@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/external/mission-context/test-harness.js

@@ -0,0 +1,121 @@
+/*
+ * test-harness.ts — shared fixture for the mission-context route tests.
+ *
+ * Builds a real temp project (pointer + spec on disk) and an in-memory store
+ * double that honours the SAME once-only contract as the real
+ * `setMissionContextOnce`, so the "exactly one write" assertions are testing
+ * the ROUTE's behaviour rather than a permissive stub.
+ */
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { vi } from "vitest";
+import { createMissionContextRouter, RECOVERY_TAIL_BYTES, TRANSCRIPT_TAIL_BYTES, } from "./routes.js";
+export const UUID = "3c9e3e11-4b53-424e-8062-f9f5a24f6b68";
+export const OTHER_UUID = "11111111-2222-3333-4444-555555555555";
+export const RUN_ID = "iterate-2026-07-18-demo";
+export const SPEC_REL = `.shipwright/planning/iterate/${RUN_ID}/mini-plan.md`;
+/** A temp project with a valid pointer + a spec document. */
+export function makeProject() {
+    const root = mkdtempSync(join(tmpdir(), "mc-route-"));
+    mkdirSync(join(root, ".shipwright", "iterate_active"), { recursive: true });
+    mkdirSync(join(root, ".shipwright", "planning", "iterate", RUN_ID), { recursive: true });
+    // A realistic spec shape: the planned-impact scan is SCOPED to the
+    // affected-boundaries section, so an FR id cited elsewhere (the References
+    // line below) must NOT be reported as impact.
+    writeFileSync(join(root, ".shipwright", "planning", "iterate", RUN_ID, "mini-plan.md"), [
+        "# Demo plan",
+        "",
+        "Wire the Mission tab to the iterate resolver.",
+        "",
+        "## Affected Boundaries",
+        "",
+        "The mission-context response shape (FR-01.66).",
+        "",
+        "## References",
+        "",
+        "Prior art: FR-01.28 (embedded terminal) — unchanged by this run.",
+        "",
+    ].join("\n"));
+    writeFileSync(join(root, ".shipwright", "iterate_active", `${UUID}.json`), JSON.stringify({
+        run_id: RUN_ID,
+        slug: "demo",
+        branch: "iterate/demo",
+        main_root: root,
+        session_id: UUID,
+        created_at: "2026-07-18T10:00:00Z",
+    }));
+    return root;
+}
+export function makeTask(over = {}) {
+    return {
+        taskId: "task-1",
+        sessionUuid: UUID,
+        cwd: "/x",
+        pluginDirs: [],
+        state: "active",
+        title: "Demo iterate",
+        projectId: "proj-1",
+        createdAt: "2026-07-18T09:00:00Z",
+        inbox: { pendingToolUseIds: [], dismissedToolUseIds: [], lastProcessedByteOffset: 0 },
+        ...over,
+    };
+}
+export function harness(root, task, opts = {}) {
+    const all = Array.isArray(task) ? task : [task];
+    const tasks = new Map(all.map((t) => [t.taskId, t]));
+    const persist = vi.fn(async () => {
+        if (opts.persistThrows)
+            throw new Error("ELOCKED");
+    });
+    // A real store double: `setMissionContextOnce` (the module under test at the
+    // route level) drives it through `get` + `patch`, so the once-only semantics
+    // exercised here are the PRODUCTION ones, not a permissive stub.
+    const store = {
+        get: (id) => tasks.get(id),
+        patch: (id, patch) => {
+            const t = tasks.get(id);
+            if (!t)
+                return undefined;
+            Object.assign(t, patch);
+            return t;
+        },
+        persist,
+    };
+    // Records the byte budget the route asked for, so a test can prove the wider
+    // recovery window is requested ONLY while it can still pay.
+    //
+    // `poll` counts READS, not reads-per-task: with several tasks the sequence
+    // interleaves. That is deliberate (the budget sequence is what the schedule
+    // tests assert, in call order) but it means a multi-task test must either use
+    // a single sticky entry or account for the interleaving itself.
+    const reads = opts.reads ?? [{ text: opts.transcript ?? "", revision: "rev-1" }];
+    let poll = 0;
+    const readTranscriptTail = vi.fn(async (_uuid, maxBytes) => {
+        const r = reads[Math.min(poll++, reads.length - 1)];
+        const narrow = (maxBytes ?? TRANSCRIPT_TAIL_BYTES) < RECOVERY_TAIL_BYTES;
+        return { text: narrow ? (r.narrowText ?? r.text) : r.text, revision: r.revision };
+    });
+    const app = createMissionContextRouter({
+        store: store,
+        getProjectById: (id) => (id === "proj-1" ? { id: "proj-1", name: "P", path: root } : undefined),
+        readTranscriptTail,
+        wideWindowCap: opts.wideWindowCap,
+        getScenarioFacts: async () => ({
+            actions: { fromUser: false, hasDiagnostics: false, actionIds: ["new-iterate"] },
+            runConfigStatus: "missing",
+            campaignSlug: null,
+            hasCampaignRecord: false,
+        }),
+    });
+    return { app, persist, tasks, readTranscriptTail };
+}
+export async function getContext(app, taskId = "task-1") {
+    const res = await app.request(`/api/external/tasks/${taskId}/mission-context`);
+    const body = (await res.json());
+    return body.context;
+}
+export function artifact(ctx, kind) {
+    return ctx.artifacts.find((a) => a.kind === kind);
+}
+//# sourceMappingURL=test-harness.js.map

package/server/dist/external/mission-context/test-harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-harness.js","sourceRoot":"","sources":["../../../src/external/mission-context/test-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE5B,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAIrB,MAAM,CAAC,MAAM,IAAI,GAAG,sCAAsC,CAAC;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,sCAAsC,CAAC;AACjE,MAAM,CAAC,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAChD,MAAM,CAAC,MAAM,QAAQ,GAAG,gCAAgC,MAAM,eAAe,CAAC;AAE9E,6DAA6D;AAC7D,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzF,mEAAmE;IACnE,2EAA2E;IAC3E,8CAA8C;IAC9C,aAAa,CACX,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EACxE;QACE,aAAa;QACb,EAAE;QACF,+CAA+C;QAC/C,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,gDAAgD;QAChD,EAAE;QACF,eAAe;QACf,EAAE;QACF,kEAAkE;QAClE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,aAAa,CACX,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,IAAI,OAAO,CAAC,EAC3D,IAAI,CAAC,SAAS,CAAC;QACb,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,sBAAsB;KACnC,CAAC,CACH,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAA8B,EAAE;IACvD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,EAAE;QACd,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,EAAE;QACrF,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAqBD,MAAM,UAAU,OAAO,CACrB,IAAY,EACZ,IAAmC,EACnC,OAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAuB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QAC/B,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,EAAE,CAAC,EAAU,EAAE,KAA4B,EAAE,EAAE;YAClD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACxB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO;KACsD,CAAC;IAEhE,6EAA6E;IAC7E,4DAA4D;IAC5D,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAa,EAAE,QAAiB,EAAE,EAAE;QAC1E,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,QAAQ,IAAI,qBAAqB,CAAC,GAAG,mBAAmB,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,0BAA0B,CAAC;QACrC,KAAK,EAAE,KAAoC;QAC3C,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,kBAAkB;QAClB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE;YAC/E,eAAe,EAAE,SAAS;YAC1B,YAAY,EAAE,IAAI;YAClB,iBAAiB,EAAE,KAAK;SACzB,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;AACrD,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAsC,EACtC,MAAM,GAAG,QAAQ;IAEjB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,MAAM,kBAAkB,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6B,CAAC;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAgB,EAAE,IAAY;IACrD,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/server/dist/external/mission-context/wire.d.ts

@@ -0,0 +1,12 @@
+import type { SessionWatcher } from "../../core/session-watcher.js";
+import type { SdkSessionsStore } from "../../core/sdk-sessions-store.js";
+import type { RunConfigReadResult } from "../../core/run-config-reader.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface WiredMissionContextDeps {
+    store: SdkSessionsStore;
+    watcher: SessionWatcher;
+    getProjectById: (id: string) => ExternalRouteProjectView | undefined;
+    readRunConfig: (projectPath: string) => Promise<RunConfigReadResult>;
+}
+export declare function createWiredMissionContextRouter(deps: WiredMissionContextDeps): import("hono").Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=wire.d.ts.map

package/server/dist/external/mission-context/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/external/mission-context/wire.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACrE,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtE;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,uBAAuB,6FAyC5E"}

package/server/dist/external/mission-context/wire.js

@@ -0,0 +1,62 @@
+/*
+ * external/mission-context/wire.ts — production wiring for the Mission-context
+ * router, kept OUT of the registration shell so `external/routes.ts` stays
+ * within the file-size rule.
+ *
+ * The transcript is read HERE, from the server's own `SessionWatcher`, and only
+ * a bounded TAIL of it. Two reasons, both from the CONTRACT:
+ *   - §5.1 input trust boundary: the client never supplies transcript content,
+ *     so a forged `pr-link` marker cannot reach the merge check.
+ *   - §5.2 bounded resolver: a multi-megabyte JSONL must not be re-read whole
+ *     on a poll; the delivery marker is always near the end.
+ *
+ * The window is CLAMPED here, not trusted from the caller: never below the
+ * ordinary tail (so the PR marker keeps its reach) and never above
+ * `RECOVERY_TAIL_BYTES` (so no code path can turn this into an unbounded read of
+ * a multi-MB JSONL).
+ */
+import { createMissionContextRouter, RECOVERY_TAIL_BYTES, TRANSCRIPT_TAIL_BYTES, } from "./routes.js";
+import { getScenarioFacts } from "./facts.js";
+export function createWiredMissionContextRouter(deps) {
+    const { store, watcher, getProjectById, readRunConfig } = deps;
+    return createMissionContextRouter({
+        store,
+        getProjectById,
+        readTranscriptTail: async (sessionUuid, maxBytes) => {
+            try {
+                const loc = await watcher.findByUuid(sessionUuid);
+                if (!loc)
+                    return { text: "", revision: "" };
+                const budget = Math.min(Math.max(maxBytes ?? TRANSCRIPT_TAIL_BYTES, TRANSCRIPT_TAIL_BYTES), RECOVERY_TAIL_BYTES);
+                const fromByte = Math.max(0, loc.sizeBytes - budget);
+                // `loc` is handed to the reader so it does not repeat the walk we just
+                // did (iterate-2026-07-22-…-single-walk). Safe HERE specifically
+                // because this caller passes `expectFingerprint: null` — a caller that
+                // relied on rotation detection must let `readChunk` resolve the file
+                // itself, since the fingerprint is computed from whatever it is given.
+                const r = await watcher.readChunk({
+                    sessionUuid,
+                    fromByte,
+                    expectFingerprint: null,
+                    location: loc,
+                });
+                if (r.status !== "ok")
+                    return { text: "", revision: "" };
+                // Already in hand from the SAME `findByUuid` walk, so scheduling the
+                // wide reach-back costs no extra I/O. All three parts earn their place:
+                // `path` catches a transcript REPLACED under the same session uuid,
+                // `sizeBytes` the ordinary append, `mtimeMs` an in-place rewrite that
+                // happens to preserve the length.
+                return { text: r.chunk.content, revision: `${loc.path}:${loc.sizeBytes}:${loc.mtimeMs}` };
+            }
+            catch {
+                // A transcript fault degrades the PR marker (merge → "unknown"), and
+                // must never fail the context read itself. No revision, so the reach-back
+                // schedule treats it as "we learned nothing".
+                return { text: "", revision: "" };
+            }
+        },
+        getScenarioFacts: (project, task) => getScenarioFacts(project, task, { readRunConfig }),
+    });
+}
+//# sourceMappingURL=wire.js.map

package/server/dist/external/mission-context/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../../src/external/mission-context/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAa9C,MAAM,UAAU,+BAA+B,CAAC,IAA6B;IAC3E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAC/D,OAAO,0BAA0B,CAAC;QAChC,KAAK;QACL,cAAc;QACd,kBAAkB,EAAE,KAAK,EAAE,WAAmB,EAAE,QAAiB,EAAE,EAAE;YACnE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,CAAC,GAAG;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,qBAAqB,EAAE,qBAAqB,CAAC,EAClE,mBAAmB,CACpB,CAAC;gBACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;gBACrD,uEAAuE;gBACvE,iEAAiE;gBACjE,uEAAuE;gBACvE,qEAAqE;gBACrE,uEAAuE;gBACvE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC;oBAChC,WAAW;oBACX,QAAQ;oBACR,iBAAiB,EAAE,IAAI;oBACvB,QAAQ,EAAE,GAAG;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACzD,qEAAqE;gBACrE,wEAAwE;gBACxE,oEAAoE;gBACpE,sEAAsE;gBACtE,kCAAkC;gBAClC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,0EAA0E;gBAC1E,8CAA8C;gBAC9C,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QACD,gBAAgB,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC;KACxF,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/model-config/routes.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import { type ModelTierConfigReadResult } from "../../core/model-tier-config-reader.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface ModelConfigRouterDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    readModelTierConfig?: (projectPath: string) => ModelTierConfigReadResult;
+}
+export declare function createModelConfigRouter(deps: ModelConfigRouterDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/dist/external/model-config/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/model-config/routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,yBAAyB,CAAC;CAC1E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAWzE"}

package/server/dist/external/model-config/routes.js

@@ -0,0 +1,18 @@
+/* Read-only project model-tier endpoint. Framework config is never mutated here. */
+import { Hono } from "hono";
+import { readModelTierConfig as defaultReadModelTierConfig, } from "../../core/model-tier-config-reader.js";
+export function createModelConfigRouter(deps) {
+    const app = new Hono();
+    const reader = deps.readModelTierConfig ?? defaultReadModelTierConfig;
+    app.get("/api/external/projects/:projectId/model-config", (c) => {
+        const projectId = c.req.param("projectId");
+        const project = deps.getProjectById?.(projectId);
+        if (!project)
+            return c.json({ error: "project_not_found", projectId }, 404);
+        if (!project.path)
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        return c.json(reader(project.path));
+    });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/server/dist/external/model-config/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/model-config/routes.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAEpF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EACL,mBAAmB,IAAI,0BAA0B,GAElD,MAAM,wCAAwC,CAAC;AAQhD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,gDAAgD,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/org/__tests__/fixtures/lock-race-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lock-race-worker.d.ts.map

package/server/dist/external/org/__tests__/fixtures/lock-race-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-race-worker.d.ts","sourceRoot":"","sources":["../../../../../src/external/org/__tests__/fixtures/lock-race-worker.ts"],"names":[],"mappings":""}

package/server/dist/external/org/__tests__/fixtures/lock-race-worker.js

@@ -0,0 +1,67 @@
+/*
+ * lock-race-worker.ts — standalone script run as a SEPARATE OS PROCESS by
+ * two-process-lock.test.ts. It is not itself a test file.
+ *
+ * Why a separate process at all: `write.ts`-style fs calls are synchronous
+ * with no event-loop yield, so a same-process `Promise.all` racing two
+ * `withDecisionsLock` calls would never actually interleave — proper-lockfile
+ * itself is the only thing that can be raced honestly, and that requires two
+ * real OS-level lock holders.
+ *
+ * Protocol: argv = [leadsRoot, label, holdMs, resultFile, mode?]. Acquires
+ * the FR-04.28 lock (unless `mode === "nolock"`, see below), records the
+ * wall-clock interval it held the critical section, appends its own
+ * numbered logged entry (proving numbering stays sequential across
+ * processes), sleeps `holdMs` INSIDE the lock (widening the window in which
+ * a second, unlocked worker would visibly overlap), then writes
+ * `{label, start, insideStart, insideEnd, number}` to its own `resultFile`
+ * — a separate file per worker so the two processes never need to
+ * coordinate a shared-file append themselves.
+ *
+ * Doubt-review fix (LOW-MEDIUM, unquantified false-pass margin): `mode ===
+ * "nolock"` bypasses `withDecisionsLock` and does the identical
+ * read-sleep-append sequence unguarded — a falsification control
+ * (two-process-lock.test.ts's own "without the lock" test) that empirically
+ * proves THIS harness actually detects a broken lock, rather than asserting
+ * it by construction.
+ */
+import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { withDecisionsLock, resolveDecisionsPaths, parseLoggedEntries, nextLoggedNumber, } from "../../decisions-lock.js";
+const [, , leadsRoot, label, holdMsRaw, resultFile, mode] = process.argv;
+const holdMs = Number(holdMsRaw);
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function criticalSection(loggedPath, start) {
+    const insideStart = Date.now();
+    const raw = existsSync(loggedPath) ? readFileSync(loggedPath, "utf8") : "";
+    const entries = parseLoggedEntries(raw);
+    const number = nextLoggedNumber(entries);
+    // Widen the critical section deliberately — this is the window a
+    // lock-bypass bug would show up as an overlapping [insideStart, insideEnd]
+    // pair from the other worker.
+    await sleep(holdMs);
+    const pad = String(number).padStart(4, "0");
+    const needsLeadingNewline = raw.length > 0 && !raw.endsWith("\n");
+    const block = `${needsLeadingNewline ? "\n" : ""}## ADR-${pad} [race-${label}] worker-${label}\nbody written by worker ${label}\n`;
+    appendFileSync(loggedPath, block);
+    const insideEnd = Date.now();
+    writeFileSync(resultFile, JSON.stringify({ label, start, insideStart, insideEnd, number }));
+}
+async function main() {
+    const start = Date.now();
+    if (mode === "nolock") {
+        const { loggedPath } = resolveDecisionsPaths(leadsRoot);
+        await criticalSection(loggedPath, start);
+        return;
+    }
+    await withDecisionsLock({ leadsRoot }, async (ctx) => {
+        await criticalSection(ctx.loggedPath, start);
+    });
+}
+main().catch((err) => {
+    // eslint-disable-next-line no-console
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=lock-race-worker.js.map

package/server/dist/external/org/__tests__/fixtures/lock-race-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-race-worker.js","sourceRoot":"","sources":["../../../../../src/external/org/__tests__/fixtures/lock-race-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAElF,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,EAAE,AAAD,EAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;AACzE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAEjC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,UAAkB,EAAE,KAAa;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,iEAAiE;IACjE,2EAA2E;IAC3E,8BAA8B;IAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IAEpB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,GAAG,UAAU,KAAK,YAAY,KAAK,4BAA4B,KAAK,IAAI,CAAC;IACnI,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAElC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,iBAAiB,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/server/dist/external/org/_helpers.d.ts

@@ -0,0 +1,67 @@
+/**
+ * True when `host` (the application's resolved BIND host — see
+ * `resolveHonoHost.ts`, passed through, never re-derived here) is loopback
+ * or within the Tailscale CGNAT range. `0.0.0.0`, `::`, and any other
+ * wide-open or unrecognized value are denied — this is an ALLOWLIST, not a
+ * denylist of known-bad values.
+ */
+export declare function isAllowedOrgRouteHost(host: string): boolean;
+export type OrgSecretCheckResult = "ok" | "not_configured" | "invalid";
+/**
+ * Constant-time comparison against the configured secret. Returns
+ * `"not_configured"` when the server has no secret set (fail-closed —
+ * distinguishable from a wrong/missing header so an operator can tell
+ * "misconfigured" from "unauthorized").
+ *
+ * Code-review fix: an `a.length !== b.length` short-circuit BEFORE
+ * `timingSafeEqual` — the obvious first draft — reintroduces the exact
+ * timing side-channel `timingSafeEqual` exists to close (a wrong-length
+ * guess returns fast; a same-length wrong guess is measurably slower).
+ * Both inputs are hashed to a fixed-length digest first, so the two
+ * `timingSafeEqual` operands are ALWAYS 32 bytes regardless of the
+ * provided header's length, and the length check is gone entirely.
+ */
+export declare function checkOrgSecret(configuredSecret: string | undefined, providedHeader: string | undefined | null): OrgSecretCheckResult;
+export type OrgAllowlistedKind = "conventions" | "decision_log" | "principal" | "agents" | "decisions_proposed" | "charter";
+/** The five literal, lead-independent org documents. */
+export declare const ORG_ALLOWLIST_LITERALS: ReadonlyArray<{
+    path: string;
+    kind: OrgAllowlistedKind;
+}>;
+/**
+ * Mirrors `leadwright/lib/org-chart.ts`'s `LEAD_ID_RE` (kebab-case,
+ * lowercase-alnum start). Exported so every consumer of a lead-id
+ * (the charter-pattern check here, and the usage route's `:leadId` param)
+ * shares ONE validator rather than drifting apart — plan-review finding
+ * (iterate-2026-08-17-org-route-leads plan review, both reviewers).
+ */
+export declare const LEAD_ID_RE: RegExp;
+export type OrgTargetReason = "traversal" | "absolute_input" | "drive_change" | "not_allowlisted";
+export type OrgTargetResolution = {
+    ok: true;
+    absolute: string;
+    kind: OrgAllowlistedKind;
+} | {
+    ok: false;
+    reason: OrgTargetReason;
+};
+/**
+ * Resolve `relpath` against `leadsRoot`, requiring BOTH a clean
+ * (non-traversing) path AND membership in the six-entry allowlist — the
+ * sixth entry (`<lead-id>/charter.md`) is a pattern, not a literal, so the
+ * "six allowed target kinds" is `ORG_ALLOWLIST_LITERALS.length + 1`.
+ *
+ * Classification runs against the path-guard's NORMALIZED relative path
+ * (post `..`/`.`-resolution), not the raw input string, so `./conventions.md`
+ * and `conventions.md` classify identically.
+ */
+export declare function resolveOrgAllowlistedTarget(leadsRoot: string, relpath: string): OrgTargetResolution;
+/**
+ * Named refresh-cadence constant for the usage read interface
+ * (`GET /api/external/org/leads/:leadId/usage`). This route itself does no
+ * polling (stateless read, like every other external GET in this codebase)
+ * — the constant documents the interval a future client poller should use,
+ * so it doesn't have to invent its own.
+ */
+export declare const LEADS_USAGE_REFRESH_INTERVAL_MS: number;
+//# sourceMappingURL=_helpers.d.ts.map

package/server/dist/external/org/_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../../src/external/org/_helpers.ts"],"names":[],"mappings":"AAqDA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI3D;AAMD,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACxC,oBAAoB,CAMtB;AAQD,MAAM,MAAM,kBAAkB,GAC1B,aAAa,GACb,cAAc,GACd,WAAW,GACX,QAAQ,GACR,oBAAoB,GACpB,SAAS,CAAC;AAEd,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAMA,CAAC;AAGF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAyB,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,gBAAgB,GAChB,cAAc,GACd,iBAAiB,CAAC;AAEtB,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACxD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,mBAAmB,CA2BrB;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,QAAgB,CAAC"}

package/server/dist/external/org/_helpers.js

@@ -0,0 +1,146 @@
+/*
+ * external/org/_helpers.ts — shared primitives for the leadwright
+ * org-directory route family (`/api/external/org/*`, FR-04.38,
+ * iterate-2026-08-17-org-route-leads).
+ *
+ * Three independent gates + one allowlist, kept pure/side-effect-free so
+ * each is unit-testable without a running Hono app:
+ *   - `isAllowedOrgRouteHost`  — the bind-host allowlist (loopback ∪
+ *     Tailscale 100.64.0.0/10). Checked against the resolved bind host
+ *     PASSED IN by the caller (`resolveHonoHost` computed once at startup),
+ *     never re-derived per request.
+ *   - `checkOrgSecret`        — the shared-secret gate, constant-time.
+ *   - `resolveOrgAllowlistedTarget` — the six-target allowlist for both
+ *     GET and PUT (`org-chart.json` is deliberately absent — it has its
+ *     own typed endpoint, see `org-chart.ts`).
+ *   - `LEADS_USAGE_REFRESH_INTERVAL_MS` — the named refresh-cadence
+ *     constant for Punkt 8's consumption read interface.
+ */
+import { timingSafeEqual, createHash } from "node:crypto";
+import { pathGuard } from "../../core/path-guard.js";
+// ---------------------------------------------------------------------------
+// Host allowlist (FR-04.38 Auflage 1) — PO decision 2026-08-16: loopback OR
+// Tailscale (100.64.0.0/10), NOT a denylist of the three known open-bind
+// values (see lead-model-spec.md:2465, and the iterate spec's Architecture
+// Review reconciliation for why this supersedes the triage doc's stale
+// "Tailscale denied" bullet).
+// ---------------------------------------------------------------------------
+const IPV4_RE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+function parseIPv4(host) {
+    const m = IPV4_RE.exec(host);
+    if (!m)
+        return null;
+    const octets = [m[1], m[2], m[3], m[4]].map(Number);
+    if (octets.some((o) => o > 255))
+        return null;
+    return octets;
+}
+/** 127.0.0.0/8 — IPv4 loopback range (not just 127.0.0.1). */
+function isLoopbackIPv4(host) {
+    const octets = parseIPv4(host);
+    return octets !== null && octets[0] === 127;
+}
+/** 100.64.0.0/10 — Carrier-Grade NAT range Tailscale allocates from. */
+function isTailscaleRangeIPv4(host) {
+    const octets = parseIPv4(host);
+    return octets !== null && octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127;
+}
+/**
+ * True when `host` (the application's resolved BIND host — see
+ * `resolveHonoHost.ts`, passed through, never re-derived here) is loopback
+ * or within the Tailscale CGNAT range. `0.0.0.0`, `::`, and any other
+ * wide-open or unrecognized value are denied — this is an ALLOWLIST, not a
+ * denylist of known-bad values.
+ */
+export function isAllowedOrgRouteHost(host) {
+    const h = host.trim();
+    if (h === "::1")
+        return true;
+    return isLoopbackIPv4(h) || isTailscaleRangeIPv4(h);
+}
+/**
+ * Constant-time comparison against the configured secret. Returns
+ * `"not_configured"` when the server has no secret set (fail-closed —
+ * distinguishable from a wrong/missing header so an operator can tell
+ * "misconfigured" from "unauthorized").
+ *
+ * Code-review fix: an `a.length !== b.length` short-circuit BEFORE
+ * `timingSafeEqual` — the obvious first draft — reintroduces the exact
+ * timing side-channel `timingSafeEqual` exists to close (a wrong-length
+ * guess returns fast; a same-length wrong guess is measurably slower).
+ * Both inputs are hashed to a fixed-length digest first, so the two
+ * `timingSafeEqual` operands are ALWAYS 32 bytes regardless of the
+ * provided header's length, and the length check is gone entirely.
+ */
+export function checkOrgSecret(configuredSecret, providedHeader) {
+    if (!configuredSecret)
+        return "not_configured";
+    if (!providedHeader)
+        return "invalid";
+    const a = createHash("sha256").update(configuredSecret, "utf8").digest();
+    const b = createHash("sha256").update(providedHeader, "utf8").digest();
+    return timingSafeEqual(a, b) ? "ok" : "invalid";
+}
+/** The five literal, lead-independent org documents. */
+export const ORG_ALLOWLIST_LITERALS = [
+    { path: "conventions.md", kind: "conventions" },
+    { path: "decision_log.md", kind: "decision_log" },
+    { path: "principal.md", kind: "principal" },
+    { path: "AGENTS.md", kind: "agents" },
+    { path: "decisions-proposed.md", kind: "decisions_proposed" },
+];
+const CHARTER_SUFFIX = "/charter.md";
+/**
+ * Mirrors `leadwright/lib/org-chart.ts`'s `LEAD_ID_RE` (kebab-case,
+ * lowercase-alnum start). Exported so every consumer of a lead-id
+ * (the charter-pattern check here, and the usage route's `:leadId` param)
+ * shares ONE validator rather than drifting apart — plan-review finding
+ * (iterate-2026-08-17-org-route-leads plan review, both reviewers).
+ */
+export const LEAD_ID_RE = /^[a-z0-9][a-z0-9-]*$/;
+/**
+ * Resolve `relpath` against `leadsRoot`, requiring BOTH a clean
+ * (non-traversing) path AND membership in the six-entry allowlist — the
+ * sixth entry (`<lead-id>/charter.md`) is a pattern, not a literal, so the
+ * "six allowed target kinds" is `ORG_ALLOWLIST_LITERALS.length + 1`.
+ *
+ * Classification runs against the path-guard's NORMALIZED relative path
+ * (post `..`/`.`-resolution), not the raw input string, so `./conventions.md`
+ * and `conventions.md` classify identically.
+ */
+export function resolveOrgAllowlistedTarget(leadsRoot, relpath) {
+    const guard = pathGuard(leadsRoot, relpath);
+    if (!guard.ok) {
+        return {
+            ok: false,
+            reason: guard.reason === "symlink_escape" ? "traversal" : guard.reason,
+        };
+    }
+    const normalizedRel = guard.absolute
+        .slice(leadsRoot.length)
+        .replace(/^[/\\]+/, "")
+        .replace(/\\/g, "/");
+    const literal = ORG_ALLOWLIST_LITERALS.find((l) => l.path === normalizedRel);
+    if (literal) {
+        return { ok: true, absolute: guard.absolute, kind: literal.kind };
+    }
+    if (normalizedRel.endsWith(CHARTER_SUFFIX)) {
+        const leadId = normalizedRel.slice(0, -CHARTER_SUFFIX.length);
+        if (LEAD_ID_RE.test(leadId) && !leadId.includes("/")) {
+            return { ok: true, absolute: guard.absolute, kind: "charter" };
+        }
+    }
+    return { ok: false, reason: "not_allowlisted" };
+}
+// ---------------------------------------------------------------------------
+// Consumption read interface (Punkt 8) — refresh cadence.
+// ---------------------------------------------------------------------------
+/**
+ * Named refresh-cadence constant for the usage read interface
+ * (`GET /api/external/org/leads/:leadId/usage`). This route itself does no
+ * polling (stateless read, like every other external GET in this codebase)
+ * — the constant documents the interval a future client poller should use,
+ * so it doesn't have to invent its own.
+ */
+export const LEADS_USAGE_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+//# sourceMappingURL=_helpers.js.map

package/server/dist/external/org/_helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.js","sourceRoot":"","sources":["../../../src/external/org/_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,OAAO,GAAG,8CAA8C,CAAC;AAE/D,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8DAA8D;AAC9D,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;AAC9C,CAAC;AAED,wEAAwE;AACxE,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,gBAAoC,EACpC,cAAyC;IAEzC,IAAI,CAAC,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC/C,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAgBD,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAG9B;IACH,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE;IAC/C,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE;IACjD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,EAAE;CAC9D,CAAC;AAEF,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAYjD;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,OAAe;IAEf,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;SACvE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ;SACjC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAC7E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/server/dist/external/org/beat-register-release-audit.d.ts

@@ -0,0 +1,17 @@
+import { type LstatFn } from "./beat-register.js";
+export interface AuditDeps {
+    leadsRoot: string;
+    now: () => Date;
+    lstat: LstatFn;
+}
+/**
+ * MIRRORED LIMITATION (plan-review PR-9, disclosed not fixed): this runs
+ * AFTER the register lock is released, identical ordering to leadwright's
+ * own `recoverRegisterEntry`. A crash or audit-write failure between the
+ * two leaves a recovered entry with no `beat_recovered` line — a retry
+ * finds the entry already closed (`recovered: false`) and does not
+ * re-append. Sharing this limitation with the mirrored contract is
+ * preferred over diverging into a different (and un-mirrored) failure mode.
+ */
+export declare function recordRecoveryAudit(deps: AuditDeps, leadId: string, auditPath: string, sessionId: string, reason: string, beatId: string): void;
+//# sourceMappingURL=beat-register-release-audit.d.ts.map

package/server/dist/external/org/beat-register-release-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-register-release-audit.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-register-release-audit.ts"],"names":[],"mappings":"AAYA,OAAO,EAAuB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAsEvE,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,IAAI,CAUN"}