@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/triage-validation.js

@@ -0,0 +1,198 @@
+/*
+ * triage-validation.ts — request-body validators for the Triage routes.
+ * Extracted out of routes/triage.ts (iterate-2026-08-05-triage-deferred-
+ * envelope) purely to keep that already-bloat-baselined file from ratcheting
+ * past its recorded ceiling; no behavior changed by the move.
+ */
+import { validateAmendEvent } from "./triage-amend.js";
+import { parseRevisitDate, utcToday } from "./triage-defer.js";
+const TRIAGE_ID_RE = /^trg-[0-9a-fA-F]{8}$/;
+const PRIORITY_VALUES = new Set([
+    "P0",
+    "P1",
+    "P2",
+    "P3",
+]);
+const COMPLEXITY_VALUES = new Set([
+    "small",
+    "medium",
+    "large",
+]);
+const MAX_TAG_LEN = 100;
+const MAX_TAGS = 32;
+const MAX_DOMAIN_LEN = 200;
+const MAX_REASON_LEN = 500;
+export function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export function containsControlChar(s) {
+    for (let i = 0; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c < 0x20 || c === 0x7f)
+            return true;
+    }
+    return false;
+}
+export function parsePromoteBody(body) {
+    if (!isPlainObject(body))
+        return { ok: false, error: { error: "body_not_object" } };
+    const triageId = body.triageId;
+    if (typeof triageId !== "string" || !TRIAGE_ID_RE.test(triageId)) {
+        return { ok: false, error: { error: "invalid_triageId", field: "triageId" } };
+    }
+    const priority = body.priority;
+    if (typeof priority !== "string" || !PRIORITY_VALUES.has(priority)) {
+        return { ok: false, error: { error: "invalid_priority", field: "priority" } };
+    }
+    const domainRaw = body.domain;
+    if (typeof domainRaw !== "string") {
+        return { ok: false, error: { error: "invalid_domain", field: "domain" } };
+    }
+    const domain = domainRaw.trim();
+    if (!domain)
+        return { ok: false, error: { error: "domain_empty", field: "domain" } };
+    if (domain.length > MAX_DOMAIN_LEN) {
+        return { ok: false, error: { error: "domain_too_long", field: "domain" } };
+    }
+    let complexityHint;
+    if (body.complexityHint !== undefined) {
+        if (typeof body.complexityHint !== "string" ||
+            !COMPLEXITY_VALUES.has(body.complexityHint)) {
+            return {
+                ok: false,
+                error: { error: "invalid_complexityHint", field: "complexityHint" },
+            };
+        }
+        complexityHint = body.complexityHint;
+    }
+    const tagsRaw = body.tags;
+    if (!Array.isArray(tagsRaw)) {
+        return { ok: false, error: { error: "invalid_tags", field: "tags" } };
+    }
+    const tagsValidated = [];
+    const seen = new Set();
+    for (const t of tagsRaw) {
+        if (typeof t !== "string") {
+            return { ok: false, error: { error: "invalid_tag_type", field: "tags" } };
+        }
+        if (containsControlChar(t)) {
+            return { ok: false, error: { error: "tag_control_char", field: "tags" } };
+        }
+        const trimmed = t.trim();
+        if (!trimmed)
+            continue;
+        if (trimmed.length > MAX_TAG_LEN) {
+            return { ok: false, error: { error: "tag_too_long", field: "tags" } };
+        }
+        if (!seen.has(trimmed)) {
+            seen.add(trimmed);
+            tagsValidated.push(trimmed);
+        }
+    }
+    if (tagsValidated.length > MAX_TAGS) {
+        return { ok: false, error: { error: "tags_too_many", field: "tags" } };
+    }
+    return {
+        ok: true,
+        value: { triageId, priority: priority, domain, complexityHint, tags: tagsValidated },
+    };
+}
+/**
+ * `newStatus` decides whether `revisitAt` is even legal on this body — park
+ * semantics apply ONLY to a `snoozed` flip, mirroring the monorepo's
+ * `mark_status` validation (`revisit_at is park semantics and is accepted
+ * only on a snoozed flip`). A non-future date (today or past) is rejected
+ * too: it would resolve straight back to `status: "triage"` on the very
+ * next read, defeating the point of parking it (iterate-2026-08-05-triage-
+ * deferred-envelope plan review, AC7).
+ */
+export function parseDismissSnoozeBody(body, newStatus) {
+    if (!isPlainObject(body))
+        return { ok: false, error: { error: "body_not_object" } };
+    const triageId = body.triageId;
+    if (typeof triageId !== "string" || !TRIAGE_ID_RE.test(triageId)) {
+        return { ok: false, error: { error: "invalid_triageId", field: "triageId" } };
+    }
+    let reason = null;
+    if (body.reason !== undefined && body.reason !== null) {
+        if (typeof body.reason !== "string") {
+            return { ok: false, error: { error: "invalid_reason", field: "reason" } };
+        }
+        if (containsControlChar(body.reason)) {
+            return { ok: false, error: { error: "reason_control_char", field: "reason" } };
+        }
+        const trimmed = body.reason.trim();
+        if (trimmed.length > MAX_REASON_LEN) {
+            return { ok: false, error: { error: "reason_too_long", field: "reason" } };
+        }
+        reason = trimmed || null;
+    }
+    let revisitAt;
+    if (body.revisitAt !== undefined && body.revisitAt !== null) {
+        if (newStatus !== "snoozed") {
+            return { ok: false, error: { error: "revisitAt_not_permitted", field: "revisitAt" } };
+        }
+        const parsed = parseRevisitDate(body.revisitAt);
+        if (parsed === null) {
+            return { ok: false, error: { error: "invalid_revisitAt", field: "revisitAt" } };
+        }
+        if (parsed <= utcToday(new Date())) {
+            return { ok: false, error: { error: "revisitAt_not_future", field: "revisitAt" } };
+        }
+        revisitAt = parsed;
+    }
+    return { ok: true, value: { triageId, reason, revisitAt } };
+}
+/**
+ * Validates a `POST /api/triage/:projectId/amend` body: a DELTA, never a
+ * rewrite — any subset of title/detail/severity, at least one present
+ * (contentless → 400 before any write, mirrors `check_amend_fields`'s
+ * writer-side precondition in `lib/triage_amend.py`). Field-level validity
+ * (non-blank title, string detail, known severity) reuses
+ * `triage-amend.ts`'s `validateAmendEvent` — the SAME check the reader
+ * applies to a stored line, so a body that would pass here is guaranteed to
+ * resolve on the very next read (no accepted-but-silently-ignored amend).
+ * `kind` is deliberately NOT accepted here — the Edit UI only offers
+ * title/detail/severity (filing-card decision); the wire format itself
+ * still supports a `kind` amend for parity with any future producer.
+ */
+export function parseAmendBody(body) {
+    if (!isPlainObject(body))
+        return { ok: false, error: { error: "body_not_object" } };
+    const triageId = body.triageId;
+    if (typeof triageId !== "string" || !TRIAGE_ID_RE.test(triageId)) {
+        return { ok: false, error: { error: "invalid_triageId", field: "triageId" } };
+    }
+    const candidate = {};
+    if (body.title !== undefined)
+        candidate.title = body.title;
+    if (body.detail !== undefined)
+        candidate.detail = body.detail;
+    if (body.severity !== undefined)
+        candidate.severity = body.severity;
+    if (Object.keys(candidate).length === 0) {
+        return { ok: false, error: { error: "amend_contentless" } };
+    }
+    if (!validateAmendEvent(candidate)) {
+        return { ok: false, error: { error: "invalid_amend_field" } };
+    }
+    // Node refuses NUL bytes in execFile arguments. Keep newlines valid in an
+    // amend detail, but reject the one character that could otherwise turn this
+    // well-formed HTTP request into an opaque process-spawn failure.
+    if ((typeof candidate.title === "string" && candidate.title.includes("\0")) ||
+        (typeof candidate.detail === "string" && candidate.detail.includes("\0"))) {
+        return { ok: false, error: { error: "invalid_amend_field" } };
+    }
+    return {
+        ok: true,
+        value: {
+            triageId,
+            ...(candidate.title !== undefined ? { title: candidate.title } : {}),
+            ...(candidate.detail !== undefined ? { detail: candidate.detail } : {}),
+            ...(candidate.severity !== undefined
+                ? { severity: candidate.severity }
+                : {}),
+        },
+    };
+}
+//# sourceMappingURL=triage-validation.js.map

package/server/dist/core/triage-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-validation.js","sourceRoot":"","sources":["../../src/core/triage-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE/D,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAC3D,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,OAAO;IACP,QAAQ;IACR,OAAO;CACR,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,GAAG,CAAC;AAqB3B,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAA0B,CAAC,EAAE,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;IACrF,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,cAAwD,CAAC;IAC7D,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACtC,IACE,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACvC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAC3C,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,EAAE;aACpE,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,IAAI,CAAC,cAA8C,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAA0B,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;KACvG,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAa,EACb,SAAkC;IAElC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACtD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,GAAG,OAAO,IAAI,IAAI,CAAC;IAC3B,CAAC;IACD,IAAI,SAA6B,CAAC;IAClC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;AAC9D,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;IAChE,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,iEAAiE;IACjE,IACE,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACzE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;IAChE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ;YACR,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAA0B,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC"}

package/server/dist/core/win32-spawn.d.ts

@@ -0,0 +1,29 @@
+export interface ResolvedSpawn {
+    command: string;
+    args: string[];
+    /** win32 only: set when the cmd.exe line is pre-quoted for `cmd /s` (a spaced
+     *  shim path) — the caller passes it straight through to child_process.spawn. */
+    windowsVerbatimArguments?: boolean;
+}
+/**
+ * Tokenize a win32 dev command WITHOUT POSIX backslash-escaping, so
+ * `C:\tools\node.exe` keeps its backslashes (audit F31). Honours double quotes
+ * for grouping args that contain spaces. Assumes the caller has already
+ * refused command-execution metacharacters (the injection fence lives in
+ * preview-session-manager.tokenizeCommand).
+ */
+export declare function splitWin32Command(command: string): string[];
+/**
+ * Compute the (command, args) to hand to child_process.spawn with
+ * `shell: false`. POSIX is a pass-through (argv0 + rest). Reads
+ * `process.platform` at call time so the win32/POSIX branch stays stubbable.
+ *
+ *   - argv0 is a real `.exe`/`.com`      → spawn it directly (no cmd.exe).
+ *   - argv0 is a `.cmd`/`.bat` shim OR an unresolved bare command (npm/yarn/
+ *     pnpm are `.cmd` shims) → run through `cmd.exe /d /s /c` — discrete argv,
+ *     or a verbatim outer-quoted line when a token contains a space.
+ *   - argv0 is an unresolvable BARE name → `null` (see the return contract in
+ *     the module header). The preview wrapper turns that into a throw.
+ */
+export declare function resolveSpawn(argv: string[], cwd: string): ResolvedSpawn | null;
+//# sourceMappingURL=win32-spawn.d.ts.map

package/server/dist/core/win32-spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"win32-spawn.d.ts","sourceRoot":"","sources":["../../src/core/win32-spawn.ts"],"names":[],"mappings":"AAgFA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;qFACiF;IACjF,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAyB3D;AA4GD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CA2C9E"}

package/server/dist/core/win32-spawn.js

@@ -0,0 +1,271 @@
+/*
+ * win32-spawn.ts — platform-aware executable resolution: turn an argv into the
+ * `{command, args}` that `child_process` can run with `shell: false`, including
+ * Windows `.cmd`/`.bat` shims (D03 / audit findings F03 + F31; ADR-044).
+ *
+ * WHY a separate module: Windows needs PATHEXT resolution plus a cmd.exe
+ * wrapper for `.cmd`/`.bat` shims — Node's CVE-2024-27980 hardening
+ * EINVAL-blocks direct `.cmd` spawns under `shell: false`. POSIX is a
+ * pass-through, so the existing behaviour stays byte-identical.
+ *
+ * WHY IT IS NOT CALLED preview-* ANY MORE (iterate-2026-08-01-win32-spawn-followups).
+ * It was extracted from `preview-win32-spawn.ts`, which named it after its only
+ * consumer at the time. It now has three consumer classes plus a cross-package
+ * mirror, and — the load-bearing half — the old module imports
+ * `PreviewProfileInvalidError` from `preview-session-manager.ts`, so every
+ * consumer of the resolver dragged the whole preview subsystem into its import
+ * closure. That made the BOOT path (`cli-compat.ts`) a MEMBER of the
+ * preview-win32-spawn ↔ preview-session-manager ESM cycle, which PR #340
+ * recorded as a new fragility. This module imports no preview module at all;
+ * `preview-win32-spawn.ts` is now a thin wrapper over it that adds the throw.
+ *
+ * Stated precisely, because the looser version is easy to over-read: what this
+ * retires is `cli-compat`'s MEMBERSHIP of the cycle, NOT the cycle itself.
+ * `server/src/index.ts` still imports `preview-session-manager.js` directly, so
+ * the cycle is still linked and still evaluated on every boot — it simply no
+ * longer has the version gate inside it. Guard:
+ * `win32-spawn.import-closure.test.ts` (transitive; the mirror-parity test only
+ * does a single non-transitive check on this file).
+ *
+ * RETURN CONTRACT: an unresolvable BARE name yields `null` — "I could not
+ * place this on PATH", which is a verdict, not an exception. The preview
+ * wrapper converts that `null` into `PreviewProfileInvalidError` for its own
+ * callers; nothing else has to.
+ *
+ * SECURITY posture (ADR-044 — `shell: false` on EVERY path). This is NOT a
+ * proof of total safety:
+ *   - `splitWin32Command` never treats backslash as an escape, so
+ *     `C:\tools\node.exe` survives verbatim (F31).
+ *   - The fence (in preview-session-manager.tokenizeCommand) is a BLOCKLIST: it
+ *     refuses shell separators / substitution + `%` before resolving. It is NOT
+ *     an allow-list — cmd builtins (`start`, `for`, `(…)`, `call`, `@`) survive
+ *     it. It does not sandbox a hostile string: the profile author is already
+ *     trusted to name an executable (a bare `.exe` is spawned directly). The
+ *     fence's narrower job is to stop this cmd.exe wrapper from AMPLIFYING a
+ *     `.cmd` shim into shell semantics or a lower-trust repo-cwd binary hijack.
+ *     NOTE that fence guards the PREVIEW caller only — `cli-compat` passes an
+ *     already-resolved binary path, and the bootstrapper mirror has its own
+ *     `SAFE_ARG` charset gate. This module never assumes it ran.
+ *   - `resolveSpawn` never sets `options.shell`. It hands cmd.exe DISCRETE argv
+ *     when no token needs quoting; for a spaced token it emits the canonical
+ *     verbatim `cmd /d /s /c ""<quoted-shim>" <args>"` line. Separators are
+ *     refused upstream, so no token can break that quoting.
+ *
+ * PATH-FLAVOUR DISCIPLINE (iterate-2026-08-01-win32-spawn-followups). The win32
+ * branch is reached whenever `process.platform` SAYS win32 — including when a
+ * test stubs it on a POSIX host — but `path` follows the REAL host. Every
+ * `path.*` call below is therefore classified, exhaustively:
+ *
+ *   (a) win32 command-STRING semantics → `path.win32` explicitly.
+ *       `extname` ×2 and the ComSpec `join`. These never touch the filesystem,
+ *       so pinning the flavour costs nothing on Windows (there `path` already
+ *       IS `path.win32`) and makes the stubbed branch faithful everywhere else.
+ *   (b) HOST-filesystem addressing → the host `path`, deliberately.
+ *       `resolve` + `join` inside `resolveViaPathExt` build candidates that are
+ *       handed to `realpathSync`/`statSync`, so they must address the fs the
+ *       process is actually running on. A win32-flavoured candidate on a POSIX
+ *       host (`/tmp/x/a\name.EXE`) names no real file.
+ *
+ * The `PATH` split stays the hardcoded win32 `;` — correct by construction and
+ * already host-independent. This repo has paid for the (a)-class gap before:
+ * `claude-bin-resolver.ts` records NINE red CI runs from using the host `path`
+ * on `C:\…` inputs under a POSIX runner.
+ */
+import path from "node:path";
+import { statSync, realpathSync } from "node:fs";
+const WIN32_EXECUTABLE_EXTS = new Set([".exe", ".com"]);
+const WIN32_SHIM_EXTS = new Set([".cmd", ".bat"]);
+/**
+ * Tokenize a win32 dev command WITHOUT POSIX backslash-escaping, so
+ * `C:\tools\node.exe` keeps its backslashes (audit F31). Honours double quotes
+ * for grouping args that contain spaces. Assumes the caller has already
+ * refused command-execution metacharacters (the injection fence lives in
+ * preview-session-manager.tokenizeCommand).
+ */
+export function splitWin32Command(command) {
+    const argv = [];
+    let cur = "";
+    let inDouble = false;
+    let started = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (ch === '"') {
+            inDouble = !inDouble;
+            started = true;
+            continue;
+        }
+        if (!inDouble && (ch === " " || ch === "\t")) {
+            if (started) {
+                argv.push(cur);
+                cur = "";
+                started = false;
+            }
+            continue;
+        }
+        cur += ch;
+        started = true;
+    }
+    if (started)
+        argv.push(cur);
+    return argv;
+}
+function win32ComSpec() {
+    const fromEnv = process.env.ComSpec ?? process.env.COMSPEC;
+    if (fromEnv && fromEnv.trim())
+        return fromEnv;
+    const root = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
+    // (a) pure string — win32 flavour pinned, so a POSIX host with a stubbed
+    // platform emits `…\System32\cmd.exe`, not the mixed `…/System32/cmd.exe`
+    // the host `path.join` produced (which is what loosened the old assertions).
+    return path.win32.join(root, "System32", "cmd.exe");
+}
+function looksPathLike(name) {
+    return name.includes("\\") || name.includes("/") || /^[a-zA-Z]:/.test(name);
+}
+/**
+ * Resolve `name` to a concrete on-disk file via PATHEXT, realpath-verified
+ * (same realpath posture as core/path-guard.ts). Returns undefined when
+ * nothing resolves. Only called for names lacking a recognised extension.
+ */
+function resolveViaPathExt(name, cwd) {
+    const exts = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD")
+        .split(";")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    const firstFile = (base, withBare) => {
+        for (const ext of withBare ? ["", ...exts] : exts) {
+            try {
+                const real = realpathSync.native(base + ext);
+                if (statSync(real).isFile())
+                    return real;
+            }
+            catch {
+                // no file at this candidate — keep searching
+            }
+        }
+        return undefined;
+    };
+    if (looksPathLike(name)) {
+        // (b) HOST flavour on purpose — this candidate goes straight to realpath.
+        return firstFile(path.resolve(cwd, name), true);
+    }
+    // Bare command — search PATH ONLY, never the untrusted previewed-project cwd:
+    // a planted `<cwd>\npm.exe` must not shadow the real tool (a shell resolves
+    // bare names from PATH, not cwd). Path-like commands stay cwd-relative above.
+    // The empty ext is excluded so an extensionless POSIX shim (the `npm` bash
+    // script) is not matched.
+    const dirs = [];
+    // `;` is the win32 PATH delimiter, hardcoded — already host-independent.
+    for (const dir of (process.env.PATH ?? process.env.Path ?? "").split(";")) {
+        if (dir.trim())
+            dirs.push(dir.trim());
+    }
+    for (const dir of dirs) {
+        // (b) HOST flavour on purpose — see the classification in the header.
+        const hit = firstFile(path.join(dir, name), false);
+        if (hit)
+            return hit;
+    }
+    return undefined;
+}
+/**
+ * Characters cmd.exe INTERPRETS, and which a surrounding pair of double quotes
+ * makes literal. A token carrying one must be quoted even without whitespace.
+ *
+ * Added iterate-2026-07-31-win32-shell-spawn-remediation. Until then the
+ * whitespace test alone was load-bearing only because the ONE caller sat behind
+ * `preview-session-manager.tokenizeCommand`, which refuses these characters in
+ * the profile command — but that fence never saw the RESOLVED path, and
+ * `resolveViaPathExt` builds one out of PATH directories. A user whose PATH
+ * contains `C:\R&D\` therefore got `cmd /d /s /c C:\R&D\tool.cmd`, which cmd
+ * splits at the `&`. Verified on Windows 11: discrete → "'C:\…\R' is not
+ * recognized as an internal or external command"; quoted → the shim runs.
+ *
+ * DELIBERATELY ABSENT, because quoting does not neutralise them:
+ *   `%` — `%VAR%` expands inside double quotes too (the upstream fence refuses it).
+ *   `"` — a token containing a quote cannot be wrapped safely by this scheme.
+ */
+const WIN32_CMD_SPECIAL = /[&|<>^]/;
+function win32NeedsQuote(token) {
+    return token === "" || /\s/.test(token) || WIN32_CMD_SPECIAL.test(token);
+}
+function win32CmdWrap(target, rest) {
+    const parts = [target, ...rest];
+    const command = win32ComSpec();
+    // No token needs quoting → discrete argv: Node quotes nothing it needn't and
+    // cmd.exe /d /s /c runs each token literally (caller keeps shell:false).
+    if (!parts.some(win32NeedsQuote)) {
+        return { command, args: ["/d", "/s", "/c", ...parts] };
+    }
+    // A token needs quoting (e.g. `C:\Program Files\nodejs\npm.cmd`). Under `cmd /s`
+    // Node's own arg-quoting is stripped, so build the canonical
+    // `cmd /d /s /c ""<quoted-shim>" <args>"` line ourselves and pass it verbatim:
+    // `/s` strips ONLY the outer quote pair, leaving the inner shim-path quotes
+    // intact. Safe because every shell separator (and `%`) is refused upstream, so
+    // no token can carry a metacharacter that would break out of the quoting.
+    const inner = parts
+        .map((p) => (win32NeedsQuote(p) ? `"${p}"` : p))
+        .join(" ");
+    return {
+        command,
+        args: ["/d", "/s", "/c", `"${inner}"`],
+        windowsVerbatimArguments: true,
+    };
+}
+/**
+ * Compute the (command, args) to hand to child_process.spawn with
+ * `shell: false`. POSIX is a pass-through (argv0 + rest). Reads
+ * `process.platform` at call time so the win32/POSIX branch stays stubbable.
+ *
+ *   - argv0 is a real `.exe`/`.com`      → spawn it directly (no cmd.exe).
+ *   - argv0 is a `.cmd`/`.bat` shim OR an unresolved bare command (npm/yarn/
+ *     pnpm are `.cmd` shims) → run through `cmd.exe /d /s /c` — discrete argv,
+ *     or a verbatim outer-quoted line when a token contains a space.
+ *   - argv0 is an unresolvable BARE name → `null` (see the return contract in
+ *     the module header). The preview wrapper turns that into a throw.
+ */
+export function resolveSpawn(argv, cwd) {
+    if (process.platform !== "win32") {
+        return { command: argv[0], args: argv.slice(1) };
+    }
+    const name = argv[0];
+    const rest = argv.slice(1);
+    // (a) pure string — win32 segment rules. On a POSIX host the host `extname`
+    // treats the whole `C:\a.b\tool` as ONE segment and answers `.b\tool` where
+    // Windows answers `""`.
+    //
+    // This closes a LATENT divergence rather than a live bug, and the reason is
+    // about the CALLERS, not about all inputs: `cli-compat` passes an
+    // already-resolved absolute binary, and the preview command is fenced
+    // upstream, so neither can produce a name whose two flavours land in
+    // different branches. A pathological leading-dot basename DOES differ —
+    // `x\.exe` is `.exe` under POSIX rules (spawned directly) but `""` under
+    // win32 (basename `.exe`, a dotfile, so it falls through to PATHEXT
+    // resolution) — and win32 is the correct answer there. An earlier version of
+    // this comment claimed the general implication; Stage-2 review disproved it.
+    const ext = path.win32.extname(name).toLowerCase();
+    if (WIN32_EXECUTABLE_EXTS.has(ext)) {
+        return { command: name, args: rest };
+    }
+    if (!WIN32_SHIM_EXTS.has(ext)) {
+        const resolved = resolveViaPathExt(name, cwd);
+        if (resolved) {
+            // (a) `resolved` is a host realpath; `path.win32` reads `/` as a
+            // separator too, so this is correct on either host.
+            if (WIN32_EXECUTABLE_EXTS.has(path.win32.extname(resolved).toLowerCase())) {
+                return { command: resolved, args: rest };
+            }
+            return win32CmdWrap(resolved, rest);
+        }
+        // Unresolved. A BARE (non-path-like) name resolves from PATH ONLY (never
+        // cwd) — so if PATHEXT can't find it we REFUSE here. Delegating
+        // `cmd /d /s /c <bare>` would let cmd.exe do its own cwd-first lookup and run
+        // a planted `<cwd>\npm.cmd` from an untrusted previewed repo. A path-like
+        // name (absolute or `.`/`..`-relative) is the author's explicit target, so
+        // it still wraps below.
+        if (!looksPathLike(name))
+            return null;
+    }
+    return win32CmdWrap(name, rest);
+}
+//# sourceMappingURL=win32-spawn.js.map

package/server/dist/core/win32-spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"win32-spawn.js","sourceRoot":"","sources":["../../src/core/win32-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAUlD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACf,GAAG,GAAG,EAAE,CAAC;gBACT,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IAC3D,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAsB,EAAE;QACxE,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;gBAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,0EAA0E;QAC1E,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,0BAA0B;IAC1B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,IAAI,GAAG,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,sEAAsE;QACtE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAc;IAClD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,iFAAiF;IACjF,6DAA6D;IAC7D,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,KAAK;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO;QACL,OAAO;QACP,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC;QACtC,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc,EAAE,GAAW;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,4EAA4E;IAC5E,4EAA4E;IAC5E,wBAAwB;IACxB,EAAE;IACF,4EAA4E;IAC5E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,iEAAiE;YACjE,oDAAoD;YACpD,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;YACD,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,8EAA8E;QAC9E,0EAA0E;QAC1E,2EAA2E;QAC3E,wBAAwB;QACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/server/dist/external/__tests__/api-contract-probes.d.ts

@@ -0,0 +1,49 @@
+/** Path-segment sentinels for the 404-by-design probes. */
+export declare const NONEXISTENT_TASK = "task-does-not-exist-123";
+export declare const NONEXISTENT_PROJECT = "project-does-not-exist-123";
+export declare const NONEXISTENT_TOOL_USE = "tool-use-does-not-exist-123";
+/**
+ * Path-segment sentinel for the 400-by-design probes that need a project
+ * to EXIST so they can reach a post-existence validator (e.g.
+ * `projects.file` reaches `path_required` only after the project lookup
+ * succeeds). The consumer suite wires `getProjectById` to return a
+ * synthetic project record for this id and undefined otherwise.
+ */
+export declare const EXISTENT_PROJECT = "test-project-existent";
+export interface Probe {
+    /** Which `baseline.endpoints[].id` this probe covers. */
+    baselineId: string;
+    /** Human-readable description appears in vitest output. */
+    describe: string;
+    method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    /** Fully-substituted concrete URL (no `:id` placeholders). */
+    path: string;
+    /** JSON-stringified into request body if present; sets Content-Type. */
+    body?: unknown;
+    /** Exact status code expected. NOT an allowed-set; one number. */
+    expectStatus: number;
+    /**
+     * When set, asserts `body.error === expectErrorCode` for JSON responses.
+     * Used for load-bearing error invariants (CLAUDE.md rules 4, 6, 9, 10, 12, 13).
+     */
+    expectErrorCode?: string;
+    /**
+     * When set, asserts `body.status === expectStatusField` for the
+     * discriminated-union endpoints (transcript, run-config).
+     */
+    expectStatusField?: string;
+    /**
+     * When set, asserts every key is present in the response JSON body
+     * (subset check via `toHaveProperty`). Skipped for non-JSON responses.
+     */
+    expectKeys?: readonly string[];
+}
+/**
+ * Per-endpoint deterministic request shape + EXACT expected status. Multiple
+ * entries may share one `baselineId` (e.g. `tasks.patch` probes both 404 and
+ * 400 paths via separate seed-needed `it(...)` in the consumer suite).
+ *
+ * Order matches the baseline file for diff-friendliness.
+ */
+export declare const PROBE_TABLE: Probe[];
+//# sourceMappingURL=api-contract-probes.d.ts.map

package/server/dist/external/__tests__/api-contract-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contract-probes.d.ts","sourceRoot":"","sources":["../../../src/external/__tests__/api-contract-probes.ts"],"names":[],"mappings":"AAcA,2DAA2D;AAC3D,eAAO,MAAM,gBAAgB,4BAA4B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAChE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAExD,MAAM,WAAW,KAAK;IACpB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;IACpD,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,EAuQ9B,CAAC"}