@gitroll/tacitt-cli 0.6.11 → 0.6.12

package/dist/{src-DlVbGB32.mjs → src-DeNJ8vOD.mjs}

@@ -1,6 +1,6 @@
-import { $n as buildPlan, An as createDetectionSummary, Bn as cleanupImplementationVersion, C as createBAnalysisUnits, Cn as reviewRoles, Dn as bindInspection, En as createSessionPreparation, Gn as nativeField, Hn as nativeParserVersion, In as createReplacementKey, Jn as transformRecords, Kn as nativeItems, Ln as sessionNonce, Mn as walkNativeFields, N as bDuplicateShift, Rn as projectNativeRecord, Sn as mainReviewRole, Tn as renderNative, U as bDigest, Un as redactionImplementationVersion, Vn as entityDictionaryVersion, W as codePointLength, Xn as retainedMainTextNodes, Yn as frameRecords, Zn as validateProfile, ar as detectStatic, bn as processNativeRecord, br as processingSite, c as reviewDigest, cn as reviewFamilies, cr as jsonSpans, er as validatePlan, fn as sourceSnapshotId, gr as ProcessingError, hr as defaultDetectionLimits, in as safeCode, ir as resolveLimits, j as bBindingCap, lr as agentContextLocation, nn as ApplicationError, nr as defaultLimits, qn as nativeText, rr as recordPointerLimits, sn as familySelected, u as textDigest, un as sourceKey, ur as createEntityMatcher, vn as nativeSourceIdentitySchema, vr as fail$1, wn as createSentenceContext, xn as projectNativeReviewInput, xr as siteFields, yn as withMandatoryCustomTerms, yr as isProcessingCode, zn as parseNativeRecord } from "./locate-Cx52Zqxv.mjs";
-import { t as createZstdFrameCheck } from "./frame-Bq2zRh-i.mjs";
-import { Jr as agentSourceSchema, L as sourceIdentityEvidence, Pn as resolveSourceSelection, R as withSourceEvidence, _i as sourceChangePolicy, jt as metadataProcessingVersion, nr as bContainment, or as bWordBounded, ot as classifyAgentSetup, qr as agentSourcePathSegment, rr as bExceptionRanges, st as defaultAgentSetupInclusion, wi as staticCatalogRef, yi as approvedTreatmentSchema, z as agentSetupKey } from "./src-D1iONla3.mjs";
+import { $n as buildPlan, An as createDetectionSummary, Bn as cleanupImplementationVersion, C as createBAnalysisUnits, Cn as reviewRoles, Dn as bindInspection, En as createSessionPreparation, Gn as nativeField, Hn as nativeParserVersion, In as createReplacementKey, Jn as transformRecords, Kn as nativeItems, Ln as sessionNonce, Mn as walkNativeFields, N as bDuplicateShift, Rn as projectNativeRecord, Sn as mainReviewRole, Tn as renderNative, U as bDigest, Un as redactionImplementationVersion, Vn as entityDictionaryVersion, W as codePointLength, Xn as retainedMainTextNodes, Yn as frameRecords, Zn as validateProfile, ar as detectStatic, bn as processNativeRecord, br as processingSite, c as reviewDigest, cn as reviewFamilies, cr as jsonSpans, er as validatePlan, fn as sourceSnapshotId, gr as ProcessingError, hr as defaultDetectionLimits, in as safeCode, ir as resolveLimits, j as bBindingCap, lr as agentContextLocation, nn as ApplicationError, nr as defaultLimits, qn as nativeText, rr as recordPointerLimits, sn as familySelected, u as textDigest, un as sourceKey, ur as createEntityMatcher, vn as nativeSourceIdentitySchema, vr as fail$1, wn as createSentenceContext, xn as projectNativeReviewInput, xr as siteFields, yn as withMandatoryCustomTerms, yr as isProcessingCode, zn as parseNativeRecord } from "./locate-D-ZaHpI0.mjs";
+import { t as createZstdFrameCheck } from "./frame-B3He21G8.mjs";
+import { L as sourceIdentityEvidence, Mn as resolveSourceSelection, Ni as approvedTreatmentSchema, Qr as metadataProcessingVersion, R as withSourceEvidence, Ri as staticCatalogRef, ai as agentSourcePathSegment, ar as bWordBounded, ji as sourceChangePolicy, nr as bExceptionRanges, oi as agentSourceSchema, ot as classifyAgentSetup, st as defaultAgentSetupInclusion, tr as bContainment, z as agentSetupKey } from "./src-Do-qzuMn.mjs";
 import { constants } from "node:fs";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rm, rmdir, stat, unlink } from "node:fs/promises";
 import { execFile, fork, spawn } from "node:child_process";
@@ -11,7 +11,7 @@ import { Readable } from "node:stream";
 import { TextDecoder as TextDecoder$1, isDeepStrictEqual, promisify } from "node:util";
 import { createHash, createHmac, randomUUID } from "node:crypto";
 import { setImmediate } from "node:timers/promises";
-import { ERR_UNSUPPORTED_FORMAT, Reader, TextReader, ZipReader, ZipWriter, configure } from "@zip.js/zip.js/index-native.js";
+import { ERR_UNSUPPORTED_FORMAT, Reader, TextReader, Uint8ArrayReader, ZipReader, ZipWriter, configure } from "@zip.js/zip.js/index-native.js";
 import "node:perf_hooks";
 import { availableParallelism, platform, tmpdir, totalmem } from "node:os";
 import { pipeline } from "node:stream/promises";
@@ -1874,11 +1874,11 @@ function description(value) {
 		sha256
 	};
 }
-function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summary) {
-	const manifest = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+function checkWorkspaceManifest(source, entries, bundleId, expectedPathHash, summary) {
+	const manifest = record$1(typeof source === "string" ? strictJson(source, manifestLimitBytes, manifestNodeLimit) : source);
 	const treatment = manifest["contentTreatment"];
 	const configured = treatment === "configured";
-	const configuredManifest = configured ? parseConfiguredManifest(text) : null;
+	const configuredManifest = typeof source !== "string" ? source : configured ? parseConfiguredManifest(source) : null;
 	if (configuredManifest) validateConfiguredManifest(configuredManifest);
 	const sourceWorkspaces = configuredManifest?.sourceWorkspaces ?? [record$1(manifest["workspace"])];
 	const workspaceIds = new Set(sourceWorkspaces.map((workspace) => string(workspace["id"])));
@@ -2443,7 +2443,7 @@ function parseAuditRow(value, sourceId, sourceSha256, ordinal) {
 		diagnostics
 	};
 }
-const location$1 = (pointer, subject) => `${subject}:${pointer}`;
+const location$2 = (pointer, subject) => `${subject}:${pointer}`;
 const child = (pointer, key) => `${pointer}/${String(key).replaceAll("~", "~0").replaceAll("/", "~1")}`;
 function outputLocations(text, signal) {
 	let root;
@@ -2462,7 +2462,7 @@ function outputLocations(text, signal) {
 	let bytes = 0;
 	function visit(node, pointer, subject) {
 		checkAbort(signal);
-		const key = location$1(pointer, subject);
+		const key = location$2(pointer, subject);
 		bytes += Buffer.byteLength(key);
 		if (bytes > maximumBytes) fail("ARTIFACT_INVALID_ARCHIVE");
 		locations.set(key, node);
@@ -2491,7 +2491,7 @@ function verifyCompanion(row, outputText, signal) {
 		if (!field.fieldId.startsWith(`${row.recordId}-f`) || match === null || Number(match[1]) >= maximumEntries || match[2] !== void 0 && Number(match[2]) >= maximumEntries || fields.has(field.fieldId)) fail("ARTIFACT_INVALID_ARCHIVE");
 		if (match?.[2] === void 0 && match?.[3] === void 0) originals.add(Number(match?.[1]));
 		if (field.pointer !== null) {
-			const key = location$1(field.pointer, field.subject);
+			const key = location$2(field.pointer, field.subject);
 			if (!locations.has(key) || referenced.has(key)) fail("ARTIFACT_INVALID_ARCHIVE");
 			referenced.add(key);
 		}
@@ -2505,7 +2505,7 @@ function verifyCompanion(row, outputText, signal) {
 		if (marker === null) continue;
 		const baseId = field.fieldId.replace(/-s\d+$|-k$/u, "");
 		const base = fields.get(baseId);
-		if (!sampled.has(baseId) || base === void 0 || field.subject !== "value" || (base.pointer === null ? field.pointer !== null : field.pointer !== (marker[2] === "k" ? child(base.pointer, "skeleton") : child(child(base.pointer, "segments"), marker[1] ?? "")) || locations.get(location$1(field.pointer, field.subject))?.kind !== "string")) fail("ARTIFACT_INVALID_ARCHIVE");
+		if (!sampled.has(baseId) || base === void 0 || field.subject !== "value" || (base.pointer === null ? field.pointer !== null : field.pointer !== (marker[2] === "k" ? child(base.pointer, "skeleton") : child(child(base.pointer, "segments"), marker[1] ?? "")) || locations.get(location$2(field.pointer, field.subject))?.kind !== "string")) fail("ARTIFACT_INVALID_ARCHIVE");
 	}
 	const synthetic = sampleLocations(row.bodies, fields, locations);
 	for (const key of locations.keys()) if (!referenced.has(key) && !synthetic.has(key)) fail("ARTIFACT_INVALID_ARCHIVE");
@@ -2643,37 +2643,31 @@ async function verifyConfiguredPart(part, entries, descriptions, signal) {
 //#endregion
 //#region packages/artifact/src/read/configured/workspace.ts
 /** Public primary facts are parsed independently; no source file is opened. */
-function workspaceSummary(text) {
-	const manifest = record$1(parseConfiguredManifest(text));
-	if (manifest["contentTreatment"] !== "configured" || manifest["formatVersion"] !== 5 || manifest["companionVersion"] !== 3) return fail("ARTIFACT_INVALID_MANIFEST");
+function workspaceSummary(input) {
+	const manifest = typeof input === "string" ? parseConfiguredManifest(input) : input;
 	return {
 		format: "sess-pilot-workspace-summary",
 		formatVersion: 1,
-		bundleId: string(manifest["bundleId"]),
-		counts: parseCounts(manifest["counts"]),
-		sessions: array(manifest["sessions"], (value) => {
-			const session = record$1(value);
-			const harness = session["harness"];
-			if (harness !== "claude" && harness !== "codex") return fail("ARTIFACT_INVALID_MANIFEST");
-			return {
-				sessionId: string(session["id"]),
-				scopeOrdinal: 0,
-				harness,
-				nativeSessionId: nullableString(session["sourceSessionId"]),
-				treatmentId: string(session["treatmentId"]),
-				sources: array(session["parts"], parseConfiguredPart).map((part, sourceOrdinal) => ({
-					sourceId: part.sourceId,
-					sourceOrdinal,
-					native: part.native
-				}))
-			};
-		})
+		bundleId: manifest.bundleId,
+		counts: manifest.counts,
+		sessions: manifest.sessions.map((session) => ({
+			sessionId: session.id,
+			scopeOrdinal: 0,
+			harness: session.harness,
+			nativeSessionId: session.sourceSessionId,
+			treatmentId: session.treatmentId,
+			sources: session.parts.map((part, sourceOrdinal) => ({
+				sourceId: part.sourceId,
+				sourceOrdinal,
+				native: part.native
+			}))
+		}))
 	};
 }
 /** Validate exact primary coverage and metadata before either native-data consumer runs. */
 async function readPrimaryMetadata(primaryEntries, primaryText, signal, only) {
-	const summary = workspaceSummary(primaryText);
 	const manifest = parseConfiguredManifest(primaryText);
+	const summary = workspaceSummary(manifest);
 	checkWorkspaceManifest(primaryText, primaryEntries, summary.bundleId, manifest.sourceWorkspaces.length === 1 ? manifest.sourceWorkspaces[0]?.pathHash ?? null : null, summary);
 	for (const description of manifest.entries) {
 		checkAbort(signal);
@@ -5588,17 +5582,20 @@ function matchFrozenOutput(input, checked) {
 	if (input.sha256 !== checked.sha256 || input.archiveBytes !== checked.archiveBytes) fail("ARTIFACT_PROCESSING_MISMATCH");
 }
 async function checkFrozenOutput(input, signal) {
-	let manifestText = "";
+	let verified;
 	const checked = await checkWrittenArchive(input.path, input.identity, void 0, (text, entries) => {
 		const manifest = parseConfiguredManifest(text);
-		checkWorkspaceManifest(text, entries, manifest.bundleId, manifest.sourceWorkspaces.length === 1 ? manifest.sourceWorkspaces[0]?.pathHash ?? null : null, workspaceSummary(text));
-		manifestText = text;
+		checkWorkspaceManifest(manifest, entries, manifest.bundleId, manifest.sourceWorkspaces.length === 1 ? manifest.sourceWorkspaces[0]?.pathHash ?? null : null, workspaceSummary(manifest));
+		verified = {
+			manifestText: text,
+			manifest
+		};
 	}, signal);
 	matchFrozenOutput(input, checked);
+	if (!verified) return fail("ARTIFACT_INVALID_MANIFEST");
 	return {
 		checked,
-		manifestText,
-		manifest: parseConfiguredManifest(manifestText)
+		...verified
 	};
 }
 /** Hold the exact verified descriptor; every entry is separately hashed before use. */
@@ -7294,6 +7291,24 @@ function stringOffsets(root, changes) {
 	return offsets;
 }
 const encodedLength = (text) => JSON.stringify(text).length - 2;
+/** Absolute JSON string-content coordinates. Fixed-size checkpoints bound both the work
+* per lookup and retained memory, including out-of-order overlapping contributor ranges. */
+function encodedOffset(text, base) {
+	const stride = 1024;
+	const offsets = [base];
+	const boundary = (block) => {
+		const at = block * stride;
+		return scalarBoundary(text, at) ? at : at - 1;
+	};
+	return (position) => {
+		const block = Math.floor(position / stride);
+		while (offsets.length <= block) {
+			const next = offsets.length;
+			offsets.push((offsets[next - 1] ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(text.slice(boundary(next - 1), boundary(next))));
+		}
+		return (offsets[block] ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(text.slice(boundary(block), position));
+	};
+}
 /** Restore verified untouched scalar lexemes without round-tripping through JS numbers. */
 function restoreLiterals(root, literals) {
 	const raw = literals.get(root.id);
@@ -7367,37 +7382,42 @@ function renderReviewRow(row, before, edits, markers, signal) {
 		const changed = inner ? renderNative(inner, innerChanges, reviewLimits, signal).text : pieces[0]?.changed ?? fail("ARTIFACT_PROCESSING_MISMATCH");
 		const sourceOffsets = inner ? stringOffsets(inner, /* @__PURE__ */ new Map()) : void 0, outputOffsets = inner ? stringOffsets(inner, innerChanges) : void 0;
 		const inputSha256 = hash$4(sourceText), outputSha256 = hash$4(changed), context = createSentenceContext(sourceText);
-		for (const piece of pieces) for (const item of piece.items) {
-			const coordinates = (range) => sourceOffsets ? {
-				start: (sourceOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(piece.source.slice(0, range.start)),
-				end: (sourceOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(piece.source.slice(0, range.end))
+		for (const piece of pieces) {
+			if (!piece.items.length) continue;
+			const inputOffset = sourceOffsets && encodedOffset(piece.source, sourceOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH"));
+			const outputOffset = outputOffsets && encodedOffset(piece.changed, outputOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH"));
+			const coordinates = (range) => inputOffset ? {
+				start: inputOffset(range.start),
+				end: inputOffset(range.end)
 			} : range;
-			const inputRange = coordinates(item.inputRange);
-			const start = outputOffsets ? (outputOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(piece.changed.slice(0, item.outputRange.start)) : item.outputRange.start;
-			const { span, ...applied } = item;
-			const transcript = {
-				...applied,
-				pointer,
-				inputSha256,
-				outputSha256,
-				inputRange,
-				outputRange: {
-					start,
-					end: start + item.replacement.length
-				},
-				context: context(inputRange)
-			};
-			transcripts.push({
-				...transcript,
-				contributors: reconstructedContributors({
-					row,
-					field: piece.field,
-					span,
-					transcript,
-					coordinates,
-					context
-				})
-			});
+			for (const item of piece.items) {
+				const inputRange = coordinates(item.inputRange);
+				const start = outputOffset ? outputOffset(item.outputRange.start) : item.outputRange.start;
+				const { span, ...applied } = item;
+				const transcript = {
+					...applied,
+					pointer,
+					inputSha256,
+					outputSha256,
+					inputRange,
+					outputRange: {
+						start,
+						end: start + item.replacement.length
+					},
+					context: context(inputRange)
+				};
+				transcripts.push({
+					...transcript,
+					contributors: reconstructedContributors({
+						row,
+						field: piece.field,
+						span,
+						transcript,
+						coordinates,
+						context
+					})
+				});
+			}
 		}
 		if (nativeContainer && changed === sourceText) {
 			if (nativeContainerText(target, signal) !== sourceText) fail("ARTIFACT_PROCESSING_MISMATCH");
@@ -7513,10 +7533,12 @@ function indexFamilyHides(manifest, hides = []) {
 		if (!family) {
 			const categories = /* @__PURE__ */ new Map();
 			const bounded = /* @__PURE__ */ new Set();
-			for (const { term, category, bounded: whole } of hide.terms) {
+			const toolResultEscapes = /* @__PURE__ */ new Set();
+			for (const { term, category, bounded: whole, toolResultEscapes: escaped } of hide.terms) {
 				if (categories.has(term)) mismatch("duplicate-term");
 				categories.set(term, maskCategory(category));
 				if (whole) bounded.add(term);
+				if (escaped) toolResultEscapes.add(term);
 			}
 			family = {
 				matcher: createEntityMatcher([...categories.keys()].map((value) => ({
@@ -7525,6 +7547,7 @@ function indexFamilyHides(manifest, hides = []) {
 				}))),
 				categories,
 				bounded,
+				toolResultEscapes,
 				excepted: bExceptionRanges(hide.exceptions ?? [])
 			};
 			shared.set(key, family);
@@ -7535,7 +7558,7 @@ function indexFamilyHides(manifest, hides = []) {
 	return parts;
 }
 /** Disjoint literal hits outside existing markers; overlaps join under the highest category. */
-function familySpans(text, family, signal) {
+function familySpans(text, family, signal, toolResult) {
 	const markers = [...text.matchAll(markerPattern)].map((match) => ({
 		start: match.index,
 		end: match.index + match[0].length
@@ -7551,7 +7574,7 @@ function familySpans(text, family, signal) {
 		}
 		return (markers[low]?.start ?? Infinity) < range.end;
 	};
-	const hits = family.matcher.find(text, signal, 2e6).filter(({ range, entity }) => !marked(range) && (!family.bounded.has(entity.value) || bWordBounded(text, range.start, range.end)) && !excepted(range)).map(({ range, entity }) => ({
+	const hits = family.matcher.find(text, signal, 2e6).filter(({ range, entity }) => !marked(range) && (!family.bounded.has(entity.value) || bWordBounded(text, range.start, range.end, toolResult && family.toolResultEscapes.has(entity.value))) && !excepted(range)).map(({ range, entity }) => ({
 		...range,
 		category: family.categories.get(entity.value) ?? mismatch("unknown-term")
 	})).sort((left, right) => left.start - right.start || right.end - left.end);
@@ -7625,8 +7648,10 @@ function maskFamilyFields(text, root, annotations, family, markers, signal, onAp
 		if (skip(field)) continue;
 		if (field.text.includes(markers.prefix)) mismatch("marker-prefix");
 		if (field.subject !== "value" || field.scalarKind !== "string" || field.field.protection || !bodies.has(field.nodeId) && structural(field.field.name)) continue;
-		const raw = familySpans(field.text, family, signal);
-		const carrier = raw.length || field.text.includes("\\") ? familyCarrierSpans(field, (value) => familySpans(value, family, signal), signal) : void 0;
+		const toolResult = field.origin.carrier === "tool-result";
+		const find = (value) => familySpans(value, family, signal, toolResult);
+		const raw = find(field.text);
+		const carrier = raw.length || field.text.includes("\\") ? familyCarrierSpans(field, find, signal) : void 0;
 		const spans = (carrier ?? raw).sort((left, right) => left.start - right.start);
 		if (!spans.length) continue;
 		const changed = maskOutputField({
@@ -9844,7 +9869,16 @@ function createSessionWorkerPool(url, size, heapMb = workerHeapMb) {
 		stopping = Promise.all(slots.map(async (slot) => {
 			try {
 				await slot.process.close();
-				if (slot.task) await removeStoppedSpools(slot.task.spoolPaths);
+				if (slot.task) {
+					if (requestKind(slot.task) === "journey-base") {
+						await removeNamedTemporarySpools(slot.task.spoolPaths);
+						for (const path of slot.task.spoolPaths) try {
+							await unlink(path);
+						} catch (error) {
+							if (filesystemCode(error) !== "ENOENT") throw error;
+						}
+					} else await removeStoppedSpools(slot.task.spoolPaths);
+				}
 			} finally {
 				slot.task?.reject(blame(slot));
 				slot.task = void 0;
@@ -9885,6 +9919,10 @@ function createSessionWorkerPool(url, size, heapMb = workerHeapMb) {
 				}
 				task.spoolPaths.add(message.path);
 				task.onSpool?.(message.path);
+				if (!closed) slot.process.send({
+					kind: "spool-owned",
+					path: message.path
+				});
 			} else if (message.kind === "result") {
 				const requestedKind = requestKind(task);
 				if ((requestedKind === "render" || requestedKind === "capture" || requestedKind === "scan" || requestedKind === "journey-output" || requestedKind === "journey-output-shard" || requestedKind === "journey-output-verify" || requestedKind === "journey-base") && message.result.kind !== requestedKind) {
@@ -15473,7 +15511,7 @@ async function sessionFileFacts(file, size, signal) {
 /** Verify bounded final redacted bytes before starting a second ZIP codec. */
 async function sessionPart(entry, expected, signal) {
 	if (expected.byteLength > 268435456 || entry.uncompressedSize !== expected.byteLength) fail("ARTIFACT_PART_LIMIT");
-	const file = await sessionFile();
+	const scratch = expected.byteLength <= 65536 ? { bytes: new Uint8Array(expected.byteLength) } : { file: await sessionFile() };
 	let size = 0;
 	const digest = createHash("sha256");
 	let crc = 0;
@@ -15483,11 +15521,14 @@ async function sessionPart(entry, expected, signal) {
 			if (size + bytes.byteLength > expected.byteLength) fail("ARTIFACT_PART_LIMIT");
 			digest.update(bytes);
 			crc = crc32(bytes, crc);
-			let offset = 0;
-			while (offset < bytes.byteLength) {
-				const result = await file.write(bytes, offset, bytes.byteLength - offset, size + offset);
-				if (!result.bytesWritten) fail("ARTIFACT_IO_FAILED");
-				offset += result.bytesWritten;
+			if (scratch.bytes) scratch.bytes.set(bytes, size);
+			else {
+				let offset = 0;
+				while (offset < bytes.byteLength) {
+					const { bytesWritten } = await scratch.file.write(bytes, offset, bytes.byteLength - offset, size + offset);
+					if (!bytesWritten) fail("ARTIFACT_IO_FAILED");
+					offset += bytesWritten;
+				}
 			}
 			size += bytes.byteLength;
 		} }), {
@@ -15495,55 +15536,93 @@ async function sessionPart(entry, expected, signal) {
 			checkSignature: true
 		});
 		if (size !== expected.byteLength || digest.digest("hex") !== expected.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
+		const reader = scratch.bytes ? new Uint8ArrayReader(scratch.bytes) : new FileReader(scratch.file, size, 262144, true, signal);
 		return {
-			file,
+			file: scratch.file,
+			reader,
 			crc32: crc
 		};
 	} catch (error) {
 		const cleanup = createCleanup();
 		cleanup.failed(error);
-		await cleanup.run(() => file.close());
+		const { file } = scratch;
+		if (file) await cleanup.run(() => file.close());
 		throw error;
 	}
 }
 //#endregion
 //#region packages/artifact/src/configured/output/sessions.ts
-/** Each yielded spool stays open until the caller advances or closes this iterator. */
-async function* configuredSessionUploads(input, identities, signal) {
+async function* configuredSessionUploads(input, identities, signal, mode = "upload", omitted = /* @__PURE__ */ new Set(), checkMinimumBytes) {
 	const verified = await checkFrozenOutput(input, signal);
 	const archive = await openCheckedOutput(input, verified.checked, signal);
 	const cleanup = createCleanup();
 	try {
 		if (archive.manifestText !== verified.manifestText) fail("ARTIFACT_PROCESSING_MISMATCH");
 		const descriptions = new Map(verified.manifest.entries.map((entry) => [entry.entryPath, entry]));
+		const byId = new Map(identities.map((identity) => [identity.archiveSessionId, identity]));
+		if (byId.size !== identities.length) fail("ARTIFACT_IDENTITY_MISMATCH");
+		if (checkMinimumBytes) {
+			const measured = /* @__PURE__ */ new Set();
+			let bytes = 0;
+			for (const session of verified.manifest.sessions) {
+				if (omitted.has(session.id)) continue;
+				if (!byId.has(session.id)) fail("ARTIFACT_IDENTITY_MISMATCH");
+				for (const part of session.parts) {
+					const entry = descriptions.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+					if (measured.has(entry.sha256)) continue;
+					measured.add(entry.sha256);
+					bytes += entry.byteLength;
+				}
+			}
+			checkMinimumBytes(bytes);
+		}
+		const workspaces = new Map(verified.manifest.sourceWorkspaces.map((workspace) => [workspace.id, workspace]));
+		const workspaceFacts = /* @__PURE__ */ new Map();
 		for (const session of verified.manifest.sessions) {
 			signal.throwIfAborted();
-			const identity = identities.find((item) => item.archiveSessionId === session.id) ?? fail("ARTIFACT_IDENTITY_MISMATCH");
-			const workspace = verified.manifest.sourceWorkspaces.find((item) => item.id === session.workspaceId) ?? fail("ARTIFACT_INVALID_MANIFEST");
-			const entry = archive.entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
-			const description = descriptions.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
-			const text = await readMetadata(entry, signal);
-			if (Buffer.byteLength(text) !== description.byteLength || createHash("sha256").update(text).digest("hex") !== description.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
-			const { version: _, ...facts } = validateConfiguredSourceMetadata(strictJson(text, metadataLimitBytes), workspace);
+			if (omitted.has(session.id)) continue;
+			const identity = byId.get(session.id) ?? fail("ARTIFACT_IDENTITY_MISMATCH");
+			const workspace = workspaces.get(session.workspaceId) ?? fail("ARTIFACT_INVALID_MANIFEST");
+			let facts = workspaceFacts.get(workspace.id);
+			if (!facts) {
+				const entry = archive.entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				const description = descriptions.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				const text = await readMetadata(entry, signal);
+				if (Buffer.byteLength(text) !== description.byteLength || createHash("sha256").update(text).digest("hex") !== description.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
+				const { version: _, ...validated } = validateConfiguredSourceMetadata(strictJson(text, metadataLimitBytes), workspace);
+				facts = validated;
+				workspaceFacts.set(workspace.id, facts);
+			}
 			const native = session.parts[0]?.native;
 			const nativeSessionId = native?.sessionId ?? session.sourceSessionId;
 			if (!nativeSessionId?.trim() && !identity.relativePath) fail("ARTIFACT_IDENTITY_MISMATCH");
 			const metadata = {
-				workspace: facts,
+				workspace: {
+					...facts,
+					remoteHashes: [...facts.remoteHashes]
+				},
 				sourceSessionId: nativeSessionId,
 				harness: session.harness,
 				lastAt: identity.lastAt,
 				parts: []
 			};
-			const file = await sessionFile();
+			const file = mode === "upload" ? await sessionFile() : null;
 			const sessionCleanup = createCleanup();
 			try {
 				let size = 0;
-				const sink = fileWriter(file, signal, (bytes) => {
+				const limit = (bytes) => {
 					if (bytes > 5 * 1024 ** 3) fail("ARTIFACT_ARCHIVE_LIMIT");
 					size = bytes;
-				}, false);
-				const zip = new ZipWriter(sink.writable, {
+				};
+				const digest = createHash("sha256");
+				let checksum = 0;
+				const writable = file ? fileWriter(file, signal, limit, false).writable : new WritableStream({ write(bytes) {
+					signal.throwIfAborted();
+					limit(size + bytes.byteLength);
+					digest.update(bytes);
+					checksum = crc32(bytes, checksum);
+				} });
+				const zip = new ZipWriter(writable, {
 					useWebWorkers: false,
 					useCompressionStream: true,
 					bufferedWrite: false,
@@ -15559,24 +15638,30 @@ async function* configuredSessionUploads(input, identities, signal) {
 					const partCleanup = createCleanup();
 					try {
 						const path = `p${String(index + 1).padStart(6, "0")}.jsonl`;
-						await zip.add(path, new FileReader(prepared.file, expected.byteLength, 262144, true, signal), { signal });
+						await zip.add(path, prepared.reader, { signal });
 						metadata.parts.push({
 							path,
 							byteLength: expected.byteLength,
 							sha256: expected.sha256,
-							crc32: prepared.crc32
+							crc32: prepared.crc32,
+							native: part.native
 						});
 					} catch (error) {
 						partCleanup.failed(error);
 						throw error;
 					} finally {
-						await partCleanup.run(() => prepared.file.close());
+						const { file } = prepared;
+						if (file) await partCleanup.run(() => file.close());
 					}
 				}
 				await zip.close();
 				if (zip.warnings?.length) fail("ARTIFACT_INVALID_ARCHIVE");
 				if (size > 5 * 1024 ** 3) fail("ARTIFACT_ARCHIVE_LIMIT");
-				const content = await sessionFileFacts(file, size, signal);
+				const content = file ? await sessionFileFacts(file, size, signal) : {
+					byteLength: size,
+					sha256: digest.digest("hex"),
+					crc32: checksum
+				};
 				await archive.fence();
 				yield {
 					...content,
@@ -15586,13 +15671,13 @@ async function* configuredSessionUploads(input, identities, signal) {
 					relativePath: identity.relativePath,
 					harness: session.harness,
 					lastAt: identity.lastAt,
-					stream: () => new FileReader(file, size, 262144, true, signal).createReadable()
+					...file ? { stream: () => new FileReader(file, size, 262144, true, signal).createReadable() } : {}
 				};
 			} catch (error) {
 				sessionCleanup.failed(error);
 				throw error;
 			} finally {
-				await sessionCleanup.run(() => file.close());
+				if (file) await sessionCleanup.run(() => file.close());
 			}
 		}
 	} catch (error) {
@@ -16361,7 +16446,7 @@ const maxChunks = 8e4;
 function batchLoad(body) {
 	return Math.max(body.chunks.length / maxChunks, (body.duplicates?.length ?? 0) / maxChunks, Buffer.byteLength(JSON.stringify(body)) / maxTransportBytes);
 }
-function location(context, fieldId, part) {
+function location$1(context, fieldId, part) {
 	const source = context.locations.get(fieldId);
 	if (!source) throw new ApplicationError("CORRUPTED_STATE");
 	const native = reviewSource(source);
@@ -16400,7 +16485,7 @@ function reviewBatchBody(context, unit, ordinal) {
 	};
 	const chunks = unit.fragments.map((part) => ({
 		id: chunkId(part.fieldId, part),
-		...location(context, part.fieldId, part),
+		...location$1(context, part.fieldId, part),
 		core: part.core,
 		offset: part.utf16Start,
 		text: part.text,
@@ -16420,7 +16505,7 @@ function reviewBatchBody(context, unit, ordinal) {
 				utf16Start: part.utf16Start + shift.utf16,
 				utf16End: part.utf16End + shift.utf16
 			};
-			const { displayMasks, ...own } = location(context, duplicate.fieldId, copy);
+			const { displayMasks, ...own } = location$1(context, duplicate.fieldId, copy);
 			const hash = fieldHash(duplicate.fieldId);
 			return {
 				id: chunkId(duplicate.fieldId, copy),
@@ -17011,4 +17096,277 @@ async function verifyPreparedSessionSources(prepared, input, signal) {
 	}
 }
 //#endregion
-export { removeNamedTemporarySpools as $, renderJobDigest as A, parallelismLimits as B, readOriginalSearchFields as C, prepareCollectionProduction as D, checkReusableBundle as E, SessionWorkerError as F, processJourneyMetadataFields as G, privateJourneyDirectory as H, sessionWorkerFailure as I, listAgentSetup as J, staticMaskCategory as K, privateCollectionDirectory as L, readCollectionIndex as M, parseCollectionWorkspaceSummary as N, captureLogicalJourneySources as O, createSharedSessionPool as P, createTemporary as Q, defaultParallelism as R, readPrivateReviewPayload as S, createCollectionArtifacts as T, readLogicalJourneyFinalMasks as U, writeLogicalJourneyOutput as V, readConfiguredOutputInfo as W, createInspectionProcessor as X, createConfiguredPreviewStream as Y, decodeZstd as Z, processJourneyMetadata as _, scanReviewFields as a, restrictToOwner as at, writeLogicalJourneyBase as b, readSessionScanRecords as c, windowsAclCodes as ct, verifyOutputShard as d, createCleanup as et, writeOutputShard as f, readCapturedOriginalRows as g, captureConfiguredSessionJob as h, buildWorkScanBatches as i, openPrivateFile as it, runConfiguredSessionJob as j, capturedJourneyScope as k, scanPreparedSession as l, openConfiguredUpload as m, verifyPreparedSessionSources as n, exclusiveLock as nt, createWorkPieces as o, windowsOwnerOnly as ot, configuredSessionUploads as p, readWorkspacePair as q, prepareSessionScans as r, makePrivateDirectory as rt, readSessionScanFields as s, isWindowsAclFailure as st, preparedScanConfiguration as t, safeError as tt, runConfiguredScanJob as u, readStaticSessionMasks as v, readConfiguredSearchFields as w, writePrivateReviewPayload as x, staticSessionJobs as y, gitSeedsProvider as z };
+//#region packages/artifact/src/configured/output/session-mask-equivalence.ts
+const exactMarker = new RegExp("^(?:" + replacementMarkerPattern.source + ")$", "u");
+function sessionMaskProof(row) {
+	const lineage = row.contributors.map((item) => {
+		const { inputRange, context } = item.kind === "static" ? item.source.mask : item.source;
+		const quote = context.text.slice(inputRange.start - context.start, inputRange.end - context.start);
+		const basis = item.kind === "static" ? [
+			item.source.sourceRecordIndex,
+			item.source.mask.originalPointer,
+			item.source.mask.sourceRange,
+			item.source.mask.inputSha256,
+			item.source.mask.stepId,
+			item.source.mask.node.id,
+			item.source.mask.node.version,
+			item.source.mask.ruleId
+		] : [item.source.pointer];
+		return JSON.stringify([
+			item.kind,
+			item.category,
+			basis,
+			inputRange.start,
+			inputRange.end,
+			quote
+		]);
+	}).sort();
+	const first = row.contributors[0];
+	return {
+		pointer: row.pointer,
+		subject: row.subject,
+		start: row.outputRange.start,
+		end: row.outputRange.end,
+		replacement: row.replacement,
+		lineage: createHash("sha256").update(JSON.stringify([row.category, lineage])).digest("hex"),
+		mayRename: row.subject === "value" && exactMarker.test(row.replacement) && row.contributors.length === 1 && first?.kind === "static" && first.source.sourceRecordIndex !== null && first.source.mask.sourceRange !== null && first.source.mask.originalPointer !== null && first.source.mask.outputPointer === row.pointer && first.source.mask.subject === row.subject && first.source.mask.replacement === row.replacement
+	};
+}
+const location = (mask) => JSON.stringify([
+	mask.pointer,
+	mask.subject,
+	mask.start,
+	mask.end
+]);
+/** Both ledgers have already been independently joined to their own frozen output by the verifier. */
+function compareSessionRows(leftText, rightText, leftMasks, rightMasks) {
+	if (leftMasks.length !== rightMasks.length) return null;
+	const rightByLocation = new Map(rightMasks.map((mask) => [location(mask), mask]));
+	if (rightByLocation.size !== rightMasks.length) return null;
+	const changes = /* @__PURE__ */ new Map();
+	const aliases = /* @__PURE__ */ new Map();
+	const reverse = /* @__PURE__ */ new Map();
+	for (const left of leftMasks) {
+		const key = location(left);
+		const right = rightByLocation.get(key);
+		if (!right || left.lineage !== right.lineage) return null;
+		rightByLocation.delete(key);
+		if (left.replacement === right.replacement) continue;
+		if (!left.mayRename || !right.mayRename || left.start < 0 || left.end - left.start !== left.replacement.length || right.replacement.length !== left.replacement.length) return null;
+		const prior = aliases.get(left.replacement);
+		const inverse = reverse.get(right.replacement);
+		if (prior !== void 0 && prior !== right.replacement || inverse !== void 0 && inverse !== left.replacement) return null;
+		aliases.set(left.replacement, right.replacement);
+		reverse.set(right.replacement, left.replacement);
+		const masks = changes.get(left.pointer) ?? [];
+		masks.push(left);
+		changes.set(left.pointer, masks);
+	}
+	if (!aliases.size) return leftText === rightText ? { aliases: [] } : null;
+	const limits = {
+		...defaultLimits,
+		maxRecordBytes: maximumRecordBytes
+	};
+	let tree;
+	try {
+		tree = parseNativeRecord(leftText, limits, new AbortController().signal);
+	} catch {
+		return null;
+	}
+	const changedCount = [...changes.values()].reduce((sum, field) => sum + field.length, 0);
+	function authenticOccurrences(root, destination) {
+		let used = 0;
+		const markers = destination ? reverse : aliases;
+		function check(node, pointer) {
+			if (node.kind === "array") return node.items.every((item, i) => check(item, pointer + "/" + i));
+			if (node.kind === "object") return node.properties.every(({ key, value }) => {
+				for (const found of key.value.matchAll(replacementMarkerPattern)) if (markers.has(found[0])) return false;
+				return check(value, pointer + "/" + key.value.replaceAll("~", "~0").replaceAll("/", "~1"));
+			});
+			if (node.kind !== "string") return true;
+			const expected = new Map((changes.get(pointer) ?? []).map((mask) => [mask.start, mask]));
+			for (const found of node.value.matchAll(replacementMarkerPattern)) {
+				if (!markers.has(found[0])) continue;
+				const mask = expected.get(found.index);
+				if (!mask || (destination ? aliases.get(mask.replacement) : mask.replacement) !== found[0]) return false;
+				expected.delete(found.index);
+				used++;
+			}
+			return expected.size === 0;
+		}
+		return check(root, "") && used === changedCount;
+	}
+	if (!authenticOccurrences(tree, false)) return null;
+	for (const winner of aliases.values()) if (aliases.has(winner)) return null;
+	let replaced = 0;
+	const renamed = leftText.replace(replacementMarkerPattern, (marker) => {
+		const mapped = aliases.get(marker);
+		if (!mapped) return marker;
+		replaced++;
+		return mapped;
+	});
+	if (changedCount !== replaced || renamed !== rightText) return null;
+	try {
+		if (!authenticOccurrences(parseNativeRecord(rightText, limits, new AbortController().signal), true)) return null;
+	} catch {
+		return null;
+	}
+	return { aliases: [...aliases] };
+}
+//#endregion
+//#region packages/artifact/src/configured/output/session-source-prefix.ts
+/**
+* Both parts come from the verified frozen primary. The caller locates longerSource through
+* its base source binding. A copied log may have a different path or inode from its ancestor.
+*/
+async function sessionSourcePrefix(short, long, longerSource, signal) {
+	checkAbort(signal);
+	if (!short.native.sessionId?.trim() || !["main", "worker"].includes(short.native.role) || !isDeepStrictEqual(short.native, long.native) || short.source.representation !== long.source.representation || short.source.byteLength > long.source.byteLength || short.recordCount > long.recordCount || short.retainedRecordCount > long.retainedRecordCount) return false;
+	if (short.source.byteLength === long.source.byteLength) return short.source.sha256 === long.source.sha256 && short.recordCount === long.recordCount;
+	if (long.source.representation !== "jsonl" || !longerSource || longerSource.representation !== "jsonl" || longerSource.snapshot.size !== long.source.byteLength || short.source.byteLength === 0 || short.recordCount === long.recordCount) return false;
+	try {
+		checkNativeEvidence(longerSource, long.native);
+		const input = await openConfiguredSource(longerSource, signal, void 0, "stable-prefix");
+		try {
+			const prefix = createHash("sha256");
+			let remaining = short.source.byteLength;
+			let endsAtRecord = false;
+			for await (const chunk of input.chunks) {
+				const take = Math.min(remaining, chunk.byteLength);
+				if (take === 0) continue;
+				prefix.update(chunk.subarray(0, take));
+				remaining -= take;
+				if (remaining === 0) endsAtRecord = chunk[take - 1] === 10;
+			}
+			const full = await input.finish();
+			return remaining === 0 && endsAtRecord && prefix.digest("hex") === short.source.sha256 && full.sha256 === long.source.sha256 && full.byteLength === long.source.byteLength;
+		} finally {
+			await input.close();
+		}
+	} catch (error) {
+		checkAbort(signal);
+		if ([
+			"ARTIFACT_SOURCE_CHANGED",
+			"ARTIFACT_SOURCE_MISSING",
+			"ARTIFACT_SOURCE_UNSAFE",
+			"ARTIFACT_SOURCE_UNREADABLE",
+			"ARTIFACT_SOURCE_TRUNCATED"
+		].includes(safeError(error).message)) return false;
+		throw error;
+	}
+}
+//#endregion
+//#region packages/artifact/src/configured/output/session-extension.ts
+/** Choose an entire already-approved variant. No edited or reconstructed bytes enter transport. */
+async function sessionExtensions(input, signal) {
+	const verified = await checkFrozenOutput(input.primary, signal);
+	const { manifest } = verified;
+	const sessions = new Map(manifest.sessions.map((session) => [session.id, session]));
+	const groups = input.groups.map((group) => group.map((id) => sessions.get(id) ?? fail("ARTIFACT_IDENTITY_MISMATCH")));
+	const paths = new Set(groups.flat().flatMap((session) => session.parts.map((part) => part.dataPath)));
+	const masks = /* @__PURE__ */ new Map();
+	for await (const row of readLogicalJourneyFinalMasks({
+		ledger: input.ledger,
+		primary: input.primary
+	}, signal, paths)) {
+		const entry = masks.get(row.entryPath) ?? /* @__PURE__ */ new Map();
+		if (!masks.has(row.entryPath)) masks.set(row.entryPath, entry);
+		const list = entry.get(row.recordIndex) ?? [];
+		list.push(sessionMaskProof(row));
+		entry.set(row.recordIndex, list);
+	}
+	const archive = await openCheckedOutput(input.primary, verified.checked, signal);
+	const omitted = /* @__PURE__ */ new Set();
+	const aliases = /* @__PURE__ */ new Map();
+	try {
+		for (const group of groups) {
+			const score = (s) => s.parts.reduce((sum, p) => sum + p.retainedRecordCount, 0);
+			const sorted = group.toSorted((a, b) => score(b) - score(a) || Date.parse(input.lastAt(b.id)) - Date.parse(input.lastAt(a.id)) || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+			const winner = sorted[0];
+			if (!winner) continue;
+			for (const shorter of sorted.slice(1)) {
+				if (shorter.workspaceId !== winner.workspaceId || shorter.harness !== winner.harness || shorter.treatmentId !== winner.treatmentId || shorter.sourceSessionId !== winner.sourceSessionId || shorter.parts.length !== winner.parts.length || Date.parse(input.lastAt(shorter.id)) > Date.parse(input.lastAt(winner.id))) return null;
+				for (const [index, part] of shorter.parts.entries()) {
+					const long = winner.parts[index];
+					if (!long || part.retainedRecordCount > long.retainedRecordCount || !await sessionSourcePrefix(part, long, input.sourceFor(winner.id, long.sourceId), signal)) return null;
+					if (!await compareParts(archive, manifest, part, long, masks, aliases, signal)) return null;
+				}
+				omitted.add(shorter.id);
+			}
+		}
+		for (const value of aliases.values()) if (aliases.has(value)) return null;
+		await archive.fence();
+		return {
+			omitted,
+			retired: new Set(aliases.keys())
+		};
+	} finally {
+		await archive.close();
+	}
+}
+async function compareParts(archive, manifest, short, long, masks, aliases, signal) {
+	const cleanup = createCleanup();
+	const spools = [];
+	try {
+		for (const part of [short, long]) {
+			const entry = archive.entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+			const expected = manifest.entries.find((d) => d.entryPath === part.dataPath) ?? fail("ARTIFACT_INVALID_MANIFEST");
+			spools.push(await spoolFacts(entry, expected, signal));
+		}
+		const [a, b] = spools;
+		if (!a || !b) return fail("ARTIFACT_INVALID_ARCHIVE");
+		let count = 0;
+		for await (const row of a.lines) {
+			const match = await b.lines.next();
+			if (match.done) return false;
+			const proof = compareSessionRows(row, match.value, masks.get(short.dataPath)?.get(count) ?? [], masks.get(long.dataPath)?.get(count) ?? []);
+			if (!proof) return false;
+			for (const [old, chosen] of proof.aliases) {
+				if (aliases.has(old) && aliases.get(old) !== chosen) return false;
+				aliases.set(old, chosen);
+			}
+			count++;
+		}
+		if (count !== short.retainedRecordCount) return false;
+		for await (const _ of b.lines) count++;
+		return count === long.retainedRecordCount;
+	} catch (error) {
+		cleanup.failed(error);
+		throw error;
+	} finally {
+		await cleanup.run(...spools.flatMap((s) => [() => s.lines.return(void 0), () => s.close()]));
+	}
+}
+/** Matches complete decoded marker spellings, including Unicode escape spellings in native JSON. */
+function refersToRetiredMarker(text, retired) {
+	let candidate = text;
+	for (let depth = 0; /\\u[\da-f]{4}/iu.test(candidate); depth++) {
+		if (depth >= 8) return true;
+		candidate = candidate.replace(/\\+u([\da-f]{4})/giu, (_, digits) => String.fromCharCode(Number.parseInt(digits, 16)));
+	}
+	for (const match of candidate.matchAll(replacementMarkerPattern)) if (retired.has(match[0])) return true;
+	return false;
+}
+/** Search all kept uploaded fields of a confirmed Work before retiring an alias in another session. */
+async function hasRetiredSessionMarker(primary, omitted, retired, signal) {
+	if (!retired.size) return false;
+	const verified = await checkFrozenOutput(primary, signal);
+	const archive = await openCheckedOutput(primary, verified.checked, signal);
+	try {
+		const entries = new Map(verified.manifest.entries.map((entry) => [entry.entryPath, entry]));
+		for (const workspace of verified.manifest.sourceWorkspaces) if (refersToRetiredMarker(await readOutputJson(archive.entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), signal), retired)) return true;
+		for (const session of verified.manifest.sessions) {
+			if (omitted.has(session.id)) continue;
+			for (const part of session.parts) {
+				const entry = archive.entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				const expected = entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				for await (const row of entryLines(entry, expected, signal)) if (refersToRetiredMarker(row, retired)) return true;
+			}
+		}
+		return false;
+	} finally {
+		await archive.close();
+	}
+}
+//#endregion
+export { decodeZstd as $, captureLogicalJourneySources as A, defaultParallelism as B, writePrivateReviewPayload as C, createCollectionArtifacts as D, readConfiguredSearchFields as E, parseCollectionWorkspaceSummary as F, readLogicalJourneyFinalMasks as G, parallelismLimits as H, createSharedSessionPool as I, staticMaskCategory as J, readConfiguredOutputInfo as K, SessionWorkerError as L, renderJobDigest as M, runConfiguredSessionJob as N, checkReusableBundle as O, readCollectionIndex as P, createInspectionProcessor as Q, sessionWorkerFailure as R, writeLogicalJourneyBase as S, readOriginalSearchFields as T, writeLogicalJourneyOutput as U, gitSeedsProvider as V, privateJourneyDirectory as W, listAgentSetup as X, readWorkspacePair as Y, createConfiguredPreviewStream as Z, captureConfiguredSessionJob as _, prepareSessionScans as a, makePrivateDirectory as at, readStaticSessionMasks as b, createWorkPieces as c, windowsOwnerOnly as ct, scanPreparedSession as d, createTemporary as et, runConfiguredScanJob as f, openConfiguredUpload as g, configuredSessionUploads as h, verifyPreparedSessionSources as i, exclusiveLock as it, capturedJourneyScope as j, prepareCollectionProduction as k, readSessionScanFields as l, isWindowsAclFailure as lt, writeOutputShard as m, sessionExtensions as n, createCleanup as nt, buildWorkScanBatches as o, openPrivateFile as ot, verifyOutputShard as p, processJourneyMetadataFields as q, preparedScanConfiguration as r, safeError as rt, scanReviewFields as s, restrictToOwner as st, hasRetiredSessionMarker as t, removeNamedTemporarySpools as tt, readSessionScanRecords as u, windowsAclCodes as ut, readCapturedOriginalRows as v, readPrivateReviewPayload as w, staticSessionJobs as x, processJourneyMetadata as y, privateCollectionDirectory as z };