@gitroll/tacitt-cli 0.6.9 → 0.6.11

package/dist/{src-V9GHLZQs.mjs → src-DlVbGB32.mjs}

@@ -1,6 +1,6 @@
-import { $n as detectStatic, An as createReplacementKey, Bn as nativeItems, En as walkNativeFields, Fn as entityDictionaryVersion, Gn as validateProfile, H as codePointLength, Hn as transformRecords, In as nativeParserVersion, Jn as validatePlan, Ln as redactionImplementationVersion, Mn as projectNativeRecord, Nn as parseNativeRecord, Pn as cleanupImplementationVersion, Qn as resolveLimits, Qt as safeCode, Un as frameRecords, V as bDigest, Vn as nativeText, Wn as retainedMainTextNodes, Xn as defaultLimits, Xt as ApplicationError, Zn as recordPointerLimits, _n as reviewRoles, bn as createSessionPreparation, c as textDigest, dr as fail$1, fn as nativeSourceIdentitySchema, fr as isProcessingCode, gn as mainReviewRole, hn as projectNativeReviewInput, in as sourceKey, ir as createEntityMatcher, j as bDuplicateShift, jn as sessionNonce, k as bBindingCap, lr as defaultDetectionLimits, mn as processNativeRecord, nn as reviewFamilies, nr as jsonSpans, o as reviewDigest, on as sourceSnapshotId, pn as withMandatoryCustomTerms, qn as buildPlan, rr as agentContextLocation, tn as familySelected, ur as ProcessingError, vn as createSentenceContext, wn as createDetectionSummary, x as createBAnalysisUnits, xn as bindInspection, yn as renderNative, zn as nativeField } from "./locate-BWkblijS.mjs";
-import { t as createZstdFrameCheck } from "./frame-Dj5Zs6UW.mjs";
-import { F as sourceIdentityEvidence, Hr as agentSourceSchema, I as withSourceEvidence, In as bWordBounded, L as agentSetupKey, Mn as bContainment, Nn as bExceptionRanges, Vr as agentSourcePathSegment, at as defaultAgentSetupInclusion, di as sourceChangePolicy, fr as resolveSourceSelection, it as classifyAgentSetup, kt as metadataProcessingVersion, pi as approvedTreatmentSchema, vi as staticCatalogRef } from "./src-DzKuzGVH.mjs";
+import { $n as buildPlan, An as createDetectionSummary, Bn as cleanupImplementationVersion, C as createBAnalysisUnits, Cn as reviewRoles, Dn as bindInspection, En as createSessionPreparation, Gn as nativeField, Hn as nativeParserVersion, In as createReplacementKey, Jn as transformRecords, Kn as nativeItems, Ln as sessionNonce, Mn as walkNativeFields, N as bDuplicateShift, Rn as projectNativeRecord, Sn as mainReviewRole, Tn as renderNative, U as bDigest, Un as redactionImplementationVersion, Vn as entityDictionaryVersion, W as codePointLength, Xn as retainedMainTextNodes, Yn as frameRecords, Zn as validateProfile, ar as detectStatic, bn as processNativeRecord, br as processingSite, c as reviewDigest, cn as reviewFamilies, cr as jsonSpans, er as validatePlan, fn as sourceSnapshotId, gr as ProcessingError, hr as defaultDetectionLimits, in as safeCode, ir as resolveLimits, j as bBindingCap, lr as agentContextLocation, nn as ApplicationError, nr as defaultLimits, qn as nativeText, rr as recordPointerLimits, sn as familySelected, u as textDigest, un as sourceKey, ur as createEntityMatcher, vn as nativeSourceIdentitySchema, vr as fail$1, wn as createSentenceContext, xn as projectNativeReviewInput, xr as siteFields, yn as withMandatoryCustomTerms, yr as isProcessingCode, zn as parseNativeRecord } from "./locate-Cx52Zqxv.mjs";
+import { t as createZstdFrameCheck } from "./frame-Bq2zRh-i.mjs";
+import { Jr as agentSourceSchema, L as sourceIdentityEvidence, Pn as resolveSourceSelection, R as withSourceEvidence, _i as sourceChangePolicy, jt as metadataProcessingVersion, nr as bContainment, or as bWordBounded, ot as classifyAgentSetup, qr as agentSourcePathSegment, rr as bExceptionRanges, st as defaultAgentSetupInclusion, wi as staticCatalogRef, yi as approvedTreatmentSchema, z as agentSetupKey } from "./src-D1iONla3.mjs";
 import { constants } from "node:fs";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rm, rmdir, stat, unlink } from "node:fs/promises";
 import { execFile, fork, spawn } from "node:child_process";
@@ -3544,7 +3544,9 @@ function unavailableContribution(kind, id, workspaceId, status, reason) {
 function reportInspectionFailure(observer, stage, error) {
 	try {
 		if (!observer) {
-			process.stderr.write(`Inspection processing failed: ${safeCode(error)} (${stage})\n`);
+			const named = processingSite(error);
+			const fields = named ? ` site=${named.site}` + (named.harness ? ` harness=${named.harness}` : "") + (named.harnessVersion ? ` version=${named.harnessVersion}` : "") : "";
+			process.stderr.write(`Inspection processing failed: ${safeCode(error)} (${stage})${fields}\n`);
 			return;
 		}
 		observer(stage, error);
@@ -4004,11 +4006,14 @@ function configuredSelection(selection, treatment) {
 				mode: { kind: "remove" },
 				replacement: edit.retainAs
 			};
-			const { replacement: _replacement, ...original } = edit;
+			if (mode.kind !== "retain") return {
+				...edit,
+				mode
+			};
+			const { replacement: _replacement, replacementSourceRanges: _source, replacementTargetRanges: _target, ...original } = edit;
 			return {
 				...original,
-				mode,
-				...mode.kind !== "retain" && edit.replacement !== void 0 ? { replacement: edit.replacement } : {}
+				mode
 			};
 		}),
 		diagnostics: selection.diagnostics,
@@ -9618,7 +9623,14 @@ function isWorkerMessage(value) {
 	if (kind === "spool") return typeof path === "string" && path.length > 0;
 	if (kind === "result") return isResult(Reflect.get(value, "result"));
 	if (kind === "worker-error") return code === "ARTIFACT_WORKER_MEMORY" || code === "ARTIFACT_PROCESSING_FAILED";
-	return kind === "error" && typeof code === "string" && code.length > 0 && (sourceId === void 0 || typeof sourceId === "string");
+	return kind === "error" && typeof code === "string" && code.length > 0 && (sourceId === void 0 || typeof sourceId === "string") && [
+		"site",
+		"harness",
+		"harnessVersion"
+	].every((key) => {
+		const field = Reflect.get(value, key);
+		return field === void 0 || typeof field === "string";
+	});
 }
 /** How long a stopped controller may take to end its Worker and flush its messages (ADR 0219). */
 const stopGraceMs = 2e3;
@@ -9699,13 +9711,18 @@ function createSessionProcess(workerUrl, heapMb, onMessage, onFailure) {
 }
 //#endregion
 //#region packages/artifact/src/configured/parallel/pool.ts
-/** Failure code plus the frozen source id that produced it, when known. */
+/** Failure code plus the frozen source id and the named refusal site (#59), when known. */
 var SessionWorkerError = class extends Error {
 	sourceId;
+	site;
+	harness;
+	harnessVersion;
 	constructor(code, sourceId, options) {
 		super(code, options);
 		this.name = "SessionWorkerError";
 		if (sourceId !== void 0) this.sourceId = sourceId;
+		const named = siteFields(options);
+		if (named) Object.assign(this, named);
 	}
 };
 /**
@@ -9912,7 +9929,7 @@ function createSessionWorkerPool(url, size, heapMb = workerHeapMb) {
 					return;
 				}
 				settle(slot, void 0, message.result);
-			} else settle(slot, new SessionWorkerError(message.code, message.sourceId));
+			} else settle(slot, new SessionWorkerError(message.code, message.sourceId, siteFields(message)));
 		} catch {
 			failPool(/* @__PURE__ */ new Error("ARTIFACT_PROCESSING_FAILED"), slot);
 		}
@@ -10169,7 +10186,7 @@ function selectConfiguredApproval(approval, admission, configuration = configure
 //#region packages/artifact/src/collection/producer/versions.ts
 /** Only configured output consumes these dependencies; hash them with actual version facts. */
 const configuredProcessingSemantics = Object.freeze({
-	catalog: "11",
+	catalog: "12",
 	parser: nativeParserVersion,
 	dictionary: entityDictionaryVersion,
 	metadata: metadataProcessingVersion,
@@ -12855,32 +12872,39 @@ async function writeOriginalWorkspace(production, workspaceId, bundleId, identit
 }
 //#endregion
 //#region packages/artifact/src/configured/admission/lifecycle.ts
-function lifecycleRecord(text, lifecycle) {
+function parsed(text) {
 	try {
-		return lifecycle.record(JSON.parse(text));
+		return JSON.parse(text);
 	} catch {
-		return false;
+		return;
 	}
 }
 /**
-* Reads the whole snapshot one bounded record at a time. Returns only when every record is an
-* exact lifecycle envelope; anything else, including an empty or oversized record, fails closed.
+* Reads the whole snapshot one bounded record at a time. Returns only when every record is a
+* lifecycle record and either one names an agent run or all match the exact journal schema
+* (ADR 0279). A launched-only file at the exact journal path is excluded when every record
+* matches that schema. Empty files, other records and oversized records fail closed.
 */
 async function confirmLifecycleSource(part, lifecycle, signal, overrides, open = openConfiguredSource) {
 	const input = await open(part, signal);
 	const cleanup = createCleanup();
 	try {
+		let agentRecords = 0;
 		let records = 0;
+		let exactOnly = true;
 		try {
 			for await (const text of frameRecords(input.chunks, "jsonl", resolveLimits(overrides).maxRecordBytes, signal)) {
-				if (!lifecycleRecord(text, lifecycle)) fail("ARTIFACT_UNRECOGNIZED_JOURNAL");
+				const value = parsed(text);
+				if (!lifecycle.record(value)) fail("ARTIFACT_UNRECOGNIZED_JOURNAL");
+				if (lifecycle.agentRecord(value)) agentRecords++;
 				records++;
+				if (!lifecycle.exactRecord(value)) exactOnly = false;
 			}
 		} catch (error) {
 			if (error instanceof ProcessingError && (error.code === "PROCESSING_LIMIT" || error.code === "PROCESSING_INVALID_RECORD")) fail("ARTIFACT_UNRECOGNIZED_JOURNAL", { cause: error });
 			throw error;
 		}
-		if (records === 0) fail("ARTIFACT_UNRECOGNIZED_JOURNAL");
+		if (records === 0 || agentRecords === 0 && !exactOnly) fail("ARTIFACT_UNRECOGNIZED_JOURNAL");
 		await input.finish();
 	} catch (error) {
 		cleanup.failed(error);
@@ -16083,7 +16107,7 @@ async function scanPreparedSession(production, sessionId, directory, hooks, canc
 			workspaceId: selected.workspace.id,
 			sessionId,
 			...source ? { sourcePartId: source.source.id } : {}
-		}), async () => {
+		}, void 0, error), async () => {
 			if (result) await unlink(result.input.file.path);
 		});
 		throw classified;
@@ -16807,24 +16831,36 @@ function buildWorkScanBatches(context, sessionId, fields, pieces) {
 /**
 * Roots whose complete frozen main capture names an automation launch. Discovery normally
 * keeps these out of classification; this catches a confirmed root it could not recognize.
+* A root whose capture the check cannot read fails like an admission refusal (issue #59), so
+* only that root leaves its Work (ADR 0188); an abort still escapes.
 */
-async function automatedRoots(rows, families, request, signal) {
+async function automatedRoots(rows, families, request, signal, onFailure) {
 	const roots = /* @__PURE__ */ new Set();
 	for (const row of rows) {
 		if (row.failure || families.owners.get(row.session.id)?.id !== row.session.id) continue;
 		const adapter = request.processing.adapters[row.session.harness];
 		for (const source of row.sources) {
 			if (source.native.role !== "main") continue;
-			const opened = await openSourceCapture(request.captures.get(source.source.path) ?? fail("ARTIFACT_SOURCE_CHANGED"));
-			const cleanup = createCleanup();
+			const capture = request.captures.get(source.source.path) ?? fail("ARTIFACT_SOURCE_CHANGED");
+			let launch;
 			try {
-				if (await capturedLaunch(source.source, opened, adapter, signal, request.processing.limits) === "automation") roots.add(row.session.id);
+				const opened = await openSourceCapture(capture);
+				const cleanup = createCleanup();
+				try {
+					launch = await capturedLaunch(source.source, opened, adapter, signal, request.processing.limits);
+				} catch (error) {
+					cleanup.failed(error);
+					throw error;
+				} finally {
+					await cleanup.run(() => opened.close());
+				}
 			} catch (error) {
-				cleanup.failed(error);
-				throw error;
-			} finally {
-				await cleanup.run(() => opened.close());
+				row.failure = inspectionFailure(error, signal);
+				onFailure(row.session, row.failure, source.source.id, error);
+				reportInspectionFailure(request.processing.onInspectionFailure, "inspection-admission", error);
+				break;
 			}
+			if (launch === "automation") roots.add(row.session.id);
 		}
 	}
 	return roots;
@@ -16860,15 +16896,16 @@ async function prepareSessionScans(request, signal) {
 		});
 	};
 	const failures = [];
+	const onFailure = (session, reason, sourcePartId, cause) => {
+		failures.push({
+			sessionId: session.id,
+			reason,
+			...sourcePartId === void 0 ? {} : { sourcePartId },
+			...cause === void 0 ? {} : { cause }
+		});
+	};
 	const rows = await admitInspection(request.inventory, request.processing, signal, {
-		onFailure(session, reason, sourcePartId, cause) {
-			failures.push({
-				sessionId: session.id,
-				reason,
-				...sourcePartId === void 0 ? {} : { sourcePartId },
-				...cause === void 0 ? {} : { cause }
-			});
-		},
+		onFailure,
 		async inspectIdentity(part, adapter, currentSignal, limits) {
 			const opened = await openSourceCapture(request.captures.get(part.path) ?? fail("ARTIFACT_SOURCE_CHANGED"));
 			const cleanup = createCleanup();
@@ -16883,7 +16920,7 @@ async function prepareSessionScans(request, signal) {
 		},
 		onExclusion: exclude
 	});
-	const automated = await automatedRoots(rows, families, request, signal);
+	const automated = await automatedRoots(rows, families, request, signal, onFailure);
 	for (const row of rows) {
 		const root = families.owners.get(row.session.id)?.id;
 		if (row.failure || root === void 0 || !automated.has(root)) continue;
@@ -16974,4 +17011,4 @@ async function verifyPreparedSessionSources(prepared, input, signal) {
 	}
 }
 //#endregion
-export { createCleanup as $, renderJobDigest as A, parallelismLimits as B, readOriginalSearchFields as C, prepareCollectionProduction as D, checkReusableBundle as E, SessionWorkerError as F, processJourneyMetadataFields as G, privateJourneyDirectory as H, sessionWorkerFailure as I, listAgentSetup as J, staticMaskCategory as K, privateCollectionDirectory as L, readCollectionIndex as M, parseCollectionWorkspaceSummary as N, captureLogicalJourneySources as O, createSharedSessionPool as P, removeNamedTemporarySpools as Q, defaultParallelism as R, readPrivateReviewPayload as S, createCollectionArtifacts as T, readLogicalJourneyFinalMasks as U, writeLogicalJourneyOutput as V, readConfiguredOutputInfo as W, createInspectionProcessor as X, createConfiguredPreviewStream as Y, createTemporary as Z, processJourneyMetadata as _, scanReviewFields as a, windowsOwnerOnly as at, writeLogicalJourneyBase as b, readSessionScanRecords as c, verifyOutputShard as d, safeError as et, writeOutputShard as f, readCapturedOriginalRows as g, captureConfiguredSessionJob as h, buildWorkScanBatches as i, restrictToOwner as it, runConfiguredSessionJob as j, capturedJourneyScope as k, scanPreparedSession as l, openConfiguredUpload as m, verifyPreparedSessionSources as n, makePrivateDirectory as nt, createWorkPieces as o, isWindowsAclFailure as ot, configuredSessionUploads as p, readWorkspacePair as q, prepareSessionScans as r, openPrivateFile as rt, readSessionScanFields as s, windowsAclCodes as st, preparedScanConfiguration as t, exclusiveLock as tt, runConfiguredScanJob as u, readStaticSessionMasks as v, readConfiguredSearchFields as w, writePrivateReviewPayload as x, staticSessionJobs as y, gitSeedsProvider as z };
+export { removeNamedTemporarySpools as $, renderJobDigest as A, parallelismLimits as B, readOriginalSearchFields as C, prepareCollectionProduction as D, checkReusableBundle as E, SessionWorkerError as F, processJourneyMetadataFields as G, privateJourneyDirectory as H, sessionWorkerFailure as I, listAgentSetup as J, staticMaskCategory as K, privateCollectionDirectory as L, readCollectionIndex as M, parseCollectionWorkspaceSummary as N, captureLogicalJourneySources as O, createSharedSessionPool as P, createTemporary as Q, defaultParallelism as R, readPrivateReviewPayload as S, createCollectionArtifacts as T, readLogicalJourneyFinalMasks as U, writeLogicalJourneyOutput as V, readConfiguredOutputInfo as W, createInspectionProcessor as X, createConfiguredPreviewStream as Y, decodeZstd as Z, processJourneyMetadata as _, scanReviewFields as a, restrictToOwner as at, writeLogicalJourneyBase as b, readSessionScanRecords as c, windowsAclCodes as ct, verifyOutputShard as d, createCleanup as et, writeOutputShard as f, readCapturedOriginalRows as g, captureConfiguredSessionJob as h, buildWorkScanBatches as i, openPrivateFile as it, runConfiguredSessionJob as j, capturedJourneyScope as k, scanPreparedSession as l, openConfiguredUpload as m, verifyPreparedSessionSources as n, exclusiveLock as nt, createWorkPieces as o, windowsOwnerOnly as ot, configuredSessionUploads as p, readWorkspacePair as q, prepareSessionScans as r, makePrivateDirectory as rt, readSessionScanFields as s, isWindowsAclFailure as st, preparedScanConfiguration as t, safeError as tt, runConfiguredScanJob as u, readStaticSessionMasks as v, readConfiguredSearchFields as w, writePrivateReviewPayload as x, staticSessionJobs as y, gitSeedsProvider as z };