@gitroll/tacitt-cli 0.6.11 → 0.6.12

package/dist/{heap-CV8Eca8V.mjs → heap-Blrat--4.mjs}

@@ -1,6 +1,6 @@
-import { S as readPrivateReviewPayload, at as restrictToOwner, it as openPrivateFile, nt as exclusiveLock, ot as windowsOwnerOnly, x as writePrivateReviewPayload } from "./src-DlVbGB32.mjs";
-import { An as createDetectionSummary, Ft as emptyReviewCorrectionSchema, Ht as termTypeSchema, It as journeyTermSchema, Lt as reviewTermsInputSchema, Nt as privacyTermSchema, Pt as emptyReviewCorrectionResultSchema, Rt as reviewTermsResultSchema, S as validateBReview, a as reviewBatchChunks, b as bContextEvidence, bt as journeyWorkSuggestionSchema, c as reviewDigest, cn as reviewFamilies, d as validateReview, f as findingReferenceKey, g as reviewAlignmentSchema, gt as journeyGuidanceSchema, l as reviewSubmitSchema, lt as journeyIdSchema, mt as nativeJourneySchema, nn as ApplicationError, o as reviewBatchSchema, or as isStaticCategory, p as reviewAlignmentAudit, pn as fileIdentitySchema, sn as familySelected, sr as staticCategories, st as journeyDigestSchema, u as textDigest, v as validateReviewAlignment, y as semanticFindingSchema, yt as journeyDescribeSchema } from "./locate-Cx52Zqxv.mjs";
-import { $ as validateDetectionSummary, $t as journeyResourceSchema, At as obsoleteJourney, Bn as journeySearchResultSchema, Cn as mergeBRepair, Cr as preparationStartSchema, En as scanCanonicalResourceSchema, Er as validatePreparationFacts, Fr as applyCardAnswers, Ft as journeyGuidance, Gn as journeyEventSchema, Gr as staticSessionId, Gt as journeyContextQuerySchema, Hn as searchScopeDigest, Hr as mergePrivacyTerms, In as journeyInventoryReadSchema, It as journeyBatchReadSchema, J as validateInspectionFence, Jt as hideFinishSchema, Kt as journeyContextSchema, Ln as journeyInventorySchema, Lt as journeyReviewStorageQuerySchema, Nn as validateScanExclusion, Nt as attemptBudgetCodePoints, On as scanSessionResourceSchema, Ot as settleCorrections, Pt as validateAttemptAppend, Q as validateInspectionContribution, Qt as journeyResourceQuerySchema, Rn as journeyPreparationProgressSchema, Rt as applyClassificationProposal, Sn as bReviewDigest, Sr as preparationSettlementSchema, Tn as scanAliasResourceSchema, Tr as preparationUpdateSchema, U as validateInspectionBatch, Un as journeyCommitResultSchema, Ut as newJourneyWork, Vn as journeySearchSaveSchema, W as validateInspectionBatches, Wn as journeyCommitSchema, X as validateInspectionInputs, Xn as settleConfirmedHides, Xr as journeySendSchema, Xt as journeyPolicyRespondSchema, Y as validateInspectionHead, Yt as hidePublishSchema, Z as validateInspectionQuery, Zt as projectPreparationProgress, _r as workPrivacyDecisions, ai as isReadingComplete, an as reviewAttemptsResultSchema, bn as reviewRepairResourceSchema, br as preparationBeginSchema, c as reconstructBFields, ci as selectedWorks, cn as sessionReconciliationResourceSchema, cr as confirmedHideKey, d as resolveGroupSplit, dr as dictionaryHides, en as journeyIsolateSchema, et as inspectionInputs, fn as sessionReviewQuerySchema, g as semanticGroupKey, gi as stateSchema, gn as sessionUsefulnessResourceSchema, gr as workDecisionDigest, gt as manualUploadSchema, h as hideScopeDigest, hn as sessionUsefulnessInputSchema, hr as retireWorkDescription, in as reviewAttemptsQuerySchema, ir as bMaskedHits, kn as scanGitSeedsId, l as chooseCheapPlacement, li as withReadingProgress, mn as sessionReviewStatusSchema, mr as syncTermGroups, nn as sortingApplySchema, o as bRereadDigest, oi as isSelectedWork, pn as sessionReviewResourceSchema, pr as maskedHitsStale, pt as manualUploadBindingSchema, q as validateInspectionClaim, qn as confirmedHideDeltaSchema, qt as hideBeginSchema, rn as reviewAttemptResourceSchema, s as reconcileBSession, si as isSkippedWork, sn as sessionReconcileResultSchema, sr as confirmedHideGroupIds, t as scanBatchContextDigest, tn as journeyPlaceSchema, u as reviseGroupMembership, un as sessionRereadResourceSchema, ur as confirmedHideTerms, v as projectJourneyInventory, vn as reviewCandidateResourceSchema, vt as candidateSortAvailable, wr as preparationStateSchema, x as bReviewScope, xr as preparationPermissionSchema, y as preparationScope, zt as classificationCommitSchema } from "./src-D1iONla3.mjs";
+import { C as writePrivateReviewPayload, ct as windowsOwnerOnly, it as exclusiveLock, ot as openPrivateFile, st as restrictToOwner, w as readPrivateReviewPayload } from "./src-DeNJ8vOD.mjs";
+import { An as createDetectionSummary, Ft as emptyReviewCorrectionSchema, Ht as termTypeSchema, It as journeyTermSchema, Lt as reviewTermsInputSchema, Nt as privacyTermSchema, Pt as emptyReviewCorrectionResultSchema, Rt as reviewTermsResultSchema, S as validateBReview, a as reviewBatchChunks, b as bContextEvidence, bt as journeyWorkSuggestionSchema, c as reviewDigest, cn as reviewFamilies, d as validateReview, f as findingReferenceKey, g as reviewAlignmentSchema, gt as journeyGuidanceSchema, l as reviewSubmitSchema, lt as journeyIdSchema, mt as nativeJourneySchema, nn as ApplicationError, o as reviewBatchSchema, or as isStaticCategory, p as reviewAlignmentAudit, pn as fileIdentitySchema, sn as familySelected, sr as staticCategories, st as journeyDigestSchema, u as textDigest, v as validateReviewAlignment, y as semanticFindingSchema, yt as journeyDescribeSchema } from "./locate-D-ZaHpI0.mjs";
+import { $ as validateDetectionSummary, $t as journeyPlaceSchema, Ai as stateSchema, At as validateAttemptAppend, Bn as journeySearchSaveSchema, Bt as newJourneyWork, Ci as withReadingProgress, Cn as scanAliasResourceSchema, Cr as preparationStateSchema, Dn as scanGitSeedsId, En as scanSessionResourceSchema, Fn as journeyInventoryReadSchema, Fr as assertJourneyPrivacyReady, Ft as classificationCommitSchema, Gt as hideFinishSchema, Hn as journeyCommitResultSchema, Ht as journeyContextQuerySchema, In as journeyInventorySchema, J as validateInspectionFence, Jr as obsoleteJourney, Jt as sendOutputQuerySchema, Kn as confirmedHideDeltaSchema, Kt as hidePublishSchema, Ln as journeyPreparationProgressSchema, Lr as reconcileReaderKeeps, Mt as journeyBatchReadSchema, Nn as projectPreparationProgress, Nt as journeyReviewStorageQuerySchema, Ot as settleCorrections, Pr as applyCardAnswers, Pt as applyClassificationProposal, Q as validateInspectionContribution, Qt as journeyIsolateSchema, Sr as preparationStartSchema, Tr as validatePreparationFacts, U as validateInspectionBatch, Un as journeyCommitSchema, Ut as journeyContextSchema, Vn as searchScopeDigest, W as validateInspectionBatches, Wn as journeyEventSchema, Wt as hideBeginSchema, X as validateInspectionInputs, Xr as sendReachedPassport, Xt as journeyResourceQuerySchema, Y as validateInspectionHead, Yn as settleConfirmedHides, Yr as sendOwesPassport, Yt as sendOutputSchema, Z as validateInspectionQuery, Zt as journeyResourceSchema, an as sessionReconcileResultSchema, bi as isSkippedWork, bn as bReviewDigest, br as preparationPermissionSchema, c as reconstructBFields, ci as journeySendSchema, cn as sessionRereadResourceSchema, d as resolveGroupSplit, dn as sessionReviewResourceSchema, ei as mergePrivacyTerms, en as sortingApplySchema, et as inspectionInputs, fn as sessionReviewStatusSchema, fr as maskedHitsStale, g as semanticGroupKey, gn as reviewCandidateResourceSchema, gr as workPrivacyDecisions, gt as manualUploadSchema, h as hideScopeDigest, hi as hasCompleteWorkDescription, hr as workDecisionDigest, jn as validateScanExclusion, jt as journeyGuidance, kt as attemptBudgetCodePoints, l as chooseCheapPlacement, lr as confirmedHideTerms, mn as sessionUsefulnessResourceSchema, mr as retireWorkDescription, nn as reviewAttemptsQuerySchema, o as bRereadDigest, on as sessionReconciliationResourceSchema, or as confirmedHideGroupIds, pi as sendSessionUploadSchema, pn as sessionUsefulnessInputSchema, pr as syncTermGroups, pt as manualUploadBindingSchema, q as validateInspectionClaim, qt as journeyPolicyRespondSchema, ri as staticSessionId, rn as reviewAttemptsResultSchema, rr as bMaskedHits, s as reconcileBSession, sr as confirmedHideKey, t as scanBatchContextDigest, tn as reviewAttemptResourceSchema, u as reviseGroupMembership, un as sessionReviewQuerySchema, ur as dictionaryHides, v as projectJourneyInventory, vi as isReadingComplete, vn as reviewRepairResourceSchema, vt as candidateSortAvailable, wn as scanCanonicalResourceSchema, wr as preparationUpdateSchema, x as bReviewScope, xi as selectedWorks, xn as mergeBRepair, xr as preparationSettlementSchema, y as preparationScope, yi as isSelectedWork, yr as preparationBeginSchema, zn as journeySearchResultSchema, zt as isolatedWorkId } from "./src-Do-qzuMn.mjs";
 import { constants } from "node:fs";
 import { z } from "zod";
 import { copyFile, link, lstat, mkdir, mkdtemp, open, readFile, realpath, rm, unlink } from "node:fs/promises";
@@ -346,9 +346,26 @@ function readJourney(db, journeyId) {
 		if (typeof text !== "string") throw new ApplicationError("CORRUPTED_STATE");
 		const state = JSON.parse(text);
 		if (typeof state === "object" && state !== null && "formatVersion" in state && state.formatVersion !== 10) throw new StoreError("OBSOLETE_SCHEMA", "Stored native Journey state uses an obsolete candidate format and has been preserved.");
+		let value = reconcileReaderKeeps(nativeJourneySchema.parse(state));
+		if (value.outputVersion !== void 0 && value.outputVersion > 1) throw new StoreError("OBSOLETE_SCHEMA", "This journey requires a newer final writer.");
+		if (value.outputVersion !== 1 && value.phase !== "completed" && !obsoleteJourney(value)) value = {
+			...value,
+			outputVersion: 1,
+			phase: value.phase === "ready" ? "review" : value.phase,
+			privacy: {
+				...value.privacy,
+				packageApproval: null
+			},
+			works: value.works.map((work) => ({
+				...work,
+				revision: work.revision + 1,
+				status: work.status === "ready" ? "review" : work.status,
+				artifact: null
+			}))
+		};
 		return {
 			text,
-			value: nativeJourneySchema.parse(state)
+			value
 		};
 	});
 }
@@ -362,23 +379,29 @@ function insertCorrectionReport(db, resource) {
 	}
 	db.prepare("INSERT INTO journey_resources VALUES(?,?,?,?)").run(resource.journeyId, resource.kind, resource.id, json);
 }
-/**
-* A snapshot of an earlier release cannot render, so a new Journey may replace it, but never
-* one with a Send record or a sent Work: that Send stays for the person to finish.
-*/
-/** A receipt or persisted session mutation intent means a Send may have reached Passport. */
+/** Whether any Send of this Journey may have reached Passport (`sendReachedPassport`). */
 function reachedPassport(db, journeyId) {
 	return db.prepare("SELECT json FROM journey_sends WHERE journey_id=?").all(journeyId).some((row) => {
 		if (typeof row["json"] !== "string") throw new ApplicationError("CORRUPTED_STATE");
-		return journeySendSchema.parse(JSON.parse(row["json"])).items.some((item) => item.receipt || item.previousReceipts.length || item.sessionUpload !== void 0 || item.sessionMembership || item.sessionAssembly);
+		return sendReachedPassport(journeySendSchema.parse(JSON.parse(row["json"])));
 	});
 }
 /** An abandoned Journey gives way to a new one unless one of its Sends reached Passport. */
 function abandoned(db, current) {
 	return current.abandonedAt !== void 0 && !reachedPassport(db, current.journeyId);
 }
+/**
+* A snapshot of an earlier release cannot render, so a new Journey replaces it unless its current
+* Send still owes Passport something its next advance sends without the person
+* (`sendOwesPassport`, ADR 0284, owner answer A): sent Works stay on Passport, and the new Journey
+* reads every Work again. Replacement cancels its unfinished Sends.
+*/
 function replaceable(db, current) {
-	return obsoleteJourney(current) && !current.works.some((work) => work.binding) && !db.prepare("SELECT 1 FROM journey_sends WHERE journey_id=? LIMIT 1").get(current.journeyId);
+	if (!obsoleteJourney(current)) return false;
+	const row = db.prepare("SELECT json FROM journey_sends JOIN journey_current_send ON journey_sends.id=journey_current_send.send_id WHERE journey_current_send.journey_id=?").get(current.journeyId);
+	if (!row) return true;
+	if (typeof row["json"] !== "string") throw new ApplicationError("CORRUPTED_STATE");
+	return !sendOwesPassport(current, journeySendSchema.parse(JSON.parse(row["json"])));
 }
 /** An addition counts only when one of its findings was assigned to a confirmed Hide category. */
 function joinedHideValues(db, state, delta) {
@@ -439,6 +462,7 @@ function commitJourney(db, input) {
 			...input,
 			state: {
 				...input.state,
+				outputVersion: 1,
 				privacy: {
 					...input.state.privacy,
 					rememberedRules
@@ -453,6 +477,7 @@ function commitJourney(db, input) {
 			state: current
 		};
 	}
+	if (input.expectedRevision === null && current && replaceable(db, current)) db.prepare("DELETE FROM journey_current_send WHERE journey_id=?").run(current.journeyId);
 	if (input.state.journeyId !== input.event.journeyId) throw new ApplicationError("INVALID_ARGUMENTS");
 	if (input.closedReader) {
 		const hold = input.closedReader;
@@ -2578,6 +2603,7 @@ function selectTerms(db, query) {
 			if (!source || source["review_ref_json"] === null) throw new ApplicationError("SCOPE_NOT_READY");
 		}
 		const work = requireActiveBatch(state, batch.header);
+		if (work.access === "drop") throw new ApplicationError("REVISION_CONFLICT");
 		if (work.reviewInterruptions?.some((hold) => hold.inputRevision === work.inputRevision && hold.batchIds.includes(unit.batchId)) || db.prepare("SELECT 1 FROM journey_resources WHERE journey_id=? AND kind='closed-reader' AND id=?").get(state.journeyId, unit.batchId + ":" + input.packId)) throw new ApplicationError("REVISION_CONFLICT");
 		if (batch.header.digest !== unit.batchDigest) throw new ApplicationError("REVISION_CONFLICT");
 		return batch;
@@ -3853,9 +3879,9 @@ function activeScope(db, input, starting) {
 	if (state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
 	const work = state.works.find((item) => item.id === input.workId);
 	if (!work || input.inputRevision !== work.inputRevision || input.snapshotId !== state.snapshotId) throw new ApplicationError("REVISION_CONFLICT");
-	const plan = readInventoryPlan(db, state);
+	const { plan, families } = readInventoryFamilies(db, state);
 	if (!plan.approval.inventory.complete) throw new ApplicationError("CORRUPTED_STATE");
-	return preparationScope(plan.approval.inventory, work);
+	return preparationScope(plan.approval.inventory, work, families);
 }
 function insert(db, record) {
 	db.prepare("INSERT INTO journey_resources VALUES(?,?,?,?)").run(record.journeyId, record.kind, record.id, JSON.stringify(record));
@@ -3926,7 +3952,16 @@ function readJourneyPreparationProgress(db, input) {
 	const state = readFencedJourney(db, input);
 	if (!state.consent || !state.snapshotId) return null;
 	const { starts, settlements } = readPreparationReceipts(db, state.journeyId);
-	return projectPreparationProgress(state, readInventoryPlan(db, state), readCaptures(db, state.journeyId), starts, settlements);
+	const captures = db.prepare(`SELECT id, json_extract(json,'$.capture.partId') AS partId,
+    json_extract(json,'$.capture.facts.byteLength') AS bytes FROM journey_resources
+    WHERE journey_id=? AND kind='capture'`).all(state.journeyId).map(({ id, partId, bytes }) => {
+		if (id !== partId || typeof partId !== "string" || typeof bytes !== "number" || !Number.isSafeInteger(bytes) || bytes < 0) throw new ApplicationError("CORRUPTED_STATE");
+		return {
+			partId,
+			bytes
+		};
+	});
+	return projectPreparationProgress(state, readInventoryFamilies(db, state).families, captures, starts, settlements);
 }
 //#endregion
 //#region packages/local-host/src/store/journey/hide.ts
@@ -4732,14 +4767,6 @@ function finishJourneyPlacement(db, packet) {
 //#endregion
 //#region packages/local-host/src/store/journey/isolation.ts
 const reason = " – couldn't prepare";
-/** Stable blocked Work IDs per parent, so later failing roots join one instead of multiplying. */
-function isolatedWorkId(parentId, ordinal) {
-	const bytes = createHash("sha256").update(`isolated-roots:${parentId}:${ordinal}`).digest().subarray(0, 16);
-	bytes[6] = (bytes[6] ?? 0) & 15 | 64;
-	bytes[8] = (bytes[8] ?? 0) & 63 | 128;
-	const hex = bytes.toString("hex");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
 /**
 * Moves identified failing roots out of a pending multi-root Work into its visible blocked
 * Work, carrying their public-safe codes; the parent returns to pending for the rest.
@@ -4783,8 +4810,15 @@ function isolateJourneyRoots(db, input) {
 		})),
 		blocks: /* @__PURE__ */ new Map([[targetId, [...codes]]])
 	});
+	const classified = !existing && parent.classificationRecommendation && hasCompleteWorkDescription(parent) && !parent.suggestion ? {
+		description: parent.description,
+		classificationRecommendation: parent.classificationRecommendation,
+		reason: parent.classificationRecommendation.reason,
+		projectType: parent.projectType?.origin === "model" ? parent.projectType : null
+	} : {};
 	const works = next.works.map((work) => work.id === targetId ? {
 		...work,
+		...classified,
 		...access
 	} : work);
 	return commitJourney(db, commit(input, {
@@ -4912,9 +4946,197 @@ function finishJourneyDescription(db, packet) {
 }
 //#endregion
 //#region packages/local-host/src/store/journey/send.ts
+/** Run the privacy fence against the store's current immutable row on every request.
+* Only the approved output and this Work's frozen upload identities cross the worker boundary. */
+function readSendOutput(db, input) {
+	const { journeyId, workId, revision } = input;
+	const state = readJourney(db, journeyId);
+	if (!state?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (state.phase === "completed" && state.outputVersion !== 1) throw new ApplicationError("SCOPE_NOT_READY");
+	assertJourneyPrivacyReady(state, true);
+	if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
+	const work = state.works.find((item) => item.id === workId);
+	if (!work?.artifact || work.revision !== revision || work.artifact.revision !== revision) throw new ApplicationError("REVISION_CONFLICT");
+	const [output] = readJourneyResources(db, {
+		journeyId,
+		kind: "output",
+		id: `${workId}:${revision}`
+	});
+	if (output?.kind !== "output" || output.workId !== workId || output.revision !== revision || output.primary.sha256 !== work.artifact.sha256) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+	if (!input.sessions) return {
+		output,
+		identities: []
+	};
+	const [base] = readJourneyResources(db, {
+		journeyId,
+		kind: "base",
+		id: `${workId}:${output.finalMaskLedger.inputRevision}`
+	});
+	if (base?.kind !== "base" || base.workId !== workId || base.inputRevision !== output.finalMaskLedger.inputRevision || base.primary.sha256 !== output.finalMaskLedger.basePrimarySha256) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+	const plan = readInventoryPlan(db, state);
+	const sessions = new Map(plan.approval.inventory.sessions.map((session) => [session.id, session]));
+	const groups = /* @__PURE__ */ new Map();
+	const identities = base.sessions.map((binding) => {
+		const session = sessions.get(binding.applicationSessionId);
+		const part = session?.parts[0];
+		const lastAt = session?.lastInteractionAt ?? session?.createdAt;
+		if (!session || !part || !lastAt || !Number.isFinite(Date.parse(lastAt))) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+		const native = part.nativeEvidence?.identity;
+		if (native?.sessionId?.trim() && native.role !== "unknown" && (native.role !== "worker" || native.agentId?.trim() && session.harness === "claude")) {
+			const key = JSON.stringify([
+				session.harness,
+				native.sessionId,
+				native.role === "worker" ? native.agentId : null
+			]);
+			const group = groups.get(key) ?? [];
+			group.push(binding.archiveSessionId);
+			groups.set(key, group);
+		}
+		const nativeId = part.nativeEvidence?.identity?.sessionId ?? session.sourceSessionId;
+		const path = part.harnessRelativePath ?? "";
+		if (!path && !nativeId?.trim() || isAbsolute(path) || path.includes("\\") || path.split("/").some((segment) => segment === ".." || segment === ".")) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+		return {
+			archiveSessionId: binding.archiveSessionId,
+			relativePath: path,
+			lastAt: new Date(lastAt).toISOString()
+		};
+	});
+	const duplicates = [...groups.values()].filter((group) => group.length > 1);
+	if (!duplicates.length) return {
+		output,
+		identities
+	};
+	const duplicateIds = new Set(duplicates.flat());
+	const owners = new Map(base.sessions.map((s) => [s.archiveSessionId, s.applicationSessionId]));
+	const sources = base.sourceBindings.flatMap((binding) => {
+		if (!duplicateIds.has(binding.sessionId) || binding.bundleId !== base.bundleId || owners.get(binding.sessionId) !== binding.applicationSessionId) return [];
+		const part = sessions.get(binding.applicationSessionId)?.parts.find((p) => p.id === binding.sourcePartId);
+		return part ? [{
+			session: binding.sessionId,
+			source: binding.bundleSourceId,
+			part
+		}] : [];
+	});
+	const outputs = state.works.filter(isSelectedWork).flatMap((w) => w.artifact ? [{
+		workId: w.id,
+		revision: w.revision,
+		sha256: w.artifact.sha256,
+		bundleId: w.artifact.bundleId
+	}] : []);
+	const approval = state.privacy.packageApproval;
+	if (!approval) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	return {
+		output,
+		identities,
+		extension: {
+			groups: duplicates,
+			sources,
+			outputs,
+			approval
+		}
+	};
+}
+const sendCurrentSchema = z.object({
+	journeyId: journeyIdSchema,
+	sendId: journeyIdSchema,
+	revision: z.number().int().nonnegative()
+}).strict();
+function isCurrentSend(db, input) {
+	return !!db.prepare(`SELECT 1 FROM journey_runs r JOIN journey_current_send s ON s.journey_id=r.id
+    JOIN journey_current c ON c.journey_id=r.id AND c.singleton=1
+    WHERE r.id=? AND r.revision=? AND s.send_id=?`).get(input.journeyId, input.revision, input.sendId);
+}
+const transferCountSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const sendTransferSchema = z.object({
+	journeyId: journeyIdSchema,
+	sendId: journeyIdSchema,
+	workId: journeyIdSchema,
+	expectedJourneyRevision: transferCountSchema,
+	expectedSendRevision: transferCountSchema,
+	storedSessions: transferCountSchema.optional(),
+	sessionUpload: sendSessionUploadSchema,
+	requestKey: journeyIdSchema,
+	at: z.iso.datetime()
+}).strict();
+const sendTransferResultSchema = z.discriminatedUnion("status", [z.object({
+	status: z.literal("applied"),
+	revision: transferCountSchema,
+	lastEvent: transferCountSchema,
+	sendRevision: transferCountSchema
+}).strict(), z.object({ status: z.enum(["stale", "replayed"]) }).strict()]);
+/** Update only transfer fields in the Send document and stamp its Journey revision/event. */
+function checkpointJourneySendTransfer(db, input) {
+	const requestHash = createHash("sha256").update(JSON.stringify(input)).digest("hex");
+	const receipt = db.prepare("SELECT request_hash,journey_id FROM journey_receipts WHERE request_key=?").get(input.requestKey);
+	if (receipt) {
+		if (receipt["request_hash"] !== requestHash || receipt["journey_id"] !== input.journeyId) throw new ApplicationError("OPERATION_CONFLICT");
+		return { status: "replayed" };
+	}
+	const row = db.prepare(`SELECT r.revision,r.state_json ->> '$.formatVersion' AS formatVersion,
+        r.state_json ->> '$.phase' AS phase,
+        json_type(r.state_json,'$.consent') AS consentType,
+        r.state_json ->> '$.pendingHideId' AS pendingHideId,
+        json_type(r.state_json,'$.abandonedAt') AS abandonedType,s.json
+      FROM journey_runs r
+      JOIN journey_current c ON c.singleton=1 AND c.journey_id=r.id
+      JOIN journey_current_send cs ON cs.journey_id=r.id AND cs.send_id=?
+      JOIN journey_sends s ON s.journey_id=r.id AND s.id=cs.send_id
+      WHERE r.id=?`).get(input.sendId, input.journeyId);
+	if (!row) return { status: "stale" };
+	const revisionValue = row["revision"];
+	if (typeof revisionValue !== "number" || !Number.isSafeInteger(revisionValue) || revisionValue < 0) throw new ApplicationError("CORRUPTED_STATE");
+	if (revisionValue !== input.expectedJourneyRevision) return { status: "stale" };
+	if (row["formatVersion"] !== 10) throw new StoreError("OBSOLETE_SCHEMA", "Stored native Journey state uses an obsolete candidate format and has been preserved.");
+	if (row["consentType"] !== "object") throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (row["phase"] !== "sending") throw new ApplicationError(row["phase"] === "paused" ? "OPERATION_CANCELED" : "INVALID_TRANSITION");
+	if (row["pendingHideId"] !== null && row["pendingHideId"] !== void 0) throw new ApplicationError("REVISION_CONFLICT");
+	if (row["abandonedType"] !== null && row["abandonedType"] !== void 0) throw new ApplicationError("INVALID_TRANSITION");
+	if (typeof row["json"] !== "string") throw new ApplicationError("CORRUPTED_STATE");
+	const send = journeySendSchema.parse(JSON.parse(row["json"]));
+	if (send.revision !== input.expectedSendRevision) return { status: "stale" };
+	if (!send.subject || !send.confirmedAt) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (send.status === "paused") throw new ApplicationError("OPERATION_CANCELED");
+	if (!["sending", "waiting"].includes(send.status)) throw new ApplicationError("INVALID_TRANSITION");
+	const index = send.items.findIndex((item) => item.workId === input.workId);
+	if (index < 0) throw new ApplicationError("INVALID_SELECTION");
+	const item = send.items[index];
+	if (!item) throw new ApplicationError("CORRUPTED_STATE");
+	if (item.status !== "uploading") throw new ApplicationError("INVALID_TRANSITION");
+	const revision = revisionValue + 1;
+	const sendRevision = send.revision + 1;
+	const next = journeySendSchema.parse({
+		...send,
+		revision: sendRevision,
+		items: send.items.map((candidate, candidateIndex) => candidateIndex === index ? {
+			...candidate,
+			sessionUpload: input.sessionUpload,
+			...input.storedSessions === void 0 ? {} : { storedSessions: input.storedSessions }
+		} : candidate)
+	});
+	if (db.prepare("UPDATE journey_sends SET json=? WHERE journey_id=? AND id=?").run(JSON.stringify(next), input.journeyId, input.sendId).changes !== 1) throw new ApplicationError("REVISION_CONFLICT");
+	const inserted = db.prepare("INSERT INTO journey_events(journey_id,event_json) VALUES(?,?)").run(input.journeyId, JSON.stringify({
+		journeyId: input.journeyId,
+		revision,
+		kind: "send",
+		source: "system",
+		at: input.at
+	}));
+	const lastEvent = Number(inserted.lastInsertRowid);
+	if (!Number.isSafeInteger(lastEvent) || lastEvent < 1) throw new ApplicationError("CORRUPTED_STATE");
+	if (db.prepare(`UPDATE journey_runs SET revision=?,state_json=json_set(
+      state_json,'$.revision',?,'$.lastEvent',?) WHERE id=? AND revision=?`).run(revision, revision, lastEvent, input.journeyId, input.expectedJourneyRevision).changes !== 1) throw new ApplicationError("REVISION_CONFLICT");
+	db.prepare("INSERT INTO journey_receipts VALUES(?,?,?,?)").run(input.requestKey, requestHash, input.journeyId, revision);
+	return {
+		status: "applied",
+		revision,
+		lastEvent,
+		sendRevision
+	};
+}
 const sendLoadSchema = z.object({
 	journeyId: journeyIdSchema,
-	sendId: journeyIdSchema.optional()
+	sendId: journeyIdSchema.optional(),
+	observedRevision: z.number().int().nonnegative().optional()
 }).strict();
 const sendSnapshotSchema = z.object({
 	journey: nativeJourneySchema,
@@ -4935,6 +5157,7 @@ const sendCommitResultSchema = sendSnapshotSchema.extend({ status: z.enum([
 	"stale"
 ]) });
 function loadJourneySend(db, input) {
+	if (input.observedRevision !== void 0 && !input.sendId && db.prepare("SELECT 1 AS same FROM journey_runs WHERE id=? AND revision=?").get(input.journeyId, input.observedRevision)) return null;
 	const journey = readJourney(db, input.journeyId);
 	if (!journey) return null;
 	const row = input.sendId ? db.prepare("SELECT json FROM journey_sends WHERE journey_id=? AND id=?").get(input.journeyId, input.sendId) : db.prepare("SELECT json FROM journey_sends JOIN journey_current_send ON journey_sends.id=journey_current_send.send_id WHERE journey_current_send.journey_id=?").get(input.journeyId);
@@ -4972,6 +5195,7 @@ function commitJourneySend(db, input) {
 		...input.state,
 		revision
 	});
+	if (!prior && obsoleteJourney(current.journey)) throw new ApplicationError("JOURNEY_OBSOLETE");
 	const skipped = (workId) => current.journey.works.some((work) => work.id === workId && isSkippedWork(work));
 	const finished = send.status === "completed" && send.omitted.every((work) => [
 		"drop",
@@ -7058,6 +7282,9 @@ const operations = {
 	"journey.policy.respond": define(true, policyRespondSchema, respondJourneyPolicy, (value) => journeyCommitResultSchema.parse(value)),
 	"journey.policy.batches": define(false, policyBatchesSchema, selectPolicyBatches, (value) => z.array(z.uuid()).parse(value)),
 	"journey.send.load": define(false, sendLoadSchema, loadJourneySend, (value) => sendSnapshotSchema.nullable().parse(value)),
+	"journey.send.current": define(false, sendCurrentSchema, isCurrentSend, (value) => z.boolean().parse(value)),
+	"journey.send.transfer": define(true, sendTransferSchema, checkpointJourneySendTransfer, (value) => sendTransferResultSchema.parse(value)),
+	"journey.send.output": define(false, sendOutputQuerySchema, readSendOutput, (value) => sendOutputSchema.parse(value)),
 	"journey.send.commit": define(true, sendCommitSchema, commitJourneySend, (value) => sendCommitResultSchema.parse(value)),
 	"manual.upload.load": define(false, manualUploadLoadSchema, loadManualUpload, (value) => manualUploadSchema.nullable().parse(value)),
 	"manual.upload.commit": define(true, manualUploadCommitSchema, commitManualUpload, (value) => manualUploadResultSchema.parse(value)),
@@ -7091,6 +7318,16 @@ const operations = {
 		]),
 		state: preparationStateSchema
 	}).strict().parse(value)),
+	"journey.receipt.revision": define(false, z.object({
+		journeyId: z.uuid(),
+		key: z.uuid(),
+		hash: z.string().regex(/^[0-9a-f]{64}$/u)
+	}).strict(), (db, { journeyId, key, hash }) => {
+		const row = db.prepare("SELECT journey_id,request_hash,revision FROM journey_receipts WHERE request_key=?").get(key);
+		if (!row) return null;
+		if (row["journey_id"] !== journeyId || row["request_hash"] !== hash) throw new ApplicationError("OPERATION_CONFLICT");
+		return z.number().int().nonnegative().parse(row["revision"]);
+	}, (value) => z.number().int().nonnegative().nullable().parse(value)),
 	"journey.current": define(false, z.object({ journeyId: z.uuid().optional() }), (db, input) => readJourney(db, input.journeyId), (value) => nativeJourneySchema.nullable().parse(value)),
 	"journey.terms.reopen-empty": define(true, emptyReviewCorrectionSchema, reopenEmptyReview, (value) => emptyReviewCorrectionResultSchema.parse(value)),
 	"journey.terms.select": define(false, termsQuerySchema, selectTerms, (value) => termsSelectionSchema.parse(value)),

package/dist/inspection-worker.mjs

@@ -1,7 +1,7 @@
-import { X as createInspectionProcessor } from "./src-DlVbGB32.mjs";
-import { Nn as createStaticProcessor } from "./locate-Cx52Zqxv.mjs";
-import { l as createNativeAdapters, u as createGitNameSeedProvider } from "./src-wZx_v0Ih.mjs";
-import { G as validateInspectionRequest } from "./src-D1iONla3.mjs";
+import { Q as createInspectionProcessor } from "./src-DeNJ8vOD.mjs";
+import { Nn as createStaticProcessor } from "./locate-D-ZaHpI0.mjs";
+import { l as createNativeAdapters, u as createGitNameSeedProvider } from "./src-CKQlTA2Z.mjs";
+import { G as validateInspectionRequest } from "./src-Do-qzuMn.mjs";
 import "./messages-D3m3bhva.mjs";
 import { z } from "zod";
 import { parentPort, workerData } from "node:worker_threads";

package/dist/{job-BKsifhyv.mjs → job-CBuIMTQ0.mjs}

@@ -1,7 +1,7 @@
-import { A as renderJobDigest, D as prepareCollectionProduction, E as checkReusableBundle, L as privateCollectionDirectory, M as readCollectionIndex, N as parseCollectionWorkspaceSummary, V as writeLogicalJourneyOutput, W as readConfiguredOutputInfo, b as writeLogicalJourneyBase, d as verifyOutputShard, f as writeOutputShard, it as openPrivateFile, ot as windowsOwnerOnly, rt as makePrivateDirectory, st as isWindowsAclFailure, w as readConfiguredSearchFields, z as gitSeedsProvider } from "./src-DlVbGB32.mjs";
-import { F as bUnitFragments, Gt as filterInventoryByPeriod, J as utf16Offset, Jt as journeyProfileAddressActionSchema, L as bClassificationKey, Lt as reviewTermsInputSchema, Qt as passportAddressSchema, S as validateBReview, U as bDigest, V as bAnchorKey, Vt as termTypeInfo, W as codePointLength, Yt as journeyProfileLinksActionSchema, _ as reviewFindingsDigest, a as reviewBatchChunks, an as safeField, cn as reviewFamilies, d as validateReview, i as compileBFindings, in as safeCode, l as reviewSubmitSchema, n as matchesReadReceipts, nn as ApplicationError, t as locateTerms, u as textDigest, yt as journeyDescribeSchema } from "./locate-Cx52Zqxv.mjs";
-import { $n as hideKeyId, Ar as journeyPreviewSchema, Br as nativeRespondSchema, C as rebindReviewOverlay, Ci as selectFrozenConfiguration, Ct as sendActionSchema, D as staticallyHiddenFindings, Dr as journeyClassificationSessionsSchema, Dt as sendStartSchema, E as guardedFindingText, Et as sendRequestSchema, Fn as journeyInventoryQuerySchema, Gt as journeyContextQuerySchema, H as inspectionStartSchema, Jn as readConfirmedHideChange, K as inspectionQuerySchema, Kn as confirmedHideAdditions, Kr as staticSessionResourceSchema, Lt as journeyReviewStorageQuerySchema, Mr as journeyRenderSchema, Or as journeyFindingImpactSchema, Qn as addHideIndexTokens, Qt as journeyResourceQuerySchema, Rr as nativeEventsSchema, S as rebindReviewAlignment, Si as freezeConfiguration, Sn as bReviewDigest, St as replaceSensitiveTermsSchema, T as reviewBatchReuse, Tt as sendPrepareSchema, V as inspectionCancelSchema, Vr as retryReviewActionSchema, Wt as reviewCompileSchema, Xt as journeyPolicyRespondSchema, Yn as renderedHideValue, Zn as termHideAdditions, _n as reviewCandidateInputSchema, _t as manualUploadStartSchema, a as bCrossSegmentReviewSchema, b as isGenericPublicTerm, bn as reviewRepairResourceSchema, bt as maximumTermsFileBytes, c as reconstructBFields, di as packageCommandSchema, dn as sessionReviewInputSchema, f as selectedValueMembers, fi as selectionBatchSchema, fn as sessionReviewQuerySchema, ft as manualUploadActionSchema, gi as stateSchema, hi as producerVersion, hn as sessionUsefulnessInputSchema, ht as manualUploadPrepareSchema, i as validateBCrossSegmentReview, jr as journeyRenderInputSchema, kr as journeyFindingsSchema, ln as sessionRereadInputSchema, mt as manualUploadChoiceSchema, n as scanBatchEquivalenceDigest, nt as settingsQuerySchema, o as bRereadDigest, on as sessionReconcileInputSchema, p as splitSelectorValues, pi as selectionSchema, pr as maskedHitsStale, r as locateTermEvidence, rn as reviewAttemptResourceSchema, rt as readWorkspaceOutcomes, s as reconcileBSession, sr as confirmedHideGroupIds, t as scanBatchContextDigest, tn as journeyPlaceSchema, tr as packHideIndex, tt as settingsBatchSchema, ui as commandSchema, ut as resolveFailureLocation, vn as reviewCandidateResourceSchema, w as rebindReviewSubmit, wn as planBRepair, wt as sendChoiceSchema, x as bReviewScope, xi as defaultScopedSettings, yn as reviewRepairInputSchema, zr as nativeGetSchema } from "./src-D1iONla3.mjs";
-import { $ as validateState, A as resourceSelectionQuerySchema, B as termReuseQuerySchema, C as loadAcceptedReview, D as aggregateUsefulness, E as loadPrivateResource, F as validateUnitCandidate, G as validateBatchBody, H as privateReviewHash, I as reuseQuerySchema, J as ownership, K as requireActiveBatch, L as batchQuery, M as evaluateUnitEvidence, N as sameCandidateRequest, O as sessionUsefulnessRecommendation, P as validateCandidateAttempt, Q as readStoredState, R as isPrivateResourceKind, S as validateSessionBindings, T as loadBatch, U as batchHeader, V as scanAliasRequestKey, W as createJourneyPayloadFiles, X as withDatabase, Y as validateDatabase, Z as readBundleDirectory, _ as loadReconciliation, _t as errorCode, a as decodeError, at as finishReset, b as validatePreparationSelection, c as dropsAnchor, ct as present, d as parseDelivery, dt as recheckPrivatePath, et as checkVersion, f as validateCandidate, ft as stateDirectory, g as loadPreparedBodies, gt as StoreError, h as loadPreparation, ht as withFileCheckTimings, i as createExecutor, it as databaseName, j as inspectionQuerySchema$1, k as sessionQuery, l as replySchema, lt as privatePath, m as loadStatus, mt as withStateSnapshot, n as releaseInheritedHeapFlags, nt as beginReset, o as ProtocolError, ot as hasResetMarker, p as classificationJourneyCommit, pt as syncDirectory, q as initializeAndClaim, r as storeHeapLimits, rt as createDatabaseFile, s as allowedReplies, st as inspectStateFiles, tt as schemaVersion, u as operations, ut as readResetMarker, v as loadRereadBodies, vt as isCoordinationBusy, w as loadAuthenticatedReview, x as validateSessionReconciliation, y as loadSessionBodies, yt as isSqliteCorruption, z as privateResourceHeader } from "./heap-CV8Eca8V.mjs";
+import { E as readConfiguredSearchFields, F as parseCollectionWorkspaceSummary, K as readConfiguredOutputInfo, M as renderJobDigest, O as checkReusableBundle, P as readCollectionIndex, S as writeLogicalJourneyBase, U as writeLogicalJourneyOutput, V as gitSeedsProvider, at as makePrivateDirectory, ct as windowsOwnerOnly, k as prepareCollectionProduction, lt as isWindowsAclFailure, m as writeOutputShard, ot as openPrivateFile, p as verifyOutputShard, z as privateCollectionDirectory } from "./src-DeNJ8vOD.mjs";
+import { F as bUnitFragments, Gt as filterInventoryByPeriod, J as utf16Offset, Jt as journeyProfileAddressActionSchema, L as bClassificationKey, Lt as reviewTermsInputSchema, Qt as passportAddressSchema, S as validateBReview, U as bDigest, V as bAnchorKey, Vt as termTypeInfo, W as codePointLength, Yt as journeyProfileLinksActionSchema, _ as reviewFindingsDigest, a as reviewBatchChunks, an as safeField, cn as reviewFamilies, d as validateReview, i as compileBFindings, in as safeCode, l as reviewSubmitSchema, n as matchesReadReceipts, nn as ApplicationError, t as locateTerms, u as textDigest, yt as journeyDescribeSchema } from "./locate-D-ZaHpI0.mjs";
+import { $t as journeyPlaceSchema, Ai as stateSchema, Ar as journeyRenderInputSchema, Br as nativeRespondSchema, C as rebindReviewOverlay, Ct as sendActionSchema, D as staticallyHiddenFindings, Di as selectionSchema, Dr as journeyFindingImpactSchema, Dt as sendStartSchema, E as guardedFindingText, Ei as selectionBatchSchema, Er as journeyClassificationSessionsSchema, Et as sendRequestSchema, Fi as defaultScopedSettings, Gn as confirmedHideAdditions, H as inspectionStartSchema, Hr as retryReviewActionSchema, Ht as journeyContextQuerySchema, Ii as freezeConfiguration, Jn as renderedHideValue, K as inspectionQuerySchema, Li as selectFrozenConfiguration, Nt as journeyReviewStorageQuerySchema, Or as journeyFindingsSchema, Pn as journeyInventoryQuerySchema, Qn as hideKeyId, Rr as nativeEventsSchema, S as rebindReviewAlignment, Sn as planBRepair, St as replaceSensitiveTermsSchema, T as reviewBatchReuse, Ti as packageCommandSchema, Tt as sendPrepareSchema, V as inspectionCancelSchema, Vt as reviewCompileSchema, Xn as termHideAdditions, Xt as journeyResourceQuerySchema, Zn as addHideIndexTokens, _n as reviewRepairInputSchema, _t as manualUploadStartSchema, a as bCrossSegmentReviewSchema, b as isGenericPublicTerm, bn as bReviewDigest, bt as maximumTermsFileBytes, c as reconstructBFields, er as packHideIndex, f as selectedValueMembers, fr as maskedHitsStale, ft as manualUploadActionSchema, gn as reviewCandidateResourceSchema, hn as reviewCandidateInputSchema, ht as manualUploadPrepareSchema, i as validateBCrossSegmentReview, ii as staticSessionResourceSchema, in as sessionReconcileInputSchema, jr as journeyRenderSchema, ki as producerVersion, kr as journeyPreviewSchema, ln as sessionReviewInputSchema, mt as manualUploadChoiceSchema, n as scanBatchEquivalenceDigest, nt as settingsQuerySchema, o as bRereadDigest, or as confirmedHideGroupIds, p as splitSelectorValues, pn as sessionUsefulnessInputSchema, qn as readConfirmedHideChange, qt as journeyPolicyRespondSchema, r as locateTermEvidence, rt as readWorkspaceOutcomes, s as reconcileBSession, sn as sessionRereadInputSchema, t as scanBatchContextDigest, tn as reviewAttemptResourceSchema, tt as settingsBatchSchema, un as sessionReviewQuerySchema, ut as resolveFailureLocation, vn as reviewRepairResourceSchema, w as rebindReviewSubmit, wi as commandSchema, wt as sendChoiceSchema, x as bReviewScope, zr as nativeGetSchema } from "./src-Do-qzuMn.mjs";
+import { $ as validateState, A as resourceSelectionQuerySchema, B as termReuseQuerySchema, C as loadAcceptedReview, D as aggregateUsefulness, E as loadPrivateResource, F as validateUnitCandidate, G as validateBatchBody, H as privateReviewHash, I as reuseQuerySchema, J as ownership, K as requireActiveBatch, L as batchQuery, M as evaluateUnitEvidence, N as sameCandidateRequest, O as sessionUsefulnessRecommendation, P as validateCandidateAttempt, Q as readStoredState, R as isPrivateResourceKind, S as validateSessionBindings, T as loadBatch, U as batchHeader, V as scanAliasRequestKey, W as createJourneyPayloadFiles, X as withDatabase, Y as validateDatabase, Z as readBundleDirectory, _ as loadReconciliation, _t as errorCode, a as decodeError, at as finishReset, b as validatePreparationSelection, c as dropsAnchor, ct as present, d as parseDelivery, dt as recheckPrivatePath, et as checkVersion, f as validateCandidate, ft as stateDirectory, g as loadPreparedBodies, gt as StoreError, h as loadPreparation, ht as withFileCheckTimings, i as createExecutor, it as databaseName, j as inspectionQuerySchema$1, k as sessionQuery, l as replySchema, lt as privatePath, m as loadStatus, mt as withStateSnapshot, n as releaseInheritedHeapFlags, nt as beginReset, o as ProtocolError, ot as hasResetMarker, p as classificationJourneyCommit, pt as syncDirectory, q as initializeAndClaim, r as storeHeapLimits, rt as createDatabaseFile, s as allowedReplies, st as inspectStateFiles, tt as schemaVersion, u as operations, ut as readResetMarker, v as loadRereadBodies, vt as isCoordinationBusy, w as loadAuthenticatedReview, x as validateSessionReconciliation, y as loadSessionBodies, yt as isSqliteCorruption, z as privateResourceHeader } from "./heap-Blrat--4.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
 import { copyFile, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
@@ -20,8 +20,8 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { ZipWriter } from "@zip.js/zip.js/index-native.js";
 import { tmpdir } from "node:os";
 import { pipeline } from "node:stream/promises";
-import { DatabaseSync } from "node:sqlite";
 import { Worker } from "node:worker_threads";
+import { DatabaseSync } from "node:sqlite";
 import { quote } from "shell-quote";
 //#region packages/file-privacy/src/sharing.ts
 const sharingCodes = /* @__PURE__ */ new Set([
@@ -595,6 +595,9 @@ const operation = z.enum([
 	"journey.current",
 	"journey.resources",
 	"journey.send.load",
+	"journey.send.current",
+	"journey.send.transfer",
+	"journey.send.output",
 	"journey.send.commit",
 	"manual.upload.load",
 	"manual.upload.commit",
@@ -650,6 +653,7 @@ const operation = z.enum([
 	"journey.commit",
 	"journey.commit.checked",
 	"journey.classification.commit",
+	"journey.receipt.revision",
 	"journey.events",
 	"journey.inventory",
 	"journey.preparation.progress",
@@ -932,7 +936,7 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 		}),
 		send: t.router({
 			request: t.procedure.input(sendRequestSchema).mutation(({ input }) => sending().request(input, "panel")),
-			get: t.procedure.input(sendAddress.partial({ sendId: true })).query(({ input, signal }) => readThroughContention(() => sending().get(input), signal)),
+			get: t.procedure.input(sendAddress.partial({ sendId: true }).extend({ observedRevision: z.number().int().nonnegative().optional() })).query(({ input, signal }) => readThroughContention(() => sending().get(input), signal)),
 			prepare: t.procedure.input(sendPrepareSchema).mutation(({ input, signal }) => sending().prepare(input, signal)),
 			start: t.procedure.input(sendStartSchema).mutation(({ input, signal }) => sending().start(input, signal)),
 			respond: t.procedure.input(sendChoiceSchema).mutation(({ input }) => sending().respond(input)),
@@ -940,6 +944,8 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 			resume: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().resume(input)),
 			withdraw: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().withdraw(input)),
 			advance: t.procedure.input(sendAddress).mutation(({ input }) => sending().advance(input, stopping)),
+			uploadAssessments: t.procedure.input(sendAddress).query(({ input }) => sending().uploadAssessments(input)),
+			ownedPassport: t.procedure.input(sendAddress).query(({ input, signal }) => sending().ownedPassport(input, signal ?? stopping)),
 			ownerProfile: t.procedure.query(({ signal }) => sending().ownerProfile(signal ?? stopping)),
 			addressTaken: t.procedure.input(z.object({ address: passportAddressSchema }).strict()).query(({ input, signal }) => sending().addressTaken(input, signal ?? stopping)),
 			saveSentProfile: t.procedure.input(z.object({ journeyId: z.uuid() }).strict()).mutation(({ input }) => sending().saveSentProfile(input, stopping))
@@ -5064,11 +5070,13 @@ async function openStore(options, backupObsolete) {
 			sessionReviewStatus: (input) => stagedJourney.sessionReviewStatus(input),
 			reviewAttempts: (input) => access.run("journey.review.attempts", input),
 			acknowledgeSessionUsefulness: (input) => stagedJourney.acknowledgeSessionUsefulness(input),
+			readSendOutput: (input) => access.run("journey.send.output", input),
 			preparationState: (journeyId) => access.run("journey.preparation.state", { journeyId }),
 			preparationPermission: (journeyId) => access.run("journey.preparation.permission", { journeyId }),
 			updatePreparation: (input) => access.run("journey.preparation.update", input),
 			current: (journeyId) => access.run("journey.current", journeyId ? { journeyId } : {}),
 			commit: (input) => stagedJourney.commit(input),
+			receiptRevision: (input) => access.run("journey.receipt.revision", input),
 			commitClassification: (input) => stagedJourney.commitClassification(input),
 			hideIndexKey: (journeyId) => stagedJourney.hideIndexKey(journeyId),
 			reopenEmpty: (input) => access.run("journey.terms.reopen-empty", input),
@@ -5081,11 +5089,18 @@ async function openStore(options, backupObsolete) {
 			})
 		},
 		journeySend: {
-			loadSend: (journeyId, sendId) => access.run("journey.send.load", {
+			isCurrentSend: (journeyId, sendId, revision) => access.run("journey.send.current", {
+				journeyId,
+				sendId,
+				revision
+			}),
+			loadSend: (journeyId, sendId, observedRevision) => access.run("journey.send.load", {
 				journeyId,
-				...sendId ? { sendId } : {}
+				...sendId ? { sendId } : {},
+				...observedRevision !== void 0 ? { observedRevision } : {}
 			}),
-			commitSend: (input) => access.run("journey.send.commit", input)
+			commitSend: (input) => access.run("journey.send.commit", input),
+			checkpointTransfer: (input) => access.run("journey.send.transfer", input)
 		},
 		manualUpload: {
 			load: (uploadId) => access.run("manual.upload.load", uploadId ? { uploadId } : {}),

package/dist/{locate-Cx52Zqxv.mjs → locate-D-ZaHpI0.mjs}

@@ -8538,8 +8538,10 @@ const safeCodes = /* @__PURE__ */ new Set([
 	"SESSION_UPLOAD_EXHAUSTED",
 	"SESSION_TRANSPORT_UNAVAILABLE",
 	"SEND_SCOPE_BUSY",
+	"HOST_REPLACEMENT_PENDING",
 	"SEND_REPLACE_REFUSED",
 	"SESSION_CONTENT_CONFLICT",
+	"WORK_SESSION_CAPACITY_EXCEEDED",
 	"SESSION_MOVE_ACCESS_REQUIRED",
 	"SESSION_MOVE_ACCESS_HELD",
 	"SEND_SCOPE_INVALIDATED",
@@ -8622,6 +8624,8 @@ const safeCodes = /* @__PURE__ */ new Set([
 	"OPERATION_BUSY",
 	"OPERATION_CONFLICT",
 	"OPERATION_FAILED",
+	"WORK_METADATA_INCOMPLETE",
+	"PACKAGING_FAILED",
 	"PACKAGING_BUSY",
 	"PROCESSING_PLAN_UNAVAILABLE",
 	"PROCESSING_PLAN_MISMATCH",
@@ -9644,6 +9648,7 @@ const journeyExceptionSchema = z.object({
 }).strict();
 const nativeJourneySchema = z.object({
 	formatVersion: z.literal(10),
+	outputVersion: z.number().int().positive().optional(),
 	classificationRevision: count$1.nullable(),
 	privacy: journeyPrivacySchema,
 	delegation: journeyDelegationSchema.nullable(),

package/dist/{model-C1UXkHh9.mjs → model-DR9odhWP.mjs}

@@ -1,4 +1,4 @@
-import "./src-D1iONla3.mjs";
+import "./src-Do-qzuMn.mjs";
 //#region packages/harnesses/src/discovery/model.ts
 const discoveryBounds = {
 	entries: 1e5,

package/dist/operation-executor.mjs

@@ -1,6 +1,6 @@
-import { _ as longCommands, c as executorRequestSchema, h as parseOptions, i as invoke, n as readOperation, o as createRuntime, r as waitOperation, y as startupFailure } from "./query-AMZerUh8.mjs";
-import { an as safeField, in as safeCode, nn as ApplicationError } from "./locate-Cx52Zqxv.mjs";
-import "./src-D1iONla3.mjs";
+import { c as executorRequestSchema, g as longCommands, i as invoke, m as parseOptions, n as readOperation, o as createRuntime, r as waitOperation, v as startupFailure } from "./query-BYDcNKy2.mjs";
+import { an as safeField, in as safeCode, nn as ApplicationError } from "./locate-D-ZaHpI0.mjs";
+import "./src-Do-qzuMn.mjs";
 import { z } from "zod";
 import { setTimeout } from "node:timers/promises";
 //#region apps/cli/src/operation/executor.ts

package/dist/preview-worker.mjs

@@ -1,4 +1,4 @@
-import { n as assertPreviewHeap, o as previewInputSchema, t as runPreview } from "./run-CaPktPhH.mjs";
+import { n as assertPreviewHeap, o as previewInputSchema, t as runPreview } from "./run-DQ9xyKSt.mjs";
 import { parentPort, workerData } from "node:worker_threads";
 //#region packages/harnesses/src/preview/worker/index.ts
 function notify(message) {