@gitroll/tacitt-cli 0.6.2 → 0.6.4

package/dist/job-CYsjL4AT.mjs

@@ -1,990 +0,0 @@
-import { A as renderJobDigest, D as prepareCollectionProduction, V as writeLogicalJourneyOutput, W as readConfiguredOutputInfo, at as windowsOwnerOnly, b as writeLogicalJourneyBase, d as verifyOutputShard, f as writeOutputShard, nt as makePrivateDirectory, w as readConfiguredSearchFields, z as gitSeedsProvider } from "./src-JoT3L94j.mjs";
-import { Xt as ApplicationError, nn as reviewFamilies, zt as filterInventoryByPeriod } from "./locate-JYtFmKu-.mjs";
-import { Ar as staticSessionResourceSchema, Cn as renderedHideValue, Dn as hideKeyId, En as addHideIndexTokens, di as defaultScopedSettings, fi as freezeConfiguration, kn as packHideIndex, pi as selectFrozenConfiguration } from "./src--Ln5GHdz.mjs";
-import { constants } from "node:fs";
-import { z } from "zod";
-import { copyFile, link, lstat, mkdir, mkdtemp, open, readFile, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
-import { execFile } from "node:child_process";
-import { dirname, join } from "node:path";
-import { promisify } from "node:util";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { tmpdir } from "node:os";
-import { quote } from "shell-quote";
-//#region apps/cli/src/remote/model.ts
-function validRemotePath(path, harness) {
-	return harness === "codex" ? /^\.codex\/sessions\/\d{4}\/\d{2}\/\d{2}\/rollout-[A-Za-z0-9_.-]+\.jsonl$/u.test(path) : /^\.claude\/projects\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+\.jsonl$/u.test(path);
-}
-function insideWindow(start, window) {
-	const time = Date.parse(start);
-	return Number.isFinite(time) && time >= Date.parse(window.start) && time <= Date.parse(window.end);
-}
-//#endregion
-//#region apps/cli/src/remote/transport.ts
-const execute = promisify(execFile);
-/** Pin every component to the signed-in user's home without following links. */
-const sourceReader = `def source_open(relative):
- parts=relative.split('/')
- if any(part in ('','.', '..') for part in parts): raise RuntimeError('invalid source')
- directory=os.open(os.path.expanduser('~'),os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW)
- try:
-  for part in parts[:-1]:
-   child=os.open(part,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=directory)
-   os.close(directory)
-   directory=child
-  descriptor=os.open(parts[-1],os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK,dir_fd=directory)
-  try:
-   metadata=os.fstat(descriptor)
-   if not stat.S_ISREG(metadata.st_mode) or metadata.st_uid!=os.getuid(): raise RuntimeError('invalid source owner or type')
-   return os.fdopen(descriptor,'rb')
-  except BaseException:
-   os.close(descriptor)
-   raise
- finally: os.close(directory)`;
-/** Read only a bounded prefix, ignoring Claude bookkeeping before native session records. */
-const startReader = `def session_start(f,harness):
- prefix=f.read(262145)
- lines=prefix[:262144].split(b'\\n')
- if len(prefix)>262144: lines.pop()
- types=('user','assistant','system','progress','summary','result','queue-operation')
- for line in lines:
-  if not line.strip(): continue
-  record=json.loads(line)
-  if not isinstance(record,dict): continue
-  if harness=='codex' and record.get('type')!='session_meta': return None
-  if harness=='claude' and record.get('type') not in types: continue
-  time=record.get('timestamp')
-  if isinstance(time,str):
-   try:
-    stamp(time)
-    return time
-   except ValueError: pass
-  if harness=='codex': return None
- return None`;
-/** Fixed remote program: bounded first-record metadata only, never directory copying. */
-const listing = `import os,glob,json,datetime,stat
-harness,start,end=INPUT
-home=os.path.expanduser('~')
-def stamp(s):
- return datetime.datetime.fromisoformat(s.replace('Z','+00:00')).timestamp()
-${startReader}
-${sourceReader}
-low,high=stamp(start),stamp(end)
-pattern='.codex/sessions/*/*/*/rollout-*.jsonl' if harness=='codex' else '.claude/projects/*/*.jsonl'
-result=[]
-for count,relative in enumerate(glob.iglob(pattern,root_dir=home)):
- if count>=100000: raise RuntimeError('listing limit')
- path=os.path.join(home,relative)
- if os.path.realpath(path)!=path or not stat.S_ISREG(os.stat(path).st_mode): continue
- try:
-  with source_open(relative) as f: time=session_start(f,harness)
-  if isinstance(time,str) and low<=stamp(time)<=high: result.append({'path':relative,'start':time})
- except (ValueError,KeyError,TypeError,OSError,RuntimeError): continue
- if len(result)>10000: raise RuntimeError('file limit')
-print(json.dumps(result))`;
-function invocation(window, script) {
-	const command = quote([
-		"python3",
-		"-c",
-		script
-	]);
-	return window.transport === "ssh" ? {
-		executable: "ssh",
-		args: [
-			"-oBatchMode=yes",
-			"-oConnectTimeout=10",
-			"-oStrictHostKeyChecking=yes",
-			"-n",
-			...window.args,
-			command
-		]
-	} : {
-		executable: "gcloud",
-		args: [
-			"compute",
-			"ssh",
-			...window.args,
-			"--quiet",
-			"--ssh-flag=-oBatchMode=yes",
-			"--ssh-flag=-oConnectTimeout=10",
-			"--ssh-flag=-oStrictHostKeyChecking=yes",
-			"--ssh-flag=-n",
-			"--command",
-			command
-		]
-	};
-}
-async function run(window, script, maxBuffer) {
-	const call = invocation(window, script);
-	const execution = execute(call.executable, call.args, {
-		timeout: 6e4,
-		killSignal: "SIGKILL",
-		maxBuffer,
-		encoding: "buffer",
-		env: {
-			...process.env,
-			SSH_ASKPASS_REQUIRE: "never",
-			CLOUDSDK_CORE_DISABLE_PROMPTS: "1"
-		}
-	});
-	let timer;
-	const deadline = new Promise((_resolve, reject) => {
-		timer = setTimeout(() => {
-			execution.child?.kill("SIGKILL");
-			execution.child?.stdin?.destroy();
-			execution.child?.stdout?.destroy();
-			execution.child?.stderr?.destroy();
-			reject(/* @__PURE__ */ new Error("REMOTE_TRANSPORT_TIMEOUT"));
-		}, 6e4);
-	});
-	try {
-		return await Promise.race([execution, deadline]);
-	} finally {
-		clearTimeout(timer);
-	}
-}
-function createRemoteTransport() {
-	return {
-		async list(window) {
-			const input = JSON.stringify([
-				window.harness,
-				window.start,
-				window.end
-			]);
-			const { stdout } = await run(window, listing.replace("INPUT", input), 4194304);
-			const value = JSON.parse(stdout.toString("utf8"));
-			if (!Array.isArray(value)) throw new Error("INVALID_REMOTE_LIST");
-			const files = [];
-			for (const item of value) {
-				if (!item || typeof item !== "object" || !("path" in item) || !("start" in item) || typeof item.path !== "string" || typeof item.start !== "string") throw new Error("INVALID_REMOTE_FILE");
-				files.push({
-					path: item.path,
-					start: item.start
-				});
-			}
-			return files;
-		},
-		async copy(window, file, destination) {
-			if (!validRemotePath(file.path, window.harness)) throw new Error("INVALID_REMOTE_PATH");
-			const { stdout } = await run(window, `import os,sys,stat,json,datetime
-def stamp(value): return datetime.datetime.fromisoformat(value.replace('Z','+00:00')).timestamp()
-${startReader}
-${sourceReader}
-with source_open(${JSON.stringify(file.path)}) as f:
- s=os.fstat(f.fileno())
- if not stat.S_ISREG(s.st_mode) or s.st_size>268435456: raise RuntimeError('source limit')
- time=session_start(f,${JSON.stringify(window.harness)})
- if time is None or not stamp(${JSON.stringify(window.start)})<=stamp(time)<=stamp(${JSON.stringify(window.end)}): raise RuntimeError('source outside window')
- f.seek(0)
- data=f.read(268435457)
- if len(data)>268435456: raise RuntimeError('source limit')
- sys.stdout.buffer.write(data)`, 268435456);
-			await writeFile(destination, stdout, {
-				flag: "wx",
-				mode: 384
-			});
-		}
-	};
-}
-//#endregion
-//#region apps/cli/src/remote/collect.ts
-/** Validate the copied bounded native start records rather than trusting a stale remote listing. */
-async function copiedStart(path, harness) {
-	const handle = await open(path, "r");
-	try {
-		if ((await handle.stat()).size > 268435456) throw new Error("REMOTE_FILE_TOO_LARGE");
-		const limit = 262144;
-		const buffer = Buffer.alloc(262145);
-		const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
-		const lines = buffer.toString("utf8", 0, Math.min(bytesRead, limit)).split("\n");
-		if (bytesRead > limit) lines.pop();
-		const types = [
-			"user",
-			"assistant",
-			"system",
-			"progress",
-			"summary",
-			"result",
-			"queue-operation"
-		];
-		for (const line of lines) {
-			if (!line.trim()) continue;
-			const value = JSON.parse(line);
-			if (!value || typeof value !== "object" || !("type" in value)) continue;
-			if (harness === "codex" && value.type !== "session_meta") return null;
-			if (harness === "claude" && (typeof value.type !== "string" || !types.includes(value.type))) continue;
-			if ("timestamp" in value && typeof value.timestamp === "string" && Number.isFinite(Date.parse(value.timestamp))) return value.timestamp;
-			if (harness === "codex") return null;
-		}
-		return null;
-	} finally {
-		await handle.close();
-	}
-}
-/** Only consented hosts are contacted. Every copy is exclusive and normal discovery reads it next. */
-async function collectRemoteWorkers(dispatches, confirmations, home, transport = createRemoteTransport(), reportFailure = () => console.error("REMOTE_WORKER_COLLECTION_FAILED"), roots = {}) {
-	const copied = [];
-	const failures = /* @__PURE__ */ new Set();
-	const seen = /* @__PURE__ */ new Set();
-	for (const window of dispatches) {
-		if (confirmations[window.host] !== true || failures.has(window.host)) continue;
-		let temporary;
-		try {
-			temporary = await mkdtemp(join(tmpdir(), "tacitt-remote-"));
-			const files = await transport.list(window);
-			if (files.length > 1e4) throw new Error("REMOTE_LIST_TOO_LARGE");
-			for (const file of files) {
-				if (!validRemotePath(file.path, window.harness) || !insideWindow(file.start, window)) continue;
-				const key = JSON.stringify([window.host, file.path]);
-				if (seen.has(key)) continue;
-				const staging = join(temporary, "worker.jsonl");
-				await transport.copy(window, file, staging);
-				const start = await copiedStart(staging, window.harness);
-				if (!start || !insideWindow(start, window)) {
-					await rm(staging, { force: true });
-					continue;
-				}
-				const hash = createHash("sha256").update(key).digest("hex");
-				const date = new Date(start).toISOString().slice(0, 10).split("-");
-				const path = window.harness === "codex" ? join(roots.codexHome ?? join(home, ".codex"), "sessions", ...date, `rollout-remote-${hash}.jsonl`) : join(roots.claudeHome ?? join(home, ".claude"), "projects", `remote-${hash.slice(0, 16)}`, `${hash}.jsonl`);
-				await mkdir(dirname(path), {
-					recursive: true,
-					mode: 448
-				});
-				try {
-					await copyFile(staging, path, constants.COPYFILE_EXCL);
-					copied.push({
-						path,
-						sourceSessionId: window.sourceSessionId
-					});
-				} catch (error) {
-					if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST") throw error;
-					const existing = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-					try {
-						if ((await existing.stat()).size <= 268435456) {
-							const incoming = await open(staging, "r");
-							try {
-								const [left, right] = await Promise.all([existing.readFile(), incoming.readFile()]);
-								if (left.equals(right)) copied.push({
-									path,
-									sourceSessionId: window.sourceSessionId
-								});
-							} finally {
-								await incoming.close();
-							}
-						}
-					} finally {
-						await existing.close();
-					}
-				}
-				seen.add(key);
-				await rm(staging, { force: true });
-			}
-		} catch (error) {
-			failures.add(window.host);
-			reportFailure(window.host, error);
-		} finally {
-			if (temporary) try {
-				await rm(temporary, {
-					recursive: true,
-					force: true
-				});
-			} catch (error) {
-				failures.add(window.host);
-				reportFailure(window.host, error);
-			}
-		}
-	}
-	return {
-		copied,
-		failures: [...failures]
-	};
-}
-//#endregion
-//#region apps/cli/src/journey/directory.ts
-async function journeyDirectory(stateDir, journeyId) {
-	let path = stateDir;
-	for (const name of ["journeys", journeyId]) {
-		path = join(path, name);
-		try {
-			await makePrivateDirectory(path);
-		} catch (cause) {
-			if (!(cause instanceof Error && "code" in cause && cause.code === "EEXIST")) throw cause;
-		}
-		const stat = await lstat(path, { bigint: true });
-		if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(path) !== path || (process.platform === "win32" ? !await windowsOwnerOnly(path, "directory") : stat.uid !== BigInt(process.getuid?.() ?? -1) || (stat.mode & 63n) !== 0n)) throw new ApplicationError("UNSAFE_STATE_PATH");
-	}
-	return path;
-}
-//#endregion
-//#region apps/cli/src/remote/state.ts
-const attachment = z.object({
-	path: z.string(),
-	sourceSessionId: z.string()
-}).strict();
-async function readRemoteState(stateDir, journeyId) {
-	const path = join(await journeyDirectory(stateDir, journeyId), "remote-workers.json");
-	try {
-		const value = JSON.parse(await readFile(path, "utf8"));
-		return z.object({
-			windows: z.array(z.object({
-				host: z.string(),
-				harness: z.enum(["codex", "claude"]),
-				transport: z.enum(["ssh", "gcloud"]),
-				args: z.array(z.string()),
-				sourceSessionId: z.string(),
-				start: z.string(),
-				end: z.string()
-			}).strict()),
-			decisions: z.record(z.string(), z.boolean()),
-			parents: z.record(z.string(), z.string()),
-			copied: z.array(attachment),
-			failures: z.array(z.string())
-		}).strict().parse(value);
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
-		throw error;
-	}
-}
-async function saveRemoteState(stateDir, journeyId, state) {
-	const path = join(await journeyDirectory(stateDir, journeyId), "remote-workers.json");
-	const temporary = `${path}.${randomUUID()}`;
-	await writeFile(temporary, JSON.stringify(state), {
-		mode: 384,
-		flag: "wx"
-	});
-	await rename(temporary, path);
-}
-async function attachRemoteWorkers(inventory, stateDir, journeyId) {
-	const state = await readRemoteState(stateDir, journeyId);
-	const allowed = new Set(state?.copied.map((copy) => copy.path) ?? []);
-	const sessions = inventory.sessions.filter((session) => session.parts.every((part) => !isRemoteImport(part.path) || allowed.has(part.path))).flatMap((session) => {
-		const imports = (state?.copied ?? []).filter((copy) => session.parts.some((part) => part.path === copy.path));
-		const parent = imports[0]?.sourceSessionId;
-		const key = parent ? state?.parents[parent] : void 0;
-		const parents = key ? inventory.sessions.filter((candidate) => candidate.sourceKey === key && candidate.parts.every((part) => !isRemoteImport(part.path))) : [];
-		const resolved = parents.length === 1 ? parents[0] : void 0;
-		if (!resolved || imports.some((copy) => copy.sourceSessionId !== parent)) return session.parts.some((part) => isRemoteImport(part.path)) ? [] : [session];
-		return [{
-			...session,
-			remoteParentSessionId: resolved.id
-		}];
-	});
-	return {
-		...inventory,
-		sessions
-	};
-}
-/** Reserved importer names never enter a later Send without that Send's consent receipt. */
-function isRemoteImport(path) {
-	return /(?:^|[/\\])rollout-remote-[a-f0-9]{64}\.jsonl$/u.test(path) || /(?:^|[/\\])projects[/\\]remote-[a-f0-9]{16}[/\\][a-f0-9]{64}\.jsonl$/u.test(path);
-}
-//#endregion
-//#region apps/cli/src/journey/plan.ts
-async function prepareSourcePlan(storage, harnesses, journeyId, sensitiveTerms, signal, period = {}, stateDir) {
-	const saved = (await storage.resources({
-		journeyId,
-		kind: "plan"
-	}))[0];
-	if (saved?.kind === "plan") return saved;
-	const discovered = await harnesses.discover(signal);
-	if (!discovered.complete) throw new ApplicationError("SCOPE_NOT_READY");
-	const linked = stateDir ? await attachRemoteWorkers(discovered, stateDir, journeyId) : discovered;
-	const inventory = filterInventoryByPeriod(linked, period);
-	if (inventory.sessions.length === 0) throw new ApplicationError("INVALID_SELECTION");
-	const families = reviewFamilies(inventory);
-	const defaults = defaultScopedSettings();
-	const settings = {
-		...defaults,
-		overall: {
-			...defaults.overall,
-			cleanup: {
-				ref: {
-					id: "native-evidence",
-					version: "2"
-				},
-				options: { assessedSessionsOnly: true }
-			}
-		},
-		workspaces: Object.fromEntries(inventory.workspaces.map((work) => [work.id, {
-			parameters: {
-				"screened-identifiers": { enabled: false },
-				"ip-addresses": { enabled: false },
-				hostnames: { enabled: false },
-				"cloud-resources": { enabled: false },
-				"mac-addresses": { enabled: false },
-				"public-key-containers": { enabled: false },
-				"geographic-coordinates": { enabled: false },
-				urls: { enabled: false },
-				"filesystem-paths": { mode: "identity-roots" }
-			},
-			optionalSteps: { "phone-numbers": true }
-		}]))
-	};
-	const configuration = freezeConfiguration(settings, inventory.sessions.flatMap((session) => {
-		const owner = families.owners.get(session.id);
-		return owner ? [{
-			sessionId: session.id,
-			workspaceId: session.workspaceId,
-			settingsOwner: {
-				sessionId: owner.id,
-				workspaceId: owner.workspaceId
-			}
-		}] : [];
-	}));
-	const resource = {
-		kind: "plan",
-		journeyId,
-		approval: {
-			runId: journeyId,
-			revision: 0,
-			approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			inventory,
-			sourceChangePolicy: "fail",
-			treatment: {
-				kind: "configured",
-				configuration,
-				dictionaryRevision: sensitiveTerms.revision
-			}
-		},
-		replacementKey: randomBytes(32).toString("hex"),
-		sensitiveTerms: {
-			revision: sensitiveTerms.revision,
-			terms: [...sensitiveTerms.terms]
-		}
-	};
-	await storage.saveResource(resource);
-	return resource;
-}
-function workApproval(approval, rootIds) {
-	if (approval.treatment?.kind !== "configured") throw new ApplicationError("PROCESSING_PLAN_UNAVAILABLE");
-	const families = reviewFamilies(approval.inventory);
-	const ids = new Set(rootIds.flatMap((id) => {
-		const members = families.members.get(id);
-		if (!members) throw new ApplicationError("UNKNOWN_ITEM");
-		return members.map((session) => session.id);
-	}));
-	const sessions = approval.inventory.sessions.filter((session) => ids.has(session.id));
-	const workspaces = new Set(sessions.map((session) => session.workspaceId));
-	return {
-		...approval,
-		inventory: {
-			...approval.inventory,
-			sessions,
-			workspaces: approval.inventory.workspaces.filter((workspace) => workspaces.has(workspace.id))
-		},
-		treatment: {
-			...approval.treatment,
-			configuration: selectFrozenConfiguration(approval.treatment.configuration, ids)
-		}
-	};
-}
-//#endregion
-//#region apps/cli/src/journey/static/production.ts
-/** Store reads of `staticBaseProduction`; undefined when no reviewed root remains. */
-async function staticBaseInputs(storage, state, work) {
-	const excluded = work.excludedReview?.snapshotId === state.snapshotId && work.excludedReview.inputRevision === work.inputRevision ? new Set(work.excludedReview.rootSessionIds) : /* @__PURE__ */ new Set();
-	const roots = work.rootSessionIds.filter((id) => !excluded.has(id));
-	if (!roots.length) return void 0;
-	const plan = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "plan"
-	}))[0];
-	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
-	const approval = workApproval(plan.approval, roots);
-	if (approval.treatment?.kind !== "configured") throw new ApplicationError("CORRUPTED_STATE");
-	const parts = new Set(approval.inventory.sessions.flatMap((session) => session.parts.map((part) => part.id)));
-	const captures = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "capture"
-	})).flatMap((item) => item.kind === "capture" && parts.has(item.capture.partId) ? [item.capture] : []);
-	if (captures.length !== parts.size) throw new ApplicationError("SCOPE_NOT_READY");
-	return {
-		journeyId: state.journeyId,
-		work,
-		roots,
-		approval,
-		captures,
-		replacementKey: createHash("sha256").update(JSON.stringify([
-			"static-base-v1",
-			plan.replacementKey,
-			work.id,
-			work.inputRevision
-		])).digest("hex"),
-		staticExceptions: {
-			workId: work.id,
-			values: state.exceptions.filter((item) => item.workId === work.id).map(({ kind, value }) => ({
-				kind,
-				value
-			}))
-		}
-	};
-}
-/** The production of `staticBaseProduction` from its stored inputs; no store access. */
-async function staticBaseFromInputs(inputs, processing, hooks) {
-	const { work, roots, approval } = inputs;
-	const { sensitiveTerms: _live, customTerms: _terms, staticExceptions: _unscoped, ...local } = processing;
-	const production = await prepareCollectionProduction(approval, inputs.journeyId, {
-		configured: {
-			...local,
-			gitNames: async () => ({
-				names: [],
-				snapshots: []
-			}),
-			replacementKey: inputs.replacementKey,
-			staticExceptions: inputs.staticExceptions
-		},
-		captures: inputs.captures,
-		everyAdmissionRefusal: true
-	}, hooks);
-	if (production.kind !== "configured" || production.workspaceFailures.length) throw new ApplicationError("SCOPE_NOT_READY");
-	const families = reviewFamilies(approval.inventory);
-	const admitted = new Set(production.selection.sessions.map((item) => item.session.id));
-	return {
-		production,
-		families,
-		work: {
-			...work,
-			rootSessionIds: roots.filter((id) => families.members.get(id)?.some((member) => admitted.has(member.id))),
-			access: work.access === "private" ? "private" : "public"
-		}
-	};
-}
-/**
-* The single production both Track B and packaging use for one Work generation (ADR 0172):
-* frozen captures, built-in static detection only (no custom terms, no Git seeds), the Work's
-* exceptions and a replacement key bound to this generation. Identical inputs give identical
-* session render jobs, so packaging can require the stored Track B result by job digest.
-*/
-async function staticBaseProduction(storage, state, work, processing, hooks) {
-	const inputs = await staticBaseInputs(storage, state, work);
-	return inputs && staticBaseFromInputs(inputs, processing, hooks);
-}
-//#endregion
-//#region apps/cli/src/journey/static/store.ts
-/** Identity, length and complete digest of one owner-only file; a symlink is never followed. */
-async function describe(path, signal) {
-	const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-	try {
-		const before = await handle.stat({ bigint: true });
-		if (!before.isFile()) throw new ApplicationError("CORRUPTED_STATE");
-		const digest = createHash("sha256");
-		let byteLength = 0;
-		const buffer = Buffer.allocUnsafe(1048576);
-		for (;;) {
-			signal.throwIfAborted();
-			const { bytesRead } = await handle.read(buffer, 0, buffer.length, byteLength);
-			if (!bytesRead) break;
-			digest.update(buffer.subarray(0, bytesRead));
-			byteLength += bytesRead;
-		}
-		const after = await handle.stat({ bigint: true });
-		if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs || BigInt(byteLength) !== after.size) throw new ApplicationError("CORRUPTED_STATE");
-		return {
-			path,
-			identity: {
-				dev: String(after.dev),
-				ino: String(after.ino)
-			},
-			sha256: digest.digest("hex"),
-			byteLength
-		};
-	} finally {
-		await handle.close();
-	}
-}
-/** A stored file must still be the exact recorded file and bytes. */
-async function authenticate(file, signal) {
-	const actual = await describe(file.path, signal);
-	if (JSON.stringify(actual) !== JSON.stringify(file)) throw new ApplicationError("CORRUPTED_STATE");
-}
-/**
-* Persist one Track B session as owner-only private state beside the journey's other scan
-* files: its three spools and a digest-bound result description. Nothing here is uploaded.
-*/
-async function saveStaticSession(storage, binding, item, result, signal) {
-	const owned = [
-		result.spoolPath,
-		result.companionSpoolPath,
-		result.maskSpoolPath
-	];
-	const resultPath = join(binding.directory, `${randomUUID()}.static.json`);
-	let saved = false;
-	try {
-		if (result.kind !== "render" || result.maskSpoolPath === void 0 || result.maskEntries === void 0 || result.metadataMasks === void 0 || result.reviewSpoolPath !== void 0) throw new ApplicationError("CORRUPTED_STATE");
-		const stored = {
-			kind: "render",
-			processingMs: result.processingMs,
-			maskEntries: result.maskEntries,
-			metadataMasks: result.metadataMasks,
-			metadata: result.metadata,
-			parts: result.parts,
-			entries: result.entries,
-			agentSetup: result.agentSetup,
-			...result.agentSources === void 0 ? {} : { agentSources: result.agentSources }
-		};
-		const file = await open(resultPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
-		owned.push(resultPath);
-		try {
-			await file.writeFile(JSON.stringify(stored));
-			await file.sync();
-		} finally {
-			await file.close();
-		}
-		const resource = staticSessionResourceSchema.parse({
-			kind: "static-session",
-			...result.agentSources === void 0 ? {} : { agentSources: result.agentSources },
-			journeyId: binding.journeyId,
-			workId: binding.work.id,
-			inputRevision: binding.work.inputRevision,
-			snapshotId: binding.snapshotId,
-			sessionId: item.sessionId,
-			jobDigest: item.digest,
-			result: await describe(resultPath, signal),
-			primary: await describe(result.spoolPath, signal),
-			companion: await describe(result.companionSpoolPath, signal),
-			masks: await describe(result.maskSpoolPath, signal),
-			...result.images === void 0 ? {} : { imagesOmitted: result.images }
-		});
-		await storage.saveResource(resource);
-		saved = true;
-		return resource;
-	} finally {
-		if (!saved) {
-			for (const path of owned) if (path !== void 0) await unlink(path).catch(() => {});
-		}
-	}
-}
-/** Current-generation Track B receipts of one Work, keyed by application session ID. */
-async function staticSessions(storage, journeyId, work) {
-	const resources = (await storage.resources({
-		journeyId,
-		kind: "static-session",
-		idPrefix: `${work.id}:${work.inputRevision}:`
-	})).filter((item) => item.kind === "static-session" && item.workId === work.id && item.inputRevision === work.inputRevision);
-	return new Map(resources.map((item) => [item.sessionId, item]));
-}
-/**
-* Shape guard like the worker transport's: the bytes are bound by the recorded digest, and the
-* archive writer checks parts, entries and masks again when it consumes them.
-*/
-function isStoredResult(value) {
-	return typeof value === "object" && value !== null && Reflect.get(value, "kind") === "render" && Array.isArray(Reflect.get(value, "maskEntries")) && Array.isArray(Reflect.get(value, "metadataMasks")) && Array.isArray(Reflect.get(value, "parts")) && Array.isArray(Reflect.get(value, "entries")) && Array.isArray(Reflect.get(value, "agentSetup")) && typeof Reflect.get(value, "metadata") === "string" && Number.isSafeInteger(Reflect.get(value, "processingMs"));
-}
-/** Authenticated result description of one stored Track B session. */
-async function readStaticResult(resource, signal) {
-	await authenticate(resource.result, signal);
-	const handle = await open(resource.result.path, constants.O_RDONLY | constants.O_NOFOLLOW);
-	try {
-		const text = await handle.readFile("utf8");
-		if (createHash("sha256").update(text).digest("hex") !== resource.result.sha256) throw new ApplicationError("CORRUPTED_STATE");
-		const value = JSON.parse(text);
-		if (!isStoredResult(value)) throw new ApplicationError("CORRUPTED_STATE");
-		return value;
-	} finally {
-		await handle.close();
-	}
-}
-/**
-* Packaging from the Track B base: the stored result of exactly this job, with fresh hard links
-* to its authenticated spools that the archive writer may consume. Static detection never runs.
-*/
-async function linkedStaticResult(resource, job, signal) {
-	if (!resource || resource.jobDigest !== job.digest) throw new ApplicationError("SCOPE_NOT_READY");
-	const result = await readStaticResult(resource, signal);
-	const links = [];
-	try {
-		const linked = async (file) => {
-			const path = join(job.spoolDirectory, `${randomUUID()}.session`);
-			await link(file.path, path);
-			links.push(path);
-			const stat = await lstat(path, { bigint: true });
-			if (String(stat.dev) !== file.identity.dev || String(stat.ino) !== file.identity.ino) throw new ApplicationError("CORRUPTED_STATE");
-			await authenticate({
-				...file,
-				path
-			}, signal);
-			return path;
-		};
-		return {
-			...result,
-			spoolPath: await linked(resource.primary),
-			companionSpoolPath: await linked(resource.companion),
-			maskSpoolPath: await linked(resource.masks)
-		};
-	} catch (error) {
-		for (const path of links) await unlink(path).catch(() => {});
-		throw error;
-	}
-}
-//#endregion
-//#region apps/cli/src/journey/render/base.ts
-/**
-* The CPU-bound part of base packaging (ADR 0172): the static production from frozen captures,
-* the base pair written from the stored Track B results and its full readback. The owning
-* thread keeps every store read and write; this runs there or in a packaging worker.
-*/
-async function writeJourneyBase(work, signal, onPath) {
-	const { inputs } = work;
-	const hooks = {
-		signal,
-		onTemporary: async () => {},
-		onPhase: async () => {}
-	};
-	const prepared = await staticBaseFromInputs(inputs, work.processing, hooks);
-	const stored = new Map(work.stored.map((item) => [item.sessionId, item]));
-	const written = await writeLogicalJourneyBase({
-		production: prepared.production,
-		directory: work.directory,
-		captureReview: false,
-		work: prepared.work,
-		prerendered: async (job) => {
-			if (job.spoolDirectory === void 0) throw new ApplicationError("CORRUPTED_STATE");
-			return linkedStaticResult(stored.get(job.session.id), {
-				digest: renderJobDigest(job),
-				spoolDirectory: job.spoolDirectory
-			}, signal);
-		}
-	}, hooks, onPath);
-	return {
-		kind: "base",
-		journeyId: inputs.journeyId,
-		workId: inputs.work.id,
-		inputRevision: inputs.work.inputRevision,
-		bundleId: written.bundleId,
-		primary: written.primary,
-		companion: written.companion,
-		maskLedger: written.maskLedger,
-		sourceBindings: [...written.sourceBindings],
-		sessions: written.sessionBindings.map((binding) => {
-			const root = prepared.families.owners.get(binding.applicationSessionId);
-			if (!root) throw new ApplicationError("CORRUPTED_STATE");
-			return {
-				applicationSessionId: binding.applicationSessionId,
-				archiveSessionId: binding.sessionId,
-				rootSessionId: root.id,
-				role: root.id === binding.applicationSessionId ? "main" : "worker"
-			};
-		})
-	};
-}
-function journeyBaseJob(work) {
-	const { processing, ...rest } = work;
-	return {
-		...rest,
-		processing: {
-			environment: processing.environment,
-			...processing.limits === void 0 ? {} : { limits: processing.limits }
-		}
-	};
-}
-/**
-* Worker side: `live` holds the worker's own adapters and static processor. The base runs no
-* static detection and reads no Git names (ADR 0172); a Git-name read fails closed.
-*/
-async function runJourneyBaseJob(job, live, signal, onPath) {
-	const processing = {
-		...live,
-		...job.processing,
-		gitNames: gitSeedsProvider([])
-	};
-	return {
-		kind: "journey-base",
-		base: await writeJourneyBase({
-			...job,
-			processing
-		}, signal, onPath)
-	};
-}
-//#endregion
-//#region apps/cli/src/journey/hide-index.ts
-/**
-* Word pieces of render input, gathered as it is read so its texts are not held to the end.
-* `from` continues a collection begun in another thread (ADR 0181).
-*/
-function createHideIndexTokens(from) {
-	const tokens = new Set(from?.tokens);
-	let complete = from?.complete ?? true;
-	return {
-		tokens,
-		add: (text) => {
-			if (complete) complete = addHideIndexTokens(text, (token) => tokens.add(token));
-			if (tokens.size > 2e6) complete = false;
-		},
-		complete: () => complete
-	};
-}
-/**
-* The pieces of a Work collected in shards (ADR 0199): the same set and completeness as one
-* collection, since pieces only accumulate and the bound applies to their union.
-*/
-function mergeHideIndexTokens(parts) {
-	const tokens = /* @__PURE__ */ new Set();
-	let complete = true;
-	for (const part of parts) {
-		complete &&= part.complete;
-		for (const token of part.tokens) {
-			if (!complete) break;
-			tokens.add(token);
-			if (tokens.size > 2e6) complete = false;
-		}
-	}
-	return createHideIndexTokens({
-		tokens: complete ? tokens : [],
-		complete
-	});
-}
-/** The Work's own texts a render can mask, read before its base archive. */
-function hideIndexTexts(work) {
-	const suggestion = work.suggestion;
-	return [
-		work.title,
-		work.description,
-		work.reason,
-		...suggestion ? [
-			suggestion.title,
-			suggestion.description,
-			suggestion.reason
-		] : []
-	];
-}
-/**
-* The CPU-bound part of a hide index: word pieces of the texts and every base field, or of one
-* shard's base fields (ADR 0199).
-*/
-async function collectHideIndexTokens(texts, primary, processing, { add, complete }, signal, shard) {
-	for (const text of texts) add(text);
-	for await (const field of readConfiguredSearchFields(primary, processing, signal, true, void 0, shard)) {
-		if (!complete()) break;
-		add(field.text);
-	}
-}
-/** Keyed digests of collected word pieces and of the confirmed Hide values. */
-async function packRenderHideIndex(input) {
-	const { work } = input;
-	const { tokens, complete } = input.tokens;
-	const key = await input.storage.hideIndexKey(input.journeyId);
-	return {
-		kind: "hide-index",
-		journeyId: input.journeyId,
-		workId: work.id,
-		revision: work.revision,
-		confirmedHideRevision: input.confirmedHideRevision,
-		keyId: hideKeyId(key),
-		digests: complete() ? packHideIndex(key, tokens) : null,
-		values: packHideIndex(key, [...input.confirmed].map(([term, { kind }]) => renderedHideValue(kind, term)))
-	};
-}
-//#endregion
-//#region apps/cli/src/journey/render/job.ts
-/**
-* The same steps on the owning thread; also the fallback when workers cannot run. The written
-* primary is read back as the publisher reads an existing output.
-*/
-async function writeJourneyOutput(work, signal, onPath) {
-	const output = await writeLogicalJourneyOutput(work.request, signal, onPath);
-	await readConfiguredOutputInfo(output.primary, signal);
-	await collectHideIndexTokens(work.texts, work.request.primary, work.request.processing, work.tokens, signal);
-	return {
-		output,
-		tokens: work.tokens
-	};
-}
-function journeyOutputJob(work) {
-	const { processing, ...request } = work.request;
-	return {
-		request,
-		processing: {
-			environment: processing.environment,
-			...processing.limits === void 0 ? {} : { limits: processing.limits },
-			...processing.replacementKey === void 0 ? {} : { replacementKey: processing.replacementKey },
-			...processing.staticExceptions === void 0 ? {} : { staticExceptions: processing.staticExceptions }
-		},
-		texts: work.texts,
-		tokens: [...work.tokens.tokens],
-		tokensComplete: work.tokens.complete()
-	};
-}
-function workerProcessing(job, live) {
-	return {
-		...live,
-		...job.processing,
-		gitNames: gitSeedsProvider([])
-	};
-}
-/**
-* Worker side of one shard: its entries rewritten into private archives and the hide-index word
-* pieces of its base entries. The first shard also takes the Work's texts, title pieces and the
-* base manifest's fields, so the shards' pieces together are those of one job.
-*/
-async function runJourneyOutputShardJob(job, live, signal, onPath) {
-	const processing = workerProcessing(job, live);
-	const { maskEvidence, ...request } = job.request;
-	if (!maskEvidence) throw new Error("ARTIFACT_INVALID_APPROVAL");
-	const pieces = await writeOutputShard({
-		...request,
-		processing,
-		maskEvidence,
-		shard: job.shard
-	}, signal, onPath);
-	const first = job.shard.index === 0;
-	const tokens = createHideIndexTokens(first ? {
-		tokens: job.tokens,
-		complete: job.tokensComplete
-	} : void 0);
-	await collectHideIndexTokens(first ? job.texts : [], job.request.primary, processing, tokens, signal, job.shard);
-	return {
-		kind: "journey-output-shard",
-		pieces,
-		tokens: [...tokens.tokens],
-		tokensComplete: tokens.complete()
-	};
-}
-/** Worker side of one shard of a merged output's readback. */
-async function runJourneyOutputVerifyJob(job, signal) {
-	const ledger = job.output.finalMaskLedger;
-	if (!ledger) throw new Error("ARTIFACT_INVALID_APPROVAL");
-	await verifyOutputShard({
-		...job.output,
-		finalMaskLedger: ledger
-	}, job.shard, signal);
-	return { kind: "journey-output-verify" };
-}
-/**
-* Worker side: `live` holds the worker's own adapters and static processor. A job with
-* `request.shards` merges them; its caller then reads the output back in shards (ADR 0199).
-*/
-async function runJourneyOutputJob(job, live, signal, onPath) {
-	const processing = workerProcessing(job, live);
-	if (job.request.shards) {
-		const output = await writeLogicalJourneyOutput({
-			...job.request,
-			processing
-		}, signal, onPath);
-		await readConfiguredOutputInfo(output.primary, signal);
-		return {
-			kind: "journey-output",
-			output,
-			tokens: [],
-			tokensComplete: true
-		};
-	}
-	const written = await writeJourneyOutput({
-		request: {
-			...job.request,
-			processing
-		},
-		texts: job.texts,
-		tokens: createHideIndexTokens({
-			tokens: job.tokens,
-			complete: job.tokensComplete
-		})
-	}, signal, onPath);
-	return {
-		kind: "journey-output",
-		output: written.output,
-		tokens: [...written.tokens.tokens],
-		tokensComplete: written.tokens.complete()
-	};
-}
-//#endregion
-export { journeyDirectory as C, saveRemoteState as S, staticBaseProduction as _, writeJourneyOutput as a, isRemoteImport as b, mergeHideIndexTokens as c, runJourneyBaseJob as d, writeJourneyBase as f, staticBaseInputs as g, staticSessions as h, runJourneyOutputVerifyJob as i, packRenderHideIndex as l, saveStaticSession as m, runJourneyOutputJob as n, createHideIndexTokens as o, readStaticResult as p, runJourneyOutputShardJob as r, hideIndexTexts as s, journeyOutputJob as t, journeyBaseJob as u, prepareSourcePlan as v, collectRemoteWorkers as w, readRemoteState as x, workApproval as y };