@gitroll/tacitt-cli 0.6.11 → 0.6.13

package/dist/{heap-CV8Eca8V.mjs → heap-DCS_WXIA.mjs}

@@ -1,6 +1,6 @@
-import { S as readPrivateReviewPayload, at as restrictToOwner, it as openPrivateFile, nt as exclusiveLock, ot as windowsOwnerOnly, x as writePrivateReviewPayload } from "./src-DlVbGB32.mjs";
-import { An as createDetectionSummary, Ft as emptyReviewCorrectionSchema, Ht as termTypeSchema, It as journeyTermSchema, Lt as reviewTermsInputSchema, Nt as privacyTermSchema, Pt as emptyReviewCorrectionResultSchema, Rt as reviewTermsResultSchema, S as validateBReview, a as reviewBatchChunks, b as bContextEvidence, bt as journeyWorkSuggestionSchema, c as reviewDigest, cn as reviewFamilies, d as validateReview, f as findingReferenceKey, g as reviewAlignmentSchema, gt as journeyGuidanceSchema, l as reviewSubmitSchema, lt as journeyIdSchema, mt as nativeJourneySchema, nn as ApplicationError, o as reviewBatchSchema, or as isStaticCategory, p as reviewAlignmentAudit, pn as fileIdentitySchema, sn as familySelected, sr as staticCategories, st as journeyDigestSchema, u as textDigest, v as validateReviewAlignment, y as semanticFindingSchema, yt as journeyDescribeSchema } from "./locate-Cx52Zqxv.mjs";
-import { $ as validateDetectionSummary, $t as journeyResourceSchema, At as obsoleteJourney, Bn as journeySearchResultSchema, Cn as mergeBRepair, Cr as preparationStartSchema, En as scanCanonicalResourceSchema, Er as validatePreparationFacts, Fr as applyCardAnswers, Ft as journeyGuidance, Gn as journeyEventSchema, Gr as staticSessionId, Gt as journeyContextQuerySchema, Hn as searchScopeDigest, Hr as mergePrivacyTerms, In as journeyInventoryReadSchema, It as journeyBatchReadSchema, J as validateInspectionFence, Jt as hideFinishSchema, Kt as journeyContextSchema, Ln as journeyInventorySchema, Lt as journeyReviewStorageQuerySchema, Nn as validateScanExclusion, Nt as attemptBudgetCodePoints, On as scanSessionResourceSchema, Ot as settleCorrections, Pt as validateAttemptAppend, Q as validateInspectionContribution, Qt as journeyResourceQuerySchema, Rn as journeyPreparationProgressSchema, Rt as applyClassificationProposal, Sn as bReviewDigest, Sr as preparationSettlementSchema, Tn as scanAliasResourceSchema, Tr as preparationUpdateSchema, U as validateInspectionBatch, Un as journeyCommitResultSchema, Ut as newJourneyWork, Vn as journeySearchSaveSchema, W as validateInspectionBatches, Wn as journeyCommitSchema, X as validateInspectionInputs, Xn as settleConfirmedHides, Xr as journeySendSchema, Xt as journeyPolicyRespondSchema, Y as validateInspectionHead, Yt as hidePublishSchema, Z as validateInspectionQuery, Zt as projectPreparationProgress, _r as workPrivacyDecisions, ai as isReadingComplete, an as reviewAttemptsResultSchema, bn as reviewRepairResourceSchema, br as preparationBeginSchema, c as reconstructBFields, ci as selectedWorks, cn as sessionReconciliationResourceSchema, cr as confirmedHideKey, d as resolveGroupSplit, dr as dictionaryHides, en as journeyIsolateSchema, et as inspectionInputs, fn as sessionReviewQuerySchema, g as semanticGroupKey, gi as stateSchema, gn as sessionUsefulnessResourceSchema, gr as workDecisionDigest, gt as manualUploadSchema, h as hideScopeDigest, hn as sessionUsefulnessInputSchema, hr as retireWorkDescription, in as reviewAttemptsQuerySchema, ir as bMaskedHits, kn as scanGitSeedsId, l as chooseCheapPlacement, li as withReadingProgress, mn as sessionReviewStatusSchema, mr as syncTermGroups, nn as sortingApplySchema, o as bRereadDigest, oi as isSelectedWork, pn as sessionReviewResourceSchema, pr as maskedHitsStale, pt as manualUploadBindingSchema, q as validateInspectionClaim, qn as confirmedHideDeltaSchema, qt as hideBeginSchema, rn as reviewAttemptResourceSchema, s as reconcileBSession, si as isSkippedWork, sn as sessionReconcileResultSchema, sr as confirmedHideGroupIds, t as scanBatchContextDigest, tn as journeyPlaceSchema, u as reviseGroupMembership, un as sessionRereadResourceSchema, ur as confirmedHideTerms, v as projectJourneyInventory, vn as reviewCandidateResourceSchema, vt as candidateSortAvailable, wr as preparationStateSchema, x as bReviewScope, xr as preparationPermissionSchema, y as preparationScope, zt as classificationCommitSchema } from "./src-D1iONla3.mjs";
+import { C as writePrivateReviewPayload, ct as openPrivateFile, lt as restrictToOwner, ot as exclusiveLock, ut as windowsOwnerOnly, w as readPrivateReviewPayload } from "./src-CP-K2PBv.mjs";
+import { Bt as reviewTermsResultSchema, C as validateBReview, Ft as privacyTermSchema, It as emptyReviewCorrectionResultSchema, Lt as emptyReviewCorrectionSchema, M as semanticFindingSchema, Mn as createDetectionSummary, Rt as journeyTermSchema, St as journeyWorkSuggestionSchema, Wt as termTypeSchema, b as validateReviewAlignment, c as reviewBatchSchema, cr as isStaticCategory, d as reviewSubmitSchema, dt as journeyIdSchema, f as textDigest, gt as nativeJourneySchema, h as reviewAlignmentAudit, hn as fileIdentitySchema, in as ApplicationError, ln as familySelected, lr as staticCategories, lt as journeyDigestSchema, m as findingReferenceKey, p as validateReview, s as reviewBatchChunks, u as reviewDigest, un as reviewFamilies, v as reviewAlignmentSchema, vt as journeyGuidanceSchema, x as bContextEvidence, xt as journeyDescribeSchema, zt as reviewTermsInputSchema } from "./locate-PLEyLYW-.mjs";
+import { $ as validateDetectionSummary, $t as journeyPlaceSchema, At as validateAttemptAppend, Bn as journeySearchSaveSchema, Bt as newJourneyWork, Cn as scanAliasResourceSchema, Dn as scanGitSeedsId, En as scanSessionResourceSchema, Fn as journeyInventoryReadSchema, Ft as classificationCommitSchema, Gr as staticSessionId, Gt as hideFinishSchema, Hn as journeyCommitResultSchema, Hr as mergePrivacyTerms, Ht as journeyContextQuerySchema, In as journeyInventorySchema, Ir as obsoleteJourney, J as validateInspectionFence, Jt as sendOutputQuerySchema, Kn as confirmedHideDeltaSchema, Kt as hidePublishSchema, Ln as journeyPreparationProgressSchema, Lr as sendOwesPassport, Mi as stateSchema, Mt as journeyBatchReadSchema, Nn as projectPreparationProgress, Nt as journeyReviewStorageQuerySchema, Ot as settleCorrections, Pt as applyClassificationProposal, Q as validateInspectionContribution, Qt as journeyIsolateSchema, Rr as sendReachedPassport, Si as bMaskedHits, Sr as assertJourneyPrivacyReady, U as validateInspectionBatch, Un as journeyCommitSchema, Ut as journeyContextSchema, Vn as searchScopeDigest, W as validateInspectionBatches, Wn as journeyEventSchema, Wt as hideBeginSchema, X as validateInspectionInputs, Xr as journeySendSchema, Xt as journeyResourceQuerySchema, Y as validateInspectionHead, Yn as settleConfirmedHides, Yt as sendOutputSchema, Z as validateInspectionQuery, Zt as journeyResourceSchema, an as sessionReconcileResultSchema, bn as bReviewDigest, c as reconstructBFields, ci as isSkippedWork, cn as sessionRereadResourceSchema, cr as preparationSettlementSchema, d as resolveGroupSplit, di as withReadingProgress, dn as sessionReviewResourceSchema, dr as preparationUpdateSchema, en as sortingApplySchema, et as inspectionInputs, fi as confirmedHideGroupIds, fn as sessionReviewStatusSchema, fr as validatePreparationFacts, g as semanticGroupKey, gi as dictionaryHides, gn as reviewCandidateResourceSchema, gt as manualUploadSchema, h as hideScopeDigest, hi as confirmedHideTerms, jn as validateScanExclusion, jt as journeyGuidance, kt as attemptBudgetCodePoints, l as chooseCheapPlacement, li as selectedWorks, lr as preparationStartSchema, mn as sessionUsefulnessResourceSchema, nn as reviewAttemptsQuerySchema, nr as workDecisionDigest, o as bRereadDigest, oi as isReadingComplete, on as sessionReconciliationResourceSchema, or as preparationBeginSchema, pi as confirmedHideKey, pn as sessionUsefulnessInputSchema, pt as manualUploadBindingSchema, q as validateInspectionClaim, qt as journeyPolicyRespondSchema, ri as hasCompleteWorkDescription, rn as reviewAttemptsResultSchema, rr as workPrivacyDecisions, s as reconcileBSession, si as isSelectedWork, sr as preparationPermissionSchema, t as scanBatchContextDigest, ti as sendSessionUploadSchema, tn as reviewAttemptResourceSchema, tr as retireWorkDescription, u as reviseGroupMembership, un as sessionReviewQuerySchema, ur as preparationStateSchema, v as projectJourneyInventory, vi as maskedHitsStale, vn as reviewRepairResourceSchema, vt as candidateSortAvailable, wn as scanCanonicalResourceSchema, wr as reconcileReaderKeeps, x as bReviewScope, xn as mergeBRepair, xr as applyCardAnswers, y as preparationScope, yi as syncTermGroups, zn as journeySearchResultSchema, zt as isolatedWorkId } from "./src-CttNuxOn.mjs";
 import { constants } from "node:fs";
 import { z } from "zod";
 import { copyFile, link, lstat, mkdir, mkdtemp, open, readFile, realpath, rm, unlink } from "node:fs/promises";
@@ -346,9 +346,26 @@ function readJourney(db, journeyId) {
 		if (typeof text !== "string") throw new ApplicationError("CORRUPTED_STATE");
 		const state = JSON.parse(text);
 		if (typeof state === "object" && state !== null && "formatVersion" in state && state.formatVersion !== 10) throw new StoreError("OBSOLETE_SCHEMA", "Stored native Journey state uses an obsolete candidate format and has been preserved.");
+		let value = reconcileReaderKeeps(nativeJourneySchema.parse(state));
+		if (value.outputVersion !== void 0 && value.outputVersion > 1) throw new StoreError("OBSOLETE_SCHEMA", "This journey requires a newer final writer.");
+		if (value.outputVersion !== 1 && value.phase !== "completed" && !obsoleteJourney(value)) value = {
+			...value,
+			outputVersion: 1,
+			phase: value.phase === "ready" ? "review" : value.phase,
+			privacy: {
+				...value.privacy,
+				packageApproval: null
+			},
+			works: value.works.map((work) => ({
+				...work,
+				revision: work.revision + 1,
+				status: work.status === "ready" ? "review" : work.status,
+				artifact: null
+			}))
+		};
 		return {
 			text,
-			value: nativeJourneySchema.parse(state)
+			value
 		};
 	});
 }
@@ -362,23 +379,29 @@ function insertCorrectionReport(db, resource) {
 	}
 	db.prepare("INSERT INTO journey_resources VALUES(?,?,?,?)").run(resource.journeyId, resource.kind, resource.id, json);
 }
-/**
-* A snapshot of an earlier release cannot render, so a new Journey may replace it, but never
-* one with a Send record or a sent Work: that Send stays for the person to finish.
-*/
-/** A receipt or persisted session mutation intent means a Send may have reached Passport. */
+/** Whether any Send of this Journey may have reached Passport (`sendReachedPassport`). */
 function reachedPassport(db, journeyId) {
 	return db.prepare("SELECT json FROM journey_sends WHERE journey_id=?").all(journeyId).some((row) => {
 		if (typeof row["json"] !== "string") throw new ApplicationError("CORRUPTED_STATE");
-		return journeySendSchema.parse(JSON.parse(row["json"])).items.some((item) => item.receipt || item.previousReceipts.length || item.sessionUpload !== void 0 || item.sessionMembership || item.sessionAssembly);
+		return sendReachedPassport(journeySendSchema.parse(JSON.parse(row["json"])));
 	});
 }
 /** An abandoned Journey gives way to a new one unless one of its Sends reached Passport. */
 function abandoned(db, current) {
 	return current.abandonedAt !== void 0 && !reachedPassport(db, current.journeyId);
 }
+/**
+* A snapshot of an earlier release cannot render, so a new Journey replaces it unless its current
+* Send still owes Passport something its next advance sends without the person
+* (`sendOwesPassport`, ADR 0284, owner answer A): sent Works stay on Passport, and the new Journey
+* reads every Work again. Replacement cancels its unfinished Sends.
+*/
 function replaceable(db, current) {
-	return obsoleteJourney(current) && !current.works.some((work) => work.binding) && !db.prepare("SELECT 1 FROM journey_sends WHERE journey_id=? LIMIT 1").get(current.journeyId);
+	if (!obsoleteJourney(current)) return false;
+	const row = db.prepare("SELECT json FROM journey_sends JOIN journey_current_send ON journey_sends.id=journey_current_send.send_id WHERE journey_current_send.journey_id=?").get(current.journeyId);
+	if (!row) return true;
+	if (typeof row["json"] !== "string") throw new ApplicationError("CORRUPTED_STATE");
+	return !sendOwesPassport(current, journeySendSchema.parse(JSON.parse(row["json"])));
 }
 /** An addition counts only when one of its findings was assigned to a confirmed Hide category. */
 function joinedHideValues(db, state, delta) {
@@ -439,6 +462,7 @@ function commitJourney(db, input) {
 			...input,
 			state: {
 				...input.state,
+				outputVersion: 1,
 				privacy: {
 					...input.state.privacy,
 					rememberedRules
@@ -453,6 +477,7 @@ function commitJourney(db, input) {
 			state: current
 		};
 	}
+	if (input.expectedRevision === null && current && replaceable(db, current)) db.prepare("DELETE FROM journey_current_send WHERE journey_id=?").run(current.journeyId);
 	if (input.state.journeyId !== input.event.journeyId) throw new ApplicationError("INVALID_ARGUMENTS");
 	if (input.closedReader) {
 		const hold = input.closedReader;
@@ -2578,6 +2603,7 @@ function selectTerms(db, query) {
 			if (!source || source["review_ref_json"] === null) throw new ApplicationError("SCOPE_NOT_READY");
 		}
 		const work = requireActiveBatch(state, batch.header);
+		if (work.access === "drop") throw new ApplicationError("REVISION_CONFLICT");
 		if (work.reviewInterruptions?.some((hold) => hold.inputRevision === work.inputRevision && hold.batchIds.includes(unit.batchId)) || db.prepare("SELECT 1 FROM journey_resources WHERE journey_id=? AND kind='closed-reader' AND id=?").get(state.journeyId, unit.batchId + ":" + input.packId)) throw new ApplicationError("REVISION_CONFLICT");
 		if (batch.header.digest !== unit.batchDigest) throw new ApplicationError("REVISION_CONFLICT");
 		return batch;
@@ -2640,6 +2666,10 @@ function finishTerms(db, packet) {
 			count: term.count - previous
 		})) added++;
 	}
+	for (const term of packet.located) if (upsertJourneyTerm(db, state.journeyId, {
+		...term,
+		count: 0
+	})) added++;
 	const groups = syncTermGroups(state, readTermCounts(db, state.journeyId), (key) => findingPreference(db, key));
 	const reference = {
 		kind: "term-pack",
@@ -3853,9 +3883,9 @@ function activeScope(db, input, starting) {
 	if (state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
 	const work = state.works.find((item) => item.id === input.workId);
 	if (!work || input.inputRevision !== work.inputRevision || input.snapshotId !== state.snapshotId) throw new ApplicationError("REVISION_CONFLICT");
-	const plan = readInventoryPlan(db, state);
+	const { plan, families } = readInventoryFamilies(db, state);
 	if (!plan.approval.inventory.complete) throw new ApplicationError("CORRUPTED_STATE");
-	return preparationScope(plan.approval.inventory, work);
+	return preparationScope(plan.approval.inventory, work, families);
 }
 function insert(db, record) {
 	db.prepare("INSERT INTO journey_resources VALUES(?,?,?,?)").run(record.journeyId, record.kind, record.id, JSON.stringify(record));
@@ -3926,7 +3956,16 @@ function readJourneyPreparationProgress(db, input) {
 	const state = readFencedJourney(db, input);
 	if (!state.consent || !state.snapshotId) return null;
 	const { starts, settlements } = readPreparationReceipts(db, state.journeyId);
-	return projectPreparationProgress(state, readInventoryPlan(db, state), readCaptures(db, state.journeyId), starts, settlements);
+	const captures = db.prepare(`SELECT id, json_extract(json,'$.capture.partId') AS partId,
+    json_extract(json,'$.capture.facts.byteLength') AS bytes FROM journey_resources
+    WHERE journey_id=? AND kind='capture'`).all(state.journeyId).map(({ id, partId, bytes }) => {
+		if (id !== partId || typeof partId !== "string" || typeof bytes !== "number" || !Number.isSafeInteger(bytes) || bytes < 0) throw new ApplicationError("CORRUPTED_STATE");
+		return {
+			partId,
+			bytes
+		};
+	});
+	return projectPreparationProgress(state, readInventoryFamilies(db, state).families, captures, starts, settlements);
 }
 //#endregion
 //#region packages/local-host/src/store/journey/hide.ts
@@ -4732,14 +4771,6 @@ function finishJourneyPlacement(db, packet) {
 //#endregion
 //#region packages/local-host/src/store/journey/isolation.ts
 const reason = " – couldn't prepare";
-/** Stable blocked Work IDs per parent, so later failing roots join one instead of multiplying. */
-function isolatedWorkId(parentId, ordinal) {
-	const bytes = createHash("sha256").update(`isolated-roots:${parentId}:${ordinal}`).digest().subarray(0, 16);
-	bytes[6] = (bytes[6] ?? 0) & 15 | 64;
-	bytes[8] = (bytes[8] ?? 0) & 63 | 128;
-	const hex = bytes.toString("hex");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
 /**
 * Moves identified failing roots out of a pending multi-root Work into its visible blocked
 * Work, carrying their public-safe codes; the parent returns to pending for the rest.
@@ -4783,8 +4814,15 @@ function isolateJourneyRoots(db, input) {
 		})),
 		blocks: /* @__PURE__ */ new Map([[targetId, [...codes]]])
 	});
+	const classified = !existing && parent.classificationRecommendation && hasCompleteWorkDescription(parent) && !parent.suggestion ? {
+		description: parent.description,
+		classificationRecommendation: parent.classificationRecommendation,
+		reason: parent.classificationRecommendation.reason,
+		projectType: parent.projectType?.origin === "model" ? parent.projectType : null
+	} : {};
 	const works = next.works.map((work) => work.id === targetId ? {
 		...work,
+		...classified,
 		...access
 	} : work);
 	return commitJourney(db, commit(input, {
@@ -4912,9 +4950,197 @@ function finishJourneyDescription(db, packet) {
 }
 //#endregion
 //#region packages/local-host/src/store/journey/send.ts
+/** Run the privacy fence against the store's current immutable row on every request.
+* Only the approved output and this Work's frozen upload identities cross the worker boundary. */
+function readSendOutput(db, input) {
+	const { journeyId, workId, revision } = input;
+	const state = readJourney(db, journeyId);
+	if (!state?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (state.phase === "completed" && state.outputVersion !== 1) throw new ApplicationError("SCOPE_NOT_READY");
+	assertJourneyPrivacyReady(state, true);
+	if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
+	const work = state.works.find((item) => item.id === workId);
+	if (!work?.artifact || work.revision !== revision || work.artifact.revision !== revision) throw new ApplicationError("REVISION_CONFLICT");
+	const [output] = readJourneyResources(db, {
+		journeyId,
+		kind: "output",
+		id: `${workId}:${revision}`
+	});
+	if (output?.kind !== "output" || output.workId !== workId || output.revision !== revision || output.primary.sha256 !== work.artifact.sha256) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+	if (!input.sessions) return {
+		output,
+		identities: []
+	};
+	const [base] = readJourneyResources(db, {
+		journeyId,
+		kind: "base",
+		id: `${workId}:${output.finalMaskLedger.inputRevision}`
+	});
+	if (base?.kind !== "base" || base.workId !== workId || base.inputRevision !== output.finalMaskLedger.inputRevision || base.primary.sha256 !== output.finalMaskLedger.basePrimarySha256) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+	const plan = readInventoryPlan(db, state);
+	const sessions = new Map(plan.approval.inventory.sessions.map((session) => [session.id, session]));
+	const groups = /* @__PURE__ */ new Map();
+	const identities = base.sessions.map((binding) => {
+		const session = sessions.get(binding.applicationSessionId);
+		const part = session?.parts[0];
+		const lastAt = session?.lastInteractionAt ?? session?.createdAt;
+		if (!session || !part || !lastAt || !Number.isFinite(Date.parse(lastAt))) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+		const native = part.nativeEvidence?.identity;
+		if (native?.sessionId?.trim() && native.role !== "unknown" && (native.role !== "worker" || native.agentId?.trim() && session.harness === "claude")) {
+			const key = JSON.stringify([
+				session.harness,
+				native.sessionId,
+				native.role === "worker" ? native.agentId : null
+			]);
+			const group = groups.get(key) ?? [];
+			group.push(binding.archiveSessionId);
+			groups.set(key, group);
+		}
+		const nativeId = part.nativeEvidence?.identity?.sessionId ?? session.sourceSessionId;
+		const path = part.harnessRelativePath ?? "";
+		if (!path && !nativeId?.trim() || isAbsolute(path) || path.includes("\\") || path.split("/").some((segment) => segment === ".." || segment === ".")) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+		return {
+			archiveSessionId: binding.archiveSessionId,
+			relativePath: path,
+			lastAt: new Date(lastAt).toISOString()
+		};
+	});
+	const duplicates = [...groups.values()].filter((group) => group.length > 1);
+	if (!duplicates.length) return {
+		output,
+		identities
+	};
+	const duplicateIds = new Set(duplicates.flat());
+	const owners = new Map(base.sessions.map((s) => [s.archiveSessionId, s.applicationSessionId]));
+	const sources = base.sourceBindings.flatMap((binding) => {
+		if (!duplicateIds.has(binding.sessionId) || binding.bundleId !== base.bundleId || owners.get(binding.sessionId) !== binding.applicationSessionId) return [];
+		const part = sessions.get(binding.applicationSessionId)?.parts.find((p) => p.id === binding.sourcePartId);
+		return part ? [{
+			session: binding.sessionId,
+			source: binding.bundleSourceId,
+			part
+		}] : [];
+	});
+	const outputs = state.works.filter(isSelectedWork).flatMap((w) => w.artifact ? [{
+		workId: w.id,
+		revision: w.revision,
+		sha256: w.artifact.sha256,
+		bundleId: w.artifact.bundleId
+	}] : []);
+	const approval = state.privacy.packageApproval;
+	if (!approval) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	return {
+		output,
+		identities,
+		extension: {
+			groups: duplicates,
+			sources,
+			outputs,
+			approval
+		}
+	};
+}
+const sendCurrentSchema = z.object({
+	journeyId: journeyIdSchema,
+	sendId: journeyIdSchema,
+	revision: z.number().int().nonnegative()
+}).strict();
+function isCurrentSend(db, input) {
+	return !!db.prepare(`SELECT 1 FROM journey_runs r JOIN journey_current_send s ON s.journey_id=r.id
+    JOIN journey_current c ON c.journey_id=r.id AND c.singleton=1
+    WHERE r.id=? AND r.revision=? AND s.send_id=?`).get(input.journeyId, input.revision, input.sendId);
+}
+const transferCountSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const sendTransferSchema = z.object({
+	journeyId: journeyIdSchema,
+	sendId: journeyIdSchema,
+	workId: journeyIdSchema,
+	expectedJourneyRevision: transferCountSchema,
+	expectedSendRevision: transferCountSchema,
+	storedSessions: transferCountSchema.optional(),
+	sessionUpload: sendSessionUploadSchema,
+	requestKey: journeyIdSchema,
+	at: z.iso.datetime()
+}).strict();
+const sendTransferResultSchema = z.discriminatedUnion("status", [z.object({
+	status: z.literal("applied"),
+	revision: transferCountSchema,
+	lastEvent: transferCountSchema,
+	sendRevision: transferCountSchema
+}).strict(), z.object({ status: z.enum(["stale", "replayed"]) }).strict()]);
+/** Update only transfer fields in the Send document and stamp its Journey revision/event. */
+function checkpointJourneySendTransfer(db, input) {
+	const requestHash = createHash("sha256").update(JSON.stringify(input)).digest("hex");
+	const receipt = db.prepare("SELECT request_hash,journey_id FROM journey_receipts WHERE request_key=?").get(input.requestKey);
+	if (receipt) {
+		if (receipt["request_hash"] !== requestHash || receipt["journey_id"] !== input.journeyId) throw new ApplicationError("OPERATION_CONFLICT");
+		return { status: "replayed" };
+	}
+	const row = db.prepare(`SELECT r.revision,r.state_json ->> '$.formatVersion' AS formatVersion,
+        r.state_json ->> '$.phase' AS phase,
+        json_type(r.state_json,'$.consent') AS consentType,
+        r.state_json ->> '$.pendingHideId' AS pendingHideId,
+        json_type(r.state_json,'$.abandonedAt') AS abandonedType,s.json
+      FROM journey_runs r
+      JOIN journey_current c ON c.singleton=1 AND c.journey_id=r.id
+      JOIN journey_current_send cs ON cs.journey_id=r.id AND cs.send_id=?
+      JOIN journey_sends s ON s.journey_id=r.id AND s.id=cs.send_id
+      WHERE r.id=?`).get(input.sendId, input.journeyId);
+	if (!row) return { status: "stale" };
+	const revisionValue = row["revision"];
+	if (typeof revisionValue !== "number" || !Number.isSafeInteger(revisionValue) || revisionValue < 0) throw new ApplicationError("CORRUPTED_STATE");
+	if (revisionValue !== input.expectedJourneyRevision) return { status: "stale" };
+	if (row["formatVersion"] !== 10) throw new StoreError("OBSOLETE_SCHEMA", "Stored native Journey state uses an obsolete candidate format and has been preserved.");
+	if (row["consentType"] !== "object") throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (row["phase"] !== "sending") throw new ApplicationError(row["phase"] === "paused" ? "OPERATION_CANCELED" : "INVALID_TRANSITION");
+	if (row["pendingHideId"] !== null && row["pendingHideId"] !== void 0) throw new ApplicationError("REVISION_CONFLICT");
+	if (row["abandonedType"] !== null && row["abandonedType"] !== void 0) throw new ApplicationError("INVALID_TRANSITION");
+	if (typeof row["json"] !== "string") throw new ApplicationError("CORRUPTED_STATE");
+	const send = journeySendSchema.parse(JSON.parse(row["json"]));
+	if (send.revision !== input.expectedSendRevision) return { status: "stale" };
+	if (!send.subject || !send.confirmedAt) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (send.status === "paused") throw new ApplicationError("OPERATION_CANCELED");
+	if (!["sending", "waiting"].includes(send.status)) throw new ApplicationError("INVALID_TRANSITION");
+	const index = send.items.findIndex((item) => item.workId === input.workId);
+	if (index < 0) throw new ApplicationError("INVALID_SELECTION");
+	const item = send.items[index];
+	if (!item) throw new ApplicationError("CORRUPTED_STATE");
+	if (item.status !== "uploading") throw new ApplicationError("INVALID_TRANSITION");
+	const revision = revisionValue + 1;
+	const sendRevision = send.revision + 1;
+	const next = journeySendSchema.parse({
+		...send,
+		revision: sendRevision,
+		items: send.items.map((candidate, candidateIndex) => candidateIndex === index ? {
+			...candidate,
+			sessionUpload: input.sessionUpload,
+			...input.storedSessions === void 0 ? {} : { storedSessions: input.storedSessions }
+		} : candidate)
+	});
+	if (db.prepare("UPDATE journey_sends SET json=? WHERE journey_id=? AND id=?").run(JSON.stringify(next), input.journeyId, input.sendId).changes !== 1) throw new ApplicationError("REVISION_CONFLICT");
+	const inserted = db.prepare("INSERT INTO journey_events(journey_id,event_json) VALUES(?,?)").run(input.journeyId, JSON.stringify({
+		journeyId: input.journeyId,
+		revision,
+		kind: "send",
+		source: "system",
+		at: input.at
+	}));
+	const lastEvent = Number(inserted.lastInsertRowid);
+	if (!Number.isSafeInteger(lastEvent) || lastEvent < 1) throw new ApplicationError("CORRUPTED_STATE");
+	if (db.prepare(`UPDATE journey_runs SET revision=?,state_json=json_set(
+      state_json,'$.revision',?,'$.lastEvent',?) WHERE id=? AND revision=?`).run(revision, revision, lastEvent, input.journeyId, input.expectedJourneyRevision).changes !== 1) throw new ApplicationError("REVISION_CONFLICT");
+	db.prepare("INSERT INTO journey_receipts VALUES(?,?,?,?)").run(input.requestKey, requestHash, input.journeyId, revision);
+	return {
+		status: "applied",
+		revision,
+		lastEvent,
+		sendRevision
+	};
+}
 const sendLoadSchema = z.object({
 	journeyId: journeyIdSchema,
-	sendId: journeyIdSchema.optional()
+	sendId: journeyIdSchema.optional(),
+	observedRevision: z.number().int().nonnegative().optional()
 }).strict();
 const sendSnapshotSchema = z.object({
 	journey: nativeJourneySchema,
@@ -4935,6 +5161,7 @@ const sendCommitResultSchema = sendSnapshotSchema.extend({ status: z.enum([
 	"stale"
 ]) });
 function loadJourneySend(db, input) {
+	if (input.observedRevision !== void 0 && !input.sendId && db.prepare("SELECT 1 AS same FROM journey_runs WHERE id=? AND revision=?").get(input.journeyId, input.observedRevision)) return null;
 	const journey = readJourney(db, input.journeyId);
 	if (!journey) return null;
 	const row = input.sendId ? db.prepare("SELECT json FROM journey_sends WHERE journey_id=? AND id=?").get(input.journeyId, input.sendId) : db.prepare("SELECT json FROM journey_sends JOIN journey_current_send ON journey_sends.id=journey_current_send.send_id WHERE journey_current_send.journey_id=?").get(input.journeyId);
@@ -4972,6 +5199,7 @@ function commitJourneySend(db, input) {
 		...input.state,
 		revision
 	});
+	if (!prior && obsoleteJourney(current.journey)) throw new ApplicationError("JOURNEY_OBSOLETE");
 	const skipped = (workId) => current.journey.works.some((work) => work.id === workId && isSkippedWork(work));
 	const finished = send.status === "completed" && send.omitted.every((work) => [
 		"drop",
@@ -7058,6 +7286,9 @@ const operations = {
 	"journey.policy.respond": define(true, policyRespondSchema, respondJourneyPolicy, (value) => journeyCommitResultSchema.parse(value)),
 	"journey.policy.batches": define(false, policyBatchesSchema, selectPolicyBatches, (value) => z.array(z.uuid()).parse(value)),
 	"journey.send.load": define(false, sendLoadSchema, loadJourneySend, (value) => sendSnapshotSchema.nullable().parse(value)),
+	"journey.send.current": define(false, sendCurrentSchema, isCurrentSend, (value) => z.boolean().parse(value)),
+	"journey.send.transfer": define(true, sendTransferSchema, checkpointJourneySendTransfer, (value) => sendTransferResultSchema.parse(value)),
+	"journey.send.output": define(false, sendOutputQuerySchema, readSendOutput, (value) => sendOutputSchema.parse(value)),
 	"journey.send.commit": define(true, sendCommitSchema, commitJourneySend, (value) => sendCommitResultSchema.parse(value)),
 	"manual.upload.load": define(false, manualUploadLoadSchema, loadManualUpload, (value) => manualUploadSchema.nullable().parse(value)),
 	"manual.upload.commit": define(true, manualUploadCommitSchema, commitManualUpload, (value) => manualUploadResultSchema.parse(value)),
@@ -7091,6 +7322,16 @@ const operations = {
 		]),
 		state: preparationStateSchema
 	}).strict().parse(value)),
+	"journey.receipt.revision": define(false, z.object({
+		journeyId: z.uuid(),
+		key: z.uuid(),
+		hash: z.string().regex(/^[0-9a-f]{64}$/u)
+	}).strict(), (db, { journeyId, key, hash }) => {
+		const row = db.prepare("SELECT journey_id,request_hash,revision FROM journey_receipts WHERE request_key=?").get(key);
+		if (!row) return null;
+		if (row["journey_id"] !== journeyId || row["request_hash"] !== hash) throw new ApplicationError("OPERATION_CONFLICT");
+		return z.number().int().nonnegative().parse(row["revision"]);
+	}, (value) => z.number().int().nonnegative().nullable().parse(value)),
 	"journey.current": define(false, z.object({ journeyId: z.uuid().optional() }), (db, input) => readJourney(db, input.journeyId), (value) => nativeJourneySchema.nullable().parse(value)),
 	"journey.terms.reopen-empty": define(true, emptyReviewCorrectionSchema, reopenEmptyReview, (value) => emptyReviewCorrectionResultSchema.parse(value)),
 	"journey.terms.select": define(false, termsQuerySchema, selectTerms, (value) => termsSelectionSchema.parse(value)),

package/dist/inspection-worker.mjs

@@ -1,7 +1,7 @@
-import { X as createInspectionProcessor } from "./src-DlVbGB32.mjs";
-import { Nn as createStaticProcessor } from "./locate-Cx52Zqxv.mjs";
-import { l as createNativeAdapters, u as createGitNameSeedProvider } from "./src-wZx_v0Ih.mjs";
-import { G as validateInspectionRequest } from "./src-D1iONla3.mjs";
+import { et as createInspectionProcessor } from "./src-CP-K2PBv.mjs";
+import { Fn as createStaticProcessor } from "./locate-PLEyLYW-.mjs";
+import { l as createNativeAdapters, u as createGitNameSeedProvider } from "./src-dL6y2mcu.mjs";
+import { G as validateInspectionRequest } from "./src-CttNuxOn.mjs";
 import "./messages-D3m3bhva.mjs";
 import { z } from "zod";
 import { parentPort, workerData } from "node:worker_threads";