci as selectFrozenConfiguration, kn as renderedHideValue, oi as defaultScopedSettings, si as freezeConfiguration } from "./src-B4R5XMEP.mjs";
+import { constants } from "node:fs";
+import { link, lstat, open, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+//#region apps/cli/src/journey/plan.ts
+async function prepareSourcePlan(storage, harnesses, journeyId, sensitiveTerms, signal, period = {}) {
+	const saved = (await storage.resources({
+		journeyId,
+		kind: "plan"
+	}))[0];
+	if (saved?.kind === "plan") return saved;
+	const discovered = await harnesses.discover(signal);
+	if (!discovered.complete) throw new ApplicationError("SCOPE_NOT_READY");
+	const inventory = filterInventoryByPeriod(discovered, period);
+	if (inventory.sessions.length === 0) throw new ApplicationError("INVALID_SELECTION");
+	const families = reviewFamilies(inventory);
+	const defaults = defaultScopedSettings();
+	const settings = {
+		...defaults,
+		overall: {
+			...defaults.overall,
+			cleanup: {
+				ref: {
+					id: "native-evidence",
+					version: "2"
+				},
+				options: { assessedSessionsOnly: true }
+			}
+		},
+		workspaces: Object.fromEntries(inventory.workspaces.map((work) => [work.id, {
+			parameters: {
+				"screened-identifiers": { enabled: false },
+				"ip-addresses": { enabled: false },
+				hostnames: { enabled: false },
+				"cloud-resources": { enabled: false },
+				"mac-addresses": { enabled: false },
+				"public-key-containers": { enabled: false },
+				"geographic-coordinates": { enabled: false },
+				urls: { enabled: false },
+				"filesystem-paths": { mode: "identity-roots" }
+			},
+			optionalSteps: { "phone-numbers": true }
+		}]))
+	};
+	const configuration = freezeConfiguration(settings, inventory.sessions.flatMap((session) => {
+		const owner = families.owners.get(session.id);
+		return owner ? [{
+			sessionId: session.id,
+			workspaceId: session.workspaceId,
+			settingsOwner: {
+				sessionId: owner.id,
+				workspaceId: owner.workspaceId
+			}
+		}] : [];
+	}));
+	const resource = {
+		kind: "plan",
+		journeyId,
+		approval: {
+			runId: journeyId,
+			revision: 0,
+			approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			inventory,
+			sourceChangePolicy: "fail",
+			treatment: {
+				kind: "configured",
+				configuration,
+				dictionaryRevision: sensitiveTerms.revision
+			}
+		},
+		replacementKey: randomBytes(32).toString("hex"),
+		sensitiveTerms: {
+			revision: sensitiveTerms.revision,
+			terms: [...sensitiveTerms.terms]
+		}
+	};
+	await storage.saveResource(resource);
+	return resource;
+}
+function workApproval(approval, rootIds) {
+	if (approval.treatment?.kind !== "configured") throw new ApplicationError("PROCESSING_PLAN_UNAVAILABLE");
+	const families = reviewFamilies(approval.inventory);
+	const ids = new Set(rootIds.flatMap((id) => {
+		const members = families.members.get(id);
+		if (!members) throw new ApplicationError("UNKNOWN_ITEM");
+		return members.map((session) => session.id);
+	}));
+	const sessions = approval.inventory.sessions.filter((session) => ids.has(session.id));
+	const workspaces = new Set(sessions.map((session) => session.workspaceId));
+	return {
+		...approval,
+		inventory: {
+			...approval.inventory,
+			sessions,
+			workspaces: approval.inventory.workspaces.filter((workspace) => workspaces.has(workspace.id))
+		},
+		treatment: {
+			...approval.treatment,
+			configuration: selectFrozenConfiguration(approval.treatment.configuration, ids)
+		}
+	};
+}
+//#endregion
+//#region apps/cli/src/journey/static/production.ts
+/** Store reads of `staticBaseProduction`; undefined when no reviewed root remains. */
+async function staticBaseInputs(storage, state, work) {
+	const excluded = work.excludedReview?.snapshotId === state.snapshotId && work.excludedReview.inputRevision === work.inputRevision ? new Set(work.excludedReview.rootSessionIds) : /* @__PURE__ */ new Set();
+	const roots = work.rootSessionIds.filter((id) => !excluded.has(id));
+	if (!roots.length) return void 0;
+	const plan = (await storage.resources({
+		journeyId: state.journeyId,
+		kind: "plan"
+	}))[0];
+	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
+	const approval = workApproval(plan.approval, roots);
+	if (approval.treatment?.kind !== "configured") throw new ApplicationError("CORRUPTED_STATE");
+	const parts = new Set(approval.inventory.sessions.flatMap((session) => session.parts.map((part) => part.id)));
+	const captures = (await storage.resources({
+		journeyId: state.journeyId,
+		kind: "capture"
+	})).flatMap((item) => item.kind === "capture" && parts.has(item.capture.partId) ? [item.capture] : []);
+	if (captures.length !== parts.size) throw new ApplicationError("SCOPE_NOT_READY");
+	return {
+		journeyId: state.journeyId,
+		work,
+		roots,
+		approval,
+		captures,
+		replacementKey: createHash("sha256").update(JSON.stringify([
+			"static-base-v1",
+			plan.replacementKey,
+			work.id,
+			work.inputRevision
+		])).digest("hex"),
+		staticExceptions: {
+			workId: work.id,
+			values: state.exceptions.filter((item) => item.workId === work.id).map(({ kind, value }) => ({
+				kind,
+				value
+			}))
+		}
+	};
+}
+/** The production of `staticBaseProduction` from its stored inputs; no store access. */
+async function staticBaseFromInputs(inputs, processing, hooks) {
+	const { work, roots, approval } = inputs;
+	const { sensitiveTerms: _live, customTerms: _terms, staticExceptions: _unscoped, ...local } = processing;
+	const production = await prepareCollectionProduction(approval, inputs.journeyId, {
+		configured: {
+			...local,
+			gitNames: async () => ({
+				names: [],
+				snapshots: []
+			}),
+			replacementKey: inputs.replacementKey,
+			staticExceptions: inputs.staticExceptions
+		},
+		captures: inputs.captures,
+		everyAdmissionRefusal: true
+	}, hooks);
+	if (production.kind !== "configured" || production.workspaceFailures.length) throw new ApplicationError("SCOPE_NOT_READY");
+	const families = reviewFamilies(approval.inventory);
+	const admitted = new Set(production.selection.sessions.map((item) => item.session.id));
+	return {
+		production,
+		families,
+		work: {
+			...work,
+			rootSessionIds: roots.filter((id) => families.members.get(id)?.some((member) => admitted.has(member.id))),
+			access: work.access === "private" ? "private" : "public"
+		}
+	};
+}
+/**
+* The single production both Track B and packaging use for one Work generation (ADR 0172):
+* frozen captures, built-in static detection only (no custom terms, no Git seeds), the Work's
+* exceptions and a replacement key bound to this generation. Identical inputs give identical
+* session render jobs, so packaging can require the stored Track B result by job digest.
+*/
+async function staticBaseProduction(storage, state, work, processing, hooks) {
+	const inputs = await staticBaseInputs(storage, state, work);
+	return inputs && staticBaseFromInputs(inputs, processing, hooks);
+}
+//#endregion
+//#region apps/cli/src/journey/static/store.ts
+/** Identity, length and complete digest of one owner-only file; a symlink is never followed. */
+async function describe(path, signal) {
+	const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		const before = await handle.stat({ bigint: true });
+		if (!before.isFile()) throw new ApplicationError("CORRUPTED_STATE");
+		const digest = createHash("sha256");
+		let byteLength = 0;
+		const buffer = Buffer.allocUnsafe(1048576);
+		for (;;) {
+			signal.throwIfAborted();
+			const { bytesRead } = await handle.read(buffer, 0, buffer.length, byteLength);
+			if (!bytesRead) break;
+			digest.update(buffer.subarray(0, bytesRead));
+			byteLength += bytesRead;
+		}
+		const after = await handle.stat({ bigint: true });
+		if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs || BigInt(byteLength) !== after.size) throw new ApplicationError("CORRUPTED_STATE");
+		return {
+			path,
+			identity: {
+				dev: String(after.dev),
+				ino: String(after.ino)
+			},
+			sha256: digest.digest("hex"),
+			byteLength
+		};
+	} finally {
+		await handle.close();
+	}
+}
+/** A stored file must still be the exact recorded file and bytes. */
+async function authenticate(file, signal) {
+	const actual = await describe(file.path, signal);
+	if (JSON.stringify(actual) !== JSON.stringify(file)) throw new ApplicationError("CORRUPTED_STATE");
+}
+/**
+* Persist one Track B session as owner-only private state beside the journey's other scan
+* files: its three spools and a digest-bound result description. Nothing here is uploaded.
+*/
+async function saveStaticSession(storage, binding, item, result, signal) {
+	const owned = [
+		result.spoolPath,
+		result.companionSpoolPath,
+		result.maskSpoolPath
+	];
+	const resultPath = join(binding.directory, `${randomUUID()}.static.json`);
+	let saved = false;
+	try {
+		if (result.kind !== "render" || result.maskSpoolPath === void 0 || result.maskEntries === void 0 || result.metadataMasks === void 0 || result.reviewSpoolPath !== void 0) throw new ApplicationError("CORRUPTED_STATE");
+		const stored = {
+			kind: "render",
+			processingMs: result.processingMs,
+			maskEntries: result.maskEntries,
+			metadataMasks: result.metadataMasks,
+			metadata: result.metadata,
+			parts: result.parts,
+			entries: result.entries,
+			agentSetup: result.agentSetup
+		};
+		const file = await open(resultPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
+		owned.push(resultPath);
+		try {
+			await file.writeFile(JSON.stringify(stored));
+			await file.sync();
+		} finally {
+			await file.close();
+		}
+		const resource = staticSessionResourceSchema.parse({
+			kind: "static-session",
+			journeyId: binding.journeyId,
+			workId: binding.work.id,
+			inputRevision: binding.work.inputRevision,
+			snapshotId: binding.snapshotId,
+			sessionId: item.sessionId,
+			jobDigest: item.digest,
+			result: await describe(resultPath, signal),
+			primary: await describe(result.spoolPath, signal),
+			companion: await describe(result.companionSpoolPath, signal),
+			masks: await describe(result.maskSpoolPath, signal),
+			...result.images === void 0 ? {} : { imagesOmitted: result.images }
+		});
+		await storage.saveResource(resource);
+		saved = true;
+		return resource;
+	} finally {
+		if (!saved) {
+			for (const path of owned) if (path !== void 0) await unlink(path).catch(() => {});
+		}
+	}
+}
+/** Current-generation Track B receipts of one Work, keyed by application session ID. */
+async function staticSessions(storage, journeyId, work) {
+	const resources = (await storage.resources({
+		journeyId,
+		kind: "static-session",
+		idPrefix: `${work.id}:${work.inputRevision}:`
+	})).filter((item) => item.kind === "static-session" && item.workId === work.id && item.inputRevision === work.inputRevision);
+	return new Map(resources.map((item) => [item.sessionId, item]));
+}
+/**
+* Shape guard like the worker transport's: the bytes are bound by the recorded digest, and the
+* archive writer checks parts, entries and masks again when it consumes them.
+*/
+function isStoredResult(value) {
+	return typeof value === "object" && value !== null && Reflect.get(value, "kind") === "render" && Array.isArray(Reflect.get(value, "maskEntries")) && Array.isArray(Reflect.get(value, "metadataMasks")) && Array.isArray(Reflect.get(value, "parts")) && Array.isArray(Reflect.get(value, "entries")) && Array.isArray(Reflect.get(value, "agentSetup")) && typeof Reflect.get(value, "metadata") === "string" && Number.isSafeInteger(Reflect.get(value, "processingMs"));
+}
+/** Authenticated result description of one stored Track B session. */
+async function readStaticResult(resource, signal) {
+	await authenticate(resource.result, signal);
+	const handle = await open(resource.result.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		const text = await handle.readFile("utf8");
+		if (createHash("sha256").update(text).digest("hex") !== resource.result.sha256) throw new ApplicationError("CORRUPTED_STATE");
+		const value = JSON.parse(text);
+		if (!isStoredResult(value)) throw new ApplicationError("CORRUPTED_STATE");
+		return value;
+	} finally {
+		await handle.close();
+	}
+}
+/**
+* Packaging from the Track B base: the stored result of exactly this job, with fresh hard links
+* to its authenticated spools that the archive writer may consume. Static detection never runs.
+*/
+async function linkedStaticResult(resource, job, signal) {
+	if (!resource || resource.jobDigest !== job.digest) throw new ApplicationError("SCOPE_NOT_READY");
+	const result = await readStaticResult(resource, signal);
+	const links = [];
+	try {
+		const linked = async (file) => {
+			const path = join(job.spoolDirectory, `${randomUUID()}.session`);
+			await link(file.path, path);
+			links.push(path);
+			const stat = await lstat(path, { bigint: true });
+			if (String(stat.dev) !== file.identity.dev || String(stat.ino) !== file.identity.ino) throw new ApplicationError("CORRUPTED_STATE");
+			await authenticate({
+				...file,
+				path
+			}, signal);
+			return path;
+		};
+		return {
+			...result,
+			spoolPath: await linked(resource.primary),
+			companionSpoolPath: await linked(resource.companion),
+			maskSpoolPath: await linked(resource.masks)
+		};
+	} catch (error) {
+		for (const path of links) await unlink(path).catch(() => {});
+		throw error;
+	}
+}
+//#endregion
+//#region apps/cli/src/journey/render/base.ts
+/**
+* The CPU-bound part of base packaging (ADR 0172): the static production from frozen captures,
+* the base pair written from the stored Track B results and its full readback. The owning
+* thread keeps every store read and write; this runs there or in a packaging worker.
+*/
+async function writeJourneyBase(work, signal, onPath) {
+	const { inputs } = work;
+	const hooks = {
+		signal,
+		onTemporary: async () => {},
+		onPhase: async () => {}
+	};
+	const prepared = await staticBaseFromInputs(inputs, work.processing, hooks);
+	const stored = new Map(work.stored.map((item) => [item.sessionId, item]));
+	const written = await writeLogicalJourneyBase({
+		production: prepared.production,
+		directory: work.directory,
+		captureReview: false,
+		work: prepared.work,
+		prerendered: async (job) => {
+			if (job.spoolDirectory === void 0) throw new ApplicationError("CORRUPTED_STATE");
+			return linkedStaticResult(stored.get(job.session.id), {
+				digest: renderJobDigest(job),
+				spoolDirectory: job.spoolDirectory
+			}, signal);
+		}
+	}, hooks, onPath);
+	return {
+		kind: "base",
+		journeyId: inputs.journeyId,
+		workId: inputs.work.id,
+		inputRevision: inputs.work.inputRevision,
+		bundleId: written.bundleId,
+		primary: written.primary,
+		companion: written.companion,
+		maskLedger: written.maskLedger,
+		sourceBindings: [...written.sourceBindings],
+		sessions: written.sessionBindings.map((binding) => {
+			const root = prepared.families.owners.get(binding.applicationSessionId);
+			if (!root) throw new ApplicationError("CORRUPTED_STATE");
+			return {
+				applicationSessionId: binding.applicationSessionId,
+				archiveSessionId: binding.sessionId,
+				rootSessionId: root.id,
+				role: root.id === binding.applicationSessionId ? "main" : "worker"
+			};
+		})
+	};
+}
+function journeyBaseJob(work) {
+	const { processing, ...rest } = work;
+	return {
+		...rest,
+		processing: {
+			environment: processing.environment,
+			...processing.limits === void 0 ? {} : { limits: processing.limits }
+		}
+	};
+}
+/**
+* Worker side: `live` holds the worker's own adapters and static processor. The base runs no
+* static detection and reads no Git names (ADR 0172); a Git-name read fails closed.
+*/
+async function runJourneyBaseJob(job, live, signal, onPath) {
+	const processing = {
+		...live,
+		...job.processing,
+		gitNames: gitSeedsProvider([])
+	};
+	return {
+		kind: "journey-base",
+		base: await writeJourneyBase({
+			...job,
+			processing
+		}, signal, onPath)
+	};
+}
+//#endregion
+//#region apps/cli/src/journey/hide-index.ts
+/**
+* Word pieces of render input, gathered as it is read so its texts are not held to the end.
+* `from` continues a collection begun in another thread (ADR 0181).
+*/
+function createHideIndexTokens(from) {
+	const tokens = new Set(from?.tokens);
+	let complete = from?.complete ?? true;
+	return {
+		tokens,
+		add: (text) => {
+			if (complete) complete = addHideIndexTokens(text, (token) => tokens.add(token));
+			if (tokens.size > 2e6) complete = false;
+		},
+		complete: () => complete
+	};
+}
+/**
+* The pieces of a Work collected in shards (ADR 0199): the same set and completeness as one
+* collection, since pieces only accumulate and the bound applies to their union.
+*/
+function mergeHideIndexTokens(parts) {
+	const tokens = /* @__PURE__ */ new Set();
+	let complete = true;
+	for (const part of parts) {
+		complete &&= part.complete;
+		for (const token of part.tokens) {
+			if (!complete) break;
+			tokens.add(token);
+			if (tokens.size > 2e6) complete = false;
+		}
+	}
+	return createHideIndexTokens({
+		tokens: complete ? tokens : [],
+		complete
+	});
+}
+/** The Work's own texts a render can mask, read before its base archive. */
+function hideIndexTexts(work) {
+	const suggestion = work.suggestion;
+	return [
+		work.title,
+		work.description,
+		work.reason,
+		...suggestion ? [
+			suggestion.title,
+			suggestion.description,
+			suggestion.reason
+		] : []
+	];
+}
+/**
+* The CPU-bound part of a hide index: word pieces of the texts and every base field, or of one
+* shard's base fields (ADR 0199).
+*/
+async function collectHideIndexTokens(texts, primary, processing, { add, complete }, signal, shard) {
+	for (const text of texts) add(text);
+	for await (const field of readConfiguredSearchFields(primary, processing, signal, true, void 0, shard)) {
+		if (!complete()) break;
+		add(field.text);
+	}
+}
+/** Keyed digests of collected word pieces and of the confirmed Hide values. */
+async function packRenderHideIndex(input) {
+	const { work } = input;
+	const { tokens, complete } = input.tokens;
+	const key = await input.storage.hideIndexKey(input.journeyId);
+	return {
+		kind: "hide-index",
+		journeyId: input.journeyId,
+		workId: work.id,
+		revision: work.revision,
+		confirmedHideRevision: input.confirmedHideRevision,
+		keyId: hideKeyId(key),
+		digests: complete() ? packHideIndex(key, tokens) : null,
+		values: packHideIndex(key, [...input.confirmed].map(([term, { kind }]) => renderedHideValue(kind, term)))
+	};
+}
+//#endregion
+//#region apps/cli/src/journey/render/job.ts
+/**
+* The same steps on the owning thread; also the fallback when workers cannot run. The written
+* primary is read back as the publisher reads an existing output.
+*/
+async function writeJourneyOutput(work, signal, onPath) {
+	const output = await writeLogicalJourneyOutput(work.request, signal, onPath);
+	await readConfiguredOutputInfo(output.primary, signal);
+	await collectHideIndexTokens(work.texts, work.request.primary, work.request.processing, work.tokens, signal);
+	return {
+		output,
+		tokens: work.tokens
+	};
+}
+function journeyOutputJob(work) {
+	const { processing, ...request } = work.request;
+	return {
+		request,
+		processing: {
+			environment: processing.environment,
+			...processing.limits === void 0 ? {} : { limits: processing.limits },
+			...processing.replacementKey === void 0 ? {} : { replacementKey: processing.replacementKey },
+			...processing.staticExceptions === void 0 ? {} : { staticExceptions: processing.staticExceptions }
+		},
+		texts: work.texts,
+		tokens: [...work.tokens.tokens],
+		tokensComplete: work.tokens.complete()
+	};
+}
+function workerProcessing(job, live) {
+	return {
+		...live,
+		...job.processing,
+		gitNames: gitSeedsProvider([])
+	};
+}
+/**
+* Worker side of one shard: its entries rewritten into private archives and the hide-index word
+* pieces of its base entries. The first shard also takes the Work's texts, title pieces and the
+* base manifest's fields, so the shards' pieces together are those of one job.
+*/
+async function runJourneyOutputShardJob(job, live, signal, onPath) {
+	const processing = workerProcessing(job, live);
+	const { maskEvidence, ...request } = job.request;
+	if (!maskEvidence) throw new Error("ARTIFACT_INVALID_APPROVAL");
+	const pieces = await writeOutputShard({
+		...request,
+		processing,
+		maskEvidence,
+		shard: job.shard
+	}, signal, onPath);
+	const first = job.shard.index === 0;
+	const tokens = createHideIndexTokens(first ? {
+		tokens: job.tokens,
+		complete: job.tokensComplete
+	} : void 0);
+	await collectHideIndexTokens(first ? job.texts : [], job.request.primary, processing, tokens, signal, job.shard);
+	return {
+		kind: "journey-output-shard",
+		pieces,
+		tokens: [...tokens.tokens],
+		tokensComplete: tokens.complete()
+	};
+}
+/** Worker side of one shard of a merged output's readback. */
+async function runJourneyOutputVerifyJob(job, signal) {
+	const ledger = job.output.finalMaskLedger;
+	if (!ledger) throw new Error("ARTIFACT_INVALID_APPROVAL");
+	await verifyOutputShard({
+		...job.output,
+		finalMaskLedger: ledger
+	}, job.shard, signal);
+	return { kind: "journey-output-verify" };
+}
+/**
+* Worker side: `live` holds the worker's own adapters and static processor. A job with
+* `request.shards` merges them; its caller then reads the output back in shards (ADR 0199).
+*/
+async function runJourneyOutputJob(job, live, signal, onPath) {
+	const processing = workerProcessing(job, live);
+	if (job.request.shards) {
+		const output = await writeLogicalJourneyOutput({
+			...job.request,
+			processing
+		}, signal, onPath);
+		await readConfiguredOutputInfo(output.primary, signal);
+		return {
+			kind: "journey-output",
+			output,
+			tokens: [],
+			tokensComplete: true
+		};
+	}
+	const written = await writeJourneyOutput({
+		request: {
+			...job.request,
+			processing
+		},
+		texts: job.texts,
+		tokens: createHideIndexTokens({
+			tokens: job.tokens,
+			complete: job.tokensComplete
+		})
+	}, signal, onPath);
+	return {
+		kind: "journey-output",
+		output: written.output,
+		tokens: [...written.tokens.tokens],
+		tokensComplete: written.tokens.complete()
+	};
+}
+//#endregion
+export { staticBaseProduction as _, writeJourneyOutput as a, mergeHideIndexTokens as c, runJourneyBaseJob as d, writeJourneyBase as f, staticBaseInputs as g, staticSessions as h, runJourneyOutputVerifyJob as i, packRenderHideIndex as l, saveStaticSession as m, runJourneyOutputJob as n, createHideIndexTokens as o, readStaticResult as p, runJourneyOutputShardJob as r, hideIndexTexts as s, journeyOutputJob as t, journeyBaseJob as u, prepareSourcePlan as v, workApproval as y };

package/dist/{locate-Bn32k2se.mjs → locate-U3-nkird.mjs}

@@ -8953,13 +8953,18 @@ const decisionCardInputSchema = z.object({
 		id: z.enum(["hide", "keep"]),
 		label: z.string().trim().min(1).max(240),
 		rule: z.string().trim().min(1).max(2e3)
-	}).strict()).length(2).refine((options) => new Set(options.map((option) => option.id)).size === 2, { message: "Decision cards require one hide option and one keep option." })
+	}).strict()).length(2).refine((options) => new Set(options.map((option) => option.id)).size === 2, { message: "Decision cards require one hide option and one keep option." }),
+	suggestion: z.object({
+		optionId: z.enum(["hide", "keep"]),
+		source: z.string().trim().min(1).max(300)
+	}).strict().optional()
 }).strict();
 const decisionCardSchema = decisionCardInputSchema.extend({ answer: z.object({
 	optionId: z.string(),
 	rule: z.string().max(4001),
 	additionalRule: z.string().max(2e3),
-	remember: z.boolean()
+	remember: z.boolean(),
+	excludedTermKeys: z.array(z.string().min(1)).max(2e4).optional()
 }).strict().nullable() }).strict();
 const journeyPrivacySchema = z.object({
 	terms: z.array(privacyTermSchema),
@@ -8983,7 +8988,18 @@ const write = z.object({
 	expectedRevision: count$2,
 	idempotencyKey: z.uuid()
 });
-const cardsSubmitSchema = write.extend({ cards: z.array(decisionCardInputSchema).max(20) }).strict();
+/**
+* `append` (D3) adds a batch while scanning continues: new cards plus values added to existing
+* cards, covering only Pending values no card covers yet. `replace` republishes the whole deck.
+*/
+const cardsSubmitSchema = write.extend({
+	cards: z.array(decisionCardInputSchema).max(20),
+	mode: z.enum(["replace", "append"]).optional(),
+	extend: z.array(z.object({
+		cardId: z.uuid(),
+		termKeys: z.array(z.string().min(1)).min(1).max(2e4)
+	}).strict()).max(20).optional()
+}).strict();
 const privacyResolveSchema = write.extend({
 	answersRevision: count$2,
 	resolutions: z.array(privacyTermSchema.omit({ sources: true }).extend({ disposition: z.enum(["hidden", "keep"]) }).strict()).min(1).max(2e4)
@@ -8993,7 +9009,8 @@ const cardAnswerActionSchema = z.object({
 	cardId: z.uuid(),
 	optionId: z.string().min(1),
 	rule: z.string().max(2e3).optional(),
-	remember: z.boolean()
+	remember: z.boolean(),
+	excludedTermKeys: z.array(z.string().min(1)).max(2e4).optional()
 }).strict();
 const cardsConfirmActionSchema = z.object({
 	kind: z.literal("cards-confirm"),
@@ -9310,7 +9327,11 @@ const journeyWorkSchema = z.object({
 		"explicit",
 		"delegate"
 	]),
-	placement: z.enum(["placed", "unsorted"]),
+	placement: z.enum([
+		"placed",
+		"unsorted",
+		"classifying"
+	]),
 	suggestion: journeyWorkSuggestionSchema.nullable(),
 	classificationRecommendation: z.object({
 		access: journeyAccessSchema,
@@ -9357,7 +9378,9 @@ const journeyWorkSchema = z.object({
 	staticReview: z.object({
 		snapshotId: journeyDigestSchema,
 		inputRevision: count$1.min(1),
-		digest: journeyDigestSchema
+		digest: journeyDigestSchema,
+		/** Images the Work's sessions leave out (D7); absent when a session receipt predates it. */
+		imagesOmitted: count$1.optional()
 	}).strict().optional(),
 	totalBatches: count$1,
 	completedBatches: count$1,