@gitroll/tacitt-cli 0.3.0 → 0.4.1

package/dist/{query-DN99jiRc.mjs → query-7uY266qY.mjs}

@@ -1,10 +1,10 @@
-import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, Q as createCleanup, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Z as removeNamedTemporarySpools, _ as readStaticSessionMasks, a as scanReviewFields, at as isWindowsAclFailure, c as readSessionScanRecords, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as windowsOwnerOnly, j as readCollectionIndex, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as openPrivateFile, o as createWorkPieces, ot as windowsAclCodes, p as openConfiguredUpload, r as prepareSessionScans, rt as restrictToOwner, s as readSessionScanFields, t as preparedScanConfiguration, tt as makePrivateDirectory, v as staticSessionJobs, w as createCollectionArtifacts, z as parallelismLimits } from "./src-CPbdnGrk.mjs";
+import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, Q as createCleanup, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Z as removeNamedTemporarySpools, _ as readStaticSessionMasks, a as scanReviewFields, at as isWindowsAclFailure, c as readSessionScanRecords, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as windowsOwnerOnly, j as readCollectionIndex, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as openPrivateFile, o as createWorkPieces, ot as windowsAclCodes, p as openConfiguredUpload, r as prepareSessionScans, rt as restrictToOwner, s as readSessionScanFields, t as preparedScanConfiguration, tt as makePrivateDirectory, v as staticSessionJobs, w as createCollectionArtifacts, z as parallelismLimits } from "./src-DIuh0LHk.mjs";
 import { Bt as sessionPeriodSchema, Dn as entityDictionaryVersion, F as bClassificationKey, Fn as frameRecords, Ft as termTypeInfo, Gt as safeField, H as codePointLength, Ht as ApplicationError, Jt as reviewFamilies, K as utf16Offset, N as bUnitFragments, Ot as privacyTermKey, Qn as admitGitName, T as bLiteralTerms, Ut as UnfinishedJourneyError, V as bDigest, Wt as safeCode, Xn as createEntityMatcher, Zn as admitCustomTerm, Zt as observeSource, b as validateBReview, c as textDigest, h as reviewFindingsDigest, ht as journeyDescribeSchema, jt as reviewTermsInputSchema, l as validateReview, mn as currentDetectorVersion, n as compileBFindings, r as reviewBatchChunks, s as reviewSubmitSchema, t as locateTerms, yn as createStaticProcessor, z as bAnchorKey } from "./locate-U3-nkird.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-qoLRvX-A.mjs";
-import { $ as settingsQuerySchema, $n as reviewCandidateInputSchema, $t as journeySearchResultSchema, A as deviceProfileScopeSchema, Ar as nativeEventsSchema, B as validateInspectionBatch, Br as isSelectedWork, Bt as journeyReviewStorageQuerySchema, C as rebindReviewSubmit, Ct as sendStartSchema, D as createAccount, Dt as sendReplaceResultSchema, E as staticallyHiddenFindings, En as confirmedHideAdditions, Er as journeyClassificationSessionsSchema, Et as sendReceiptSchema, Gr as journeyFindingsSchema, Gt as retireScanGeneration, Hr as withReadingProgress, Jr as journeyRenderSchema, Jt as journeyContextQuerySchema, Kn as journeyConfirmedHides, Kr as journeyPreviewSchema, Kt as newJourneyWork, L as createApplication, Lr as hasCompleteWorkDescription, M as readAccountAvatarUrl, Mr as nativeRespondSchema, Mt as obsoleteJourney, N as storedCredentialSchema, Nr as hasCurrentStaticReview, O as accountProfileSchema, On as readConfirmedHideChange, Or as assertJourneyPrivacyReady, Ot as sendResolutionSchema, Pr as staticReviewDigest, Q as settingsBatchSchema, Qn as workCorrectionBinding, Qr as selectionSchema, R as inspectionCancelSchema, Rr as isClassifying, Rt as applyClassification, S as rebindReviewOverlay, St as sendPrepareSchema, T as guardedFindingText, Tt as sendArtifactSchema, U as inspectionQuerySchema, Un as confirmedHideKinds, Ut as classificationPartition, Vn as confirmedHideGroupIds, Wr as journeyFindingImpactSchema, Wt as classificationWorks, Xn as workDecisionDigest, Xr as packageCommandSchema, Yn as retireWorkDescription, Yr as commandSchema, Zr as selectionBatchSchema, _n as sessionReviewInputSchema, _r as journeyInventoryQuerySchema, _t as maximumTermsFileBytes, a as bCrossSegmentReviewSchema, b as bReviewScope, bt as sendActionSchema, c as reconstructBFields, ct as validateFailureLocation, d as selectedValueMembers, dr as scanGitSeedsId, dt as manualUploadChoiceSchema, ei as producerVersion, er as reviewCandidateResourceSchema, et as readWorkspaceOutcomes, f as splitSelectorValues, fn as sessionReconcileInputSchema, fr as scanGitSeedsResource, ft as manualUploadPrepareSchema, g as changeJourney, gt as emptyTermsRevision, hn as sessionRereadInputSchema, i as validateBCrossSegmentReview, in as journeyResourceQuerySchema, ir as bReviewDigest, j as profileUrlMatchesIdentity, jn as termHideAdditions, jr as nativeGetSchema, jt as currentJourneyAdapters, k as deviceAuthorizationSchema, kr as privacyDecisionDigest, kt as sendSettingsSchema, ln as reviewAttemptResourceSchema, lr as scanPreparationDigest, lt as manualUploadActionSchema, m as hideScopeDigest, mr as scanExclusionResourceSchema, mt as manualUploadStartSchema, n as scanBatchEquivalenceDigest, nn as journeyPolicyRespondSchema, nr as reviewRepairResourceSchema, nt as appendSensitiveTerms, o as bRereadDigest, or as planBRepair, ot as artifactFailureDetailSchema, p as activeJourneyTerms, pr as verifiedScanGitSeeds, pt as manualUploadSchema, qn as maskedHitsStale, qr as journeyRenderInputSchema, qt as reviewCompileSchema, r as locateTermEvidence, ri as recommendParallelism, s as reconcileBSession, sn as journeyPlaceSchema, st as resolveFailureLocation, t as scanBatchContextDigest, ti as stateSchema, tn as searchScopeDigest, tr as reviewRepairInputSchema, ur as scanSessionResourceSchema, vn as sessionReviewQuerySchema, vt as normalizeSensitiveTerms, w as reviewBatchReuse, wt as journeySendSchema, x as rebindReviewAlignment, xn as sessionUsefulnessInputSchema, xr as emptyPreparationFacts, xt as sendChoiceSchema, y as isGenericPublicTerm, yt as replaceSensitiveTermsSchema, z as inspectionStartSchema, zn as bTermMatcher, zr as isReadingComplete } from "./src-B4R5XMEP.mjs";
-import { $ as checkVersion, A as resourceSelectionQuerySchema, B as termReuseQuerySchema, C as loadAcceptedReview, D as aggregateUsefulness, E as loadPrivateResource, F as validateUnitCandidate, G as requireActiveBatch, H as batchHeader, I as reuseQuerySchema, J as validateDatabase, K as initializeAndClaim, L as batchQuery, M as evaluateUnitEvidence, N as sameCandidateRequest, O as sessionUsefulnessRecommendation, P as validateCandidateAttempt, Q as validateState, R as isPrivateResourceKind, S as validateSessionBindings, T as loadBatch, U as createJourneyPayloadFiles, V as privateReviewHash, W as validateBatchBody, X as readBundleDirectory, Y as withDatabase, Z as readStoredState, _ as loadReconciliation, _t as isCoordinationBusy, a as decodeError, at as hasResetMarker, b as validatePreparationSelection, c as dropsAnchor, ct as privatePath, d as parseDelivery, dt as stateDirectory, et as schemaVersion, f as validateCandidate, ft as syncDirectory, g as loadPreparedBodies, gt as errorCode$1, h as loadPreparation, ht as StoreError, i as createExecutor, it as finishReset, j as inspectionQuerySchema$1, k as sessionQuery, l as replySchema, lt as readResetMarker, m as loadStatus, mt as withFileCheckTimings, n as releaseInheritedHeapFlags, nt as createDatabaseFile, o as ProtocolError, ot as inspectStateFiles, p as classificationJourneyCommit, pt as withStateSnapshot, q as ownership, r as storeHeapLimits, rt as databaseName, s as allowedReplies, st as present, tt as beginReset, u as operations, ut as recheckPrivatePath, v as loadRereadBodies, vt as isSqliteCorruption, w as loadAuthenticatedReview, x as validateSessionReconciliation, y as loadSessionBodies, z as privateResourceHeader } from "./heap-eO_uWpD1.mjs";
-import { _ as staticBaseProduction, a as writeJourneyOutput, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as prepareSourcePlan, y as workApproval } from "./job-rK-Ho9OD.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-CLXdKr2I.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-BESjwh7X.mjs";
+import { $ as settingsQuerySchema, $r as packageCommandSchema, A as deviceProfileScopeSchema, B as validateInspectionBatch, Bn as journeyConfirmedHides, Br as hasCompleteWorkDescription, Bt as newJourneyWork, C as rebindReviewSubmit, Cr as privacyDecisionDigest, Ct as sendStartSchema, D as createAccount, Dr as hasCurrentStaticReview, E as staticallyHiddenFindings, Er as nativeRespondSchema, Et as obsoleteJourney, Fn as confirmedHideGroupIds, Fr as sendArtifactSchema, Gr as withReadingProgress, Hr as isReadingComplete, Ht as journeyContextQuerySchema, Ir as sendReceiptSchema, Jn as reviewCandidateResourceSchema, Jr as journeyFindingsSchema, Kn as workCorrectionBinding, L as createApplication, Ln as confirmedHideKinds, Lr as sendReplaceResultSchema, Lt as classificationPartition, M as readAccountAvatarUrl, Mr as agentSourceSchema, Mt as applyClassification, N as storedCredentialSchema, Nn as bTermMatcher, Nr as agentSourcesSchema, O as accountProfileSchema, Or as staticReviewDigest, Pr as journeySendSchema, Pt as journeyReviewStorageQuerySchema, Q as settingsBatchSchema, Qn as bReviewDigest, Qr as commandSchema, Qt as journeyResourceQuerySchema, R as inspectionCancelSchema, Rr as sendResolutionSchema, Rt as classificationWorks, S as rebindReviewOverlay, Sn as readConfirmedHideChange, Sr as assertJourneyPrivacyReady, St as sendPrepareSchema, T as guardedFindingText, Tn as termHideAdditions, Tr as nativeGetSchema, Tt as currentJourneyAdapters, U as inspectionQuerySchema, Un as retireWorkDescription, Ur as isSelectedWork, Vn as maskedHitsStale, Vr as isClassifying, Vt as reviewCompileSchema, Wn as workDecisionDigest, Xn as reviewRepairResourceSchema, Xr as journeyRenderInputSchema, Xt as journeyPolicyRespondSchema, Yn as reviewRepairInputSchema, Yr as journeyPreviewSchema, Yt as searchScopeDigest, Zr as journeyRenderSchema, _t as maximumTermsFileBytes, a as bCrossSegmentReviewSchema, ar as scanGitSeedsId, b as bReviewScope, bn as confirmedHideAdditions, br as journeyClassificationSessionsSchema, bt as sendActionSchema, c as reconstructBFields, cr as scanExclusionResourceSchema, ct as validateFailureLocation, d as selectedValueMembers, dn as sessionReviewInputSchema, dr as journeyInventoryQuerySchema, dt as manualUploadChoiceSchema, ei as selectionBatchSchema, er as planBRepair, et as readWorkspaceOutcomes, f as splitSelectorValues, fn as sessionReviewQuerySchema, ft as manualUploadPrepareSchema, g as changeJourney, gt as emptyTermsRevision, hn as sessionUsefulnessInputSchema, hr as emptyPreparationFacts, i as validateBCrossSegmentReview, ii as stateSchema, ir as scanSessionResourceSchema, j as profileUrlMatchesIdentity, k as deviceAuthorizationSchema, ln as sessionRereadInputSchema, lt as manualUploadActionSchema, m as hideScopeDigest, mt as manualUploadStartSchema, n as scanBatchEquivalenceDigest, nt as appendSensitiveTerms, o as bRereadDigest, oi as recommendParallelism, on as sessionReconcileInputSchema, or as scanGitSeedsResource, ot as artifactFailureDetailSchema, p as activeJourneyTerms, pt as manualUploadSchema, qn as reviewCandidateInputSchema, qr as journeyFindingImpactSchema, qt as journeySearchResultSchema, r as locateTermEvidence, ri as producerVersion, rn as reviewAttemptResourceSchema, rr as scanPreparationDigest, s as reconcileBSession, sr as verifiedScanGitSeeds, st as resolveFailureLocation, t as scanBatchContextDigest, ti as selectionSchema, tn as journeyPlaceSchema, vt as normalizeSensitiveTerms, w as reviewBatchReuse, wr as nativeEventsSchema, x as rebindReviewAlignment, xt as sendChoiceSchema, y as isGenericPublicTerm, yt as replaceSensitiveTermsSchema, z as inspectionStartSchema, zr as sendSettingsSchema, zt as retireScanGeneration } from "./src-DSDRF7i6.mjs";
+import { $ as checkVersion, A as resourceSelectionQuerySchema, B as termReuseQuerySchema, C as loadAcceptedReview, D as aggregateUsefulness, E as loadPrivateResource, F as validateUnitCandidate, G as requireActiveBatch, H as batchHeader, I as reuseQuerySchema, J as validateDatabase, K as initializeAndClaim, L as batchQuery, M as evaluateUnitEvidence, N as sameCandidateRequest, O as sessionUsefulnessRecommendation, P as validateCandidateAttempt, Q as validateState, R as isPrivateResourceKind, S as validateSessionBindings, T as loadBatch, U as createJourneyPayloadFiles, V as privateReviewHash, W as validateBatchBody, X as readBundleDirectory, Y as withDatabase, Z as readStoredState, _ as loadReconciliation, _t as isCoordinationBusy, a as decodeError, at as hasResetMarker, b as validatePreparationSelection, c as dropsAnchor, ct as privatePath, d as parseDelivery, dt as stateDirectory, et as schemaVersion, f as validateCandidate, ft as syncDirectory, g as loadPreparedBodies, gt as errorCode$1, h as loadPreparation, ht as StoreError, i as createExecutor, it as finishReset, j as inspectionQuerySchema$1, k as sessionQuery, l as replySchema, lt as readResetMarker, m as loadStatus, mt as withFileCheckTimings, n as releaseInheritedHeapFlags, nt as createDatabaseFile, o as ProtocolError, ot as inspectStateFiles, p as classificationJourneyCommit, pt as withStateSnapshot, q as ownership, r as storeHeapLimits, rt as databaseName, s as allowedReplies, st as present, tt as beginReset, u as operations, ut as recheckPrivatePath, v as loadRereadBodies, vt as isSqliteCorruption, w as loadAuthenticatedReview, x as validateSessionReconciliation, y as loadSessionBodies, z as privateResourceHeader } from "./heap-eZTo0VYj.mjs";
+import { _ as staticBaseProduction, a as writeJourneyOutput, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as prepareSourcePlan, y as workApproval } from "./job-Bi57uRU-.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-Cb_spmGb.mjs";
 import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
@@ -925,7 +925,7 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 			})
 		}),
 		send: t.router({
-			get: t.procedure.input(sendAddress.partial({ sendId: true })).query(({ input }) => sending().get(input)),
+			get: t.procedure.input(sendAddress.partial({ sendId: true })).query(({ input, signal }) => readThroughContention(() => sending().get(input), signal)),
 			prepare: t.procedure.input(sendPrepareSchema).mutation(({ input, signal }) => sending().prepare(input, signal)),
 			start: t.procedure.input(sendStartSchema).mutation(({ input, signal }) => sending().start(input, signal)),
 			respond: t.procedure.input(sendChoiceSchema).mutation(({ input }) => sending().respond(input)),
@@ -6660,6 +6660,7 @@ async function prepareScanContext(storage, journeyId, work, selected, processing
 }
 //#endregion
 //#region apps/cli/src/journey/prepare/scan-plan.ts
+let publication = Promise.resolve();
 /**
 * The second pass of a Work's Track A (ADR 0177): with every session's receipt saved, its
 * authenticated fields files are read in the Work's reading order twice, once to find each
@@ -6667,6 +6668,18 @@ async function prepareScanContext(storage, journeyId, work, selected, processing
 * Only the plan's outlines stay in memory between the reads, never the Work's text.
 */
 async function publishWorkBatches(storage, plan, work, resources, signal) {
+	const previous = publication;
+	const turn = Promise.withResolvers();
+	publication = turn.promise;
+	await previous;
+	try {
+		signal.throwIfAborted();
+		return await publishAdmittedWork(storage, plan, work, resources, signal);
+	} finally {
+		turn.resolve();
+	}
+}
+async function publishAdmittedWork(storage, plan, work, resources, signal) {
 	const order = new Map(plan.approval.inventory.sessions.map((item, index) => [item.id, index]));
 	const workIndex = (resource) => {
 		const index = order.get(resource.input.sessionId);
@@ -9792,7 +9805,33 @@ function createJourneySendArtifacts(storage) {
 			const output = await find(journey.journeyId, work.id, work.revision);
 			const info = await readConfiguredOutputInfo(output.primary, signal);
 			if (info.work.id !== work.id || info.work.access !== work.access) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+			let agentSources = [];
+			try {
+				const base = (await storage.resources({
+					journeyId: journey.journeyId,
+					kind: "base"
+				})).find((item) => item.kind === "base" && item.workId === work.id && item.inputRevision === output.finalMaskLedger.inputRevision && item.primary.sha256 === output.finalMaskLedger.basePrimarySha256);
+				if (base?.kind === "base") {
+					const included = new Set(base.sessions.map((item) => item.applicationSessionId));
+					const resources = await storage.resources({
+						journeyId: journey.journeyId,
+						kind: "static-session"
+					});
+					const unique = /* @__PURE__ */ new Map();
+					for (const resource of resources) {
+						if (resource.kind !== "static-session" || resource.workId !== work.id || resource.inputRevision !== base.inputRevision || !included.has(resource.sessionId)) continue;
+						for (const candidate of resource.agentSources ?? []) {
+							const parsed = agentSourceSchema.safeParse(candidate);
+							if (parsed.success && unique.size < 500) unique.set(JSON.stringify(parsed.data), parsed.data);
+						}
+					}
+					agentSources = [...unique.values()];
+				}
+			} catch {
+				console.error("AGENT_SOURCES_METADATA_UNAVAILABLE");
+			}
 			return sendArtifactSchema.parse({
+				...agentSources.length === 0 ? {} : { agentSources },
 				workId: work.id,
 				revision: work.revision,
 				bundleId: info.manifest.bundleId,
@@ -9952,6 +9991,85 @@ async function readOwnerJson(response) {
 	return JSON.parse(Buffer.concat(chunks, bytes).toString("utf8"));
 }
 //#endregion
+//#region apps/cli/src/account/journey/public-sources.ts
+/** Anonymous evidence only. Expected absence, refusal and lookup failure all omit enrichment. */
+async function publicSource(source, requestFetch, signal) {
+	const controller = new AbortController();
+	let onAbort = () => {};
+	const cancelled = new Promise((resolve) => {
+		onAbort = () => {
+			controller.abort();
+			resolve(false);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		if (signal?.aborted) onAbort();
+	});
+	let timer;
+	const expired = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			controller.abort();
+			resolve(false);
+		}, 3e3);
+	});
+	const check = async () => {
+		const response = await requestFetch(source.type === "github" ? `https://api.github.com/repos/${source.repo}` : `https://registry.npmjs.org/${encodeURIComponent(source.package)}`, {
+			method: "GET",
+			credentials: "omit",
+			redirect: "error",
+			referrerPolicy: "no-referrer",
+			cache: "no-store",
+			signal: controller.signal
+		});
+		if (response.status !== 200 || source.type === "npm") {
+			await response.body?.cancel();
+			return response.status === 200;
+		}
+		const value = await readOwnerJson(response);
+		return typeof value === "object" && value !== null && "private" in value && value.private === false;
+	};
+	try {
+		return await Promise.race([
+			check(),
+			expired,
+			cancelled
+		]);
+	} catch {
+		return false;
+	} finally {
+		signal?.removeEventListener("abort", onAbort);
+		clearTimeout(timer);
+		controller.abort();
+	}
+}
+/** One upload, at most twenty distinct checks in parallel and a three-second I/O deadline. */
+async function checkPublicAgentSources(candidates, requestFetch = fetch, signal) {
+	signal?.throwIfAborted();
+	if (!Array.isArray(candidates) || candidates.length > 500) return [];
+	const admittedShape = candidates.flatMap((item) => {
+		const parsed = agentSourcesSchema.element.safeParse(item);
+		return parsed.success ? [parsed.data] : [];
+	});
+	const cache = /* @__PURE__ */ new Map();
+	const selected = [];
+	for (const item of admittedShape) {
+		const source = item.source;
+		const key = source.type === "github" ? `github:${source.repo.toLowerCase()}` : `npm:${source.package}`;
+		let result = cache.get(key);
+		if (!result) {
+			if (cache.size === 20) continue;
+			result = publicSource(source, requestFetch, signal);
+			cache.set(key, result);
+		}
+		selected.push({
+			item,
+			result
+		});
+	}
+	const results = await Promise.all(selected.map(async ({ item, result }) => await result ? item : null));
+	signal?.throwIfAborted();
+	return results.filter((item) => item !== null);
+}
+//#endregion
 //#region apps/cli/src/account/journey/client.ts
 const refusalSchema = z.object({
 	error: z.string(),
@@ -10041,6 +10159,9 @@ function createJourneyOwnerClient(options) {
 	const receipt = (id) => sendReceiptSchema.refine((value) => value.receiptId === id);
 	return {
 		subject: options.subject,
+		checkAgentSources(candidates, signal) {
+			return checkPublicAgentSources(candidates, requestFetch, signal);
+		},
 		async assertCurrent(signal) {
 			await options.authorize();
 			signal.throwIfAborted();
@@ -10065,8 +10186,15 @@ function createJourneyOwnerClient(options) {
 				membersDigest: preview.membersDigest
 			}, "PUT");
 		},
-		reserve(key, input, signal, checksumUpload = true) {
-			return request("/me/work-bundles/uploads", sendReceiptSchema.refine((value) => receiptMatches(input, value)), signal, input, "POST", key, requestTimeoutMs$2, checksumUpload);
+		async reserve(key, input, signal, checksumUpload = true) {
+			const reserve = (body) => request("/me/work-bundles/uploads", sendReceiptSchema.refine((value) => receiptMatches(input, value)), signal, body, "POST", key, requestTimeoutMs$2, checksumUpload);
+			try {
+				return await reserve(input);
+			} catch (error) {
+				if (!(error instanceof JourneyRemoteError) || error.status !== 400 || error.code !== "invalid_request" || input.agentSources === void 0) throw error;
+				const { agentSources: _, ...withoutSources } = input;
+				return reserve(withoutSources);
+			}
 		},
 		complete(id, signal) {
 			return request(`/me/work-bundles/uploads/${encodeURIComponent(id)}/complete`, receipt(id), signal, {}, "POST", void 0, completeTimeoutMs);
@@ -10219,6 +10347,8 @@ async function resolveItem(item, bindingId, connection, signal, snapshot = false
 			resolution
 		}, settings, null, snapshot);
 	}
+	const agentSources = await connection.checkAgentSources?.(item.artifact.agentSources, signal);
+	signal.throwIfAborted();
 	return {
 		...item,
 		target,
@@ -10226,6 +10356,7 @@ async function resolveItem(item, bindingId, connection, signal, snapshot = false
 		status: "uploading",
 		error: null,
 		reservation: {
+			...agentSources?.length ? { agentSources } : {},
 			work,
 			target,
 			bundleId: item.artifact.bundleId,
@@ -12310,6 +12441,7 @@ function createJourneySender(dependencies, phases = 3) {
 			if (!sameIds(input.confirmedWorkIds, snapshot.send.items.map((item) => item.workId)) || !sameIds(input.confirmedOmittedWorkIds, snapshot.send.omitted.map((item) => item.workId)) || input.scopeDigest !== snapshot.send.scopeDigest || snapshot.send.items.length === 0) throw new ApplicationError("CONFIRMATION_REQUIRED");
 			if (snapshot.send.confirmedAt !== null) return saveSend(dependencies, snapshot, snapshot.send, input);
 			const connection = await dependencies.auth.connect(signal);
+			if (!connection && !dependencies.auth.configured) throw new ApplicationError("ACCOUNT_NOT_CONFIGURED");
 			if (connection && snapshot.send.subject !== null && snapshot.send.subject !== connection.subject) throw new ApplicationError("IDENTITY_REJECTED");
 			let profile = {
 				status: "sign-in",
@@ -12484,33 +12616,36 @@ function createJourneySendAuth(account, requestFetch) {
 		}
 		return response;
 	};
-	return { async connect(signal) {
-		let credential = await current();
-		if (!credential) return null;
-		let verified = await account.identity.readIdentity(credential.accessToken, signal);
-		if (!verified) {
-			await refuse(credential.accessToken);
-			credential = await current();
+	return {
+		configured: account.configuration.clientId !== null,
+		async connect(signal) {
+			let credential = await current();
 			if (!credential) return null;
-			verified = await account.identity.readIdentity(credential.accessToken, signal);
+			let verified = await account.identity.readIdentity(credential.accessToken, signal);
 			if (!verified) {
-				await expire(credential.accessToken);
-				return null;
+				await refuse(credential.accessToken);
+				credential = await current();
+				if (!credential) return null;
+				verified = await account.identity.readIdentity(credential.accessToken, signal);
+				if (!verified) {
+					await expire(credential.accessToken);
+					return null;
+				}
 			}
+			if (verified.identityId !== credential.identityId) throw new ApplicationError("IDENTITY_REJECTED");
+			return createJourneyOwnerClient({
+				apiUrl: account.configuration.passportApiUrl,
+				subject: verified.identityId,
+				fetch: ownerFetch,
+				async authorize() {
+					const latest = await current();
+					if (!latest) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
+					if (latest.identityId !== verified.identityId) throw new ApplicationError("IDENTITY_REJECTED");
+					return latest.accessToken;
+				}
+			});
 		}
-		if (verified.identityId !== credential.identityId) throw new ApplicationError("IDENTITY_REJECTED");
-		return createJourneyOwnerClient({
-			apiUrl: account.configuration.passportApiUrl,
-			subject: verified.identityId,
-			fetch: ownerFetch,
-			async authorize() {
-				const latest = await current();
-				if (!latest) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
-				if (latest.identityId !== verified.identityId) throw new ApplicationError("IDENTITY_REJECTED");
-				return latest.accessToken;
-			}
-		});
-	} };
+	};
 }
 //#endregion
 //#region apps/cli/src/operation/protocol.ts
@@ -12528,6 +12663,15 @@ const sourceExclusionReasonSchema = z.enum([
 ]);
 const identifier = z.string().regex(/^[A-Za-z0-9_-]{1,128}$/);
 const count = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+const driftCountsSchema = z.object({
+	"claude-row": count.optional(),
+	"claude-block": count.optional(),
+	"codex-row": count.optional(),
+	"codex-event": count.optional(),
+	"codex-item": count.optional(),
+	"codex-extension": count.optional(),
+	launch: count.optional()
+});
 const safeDiagnosticSchema = z.object({
 	code: z.string().regex(/^[A-Z][A-Z0-9_]{0,79}$/),
 	stage: z.string().regex(/^[a-z][a-z0-9.-]{0,63}$/).default("runtime"),
@@ -12537,6 +12681,7 @@ const safeDiagnosticSchema = z.object({
 	at: z.string().datetime().max(64).optional(),
 	reason: sourceExclusionReasonSchema.optional(),
 	sourceId: z.string().regex(/^src[0-9]{1,12}$/).optional(),
+	driftCounts: driftCountsSchema.optional(),
 	counts: z.object({
 		workspaces: count,
 		sessions: count,
@@ -12604,6 +12749,7 @@ function projectSafeDiagnostic(value) {
 		operationId: Reflect.get(value, "operationId"),
 		at: Reflect.get(value, "at"),
 		counts: Reflect.get(value, "counts"),
+		driftCounts: Reflect.get(value, "driftCounts"),
 		location: safeLocation,
 		reason: Reflect.get(value, "reason"),
 		sourceId: Reflect.get(value, "sourceId")
@@ -12618,11 +12764,22 @@ function createSafeProducerCallbacks(emit, record) {
 			code: diagnostic.code,
 			stage: diagnostic.stage,
 			...diagnostic.reason ? { reason: diagnostic.reason } : {},
-			...diagnostic.sourceId ? { sourceId: diagnostic.sourceId } : {}
+			...diagnostic.sourceId ? { sourceId: diagnostic.sourceId } : {},
+			...diagnostic.driftCounts ? { driftCounts: diagnostic.driftCounts } : {}
 		});
 		emit(diagnostic);
 	}
 	function anomaly(stage, event) {
+		if (event.code === "tolerated-harness-drift") {
+			const counts = driftCountsSchema.safeParse(event.driftCounts);
+			publish({
+				code: "HARNESS_DRIFT_TOLERATED",
+				...counts.success ? { driftCounts: counts.data } : {},
+				stage,
+				.../^src[0-9]{1,12}$/.test(event.sourceId) ? { sourceId: event.sourceId } : {}
+			});
+			return;
+		}
 		const reason = sourceExclusionReasonSchema.safeParse(event.code);
 		if (!reason.success) return;
 		publish({

package/dist/{run-4G_CvdDj.mjs → run-CV6Io7CS.mjs}

@@ -1,7 +1,7 @@
 import { tn as sessionSchema } from "./locate-U3-nkird.mjs";
 import { t as createZstdFrameCheck$1 } from "./frame-waS5FnN5.mjs";
-import "./src-B4R5XMEP.mjs";
-import { a as isRecord } from "./model-BBAnsFAx.mjs";
+import "./src-DSDRF7i6.mjs";
+import { a as isRecord } from "./model-BDrntocp.mjs";
 import { constants } from "node:fs";
 import { z } from "zod";
 import { lstat, open, stat } from "node:fs/promises";