@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/triage-contract.js

@@ -0,0 +1,45 @@
+/*
+ * triage-contract.ts — TS port of `shared/scripts/lib/triage_contract.py`,
+ * the shape of the monorepo's `triage_cli.py list --json` output.
+ *
+ * NOT the live WebUI `GET /api/triage/:projectId` wire shape (that stays
+ * `{items, origin}`, additive fields only — see the spec's Technical
+ * Approach for why). This module exists so the WebUI's understanding of the
+ * monorepo's cross-repo CLI contract stays provably in sync — the parity
+ * gate in `triage-contract.test.ts` compares its output byte-for-byte
+ * against a fixture regenerated from the REAL `triage_cli.py`.
+ */
+import { sortDeferred } from "./triage-defer.js";
+import { enrichPendingDelivery } from "./triage-enrich.js";
+import { filterTriage } from "./triage-store.js";
+/** Bump when the SHAPE changes — not when an item gains a field. Mirrors triage_contract.py. */
+export const CONTRACT_VERSION = 2;
+/**
+ * The full `list --json` payload for a resolved view. `open` = status ===
+ * "triage"; `deferred` = status === "snoozed" (park-expiry already resolved
+ * by `applyDeferOverlay` inside `readAllItems`, so a due park is already in
+ * `open` by the time this runs). Both sections are COMPLETE — never capped,
+ * mirroring upstream's "the machine contract is never capped" rule.
+ * `deferred` is ordered by `sortDeferred` (soonest dated first).
+ */
+export function buildTriageListing(items, trackedPath) {
+    const open = filterTriage(items).map((it) => ({ ...it }));
+    const deferred = items
+        .filter((it) => it.status === "snoozed")
+        .map((it) => ({ ...it }));
+    enrichPendingDelivery(open, trackedPath);
+    enrichPendingDelivery(deferred, trackedPath);
+    const severityRank = {
+        critical: 0,
+        high: 1,
+        medium: 2,
+        low: 3,
+        info: 4,
+    };
+    return {
+        contractVersion: CONTRACT_VERSION,
+        open,
+        deferred: sortDeferred(deferred, severityRank),
+    };
+}
+//# sourceMappingURL=triage-contract.js.map

package/server/dist/core/triage-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-contract.js","sourceRoot":"","sources":["../../src/core/triage-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAQlC;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAmB,EACnB,WAAmB;IAEnB,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;SACvC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5B,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACzC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,YAAY,GAA2B;QAC3C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,OAAO;QACL,eAAe,EAAE,gBAAgB;QACjC,IAAI;QACJ,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/server/dist/core/triage-defer.d.ts

@@ -0,0 +1,36 @@
+import type { TriageItem } from "../types/triage.js";
+/**
+ * Exactly `YYYY-MM-DD`, and a real calendar date (rejects e.g. 2026-02-30),
+ * or `null`. Strict on purpose — mirrors Python `parse_revisit_date`'s
+ * `datetime.strptime(raw, "%Y-%m-%d")`, which rejects a non-zero-padded or
+ * out-of-range component. An unreadable value is never guessed at; it is
+ * treated as "no date" everywhere downstream.
+ */
+export declare function parseRevisitDate(raw: unknown): string | null;
+/** The UTC calendar day of `now`, as `YYYY-MM-DD`. */
+export declare function utcToday(now: Date): string;
+/**
+ * Has a park named for `raw` come due as of `todayIso`? A park named for day
+ * D is due FROM 00:00:00 UTC on D (`todayIso >= D`) — open ON the named day,
+ * not the day after. An unreadable or missing value is NOT due — the
+ * conservative direction: a damaged date must not silently re-open an entry.
+ */
+export declare function isDue(raw: unknown, todayIso: string): boolean;
+/**
+ * Overlay park expiry on an already-resolved view. Every item gains
+ * `revisitDue`; a `snoozed` item whose date has come reads `status: "triage"`
+ * (its `revisitAt` is left untouched, so the two open-looking cases —
+ * never-parked vs. just-returned — stay distinguishable). Returns NEW item
+ * objects (never mutates the input) but is a pure function of its input, so
+ * a caller applying it exactly once per resolved view (never to its own
+ * output) gets a stable result — see the module header.
+ */
+export declare function applyDeferOverlay(items: TriageItem[], now: Date): TriageItem[];
+/**
+ * Order parked entries for display — a TOTAL order (the trailing id key
+ * breaks every tie, so "the first N" never depends on incoming order).
+ * Soonest dated return first, then undated entries, then severity (critical
+ * first, unknown last), then id. Returns a new array; the input is untouched.
+ */
+export declare function sortDeferred(items: TriageItem[], severityRank: Record<string, number>): TriageItem[];
+//# sourceMappingURL=triage-defer.d.ts.map

package/server/dist/core/triage-defer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-defer.d.ts","sourceRoot":"","sources":["../../src/core/triage-defer.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAOrD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAgB5D;AAED,sDAAsD;AACtD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,UAAU,EAAE,CAW9E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,UAAU,EAAE,EACnB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,UAAU,EAAE,CAuBd"}

package/server/dist/core/triage-defer.js

@@ -0,0 +1,117 @@
+/*
+ * triage-defer.ts — TS port of the parked-entry lifecycle from
+ * `shared/scripts/lib/triage_defer.py` (monorepo P2.03,
+ * iterate-2026-08-01-triage-defer-lifecycle, CONTRACT_VERSION 2).
+ *
+ * A parked (`status: "snoozed"`) entry names the day it should return
+ * (`revisitAt`, strictly `YYYY-MM-DD`). The park expires by DERIVATION, not
+ * by a writer: `applyDeferOverlay` resolves a due park back to
+ * `status: "triage"` on every read — nothing appends a second event. Applied
+ * EXACTLY ONCE per resolved view (in `triage-store.ts` / `triage-compose.ts`,
+ * at cache-fill time), mirroring upstream `read_all_items`, which calls
+ * `_defer.apply_revisit_expiry` once at the end and never re-applies it to an
+ * already-overlaid view (re-applying would null out a due item's `revisitAt`
+ * and re-flip `revisitDue` to false — see iterate-2026-08-05-triage-deferred-
+ * envelope plan review M2).
+ *
+ * An entry with no `revisitAt` (today's WebUI Snooze, and the
+ * upstream-permitted no-date park) is `revisitDue: false` forever —
+ * "parked-not-due" — by construction: `isDue` treats an unreadable or
+ * missing date as not due, the conservative direction.
+ */
+const DATE_PATTERN = /^(\d{4})-(\d{2})-(\d{2})$/;
+/** Sorts after every known severity — a hand-edited severity never jumps the queue. */
+const UNKNOWN_SEVERITY_RANK = 1_000;
+/**
+ * Exactly `YYYY-MM-DD`, and a real calendar date (rejects e.g. 2026-02-30),
+ * or `null`. Strict on purpose — mirrors Python `parse_revisit_date`'s
+ * `datetime.strptime(raw, "%Y-%m-%d")`, which rejects a non-zero-padded or
+ * out-of-range component. An unreadable value is never guessed at; it is
+ * treated as "no date" everywhere downstream.
+ */
+export function parseRevisitDate(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const m = DATE_PATTERN.exec(raw);
+    if (!m)
+        return null;
+    const year = Number(m[1]);
+    const month = Number(m[2]);
+    const day = Number(m[3]);
+    const d = new Date(Date.UTC(year, month - 1, day));
+    if (d.getUTCFullYear() !== year ||
+        d.getUTCMonth() !== month - 1 ||
+        d.getUTCDate() !== day) {
+        return null;
+    }
+    return raw;
+}
+/** The UTC calendar day of `now`, as `YYYY-MM-DD`. */
+export function utcToday(now) {
+    return now.toISOString().slice(0, 10);
+}
+/**
+ * Has a park named for `raw` come due as of `todayIso`? A park named for day
+ * D is due FROM 00:00:00 UTC on D (`todayIso >= D`) — open ON the named day,
+ * not the day after. An unreadable or missing value is NOT due — the
+ * conservative direction: a damaged date must not silently re-open an entry.
+ */
+export function isDue(raw, todayIso) {
+    const parsed = parseRevisitDate(raw);
+    return parsed !== null && todayIso >= parsed;
+}
+/**
+ * Overlay park expiry on an already-resolved view. Every item gains
+ * `revisitDue`; a `snoozed` item whose date has come reads `status: "triage"`
+ * (its `revisitAt` is left untouched, so the two open-looking cases —
+ * never-parked vs. just-returned — stay distinguishable). Returns NEW item
+ * objects (never mutates the input) but is a pure function of its input, so
+ * a caller applying it exactly once per resolved view (never to its own
+ * output) gets a stable result — see the module header.
+ */
+export function applyDeferOverlay(items, now) {
+    const today = utcToday(now);
+    return items.map((item) => {
+        const parked = item.status === "snoozed";
+        const due = parked && isDue(item.revisitAt, today);
+        return {
+            ...item,
+            revisitDue: due,
+            status: due ? "triage" : item.status,
+        };
+    });
+}
+/**
+ * Order parked entries for display — a TOTAL order (the trailing id key
+ * breaks every tie, so "the first N" never depends on incoming order).
+ * Soonest dated return first, then undated entries, then severity (critical
+ * first, unknown last), then id. Returns a new array; the input is untouched.
+ */
+export function sortDeferred(items, severityRank) {
+    const keyed = items.map((item) => {
+        const parsed = parseRevisitDate(item.revisitAt);
+        const rank = typeof item.severity === "string"
+            ? (severityRank[item.severity] ?? UNKNOWN_SEVERITY_RANK)
+            : UNKNOWN_SEVERITY_RANK;
+        return {
+            item,
+            hasNoDate: parsed === null,
+            dateKey: parsed ?? "",
+            rank,
+            idKey: item.id ?? "",
+        };
+    });
+    keyed.sort((a, b) => {
+        if (a.hasNoDate !== b.hasNoDate)
+            return a.hasNoDate ? 1 : -1;
+        if (a.dateKey !== b.dateKey)
+            return a.dateKey < b.dateKey ? -1 : 1;
+        if (a.rank !== b.rank)
+            return a.rank - b.rank;
+        if (a.idKey !== b.idKey)
+            return a.idKey < b.idKey ? -1 : 1;
+        return 0;
+    });
+    return keyed.map((k) => k.item);
+}
+//# sourceMappingURL=triage-defer.js.map

package/server/dist/core/triage-defer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-defer.js","sourceRoot":"","sources":["../../src/core/triage-defer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,uFAAuF;AACvF,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,IACE,CAAC,CAAC,cAAc,EAAE,KAAK,IAAI;QAC3B,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,GAAG,CAAC;QAC7B,CAAC,CAAC,UAAU,EAAE,KAAK,GAAG,EACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,QAAQ,CAAC,GAAS;IAChC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,QAAgB;IAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,MAAM,KAAK,IAAI,IAAI,QAAQ,IAAI,MAAM,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAmB,EAAE,GAAS;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO;YACL,GAAG,IAAI;YACP,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAmB,EACnB,YAAoC;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,qBAAqB,CAAC;YACxD,CAAC,CAAC,qBAAqB,CAAC;QAC5B,OAAO;YACL,IAAI;YACJ,SAAS,EAAE,MAAM,KAAK,IAAI;YAC1B,OAAO,EAAE,MAAM,IAAI,EAAE;YACrB,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;SACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAC9C,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/server/dist/core/triage-enrich.d.ts

@@ -0,0 +1,31 @@
+import type { TriageItem } from "../types/triage.js";
+/** Test-only — clear the residence memo. */
+export declare function _clearEnrichCache_TEST_ONLY(): void;
+/**
+ * Annotate every item with a CONCRETE `pendingDelivery` boolean (never
+ * undefined — external review OAI1): `true` iff the item's `append` lives
+ * ONLY in the gitignored per-tree outbox buffer, i.e. it has not yet been
+ * swept into the tracked log and "ships with the next iterate" PR.
+ * TRACKED-PREFERRED: an id present in BOTH files (post-sweep, pre-GC) is
+ * NOT pending — parallels `triage.mark_status` residence derivation.
+ * Status-independent by design (OAI9): closed items get the flag too; the
+ * inbox UI only renders open items.
+ */
+export declare function enrichPendingDelivery(items: TriageItem[], trackedPath: string): void;
+/** Injected campaign correlation ref (shape owned by the route deps). */
+export interface CampaignRef {
+    expandsTriage: string | null;
+    slug: string;
+    status: "draft" | "active" | "complete" | null;
+}
+/**
+ * FR-01.33 — annotate triage items with the campaign that expands them
+ * (campaignSlug + campaignStatus). Server-side join via the injected
+ * `listCampaignRefs` dep so the route module imports no campaign code
+ * (preserves the campaigns-no-triage-coupling boundary). Best-effort — a
+ * thrown dep never fails the triage list. Deterministic when multiple
+ * campaigns share an `expandsTriage`: prefer draft, then active, then
+ * first seen.
+ */
+export declare function enrichWithCampaignRefs(items: TriageItem[], projectId: string, listCampaignRefs: ((projectId: string) => CampaignRef[]) | undefined): void;
+//# sourceMappingURL=triage-enrich.d.ts.map

package/server/dist/core/triage-enrich.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-enrich.d.ts","sourceRoot":"","sources":["../../src/core/triage-enrich.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAoBrD,4CAA4C;AAC5C,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EAAE,EACnB,WAAW,EAAE,MAAM,GAClB,IAAI,CAKN;AAMD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,UAAU,EAAE,EACnB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC,GAAG,SAAS,GACnE,IAAI,CA6BN"}

package/server/dist/core/triage-enrich.js

@@ -0,0 +1,127 @@
+/*
+ * triage-enrich.ts — GET-route enrichment layer over the resolved triage
+ * view. Two deliberately separate concerns (external review OAI11):
+ *
+ *   enrichPendingDelivery — TRACKED-PREFERRED outbox residence flag,
+ *     mirroring the monorepo `triage_cli.py list --json` contract
+ *     (shipwright PR #177, trg-e2a0ebb3). Python layering parallel:
+ *     `read_all_items()` never emits the field — only the CLI list
+ *     surface adds it — so it must NOT live in `readAllItems()` (whose
+ *     output is parity-tested byte-for-byte against `read_all_items`).
+ *
+ *   enrichWithCampaignRefs — FR-01.33 campaign correlation, moved
+ *     verbatim from routes/triage.ts (anti-ratchet extraction,
+ *     iterate-2026-06-10-triage-pending-delivery-badge). Consumes only
+ *     the injected ref list, so the campaigns-no-triage-coupling import
+ *     boundary is preserved: this module imports no campaign code.
+ *
+ * Neither function is part of the `readAllItems` parity surface; both are
+ * per-request annotations that never persist to triage.jsonl.
+ */
+import { appendIdsInFile } from "./triage-store.js";
+import { outboxPathFor } from "./triage-paths.js";
+import { statSync } from "node:fs";
+const RESIDENCE_TTL_MS = 5_000;
+const residenceCache = new Map();
+/** Test-only — clear the residence memo. */
+export function _clearEnrichCache_TEST_ONLY() {
+    residenceCache.clear();
+}
+function mtimeOrNull(p) {
+    try {
+        return statSync(p).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Append-id residence sets for a project's tracked + outbox pair, memoized
+ * by both mtimes (5 s soft TTL, same shape as the triage-store cache) so a
+ * polling GET costs two stat() calls, not two file parses (external review
+ * OAI4/Gem1). The residence key is the triage item id (`trg-…`) of `append`
+ * events — identical to Python `_append_ids_at` (OAI2/Gem4). A missing file
+ * yields an empty set via `appendIdsInFile`'s tolerant reader (OAI7/Gem2).
+ *
+ * Deliberately NOT evicted by a writer: WebUI
+ * writes are exclusively `status` events, which never change append-id sets
+ * (and the write bumps the file mtime anyway, which misses this memo on the
+ * next call). Do not "fix" the asymmetry.
+ */
+function residenceSets(trackedPath) {
+    const outboxPath = outboxPathFor(trackedPath);
+    const trackedMtimeMs = mtimeOrNull(trackedPath);
+    const outboxMtimeMs = mtimeOrNull(outboxPath);
+    const cached = residenceCache.get(trackedPath);
+    if (cached &&
+        cached.trackedMtimeMs === trackedMtimeMs &&
+        cached.outboxMtimeMs === outboxMtimeMs &&
+        Date.now() - cached.filledAt < RESIDENCE_TTL_MS) {
+        return cached;
+    }
+    const entry = {
+        trackedMtimeMs,
+        outboxMtimeMs,
+        filledAt: Date.now(),
+        trackedIds: appendIdsInFile(trackedPath),
+        outboxIds: appendIdsInFile(outboxPath),
+    };
+    residenceCache.set(trackedPath, entry);
+    return entry;
+}
+/**
+ * Annotate every item with a CONCRETE `pendingDelivery` boolean (never
+ * undefined — external review OAI1): `true` iff the item's `append` lives
+ * ONLY in the gitignored per-tree outbox buffer, i.e. it has not yet been
+ * swept into the tracked log and "ships with the next iterate" PR.
+ * TRACKED-PREFERRED: an id present in BOTH files (post-sweep, pre-GC) is
+ * NOT pending — parallels `triage.mark_status` residence derivation.
+ * Status-independent by design (OAI9): closed items get the flag too; the
+ * inbox UI only renders open items.
+ */
+export function enrichPendingDelivery(items, trackedPath) {
+    const { trackedIds, outboxIds } = residenceSets(trackedPath);
+    for (const it of items) {
+        it.pendingDelivery = outboxIds.has(it.id) && !trackedIds.has(it.id);
+    }
+}
+/**
+ * FR-01.33 — annotate triage items with the campaign that expands them
+ * (campaignSlug + campaignStatus). Server-side join via the injected
+ * `listCampaignRefs` dep so the route module imports no campaign code
+ * (preserves the campaigns-no-triage-coupling boundary). Best-effort — a
+ * thrown dep never fails the triage list. Deterministic when multiple
+ * campaigns share an `expandsTriage`: prefer draft, then active, then
+ * first seen.
+ */
+export function enrichWithCampaignRefs(items, projectId, listCampaignRefs) {
+    if (!listCampaignRefs)
+        return;
+    let refs;
+    try {
+        refs = listCampaignRefs(projectId);
+    }
+    catch {
+        return;
+    }
+    if (!refs.length)
+        return;
+    const rank = (s) => s === "draft" ? 0 : s === "active" ? 1 : 2;
+    const byTriage = new Map();
+    for (const r of refs) {
+        if (!r.expandsTriage)
+            continue;
+        const existing = byTriage.get(r.expandsTriage);
+        if (!existing || rank(r.status) < rank(existing.status)) {
+            byTriage.set(r.expandsTriage, { slug: r.slug, status: r.status });
+        }
+    }
+    for (const it of items) {
+        const ref = byTriage.get(it.id);
+        if (ref) {
+            it.campaignSlug = ref.slug;
+            it.campaignStatus = ref.status;
+        }
+    }
+}
+//# sourceMappingURL=triage-enrich.js.map

package/server/dist/core/triage-enrich.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-enrich.js","sourceRoot":"","sources":["../../src/core/triage-enrich.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAcnC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEzD,4CAA4C;AAC5C,MAAM,UAAU,2BAA2B;IACzC,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,IACE,MAAM;QACN,MAAM,CAAC,cAAc,KAAK,cAAc;QACxC,MAAM,CAAC,aAAa,KAAK,aAAa;QACtC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,gBAAgB,EAC/C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAmB;QAC5B,cAAc;QACd,aAAa;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;QACpB,UAAU,EAAE,eAAe,CAAC,WAAW,CAAC;QACxC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC;KACvC,CAAC;IACF,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAmB,EACnB,WAAmB;IAEnB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7D,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,EAAE,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmB,EACnB,SAAiB,EACjB,gBAAoE;IAEpE,IAAI,CAAC,gBAAgB;QAAE,OAAO;IAC9B,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO;IACzB,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAU,EAAE,CACxC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,aAAa;YAAE,SAAS;QAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,EAAE,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC;YAC3B,EAAE,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC"}

package/server/dist/core/triage-lock.d.ts

@@ -0,0 +1,12 @@
+export type TriageLockRelease = () => Promise<void>;
+/**
+ * Build a collision-safe lock helper. Locking path `p`
+ * coordinates via a `<p>.weblock` directory — never the `<p>.lock`
+ * path the Python `_FileLock` sidecar occupies.
+ *
+ * @param retries proper-lockfile retry budget. Default 3 (production —
+ *   rides out transient webui-vs-webui contention from another tab).
+ *   Tests pass 0 for deterministic fast-fail on contention.
+ */
+export declare function createTriageLock(retries?: number): (p: string) => Promise<TriageLockRelease>;
+//# sourceMappingURL=triage-lock.d.ts.map

package/server/dist/core/triage-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-lock.d.ts","sourceRoot":"","sources":["../../src/core/triage-lock.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,SAAI,GACV,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAG3C"}

package/server/dist/core/triage-lock.js

@@ -0,0 +1,41 @@
+/*
+ * triage-lock.ts — collision-safe proper-lockfile factory for legacy
+ * Node-owned stores (ADR-106, iterate-20260515-triage-promote-500).
+ *
+ * Why this exists:
+ *   `<project>/.shipwright/triage.jsonl` is locked by TWO independent,
+ *   non-composable primitives:
+ *     - shipwright Python producer hooks (compliance / Phase-Quality /
+ *       drift) lock via `_FileLock`, which leaves a REGULAR FILE
+ *       sidecar at `<file>.lock`;
+ *     - the webui locks via `proper-lockfile`, whose DEFAULT lockfile
+ *       path is also `<file>.lock` — but proper-lockfile expects a
+ *       DIRECTORY there.
+ *   When the Python regular-file sidecar is present, `proper-lockfile`
+ *   does `mkdir(<file>.lock)` → `EEXIST`, then (a regular file is not a
+ *   removable stale lock-dir) exhausts its retries and throws
+ *   `ELOCKED`. Every webui triage write 500s. The Python sidecar
+ *   persists on disk, so the collision is permanent — not a race.
+ *
+ * Fix: route a Node store's lockfile to `<file>.weblock` so the two
+ *   primitives occupy disjoint paths. Triage transition safety now rests on
+ *   the Python CLI; this helper remains for other Node-owned stores.
+ *
+ * This factory is the single, tested home of the `.weblock` decision —
+ * Current users include campaign and dismissed-campaign stores. Triage routes
+ * do not use this helper: they execute the Python CLI for every transition.
+ */
+import * as lockfile from "proper-lockfile";
+/**
+ * Build a collision-safe lock helper. Locking path `p`
+ * coordinates via a `<p>.weblock` directory — never the `<p>.lock`
+ * path the Python `_FileLock` sidecar occupies.
+ *
+ * @param retries proper-lockfile retry budget. Default 3 (production —
+ *   rides out transient webui-vs-webui contention from another tab).
+ *   Tests pass 0 for deterministic fast-fail on contention.
+ */
+export function createTriageLock(retries = 3) {
+    return (p) => lockfile.lock(p, { retries, lockfilePath: `${p}.weblock` });
+}
+//# sourceMappingURL=triage-lock.js.map

package/server/dist/core/triage-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-lock.js","sourceRoot":"","sources":["../../src/core/triage-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAI5C;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAO,GAAG,CAAC;IAEX,OAAO,CAAC,CAAS,EAAE,EAAE,CACnB,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/server/dist/core/triage-origin.d.ts

@@ -0,0 +1,52 @@
+interface Upstream {
+    /** Full ref, e.g. `refs/remotes/origin/main`. */
+    ref: string;
+    remote: string;
+    branch: string;
+}
+/**
+ * Resolve the checked-out branch's upstream via `@{u}` (never hardcodes
+ * origin/main — respects a different remote, a feature branch, etc.). Returns
+ * null when there is no upstream (detached HEAD, unset tracking, non-repo).
+ */
+export declare function resolveUpstream(projectRoot: string): Upstream | null;
+/** Test-only — clear caches + in-flight/cooldown state. */
+export declare function _resetOriginState_TEST_ONLY(): void;
+/**
+ * The parsed `origin/<default>:.shipwright/triage.jsonl` snapshot, cached by the
+ * upstream ref SHA so `git show` re-runs only when the ref moves. Returns:
+ *   - `Record[]` (possibly empty) when the upstream ref resolves — empty means
+ *     the ref has no triage file yet (origin available, nothing delivered).
+ *   - `null` when there is no upstream / git failed → the composer degrades to
+ *     the local-only union.
+ */
+export declare function originSnapshot(projectRoot: string, upstream: Upstream): Record<string, unknown>[] | null;
+/** Commits the local checkout is BEHIND its upstream (for the staleness banner).
+ *  Local op, no network. Null on any failure. */
+export declare function localBehindCount(projectRoot: string): number | null;
+/**
+ * Kick a background `git fetch <remote> <branch>` if none is in flight for this
+ * repo and the cooldown has elapsed. NEVER blocks and NEVER throws into the
+ * caller — the current request serves the cached snapshot; the next read after
+ * the fetch lands picks up the new SHA. Detached from the request lifecycle.
+ */
+export declare function scheduleFetch(projectRoot: string, upstream: Upstream): void;
+export interface DeliveredOrigin {
+    /** Origin raw lines for the composer, or null to degrade to local-only. */
+    originRawLines: Record<string, unknown>[] | null;
+    /** True when the upstream ref resolved (origin snapshot is authoritative). */
+    originAvailable: boolean;
+    /** Commits the local checkout is behind upstream (banner), or null. */
+    localBehind: number | null;
+}
+/**
+ * Load the delivered-origin snapshot for a project root and schedule a
+ * background fetch. `enabled === false` (feature flag off) short-circuits to a
+ * pure local-only degrade. Any git failure also degrades. This function is
+ * synchronous and non-blocking on the network (the fetch is fire-and-forget).
+ */
+export declare function loadDeliveredOrigin(projectRoot: string, opts: {
+    enabled: boolean;
+}): DeliveredOrigin;
+export {};
+//# sourceMappingURL=triage-origin.d.ts.map

package/server/dist/core/triage-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-origin.d.ts","sourceRoot":"","sources":["../../src/core/triage-origin.ts"],"names":[],"mappings":"AAiEA,UAAU,QAAQ;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAUpE;AAUD,2DAA2D;AAC3D,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAcxG;AAED;iDACiD;AACjD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMnE;AAOD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAwC3E;AAID,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IACjD,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAQD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,eAAe,CAWjB"}

package/server/dist/core/triage-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-origin.js","sourceRoot":"","sources":["../../src/core/triage-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,oFAAoF;AACpF,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAEtC,wEAAwE;AACxE,SAAS,MAAM;IACb,OAAO;QACL,GAAG,OAAO,CAAC,GAAG;QACd,mBAAmB,EAAE,GAAG;QACxB,WAAW,EAAE,MAAM;QACnB,eAAe,EAAE,wDAAwD;QACzE,eAAe,EAAE,OAAO;KACzB,CAAC;AACJ,CAAC;AAED;oEACoE;AACpE,SAAS,UAAU,CAAC,WAAmB,EAAE,IAAc;IACrD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE;YACvD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,MAAM,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACxB,oCAAoC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAQD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;AAExD,2DAA2D;AAC3D,MAAM,UAAU,2BAA2B;IACzC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,QAAkB;IACpE,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IAEhE,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;iDACiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,8DAA8D;AACrF,CAAC;AAED,gFAAgF;AAEhF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AACxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,QAAkB;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,eAAe;IAC3D,IAAI,GAAG,GAAG,IAAI,GAAG,iBAAiB;QAAE,OAAO,CAAC,WAAW;IACvD,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACvC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;YACpG,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,QAAQ;YACf,GAAG,EAAE,MAAM,EAAE;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAaD,MAAM,QAAQ,GAAoB;IAChC,cAAc,EAAE,IAAI;IACpB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,IAAI;CAClB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,IAA0B;IAE1B,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IACnC,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO;QACL,cAAc;QACd,eAAe,EAAE,cAAc,KAAK,IAAI;QACxC,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;KAC3C,CAAC;AACJ,CAAC"}

package/server/dist/core/triage-paths.d.ts

@@ -0,0 +1,25 @@
+export type TriagePathError = {
+    reason: "missing_project_path" | "synthesized_project" | "path_traversal" | "project_root_not_directory";
+};
+export type TriagePathResult = {
+    ok: true;
+    absolute: string;
+    existed: boolean;
+} | {
+    ok: false;
+    error: TriagePathError;
+};
+export interface TriagePathProject {
+    path: string;
+    synthesized?: boolean;
+}
+/**
+ * Derive the per-tree outbox path that sits alongside an already-resolved
+ * tracked `triage.jsonl` path. The outbox lives in the SAME `.shipwright`
+ * directory that `resolveTriagePath` already realpath-guarded, so it
+ * inherits that traversal protection — there is no new path-guard surface.
+ * Pass the `absolute` from a successful `resolveTriagePath` result.
+ */
+export declare function outboxPathFor(trackedAbsolute: string): string;
+export declare function resolveTriagePath(project: TriagePathProject): TriagePathResult;
+//# sourceMappingURL=triage-paths.d.ts.map

package/server/dist/core/triage-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-paths.d.ts","sourceRoot":"","sources":["../../src/core/triage-paths.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EACF,sBAAsB,GACtB,qBAAqB,GACrB,gBAAgB,GAChB,4BAA4B,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AAc1C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA0E9E"}