@jungjaehoon/mama-core 1.4.2 → 1.6.0

package/dist/cases/corrections.js

@@ -0,0 +1,1045 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.insertCaseCorrectionLock = insertCaseCorrectionLock;
+exports.applyCorrection = applyCorrection;
+exports.revertCorrection = revertCorrection;
+exports.supersedeCorrection = supersedeCorrection;
+const node_crypto_1 = require("node:crypto");
+const canonicalize_js_1 = require("../canonicalize.js");
+const sqlite_transaction_js_1 = require("./sqlite-transaction.js");
+const target_ref_js_1 = require("./target-ref.js");
+const RECONFIRM_TOKEN_TTL_MS = 10 * 60_000;
+const TERMINAL_CASE_STATUSES = new Set(['merged', 'archived', 'split']);
+const CORRECTION_FIELD_NAMES = new Set([
+    'status',
+    'status_reason',
+    'primary_actors',
+    'blockers',
+    'confidence',
+]);
+function normalizeNow(value) {
+    return value ?? new Date().toISOString();
+}
+function timestampMs(value) {
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : Date.now();
+}
+function sha256Hex(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+}
+function hmacHex(secret, value) {
+    return (0, node_crypto_1.createHmac)('sha256', secret).update(value, 'utf8').digest('hex');
+}
+function deterministicCorrectionId(nonce) {
+    return `corr_${sha256Hex(`case-reconfirm:v1:${nonce}`).slice(0, 32)}`;
+}
+function randomCorrectionId() {
+    return `corr_${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}`;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function parseJsonValue(value) {
+    return JSON.parse(value);
+}
+function canonicalJsonOrNull(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    return (0, canonicalize_js_1.canonicalizeJSON)(parseJsonValue(value));
+}
+function nullableString(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    return String(value);
+}
+function nullableNumber(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    const n = Number(value);
+    if (!Number.isFinite(n)) {
+        throw new Error('Membership confidence must be a finite number.');
+    }
+    return n;
+}
+function canonicalStoredJson(value) {
+    if (value === null || value.trim().length === 0) {
+        return (0, canonicalize_js_1.canonicalizeJSON)(null);
+    }
+    return (0, canonicalize_js_1.canonicalizeJSON)(parseJsonValue(value));
+}
+function decodeSecretWithEncoding(value, encoding) {
+    if (value.length === 0) {
+        return null;
+    }
+    if (encoding === 'hex') {
+        if (!/^[0-9a-f]+$/i.test(value) || value.length % 2 !== 0) {
+            return null;
+        }
+        const hex = Buffer.from(value, 'hex');
+        return hex.length >= 32 ? hex : null;
+    }
+    const decoded = Buffer.from(value, encoding);
+    return decoded.length >= 32 ? decoded : null;
+}
+function decodeSecret(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        return null;
+    }
+    const explicitEncoding = trimmed.match(/^(hex|base64|utf8):(.*)$/is);
+    if (explicitEncoding) {
+        return decodeSecretWithEncoding(explicitEncoding[2]?.trim() ?? '', explicitEncoding[1].toLowerCase());
+    }
+    const hex = decodeSecretWithEncoding(trimmed, 'hex');
+    if (hex) {
+        return hex;
+    }
+    const base64 = decodeSecretWithEncoding(trimmed, 'base64');
+    if (base64) {
+        return base64;
+    }
+    return decodeSecretWithEncoding(trimmed, 'utf8');
+}
+function secretKid(secret) {
+    return (0, node_crypto_1.createHash)('sha256').update(secret).digest('hex').slice(0, 16);
+}
+function currentSecret() {
+    const raw = process.env.MAMA_RECONFIRM_TOKEN_SECRET;
+    const secret = raw ? decodeSecret(raw) : null;
+    if (!secret) {
+        throw new Error('MAMA_RECONFIRM_TOKEN_SECRET must be a 32+ byte secret (optionally prefixed with hex:, base64:, or utf8:).');
+    }
+    return {
+        kid: secretKid(secret),
+        secret,
+    };
+}
+function verificationSecrets() {
+    const secrets = new Map();
+    const current = currentSecret();
+    secrets.set(current.kid, current.secret);
+    for (const raw of (process.env.MAMA_RECONFIRM_TOKEN_OLD_SECRETS ?? '').split(',')) {
+        const secret = decodeSecret(raw);
+        if (secret) {
+            secrets.set(secretKid(secret), secret);
+        }
+    }
+    return secrets;
+}
+function encodeReconfirmToken(payload, secret) {
+    const payloadJson = (0, canonicalize_js_1.canonicalizeJSON)(payload);
+    const signatureHex = hmacHex(secret, payloadJson);
+    const envelope = {
+        kid: payload.kid,
+        payload,
+        signature_hex: signatureHex,
+    };
+    return Buffer.from((0, canonicalize_js_1.canonicalizeJSON)(envelope), 'utf8').toString('base64url');
+}
+function readReconfirmEnvelope(token) {
+    try {
+        const parsed = JSON.parse(Buffer.from(token, 'base64url').toString('utf8'));
+        if (!isRecord(parsed) || !isRecord(parsed.payload)) {
+            return null;
+        }
+        const payload = parsed.payload;
+        if (parsed.kid !== payload.kid ||
+            payload.v !== 1 ||
+            typeof parsed.kid !== 'string' ||
+            typeof parsed.signature_hex !== 'string' ||
+            typeof payload.kid !== 'string' ||
+            typeof payload.nonce !== 'string' ||
+            typeof payload.case_id !== 'string' ||
+            typeof payload.target_kind !== 'string' ||
+            typeof payload.target_ref_hash_hex !== 'string' ||
+            typeof payload.current_value_hash_hex !== 'string' ||
+            typeof payload.proposed_value_hash_hex !== 'string' ||
+            typeof payload.confirmed_by !== 'string' ||
+            !(payload.session_id === null || typeof payload.session_id === 'string') ||
+            typeof payload.expires_at !== 'string') {
+            return null;
+        }
+        if (payload.target_kind !== 'case_field' &&
+            payload.target_kind !== 'membership' &&
+            payload.target_kind !== 'wiki_section') {
+            return null;
+        }
+        return {
+            kid: parsed.kid,
+            payload: payload,
+            signature_hex: parsed.signature_hex,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function verifyReconfirmToken(input) {
+    const envelope = readReconfirmEnvelope(input.token);
+    if (!envelope) {
+        return null;
+    }
+    const secret = verificationSecrets().get(envelope.kid);
+    if (!secret) {
+        return null;
+    }
+    const expected = Buffer.from(hmacHex(secret, (0, canonicalize_js_1.canonicalizeJSON)(envelope.payload)), 'hex');
+    const actual = Buffer.from(envelope.signature_hex, 'hex');
+    if (actual.length !== expected.length || !(0, node_crypto_1.timingSafeEqual)(actual, expected)) {
+        return null;
+    }
+    const expiresAtMs = Date.parse(envelope.payload.expires_at);
+    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= timestampMs(input.now)) {
+        return null;
+    }
+    if (envelope.payload.case_id !== input.case_id ||
+        envelope.payload.target_kind !== input.target_kind ||
+        envelope.payload.target_ref_hash_hex !== input.target_ref_hash_hex ||
+        envelope.payload.proposed_value_hash_hex !== input.proposed_value_hash_hex ||
+        envelope.payload.confirmed_by !== input.confirmed_by ||
+        envelope.payload.session_id !== input.session_id) {
+        return null;
+    }
+    return envelope.payload;
+}
+function buildRequiresReconfirm(input) {
+    const secret = currentSecret();
+    const expiresAt = new Date(timestampMs(input.now) + RECONFIRM_TOKEN_TTL_MS).toISOString();
+    const payload = {
+        v: 1,
+        kid: secret.kid,
+        nonce: (0, node_crypto_1.randomUUID)(),
+        case_id: input.case_id,
+        target_kind: input.target_kind,
+        target_ref_hash_hex: input.target_ref_hash_hex,
+        current_value_hash_hex: sha256Hex(input.current_value_json),
+        proposed_value_hash_hex: sha256Hex(input.proposed_new_value_json),
+        confirmed_by: input.confirmed_by,
+        session_id: input.session_id,
+        expires_at: expiresAt,
+    };
+    return {
+        kind: 'requires_reconfirm',
+        code: 'case.correction_requires_reconfirm',
+        case_id: input.case_id,
+        target_kind: input.target_kind,
+        target_ref_json: input.target_ref_json,
+        current_value_json: input.current_value_json,
+        old_value_json: input.old_value_json,
+        proposed_new_value_json: input.proposed_new_value_json,
+        reconfirm_token: encodeReconfirmToken(payload, secret.secret),
+        reconfirm_token_expires_at: expiresAt,
+        message: 'The target changed since the viewed snapshot. Reconfirm against the current value.',
+    };
+}
+function requireMatchingTargetKind(input) {
+    if (input.target_ref.kind !== input.target_kind) {
+        throw new Error(`Correction target_kind ${input.target_kind} does not match target_ref kind ${input.target_ref.kind}.`);
+    }
+}
+function correctionFieldName(input) {
+    const fieldFromRef = input.target_ref.kind === 'case_field' ? input.target_ref.field : null;
+    const field = input.field_name ?? fieldFromRef;
+    if (!field || !CORRECTION_FIELD_NAMES.has(field)) {
+        throw new Error(`Unsupported case correction field: ${String(field)}`);
+    }
+    if (input.field_name && fieldFromRef && input.field_name !== fieldFromRef) {
+        throw new Error('field_name must match target_ref.field.');
+    }
+    return field;
+}
+function membershipTarget(input) {
+    if (input.target_ref.kind !== 'membership') {
+        throw new Error('Membership correction requires membership target_ref.');
+    }
+    return input.target_ref;
+}
+function readCaseFieldCurrentValueJson(adapter, caseId, field) {
+    const row = adapter
+        .prepare(`
+        SELECT status, status_reason, primary_actors, blockers, confidence
+        FROM case_truth
+        WHERE case_id = ?
+      `)
+        .get(caseId);
+    if (!row) {
+        throw new Error(`case_truth row disappeared while applying correction: ${caseId}`);
+    }
+    if (field === 'primary_actors' || field === 'blockers') {
+        return canonicalStoredJson(row[field]);
+    }
+    if (field === 'confidence') {
+        if (row.confidence === null || row.confidence === undefined) {
+            return (0, canonicalize_js_1.canonicalizeJSON)(null);
+        }
+        const confidence = Number(row.confidence);
+        if (!Number.isFinite(confidence)) {
+            throw new Error(`case_truth confidence is not a finite number for case_id=${caseId}`);
+        }
+        return (0, canonicalize_js_1.canonicalizeJSON)(confidence);
+    }
+    return (0, canonicalize_js_1.canonicalizeJSON)(row[field]);
+}
+function readMembershipCurrentValueJson(adapter, caseId, sourceType, sourceId) {
+    const row = adapter
+        .prepare(`
+        SELECT status, role, confidence, reason, user_locked
+        FROM case_memberships
+        WHERE case_id = ?
+          AND source_type = ?
+          AND source_id = ?
+      `)
+        .get(caseId, sourceType, sourceId);
+    if (!row) {
+        return (0, canonicalize_js_1.canonicalizeJSON)(null);
+    }
+    return (0, canonicalize_js_1.canonicalizeJSON)({
+        status: row.status,
+        role: row.role,
+        confidence: row.confidence,
+        reason: row.reason,
+        user_locked: Number(row.user_locked) === 1 ? 1 : 0,
+    });
+}
+function readCurrentValueJson(adapter, input) {
+    if (input.target_kind === 'case_field') {
+        return readCaseFieldCurrentValueJson(adapter, input.case_id, correctionFieldName(input));
+    }
+    if (input.target_kind === 'membership') {
+        const target = membershipTarget(input);
+        return readMembershipCurrentValueJson(adapter, input.case_id, target.source_type, target.source_id);
+    }
+    return (0, canonicalize_js_1.canonicalizeJSON)(null);
+}
+function storageValueForCaseField(field, newValueJson) {
+    const value = parseJsonValue(newValueJson);
+    if (value === null) {
+        return null;
+    }
+    if (field === 'primary_actors' || field === 'blockers') {
+        return (0, canonicalize_js_1.canonicalizeJSON)(value);
+    }
+    if (field === 'confidence') {
+        const confidence = Number(value);
+        if (!Number.isFinite(confidence)) {
+            throw new Error('Case field confidence correction value must be a finite number or null.');
+        }
+        return String(confidence);
+    }
+    if (typeof value !== 'string') {
+        throw new Error(`Case field ${field} correction value must be a JSON string or null.`);
+    }
+    return value;
+}
+function applyCaseFieldMutation(input) {
+    const storageValue = storageValueForCaseField(input.field, input.new_value_json);
+    const result = input.adapter
+        .prepare(`
+        UPDATE case_truth
+           SET ${input.field} = ?,
+               updated_at = ?
+         WHERE case_id = ?
+           AND status NOT IN ('merged','archived','split')
+      `)
+        .run(storageValue, input.now, input.case_id);
+    if (result.changes !== 1) {
+        throw new Error(`Failed to apply case field correction for case_id=${input.case_id}.`);
+    }
+    const actual = readCaseFieldCurrentValueJson(input.adapter, input.case_id, input.field);
+    const expected = (0, canonicalize_js_1.canonicalizeJSON)(parseJsonValue(input.new_value_json));
+    if (actual !== expected) {
+        throw new Error(`Case field correction verification failed for ${input.field}.`);
+    }
+}
+function membershipStatus(value) {
+    if (value === 'active' || value === 'excluded' || value === 'removed') {
+        return value;
+    }
+    throw new Error('Membership correction status must be active, excluded, or removed.');
+}
+function verifyMembershipMutation(input) {
+    const row = input.adapter
+        .prepare(`
+        SELECT status, role, confidence, reason, user_locked, added_by
+        FROM case_memberships
+        WHERE case_id = ?
+          AND source_type = ?
+          AND source_id = ?
+      `)
+        .get(input.case_id, input.source_type, input.source_id);
+    if (!row) {
+        throw new Error('Membership correction verification failed: row missing.');
+    }
+    const expectedStatus = String(input.expected.status);
+    if (row.status !== expectedStatus ||
+        Number(row.user_locked) !== 1 ||
+        row.added_by !== 'user-correction') {
+        throw new Error('Membership correction verification failed.');
+    }
+    if (expectedStatus === 'active') {
+        const expectedRole = nullableString(input.expected.role);
+        const expectedConfidence = nullableNumber(input.expected.confidence);
+        const expectedReason = nullableString(input.expected.reason);
+        if (row.role !== expectedRole ||
+            row.confidence !== expectedConfidence ||
+            row.reason !== expectedReason) {
+            throw new Error('Active membership correction verification failed.');
+        }
+    }
+}
+function applyMembershipMutation(input) {
+    const value = parseJsonValue(input.new_value_json);
+    if (!isRecord(value)) {
+        throw new Error('Membership correction value must be a JSON object.');
+    }
+    const status = membershipStatus(value.status);
+    if (status === 'removed') {
+        input.adapter
+            .prepare(`
+          UPDATE case_memberships
+             SET status = 'removed',
+                 user_locked = 1,
+                 added_by = 'user-correction',
+                 updated_at = ?
+           WHERE case_id = ?
+             AND source_type = ?
+             AND source_id = ?
+        `)
+            .run(input.now, input.case_id, input.target.source_type, input.target.source_id);
+    }
+    else if (status === 'excluded') {
+        const confidence = nullableNumber(value.confidence);
+        const reason = nullableString(value.reason) ?? input.reason;
+        input.adapter
+            .prepare(`
+          INSERT INTO case_memberships (
+            case_id, source_type, source_id, role, confidence, reason, status,
+            added_by, added_at, user_locked, updated_at
+          )
+          VALUES (?, ?, ?, NULL, ?, ?, 'excluded', 'user-correction', ?, 1, ?)
+          ON CONFLICT(case_id, source_type, source_id) DO UPDATE SET
+            role = excluded.role,
+            confidence = excluded.confidence,
+            reason = excluded.reason,
+            status = excluded.status,
+            added_by = 'user-correction',
+            user_locked = 1,
+            updated_at = excluded.updated_at
+        `)
+            .run(input.case_id, input.target.source_type, input.target.source_id, confidence, reason, input.now, input.now);
+    }
+    else {
+        const role = nullableString(value.role);
+        const confidence = nullableNumber(value.confidence);
+        const reason = nullableString(value.reason);
+        input.adapter
+            .prepare(`
+          INSERT INTO case_memberships (
+            case_id, source_type, source_id, role, confidence, reason, status,
+            added_by, added_at, user_locked, updated_at
+          )
+          VALUES (?, ?, ?, ?, ?, ?, 'active', 'user-correction', ?, 1, ?)
+          ON CONFLICT(case_id, source_type, source_id) DO UPDATE SET
+            role = excluded.role,
+            confidence = excluded.confidence,
+            reason = excluded.reason,
+            status = excluded.status,
+            added_by = 'user-correction',
+            user_locked = 1,
+            updated_at = excluded.updated_at
+        `)
+            .run(input.case_id, input.target.source_type, input.target.source_id, role, confidence, reason, input.now, input.now);
+    }
+    verifyMembershipMutation({
+        adapter: input.adapter,
+        case_id: input.case_id,
+        source_type: input.target.source_type,
+        source_id: input.target.source_id,
+        expected: value,
+    });
+}
+function applyTargetMutation(input) {
+    if (input.correction.target_kind === 'case_field') {
+        applyCaseFieldMutation({
+            adapter: input.adapter,
+            case_id: input.correction.case_id,
+            field: correctionFieldName(input.correction),
+            new_value_json: input.correction.new_value_json,
+            now: input.now,
+        });
+        return;
+    }
+    if (input.correction.target_kind === 'membership') {
+        applyMembershipMutation({
+            adapter: input.adapter,
+            case_id: input.correction.case_id,
+            target: membershipTarget(input.correction),
+            new_value_json: input.correction.new_value_json,
+            reason: input.correction.reason,
+            now: input.now,
+        });
+    }
+}
+function revertMembershipValueJson(value) {
+    const canonicalValue = canonicalJsonOrNull(value);
+    if (canonicalValue === null || canonicalValue === (0, canonicalize_js_1.canonicalizeJSON)(null)) {
+        return (0, canonicalize_js_1.canonicalizeJSON)({ status: 'removed' });
+    }
+    return canonicalValue;
+}
+function insertCorrectionMemoryEvent(input) {
+    const evidenceRefs = [input.correction_id, ...(input.extra_refs ?? [])];
+    input.adapter
+        .prepare(`
+        INSERT INTO memory_events (
+          event_id, event_type, actor, source_turn_id, memory_id, topic,
+          scope_refs, evidence_refs, reason, created_at
+        )
+        VALUES (?, ?, ?, ?, NULL, ?, ?, ?, ?, ?)
+      `)
+        .run(`evt_${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}`, input.event_type, input.actor, input.source_turn_id ?? null, `case:${input.case_id}`, (0, canonicalize_js_1.canonicalizeJSON)([{ type: 'case', id: input.case_id }]), (0, canonicalize_js_1.canonicalizeJSON)(evidenceRefs), (0, canonicalize_js_1.canonicalizeJSON)({
+        correction_id: input.correction_id,
+        confirmation_summary: input.confirmation_summary,
+        ...(input.extra_refs ? { predecessor_correction_ids: input.extra_refs } : {}),
+    }), timestampMs(input.now));
+}
+function activeCorrectionForTarget(adapter, caseId, targetRefHash) {
+    const row = adapter
+        .prepare(`
+        SELECT correction_id
+        FROM case_corrections
+        WHERE case_id = ?
+          AND target_ref_hash = ?
+          AND is_lock_active = 1
+          AND reverted_at IS NULL
+        LIMIT 1
+      `)
+        .get(caseId, targetRefHash);
+    return row ?? null;
+}
+function correctionExists(adapter, correctionId) {
+    const row = adapter
+        .prepare('SELECT correction_id FROM case_corrections WHERE correction_id = ?')
+        .get(correctionId);
+    return row !== undefined;
+}
+function isUniqueConstraintError(error) {
+    return (error instanceof Error && /UNIQUE constraint|SQLITE_CONSTRAINT_UNIQUE/i.test(error.message));
+}
+function insertCaseCorrectionLock(adapter, input) {
+    const correctionAdapter = adapter;
+    const canonical = (0, target_ref_js_1.canonicalTargetRef)(input.target_ref);
+    const correctionId = input.correction_id ?? randomCorrectionId();
+    const isLockActive = input.is_lock_active ?? 1;
+    correctionAdapter
+        .prepare(`
+        INSERT INTO case_corrections (
+          correction_id, case_id, target_kind, target_ref_json, target_ref_hash,
+          field_name, old_value_json, new_value_json, reason,
+          applied_by, applied_at, is_lock_active, reverted_at, superseded_by
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?);
+      `)
+        .run(correctionId, input.case_id, input.target_kind, canonical.json, canonical.hash, input.field_name ?? null, input.old_value_json, input.new_value_json, input.reason, input.applied_by, input.applied_at, isLockActive, input.superseded_by ?? null);
+    return {
+        correction_id: correctionId,
+        case_id: input.case_id,
+        target_kind: input.target_kind,
+        target_ref_json: canonical.json,
+        target_ref_hash: canonical.hash,
+        canonical_hash_hex: canonical.hash.toString('hex'),
+        applied_at: input.applied_at,
+        is_lock_active: isLockActive,
+    };
+}
+function applyCorrection(adapter, input) {
+    const correctionAdapter = adapter;
+    return (0, sqlite_transaction_js_1.runImmediateTransaction)(correctionAdapter, () => {
+        requireMatchingTargetKind(input);
+        const now = normalizeNow(input.now);
+        const caseRow = correctionAdapter
+            .prepare(`
+          SELECT case_id, status, canonical_case_id
+          FROM case_truth
+          WHERE case_id = ?;
+        `)
+            .get(input.case_id);
+        if (!caseRow) {
+            return { kind: 'precompile_gap', code: 'case.precompile_gap', case_id: input.case_id };
+        }
+        if (TERMINAL_CASE_STATUSES.has(caseRow.status)) {
+            return {
+                kind: 'rejected',
+                code: 'case.terminal_status',
+                message: `Active corrections cannot target terminal case status ${caseRow.status}.`,
+                case_id: input.case_id,
+            };
+        }
+        const canonical = (0, target_ref_js_1.canonicalTargetRef)(input.target_ref);
+        const targetRefHashHex = canonical.hash.toString('hex');
+        const currentValueJson = readCurrentValueJson(correctionAdapter, input);
+        const expectedOldValueJson = canonicalJsonOrNull(input.old_value_json);
+        let correctionId = randomCorrectionId();
+        if (expectedOldValueJson !== null && expectedOldValueJson !== currentValueJson) {
+            const token = input.reconfirm_token ?? null;
+            if (!token) {
+                return buildRequiresReconfirm({
+                    case_id: input.case_id,
+                    target_kind: input.target_kind,
+                    target_ref_json: canonical.json,
+                    target_ref_hash_hex: targetRefHashHex,
+                    current_value_json: currentValueJson,
+                    old_value_json: expectedOldValueJson,
+                    proposed_new_value_json: input.new_value_json,
+                    confirmed_by: input.confirmed_by,
+                    session_id: input.session_id ?? null,
+                    now,
+                });
+            }
+            const payload = verifyReconfirmToken({
+                token,
+                case_id: input.case_id,
+                target_kind: input.target_kind,
+                target_ref_hash_hex: targetRefHashHex,
+                proposed_value_hash_hex: sha256Hex(input.new_value_json),
+                confirmed_by: input.confirmed_by,
+                session_id: input.session_id ?? null,
+                now,
+            });
+            if (!payload) {
+                return buildRequiresReconfirm({
+                    case_id: input.case_id,
+                    target_kind: input.target_kind,
+                    target_ref_json: canonical.json,
+                    target_ref_hash_hex: targetRefHashHex,
+                    current_value_json: currentValueJson,
+                    old_value_json: expectedOldValueJson,
+                    proposed_new_value_json: input.new_value_json,
+                    confirmed_by: input.confirmed_by,
+                    session_id: input.session_id ?? null,
+                    now,
+                });
+            }
+            correctionId = deterministicCorrectionId(payload.nonce);
+            if (correctionExists(correctionAdapter, correctionId)) {
+                return {
+                    kind: 'rejected',
+                    code: 'case.reconfirm_token_replayed',
+                    message: 'Reconfirm token has already been consumed.',
+                    case_id: input.case_id,
+                };
+            }
+            if (payload.current_value_hash_hex !== sha256Hex(currentValueJson)) {
+                return buildRequiresReconfirm({
+                    case_id: input.case_id,
+                    target_kind: input.target_kind,
+                    target_ref_json: canonical.json,
+                    target_ref_hash_hex: targetRefHashHex,
+                    current_value_json: currentValueJson,
+                    old_value_json: expectedOldValueJson,
+                    proposed_new_value_json: input.new_value_json,
+                    confirmed_by: input.confirmed_by,
+                    session_id: input.session_id ?? null,
+                    now,
+                });
+            }
+        }
+        if (activeCorrectionForTarget(correctionAdapter, input.case_id, canonical.hash)) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_active_conflict',
+                message: 'An active correction already locks this target.',
+                case_id: input.case_id,
+            };
+        }
+        let inserted;
+        try {
+            inserted = insertCaseCorrectionLock(adapter, {
+                correction_id: correctionId,
+                case_id: input.case_id,
+                target_kind: input.target_kind,
+                target_ref: input.target_ref,
+                field_name: input.target_kind === 'case_field' ? correctionFieldName(input) : null,
+                old_value_json: currentValueJson,
+                new_value_json: input.new_value_json,
+                reason: input.reason,
+                applied_by: input.confirmed_by,
+                applied_at: now,
+                is_lock_active: 1,
+                superseded_by: null,
+            });
+        }
+        catch (error) {
+            if (isUniqueConstraintError(error)) {
+                return {
+                    kind: 'rejected',
+                    code: 'case.correction_active_conflict',
+                    message: 'An active correction already locks this target.',
+                    case_id: input.case_id,
+                };
+            }
+            throw error;
+        }
+        applyTargetMutation({ adapter: correctionAdapter, correction: input, now });
+        insertCorrectionMemoryEvent({
+            adapter: correctionAdapter,
+            event_type: 'case.correction_applied',
+            correction_id: inserted.correction_id,
+            case_id: input.case_id,
+            actor: input.confirmed_by,
+            source_turn_id: input.session_id ?? null,
+            confirmation_summary: input.confirmation_summary,
+            now,
+        });
+        return {
+            kind: 'applied',
+            correction_id: inserted.correction_id,
+            case_id: input.case_id,
+            target_ref_json: inserted.target_ref_json,
+            canonical_hash_hex: inserted.canonical_hash_hex,
+        };
+    });
+}
+function revertCorrection(adapter, input) {
+    const correctionAdapter = adapter;
+    return (0, sqlite_transaction_js_1.runImmediateTransaction)(correctionAdapter, () => {
+        const now = normalizeNow(input.now);
+        const row = correctionAdapter
+            .prepare(`
+          SELECT correction_id, case_id, target_kind, target_ref_json, field_name,
+                 old_value_json, is_lock_active, reverted_at
+                 , superseded_by
+          FROM case_corrections
+          WHERE correction_id = ?
+        `)
+            .get(input.correction_id);
+        if (!row) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_not_found',
+                message: 'Correction not found.',
+                correction_id: input.correction_id,
+            };
+        }
+        if (row.reverted_at !== null) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_reverted',
+                message: 'Correction has already been reverted.',
+                correction_id: input.correction_id,
+            };
+        }
+        if (Number(row.is_lock_active) === 0 && row.superseded_by) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_already_superseded',
+                message: 'Correction has already been superseded.',
+                correction_id: input.correction_id,
+            };
+        }
+        if (Number(row.is_lock_active) === 0) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_inactive',
+                message: 'Correction is inactive.',
+                correction_id: input.correction_id,
+            };
+        }
+        const caseRow = correctionAdapter
+            .prepare('SELECT status, canonical_case_id FROM case_truth WHERE case_id = ?')
+            .get(row.case_id);
+        if (!caseRow) {
+            return {
+                kind: 'precompile_gap',
+                code: 'case.precompile_gap',
+                case_id: row.case_id,
+            };
+        }
+        if (TERMINAL_CASE_STATUSES.has(caseRow.status)) {
+            return {
+                kind: 'rejected',
+                code: 'case.terminal_status',
+                message: 'Case is in a terminal status.',
+                case_id: row.case_id,
+            };
+        }
+        applyTargetMutation({
+            adapter: correctionAdapter,
+            correction: {
+                case_id: row.case_id,
+                target_kind: row.target_kind,
+                target_ref: parseJsonValue(row.target_ref_json),
+                field_name: row.field_name ?? undefined,
+                old_value_json: null,
+                new_value_json: row.target_kind === 'membership'
+                    ? revertMembershipValueJson(row.old_value_json)
+                    : (row.old_value_json ?? (0, canonicalize_js_1.canonicalizeJSON)(null)),
+                reason: 'Revert correction',
+                confirmed: true,
+                confirmed_by: input.confirmed_by,
+                confirmation_summary: input.confirmation_summary,
+            },
+            now,
+        });
+        correctionAdapter
+            .prepare(`
+          UPDATE case_corrections
+             SET reverted_at = ?,
+                 is_lock_active = 0
+           WHERE correction_id = ?
+        `)
+            .run(now, input.correction_id);
+        insertCorrectionMemoryEvent({
+            adapter: correctionAdapter,
+            event_type: 'case.correction_reverted',
+            correction_id: input.correction_id,
+            case_id: row.case_id,
+            actor: input.confirmed_by,
+            confirmation_summary: input.confirmation_summary,
+            now,
+        });
+        return { kind: 'reverted', correction_id: input.correction_id, case_id: row.case_id };
+    });
+}
+/**
+ * supersedeCorrection — Phase 2b. Unblocked by spec amendment-8 (2026-04-18)
+ * which added `superseded_by` to the mutable-column set in §5.4.
+ *
+ * Semantics: user changes their mind on an active correction. Inside a single
+ * transaction:
+ *   1. Read OLD row; reject if not found / reverted / already superseded / inactive.
+ *   2. INSERT new correction row referencing the same (case_id, target_kind,
+ *      target_ref_hash) with new_value_json and is_lock_active=1.
+ *   3. UPDATE OLD row: superseded_by = new.correction_id, is_lock_active = 0.
+ *   4. Emit case.correction_superseded memory_event.
+ *
+ * Per spec §5.4 invariant (amendment-8), the three mutable columns are
+ * is_lock_active + reverted_at + superseded_by. superseded_by is written
+ * ONLY inside this transition.
+ */
+function supersedeCorrection(adapter, input) {
+    const correctionAdapter = adapter;
+    return (0, sqlite_transaction_js_1.runImmediateTransaction)(correctionAdapter, () => {
+        const now = normalizeNow(input.now);
+        const old = correctionAdapter
+            .prepare(`
+          SELECT correction_id, case_id, target_kind, target_ref_json, target_ref_hash,
+                 field_name, is_lock_active, reverted_at, superseded_by
+          FROM case_corrections
+          WHERE correction_id = ?
+        `)
+            .get(input.old_correction_id);
+        if (!old) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_not_found',
+                message: 'Old correction not found.',
+                correction_id: input.old_correction_id,
+            };
+        }
+        if (old.reverted_at !== null) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_reverted',
+                message: 'Cannot supersede a reverted correction.',
+                correction_id: input.old_correction_id,
+            };
+        }
+        if (old.superseded_by !== null) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_already_superseded',
+                message: 'Correction has already been superseded.',
+                correction_id: input.old_correction_id,
+            };
+        }
+        if (Number(old.is_lock_active) === 0) {
+            return {
+                kind: 'rejected',
+                code: 'case.correction_inactive',
+                message: 'Correction is inactive.',
+                correction_id: input.old_correction_id,
+            };
+        }
+        // Terminal-case gate — mirror applyCorrection. Supersede must not
+        // rotate locks or mutate live state on merged/archived/split cases.
+        // Without this guard, case_field supersede throws from
+        // applyCaseFieldMutation (transaction rolls back but handler leaks
+        // 500) and membership supersede silently writes to a dead case.
+        const caseRow = correctionAdapter
+            .prepare('SELECT status, canonical_case_id FROM case_truth WHERE case_id = ?')
+            .get(old.case_id);
+        if (!caseRow) {
+            return {
+                kind: 'precompile_gap',
+                code: 'case.precompile_gap',
+                case_id: old.case_id,
+            };
+        }
+        if (TERMINAL_CASE_STATUSES.has(caseRow.status)) {
+            return {
+                kind: 'rejected',
+                code: 'case.terminal_status',
+                message: `Supersede rejected: case is in terminal status ${caseRow.status}.`,
+                case_id: old.case_id,
+            };
+        }
+        let newCorrectionId = randomCorrectionId();
+        // Reconstruct the ApplyCorrection-shaped input from OLD's canonical
+        // target_ref_json so we can reuse readCurrentValueJson + applyTargetMutation.
+        // The JSON round-trips through canonicalizeJSON on insert so it is safe to
+        // parse here without re-validating shape.
+        const syntheticTargetRef = parseJsonValue(old.target_ref_json);
+        const syntheticInput = {
+            case_id: old.case_id,
+            target_kind: old.target_kind,
+            target_ref: syntheticTargetRef,
+            field_name: old.field_name ?? undefined,
+            new_value_json: input.new_value_json,
+            reason: input.reason,
+            confirmed: true,
+            confirmed_by: input.confirmed_by,
+            confirmation_summary: input.confirmation_summary,
+        };
+        // Snapshot the current live value BEFORE mutating so the NEW row's
+        // old_value_json reflects the state the user actually superseded
+        // (not NULL, which would erase the audit trail).
+        const currentValueJson = readCurrentValueJson(correctionAdapter, syntheticInput);
+        const targetRefHashHex = Buffer.from(old.target_ref_hash).toString('hex');
+        // CAS / reconfirm dance — mirrors applyCorrection. Now that supersede
+        // actually writes live state (P1-1 fix), a stale-view supersede could
+        // silently overwrite a value the user never saw. Opt-in via
+        // expected_current_value_json (undefined/null = skip CAS).
+        //
+        // Canonicalize the caller's expected value before comparison so
+        // key-ordering or whitespace differences do not cause false 409s.
+        // Invalid JSON (including empty string "") throws at the handler
+        // boundary — the caller sees a validation_error rather than a bogus
+        // silent 409.
+        let canonicalExpectedCurrent = null;
+        if (typeof input.expected_current_value_json === 'string') {
+            canonicalExpectedCurrent = (0, canonicalize_js_1.canonicalizeJSON)(parseJsonValue(input.expected_current_value_json));
+        }
+        if (canonicalExpectedCurrent !== null && canonicalExpectedCurrent !== currentValueJson) {
+            const token = input.reconfirm_token ?? null;
+            if (!token) {
+                return buildRequiresReconfirm({
+                    case_id: old.case_id,
+                    target_kind: old.target_kind,
+                    target_ref_json: old.target_ref_json,
+                    target_ref_hash_hex: targetRefHashHex,
+                    current_value_json: currentValueJson,
+                    old_value_json: input.expected_current_value_json ?? null,
+                    proposed_new_value_json: input.new_value_json,
+                    confirmed_by: input.confirmed_by,
+                    session_id: input.session_id ?? null,
+                    now,
+                });
+            }
+            const payload = verifyReconfirmToken({
+                token,
+                case_id: old.case_id,
+                target_kind: old.target_kind,
+                target_ref_hash_hex: targetRefHashHex,
+                proposed_value_hash_hex: sha256Hex(input.new_value_json),
+                confirmed_by: input.confirmed_by,
+                session_id: input.session_id ?? null,
+                now,
+            });
+            if (!payload) {
+                return buildRequiresReconfirm({
+                    case_id: old.case_id,
+                    target_kind: old.target_kind,
+                    target_ref_json: old.target_ref_json,
+                    target_ref_hash_hex: targetRefHashHex,
+                    current_value_json: currentValueJson,
+                    old_value_json: input.expected_current_value_json ?? null,
+                    proposed_new_value_json: input.new_value_json,
+                    confirmed_by: input.confirmed_by,
+                    session_id: input.session_id ?? null,
+                    now,
+                });
+            }
+            newCorrectionId = deterministicCorrectionId(payload.nonce);
+            if (correctionExists(correctionAdapter, newCorrectionId)) {
+                return {
+                    kind: 'rejected',
+                    code: 'case.reconfirm_token_replayed',
+                    message: 'Reconfirm token has already been consumed.',
+                    case_id: old.case_id,
+                };
+            }
+            if (payload.current_value_hash_hex !== sha256Hex(currentValueJson)) {
+                return buildRequiresReconfirm({
+                    case_id: old.case_id,
+                    target_kind: old.target_kind,
+                    target_ref_json: old.target_ref_json,
+                    target_ref_hash_hex: targetRefHashHex,
+                    current_value_json: currentValueJson,
+                    old_value_json: input.expected_current_value_json ?? null,
+                    proposed_new_value_json: input.new_value_json,
+                    confirmed_by: input.confirmed_by,
+                    session_id: input.session_id ?? null,
+                    now,
+                });
+            }
+        }
+        // Drop OLD lock FIRST so the partial-unique (case_id, target_ref_hash)
+        // slot is free before INSERTing the NEW active row.
+        correctionAdapter
+            .prepare(`
+          UPDATE case_corrections
+             SET is_lock_active = 0
+           WHERE correction_id = ?
+        `)
+            .run(input.old_correction_id);
+        insertCaseCorrectionLock(adapter, {
+            correction_id: newCorrectionId,
+            case_id: old.case_id,
+            target_kind: old.target_kind,
+            target_ref: syntheticTargetRef,
+            field_name: old.field_name ?? undefined,
+            old_value_json: currentValueJson,
+            new_value_json: input.new_value_json,
+            reason: input.reason,
+            applied_by: input.confirmed_by,
+            applied_at: now,
+            is_lock_active: 1,
+        });
+        // Populate linkage last — sole mutation of superseded_by, permitted by
+        // spec §5.4 amendment-8 (2026-04-18).
+        correctionAdapter
+            .prepare(`
+          UPDATE case_corrections
+             SET superseded_by = ?
+           WHERE correction_id = ?
+        `)
+            .run(newCorrectionId, input.old_correction_id);
+        // Write the revised value to the live target (case_truth / case_memberships)
+        // so the correction drawer and the case board stay consistent. wiki_section
+        // targets are overlay-only and intentionally no-op here.
+        applyTargetMutation({ adapter: correctionAdapter, correction: syntheticInput, now });
+        insertCorrectionMemoryEvent({
+            adapter: correctionAdapter,
+            event_type: 'case.correction_superseded',
+            correction_id: newCorrectionId,
+            case_id: old.case_id,
+            actor: input.confirmed_by,
+            confirmation_summary: input.confirmation_summary,
+            now,
+            extra_refs: [old.correction_id],
+        });
+        return {
+            kind: 'superseded',
+            old_correction_id: input.old_correction_id,
+            new_correction_id: newCorrectionId,
+            case_id: old.case_id,
+            target_ref_json: old.target_ref_json,
+            canonical_hash_hex: Buffer.from(old.target_ref_hash).toString('hex'),
+        };
+    });
+}
+//# sourceMappingURL=corrections.js.map