@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/external/org/decisions-lock.js

@@ -0,0 +1,209 @@
+/*
+ * external/org/decisions-lock.ts — the FR-04.28 cross-process lock contract
+ * + the decision-log transfer format (opaque, header-delimited blocks — see
+ * the iterate spec's "Design decisions I own", point 3).
+ *
+ * Lock target is `decisions-proposed.md` ONLY (`<path>.lock`, proper-lockfile's
+ * OWN default — neither side sets `lockfilePath`). It is the file both
+ * processes (this route, leadwright's daemon) actually contend on;
+ * `decision_log.md` has exactly one writer (this action), so serializing on
+ * the proposed-side file makes the whole two-file read-modify-write atomic
+ * with respect to the daemon (lead-model-spec.md §4.1a: "keine getrennten
+ * Arbeitsbäume, deshalb genügt ein Dateilock" — one lock, singular, is
+ * enough).
+ *
+ * Plan-review fix (both external reviewers, HIGH): this module resolves
+ * BOTH file paths through the same allowlist + symlink defense as the
+ * generic `/file` route rather than touching the filesystem directly —
+ * `decisions-lock.ts` is a second, independent write path onto exactly the
+ * files the allowlist protects, so it needs the same guard, not a weaker
+ * one.
+ */
+import * as lockfile from "proper-lockfile";
+import { existsSync, mkdirSync, writeFileSync, readFileSync, lstatSync } from "node:fs";
+import { dirname } from "node:path";
+import { resolveOrgAllowlistedTarget } from "./_helpers.js";
+// ---------------------------------------------------------------------------
+// Entry format — strict, anchored, full-line header shapes (plan-review
+// fix, deepseek LOW: a loose "line starts with ##" match could misclassify
+// an opaque body line as a boundary).
+//
+// Doubt-review fix (HIGH): `raw.split("\n")` leaves a trailing "\r" on each
+// line when the source is CRLF-terminated, and `.` never matches "\r" (JS
+// LineTerminator exclusion) — so a bare `(.+)$` could never reach `$` on a
+// CRLF file and every header silently failed to match, making
+// `nextLoggedNumber` always return 1 (duplicate ADR numbers). The trailing
+// `\r?` tolerates that without touching `splitBlocks`' byte offsets (which
+// must stay keyed to the ORIGINAL raw string — `toLoggedBlock`/countersign.ts
+// splice on those offsets directly).
+// ---------------------------------------------------------------------------
+const PROPOSED_HEADER_RE = /^## \[([^\]]+)\] (.+?)\r?$/;
+const LOGGED_HEADER_RE = /^## ADR-(\d{4}) \[([^\]]+)\] (.+?)\r?$/;
+function splitBlocks(raw, headerRe) {
+    const lines = raw.split("\n");
+    const lineStarts = [];
+    let offset = 0;
+    for (const line of lines) {
+        lineStarts.push(offset);
+        offset += line.length + 1;
+    }
+    const headerLineIdx = [];
+    const matches = [];
+    lines.forEach((line, idx) => {
+        const m = headerRe.exec(line);
+        if (m) {
+            headerLineIdx.push(idx);
+            matches.push(m);
+        }
+    });
+    return headerLineIdx.map((lineIdx, i) => {
+        const startIndex = lineStarts[lineIdx];
+        const nextHeaderLineIdx = headerLineIdx[i + 1];
+        const endIndex = nextHeaderLineIdx !== undefined ? lineStarts[nextHeaderLineIdx] : raw.length;
+        return { match: matches[i], startIndex, endIndex, block: raw.slice(startIndex, endIndex) };
+    });
+}
+/** Parse `decisions-proposed.md` into its opaque, header-delimited entries. */
+export function parseProposedEntries(raw) {
+    return splitBlocks(raw, PROPOSED_HEADER_RE).map(({ match, startIndex, endIndex, block }) => ({
+        timestamp: match[1],
+        leadId: match[2],
+        block,
+        startIndex,
+        endIndex,
+    }));
+}
+/** Parse `decision_log.md` into its numbered, header-delimited entries. */
+export function parseLoggedEntries(raw) {
+    return splitBlocks(raw, LOGGED_HEADER_RE).map(({ match, block }) => ({
+        number: Number(match[1]),
+        timestamp: match[2],
+        leadId: match[3],
+        block,
+    }));
+}
+export function findLoggedEntry(entries, timestamp, leadId) {
+    return entries.find((e) => e.timestamp === timestamp && e.leadId === leadId);
+}
+export function nextLoggedNumber(entries) {
+    if (entries.length === 0)
+        return 1;
+    return Math.max(...entries.map((e) => e.number)) + 1;
+}
+/**
+ * Rewrite a proposed entry's block into logged form: same body, header line
+ * becomes `## ADR-<NNNN> [<timestamp>] <leadId>`. Byte-preserving beyond the
+ * header line — this route never parses or understands the body prose.
+ */
+export function toLoggedBlock(proposedBlock, number) {
+    const newlineIdx = proposedBlock.indexOf("\n");
+    const headerLine = newlineIdx === -1 ? proposedBlock : proposedBlock.slice(0, newlineIdx);
+    const rest = newlineIdx === -1 ? "" : proposedBlock.slice(newlineIdx);
+    const m = PROPOSED_HEADER_RE.exec(headerLine);
+    if (!m) {
+        throw new Error(`toLoggedBlock: block does not start with a proposed-entry header: ${headerLine.slice(0, 80)}`);
+    }
+    const adr = `ADR-${String(number).padStart(4, "0")}`;
+    return `## ${adr} [${m[1]}] ${m[2]}${rest}`;
+}
+// ---------------------------------------------------------------------------
+// Lock contract.
+// ---------------------------------------------------------------------------
+export class OrgSymlinkEscapeError extends Error {
+    path;
+    constructor(path) {
+        super(`refusing to lock/write through a symlink: ${path}`);
+        this.path = path;
+    }
+}
+function assertNotSymlink(absolutePath, lstat) {
+    let lst;
+    try {
+        lst = lstat(absolutePath);
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return;
+        throw err;
+    }
+    if (lst.isSymbolicLink()) {
+        throw new OrgSymlinkEscapeError(absolutePath);
+    }
+}
+/**
+ * Create `absolutePath` empty ONLY if it does not already exist — via the
+ * `wx` flag (O_CREAT|O_EXCL), not existsSync+writeFileSync. Code-review fix:
+ * O_EXCL fails EEXIST against ANY pre-existing path, including a dangling
+ * symlink, WITHOUT following it — existsSync (which follows symlinks) would
+ * report a dangling symlink as absent and let writeFileSync create/write
+ * through it to whatever it points at, outside `leadsRoot`. The caller still
+ * runs `assertNotSymlink` right after this, which is what actually rejects
+ * an existing (non-dangling) symlink; this function's only job is to not be
+ * the thing that writes through one first.
+ */
+function ensureFile(absolutePath) {
+    const dir = dirname(absolutePath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    try {
+        writeFileSync(absolutePath, "", { flag: "wx" });
+    }
+    catch (err) {
+        if (err?.code !== "EEXIST")
+            throw err;
+    }
+}
+/** Resolve `decisions-proposed.md` / `decision_log.md` under `leadsRoot`
+ *  through the SAME allowlist + path-guard as the generic `/file` route. */
+export function resolveDecisionsPaths(leadsRoot) {
+    const proposed = resolveOrgAllowlistedTarget(leadsRoot, "decisions-proposed.md");
+    const logged = resolveOrgAllowlistedTarget(leadsRoot, "decision_log.md");
+    if (!proposed.ok || !logged.ok) {
+        throw new Error("internal invariant violated: decisions-proposed.md / decision_log.md failed to resolve under leadsRoot");
+    }
+    return { proposedPath: proposed.absolute, loggedPath: logged.absolute };
+}
+/**
+ * Acquire the FR-04.28 lock on `decisions-proposed.md`
+ * (`stale: 10_000`, `realpath: true` — both explicit, per the contract;
+ * neither side sets `lockfilePath`, so proper-lockfile's own default
+ * `<path>.lock` is what leadwright's daemon must also target), run `fn`
+ * inside the critical section, then release. The target file is created
+ * (empty) before acquisition if missing. Both files are symlink-checked
+ * before the lock is taken, AND re-checked immediately after it is held
+ * (doubt-review fix, MEDIUM-HIGH): `lockfile.lock()` retries for up to
+ * ~2.75s under contention (8 retries, 50ms→500ms backoff) — a co-resident
+ * writer could swap either path for a symlink in that window, after the
+ * first check ran but before the lock was actually ours. Re-checking right
+ * after acquisition closes that specific gap. It does not extend to
+ * arbitrary time spent inside `fn` itself — that would mean re-lstat'ing on
+ * every read, which is unwarranted for a route whose only writers are this
+ * process and leadwright's daemon, both honoring the same lock.
+ */
+export async function withDecisionsLock(deps, fn) {
+    const { proposedPath, loggedPath } = resolveDecisionsPaths(deps.leadsRoot);
+    const lstat = deps.lstatSync ?? ((p) => lstatSync(p));
+    ensureFile(proposedPath);
+    assertNotSymlink(proposedPath, lstat);
+    assertNotSymlink(loggedPath, lstat);
+    const release = await lockfile.lock(proposedPath, {
+        stale: 10_000,
+        realpath: true,
+        retries: { retries: 8, minTimeout: 50, maxTimeout: 500, factor: 2 },
+    });
+    try {
+        assertNotSymlink(proposedPath, lstat);
+        assertNotSymlink(loggedPath, lstat);
+        const ctx = {
+            proposedPath,
+            loggedPath,
+            readProposed: () => readFileSync(proposedPath, "utf8"),
+            readLogged: () => (existsSync(loggedPath) ? readFileSync(loggedPath, "utf8") : ""),
+        };
+        return await fn(ctx);
+    }
+    finally {
+        await release();
+    }
+}
+//# sourceMappingURL=decisions-lock.js.map

package/server/dist/external/org/decisions-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions-lock.js","sourceRoot":"","sources":["../../../src/external/org/decisions-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,8EAA8E;AAC9E,wEAAwE;AACxE,2EAA2E;AAC3E,sCAAsC;AACtC,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,8DAA8D;AAC9D,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AACxD,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAmBlE,SAAS,WAAW,CAClB,GAAW,EACX,QAAgB;IAEhB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,GACZ,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/E,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3F,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAChB,KAAK;QACL,UAAU;QACV,QAAQ;KACT,CAAC,CAAC,CAAC;AACN,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAChB,KAAK;KACN,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAsB,EACtB,SAAiB,EACjB,MAAc;IAEd,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,aAAqB,EAAE,MAAc;IACjE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qEAAqE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACrD,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAClB;IAA5B,YAA4B,IAAY;QACtC,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;QADjC,SAAI,GAAJ,IAAI,CAAQ;IAExC,CAAC;CACF;AAOD,SAAS,gBAAgB,CACvB,YAAoB,EACpB,KAAmD;IAEnD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,YAAoB;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,aAAa,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACnE,CAAC;AACH,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IAIrD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC1E,CAAC;AASD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAAiD;IAEjD,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,UAAU,CAAC,YAAY,CAAC,CAAC;IACzB,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE;QAChD,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;KACpE,CAAC,CAAC;IACH,IAAI,CAAC;QACH,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAyB;YAChC,YAAY;YACZ,UAAU;YACV,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC;YACtD,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;QACF,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC"}

package/server/dist/external/org/file-read.d.ts

@@ -0,0 +1,14 @@
+import type { Hono } from "hono";
+import { openSync } from "node:fs";
+export interface OrgFileReadDeps {
+    leadsRoot: string;
+    /**
+     * Test seam for the O_NOFOLLOW open below (e.g. to simulate an ELOOP a
+     * mocked final-component symlink would produce, without needing a REAL
+     * symlink on disk — those require elevated privileges on Windows CI).
+     * Defaults to the real `openSync`.
+     */
+    openSync?: typeof openSync;
+}
+export declare function registerOrgFileRead(app: Hono, deps: OrgFileReadDeps): void;
+//# sourceMappingURL=file-read.d.ts.map

package/server/dist/external/org/file-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-read.d.ts","sourceRoot":"","sources":["../../../src/external/org/file-read.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAkD,QAAQ,EAAgB,MAAM,SAAS,CAAC;AAMjG,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC;CAC5B;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAgE1E"}

package/server/dist/external/org/file-read.js

@@ -0,0 +1,80 @@
+/*
+ * external/org/file-read.ts — GET /api/external/org/file.
+ *
+ * Mirrors `external/file/routes.ts` GET (symlink/realpath defense, ETag
+ * fingerprint, nosniff), scoped to the six-target org allowlist instead of
+ * an arbitrary project-relative path. Exists so the PUT handler's
+ * `If-Match` contract is actually usable (a client needs the current
+ * fingerprint before it can construct a conditional write) — `org-chart.json`
+ * is deliberately unreachable here; it has its own typed endpoint
+ * (`org-chart.ts`), because the acceptance bar for it is "malformed → error,
+ * never a half structure", which needs parsing, not byte-streaming.
+ *
+ * Status codes:
+ *   400 traversal / absolute / missing path / not-a-file
+ *   403 symlink_forbidden / not_allowlisted
+ *   404 missing target file
+ *   500 stat / read failure
+ */
+import { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync } from "node:fs";
+import { realPathGuard } from "../../core/path-guard.js";
+import { resolveOrgAllowlistedTarget } from "./_helpers.js";
+import { fileFingerprint } from "../file/_helpers.js";
+export function registerOrgFileRead(app, deps) {
+    const { leadsRoot } = deps;
+    const open = deps.openSync ?? openSync;
+    app.get("/api/external/org/file", async (c) => {
+        const relpath = c.req.query("path");
+        if (!relpath || relpath.length === 0) {
+            return c.json({ error: "path_required" }, 400);
+        }
+        const target = resolveOrgAllowlistedTarget(leadsRoot, relpath);
+        if (!target.ok) {
+            const status = target.reason === "not_allowlisted" ? 403 : 400;
+            const err = target.reason === "traversal" ? "path_traversal" : target.reason;
+            return c.json({ error: err, detail: target.reason }, status);
+        }
+        const realGuard = realPathGuard(leadsRoot, target.absolute);
+        if (!realGuard.ok) {
+            return c.json({ error: "path_traversal", detail: realGuard.reason }, 400);
+        }
+        // CodeQL js/file-system-race fix: a separate lstat-check + stat + read
+        // (each its own syscall against the PATH) leaves a window where the
+        // final component could be swapped for a symlink between checks. Open
+        // ONCE with O_NOFOLLOW — the kernel atomically refuses a symlinked final
+        // component (ELOOP), so there is no gap left to race — then fstat/read
+        // the SAME fd, so what gets served is provably what got checked.
+        let fd;
+        try {
+            fd = open(target.absolute, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT") {
+                return c.json({ error: "not_found", path: relpath }, 404);
+            }
+            if (code === "ELOOP") {
+                return c.json({ error: "symlink_forbidden", path: relpath }, 403);
+            }
+            return c.json({ error: "file_stat_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        try {
+            if (!fstatSync(fd).isFile()) {
+                return c.json({ error: "not_a_file", path: relpath }, 400);
+            }
+            const body = readFileSync(fd);
+            c.header("Content-Type", "text/markdown; charset=utf-8");
+            c.header("X-Content-Type-Options", "nosniff");
+            c.header("ETag", `"${fileFingerprint(body)}"`);
+            c.header("Cache-Control", "private, max-age=0, must-revalidate");
+            return c.body(new Uint8Array(body));
+        }
+        catch (err) {
+            return c.json({ error: "file_read_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        finally {
+            closeSync(fd);
+        }
+    });
+}
+//# sourceMappingURL=file-read.js.map

package/server/dist/external/org/file-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-read.js","sourceRoot":"","sources":["../../../src/external/org/file-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEjG,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAatD,MAAM,UAAU,mBAAmB,CAAC,GAAS,EAAE,IAAqB;IAClE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAEvC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,GAAG,CACJ,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/org/file-write.d.ts

@@ -0,0 +1,14 @@
+import type { Hono } from "hono";
+import { withDecisionsLock, type DecisionsLockDeps } from "./decisions-lock.js";
+/** 2 MiB — org docs are small prose files, same cap as the project markdown write. */
+export declare const ORG_WRITE_MAX_BYTES: number;
+export interface OrgFileWriteDeps extends DecisionsLockDeps {
+    lstatSync?: (path: string) => {
+        isSymbolicLink(): boolean;
+        isFile(): boolean;
+    };
+    /** Injectable for tests; production wires the real `withDecisionsLock`. */
+    withDecisionsLock?: typeof withDecisionsLock;
+}
+export declare function registerOrgFileWrite(app: Hono, deps: OrgFileWriteDeps): void;
+//# sourceMappingURL=file-write.d.ts.map

package/server/dist/external/org/file-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-write.d.ts","sourceRoot":"","sources":["../../../src/external/org/file-write.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiBjC,OAAO,EACL,iBAAiB,EAEjB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAE7B,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,QAAkB,CAAC;AAWnD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,cAAc,IAAI,OAAO,CAAC;QAAC,MAAM,IAAI,OAAO,CAAA;KAAE,CAAC;IAC/E,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;CAC9C;AA2FD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAiF5E"}

package/server/dist/external/org/file-write.js

@@ -0,0 +1,205 @@
+/*
+ * external/org/file-write.ts — PUT /api/external/org/file.
+ *
+ * Models `external/file/write.ts` almost exactly (extension-free here — the
+ * allowlist IS the extension gate; atomic tmp+rename write; `If-Match`
+ * optimistic concurrency; symlink rejection via injectable `lstat`), scoped
+ * to `~/.claude/leads/**` instead of a project root.
+ *
+ * Plan-review fix (both external reviewers, HIGH): the card's "no lock"
+ * exception applies to the FOUR lead-independent/charter docs
+ * (`conventions.md`, `principal.md`, `AGENTS.md`, charter files) — it does
+ * NOT extend to `decision_log.md` / `decisions-proposed.md`, which are the
+ * exact two files the countersign action's FR-04.28 lock exists to
+ * serialize against leadwright's daemon. Routing an unlocked write to
+ * either through this generic allowlisted PUT would let the shared secret
+ * alone bypass that lock. So: when the resolved target's `kind` is
+ * `decision_log` or `decisions_proposed`, the read-check-write sequence
+ * below runs INSIDE `withDecisionsLock` — same lock, same file, whichever
+ * path reaches it. For the other four kinds, `If-Match` alone is the
+ * concurrency story, exactly like `write.ts` — no cross-process contender.
+ *
+ * External-review fix (MEDIUM, spec): `withDecisionsLock` creates
+ * `decisions-proposed.md` (empty) if missing, because THAT file is the lock
+ * target itself and proper-lockfile needs it to exist — but the spec's
+ * generic-PUT contract is edit-existing-only (mirrors `write.ts` exactly),
+ * with no carve-out for the lock's own bootstrap need. A PUT to
+ * `decisions-proposed.md` on a not-yet-bootstrapped org directory used to
+ * auto-vivify it instead of 404ing, silently CREATING an allowlisted
+ * document through what is supposed to be an edit-only endpoint. Fixed by
+ * probing existence via `lstat` BEFORE ever calling `lockFn` — `lstat`
+ * (unlike `existsSync`) does not follow symlinks, so a dangling symlink at
+ * the target still reports as "exists" here and correctly falls through
+ * into the lock's own `assertNotSymlink` defense rather than being
+ * misclassified as merely missing.
+ *
+ * Status codes:
+ *   400 traversal / absolute / missing path / missing If-Match / not-a-file
+ *   403 symlink_forbidden — final path component is a symlink
+ *   403 not_allowlisted — target is not one of the six allowed kinds
+ *   404 missing target file
+ *   409 fingerprint_mismatch, or ELOCKED (lock contention — errorHandler)
+ *   413 body over ORG_WRITE_MAX_BYTES
+ *   500 stat / read / write failure
+ */
+import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, lstatSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { realPathGuard } from "../../core/path-guard.js";
+import { resolveOrgAllowlistedTarget, } from "./_helpers.js";
+import { fileFingerprint, unquoteEtag } from "../file/_helpers.js";
+import { withDecisionsLock, OrgSymlinkEscapeError, } from "./decisions-lock.js";
+/** 2 MiB — org docs are small prose files, same cap as the project markdown write. */
+export const ORG_WRITE_MAX_BYTES = 2 * 1024 * 1024;
+const LOCKED_KINDS = new Set([
+    "decision_log",
+    "decisions_proposed",
+]);
+function performWrite(absoluteTarget, leadsRoot, relpath, body, ifMatch, lstat) {
+    let lst;
+    try {
+        lst = lstat(absoluteTarget);
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") {
+            return { ok: false, status: 404, body: { error: "not_found", path: relpath } };
+        }
+        return {
+            ok: false,
+            status: 500,
+            body: { error: "file_stat_failed", detail: String(err).slice(0, 200) },
+        };
+    }
+    if (lst.isSymbolicLink()) {
+        return { ok: false, status: 403, body: { error: "symlink_forbidden", path: relpath } };
+    }
+    if (!lst.isFile()) {
+        return { ok: false, status: 400, body: { error: "not_a_file", path: relpath } };
+    }
+    const realGuard = realPathGuard(leadsRoot, absoluteTarget);
+    if (!realGuard.ok) {
+        return {
+            ok: false,
+            status: 400,
+            body: { error: "path_traversal", detail: realGuard.reason },
+        };
+    }
+    if (!ifMatch) {
+        return { ok: false, status: 400, body: { error: "precondition_required" } };
+    }
+    let current;
+    try {
+        current = readFileSync(absoluteTarget);
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") {
+            return { ok: false, status: 404, body: { error: "not_found", path: relpath } };
+        }
+        return {
+            ok: false,
+            status: 500,
+            body: { error: "file_read_failed", detail: String(err).slice(0, 200) },
+        };
+    }
+    const currentFingerprint = fileFingerprint(current);
+    if (unquoteEtag(ifMatch) !== currentFingerprint) {
+        return {
+            ok: false,
+            status: 409,
+            body: { error: "fingerprint_mismatch", currentFingerprint },
+        };
+    }
+    const nextBuf = Buffer.from(body, "utf8");
+    const tmp = join(dirname(absoluteTarget), `.org-write.tmp-${process.pid}-${Date.now()}`);
+    try {
+        writeFileSync(tmp, nextBuf);
+        renameSync(tmp, absoluteTarget);
+    }
+    catch (err) {
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch {
+            /* swallow */
+        }
+        return {
+            ok: false,
+            status: 500,
+            body: { error: "write_failed", detail: String(err).slice(0, 200), path: relpath },
+        };
+    }
+    return {
+        ok: true,
+        status: 200,
+        body: { written: true, fingerprint: fileFingerprint(nextBuf), size: nextBuf.length },
+    };
+}
+export function registerOrgFileWrite(app, deps) {
+    const { leadsRoot } = deps;
+    const lstat = deps.lstatSync ?? ((p) => lstatSync(p));
+    const lockFn = deps.withDecisionsLock ?? withDecisionsLock;
+    app.put("/api/external/org/file", async (c) => {
+        const relpath = c.req.query("path");
+        if (!relpath || relpath.length === 0) {
+            return c.json({ error: "path_required" }, 400);
+        }
+        const target = resolveOrgAllowlistedTarget(leadsRoot, relpath);
+        if (!target.ok) {
+            const status = target.reason === "not_allowlisted" ? 403 : 400;
+            const err = target.reason === "traversal" ? "path_traversal" : target.reason;
+            return c.json({ error: err, detail: target.reason }, status);
+        }
+        const declaredLength = Number(c.req.header("content-length") ?? "");
+        if (Number.isFinite(declaredLength) && declaredLength > ORG_WRITE_MAX_BYTES) {
+            return c.json({ error: "payload_too_large", maxBytes: ORG_WRITE_MAX_BYTES, size: declaredLength }, 413);
+        }
+        const body = await c.req.text();
+        const byteLen = Buffer.byteLength(body, "utf8");
+        if (byteLen > ORG_WRITE_MAX_BYTES) {
+            return c.json({ error: "payload_too_large", maxBytes: ORG_WRITE_MAX_BYTES, size: byteLen }, 413);
+        }
+        const ifMatch = c.req.header("if-match");
+        let outcome;
+        if (LOCKED_KINDS.has(target.kind)) {
+            // Pre-lock existence probe (external-review fix) — must run BEFORE
+            // withDecisionsLock, since its own ensureFile() would otherwise
+            // auto-vivify decisions-proposed.md first and hide a genuinely
+            // missing target from performWrite's existence check.
+            try {
+                lstat(target.absolute);
+            }
+            catch (err) {
+                const code = err?.code;
+                if (code === "ENOENT") {
+                    return c.json({ error: "not_found", path: relpath }, 404);
+                }
+                return c.json({ error: "file_stat_failed", detail: String(err).slice(0, 200) }, 500);
+            }
+            try {
+                outcome = await lockFn({ leadsRoot, lstatSync: deps.lstatSync }, () => performWrite(target.absolute, leadsRoot, relpath, body, ifMatch, lstat));
+            }
+            catch (err) {
+                // Doubt-review fix: `withDecisionsLock` symlink-checks BOTH
+                // decision_log.md and decisions-proposed.md (whichever one this PUT
+                // targets, the OTHER is still checked because it shares the lock) —
+                // uncaught, that 403-shaped condition fell through to the generic
+                // 500 handler instead of the family's typed symlink_forbidden.
+                // ELOCKED is deliberately NOT caught here: it propagates to the
+                // app-level errorHandler (middleware/error-handler.ts), which already
+                // maps it to the same retryable 409 every other multi-writer state
+                // file uses (CLAUDE.md DO-NOT #6).
+                if (err instanceof OrgSymlinkEscapeError) {
+                    return c.json({ error: "symlink_forbidden", path: err.path }, 403);
+                }
+                throw err;
+            }
+        }
+        else {
+            outcome = performWrite(target.absolute, leadsRoot, relpath, body, ifMatch, lstat);
+        }
+        return c.json(outcome.body, outcome.status);
+    });
+}
+//# sourceMappingURL=file-write.js.map

package/server/dist/external/org/file-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-write.js","sourceRoot":"","sources":["../../../src/external/org/file-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,2BAA2B,GAE5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAE7B,sFAAsF;AACtF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,MAAM,YAAY,GAAoC,IAAI,GAAG,CAAC;IAC5D,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAYH,SAAS,YAAY,CACnB,cAAsB,EACtB,SAAiB,EACjB,OAAe,EACf,IAAY,EACZ,OAA2B,EAC3B,KAAyE;IAEzE,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,kBAAkB,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAS,EAAE,IAAsB;IACpE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE3D,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,mBAAmB,EAAE,CAAC;YAC5E,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,EACnF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,EAC5E,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEzC,IAAI,OAAqB,CAAC;QAC1B,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,sDAAsD;YACtD,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;gBAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CACpE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CACxE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4DAA4D;gBAC5D,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,+DAA+D;gBAC/D,gEAAgE;gBAChE,sEAAsE;gBACtE,mEAAmE;gBACnE,mCAAmC;gBACnC,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;oBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAA2C,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/org/last-run.d.ts

@@ -0,0 +1,28 @@
+import type { Hono } from "hono";
+import { type LeadOrgInfoReason } from "./org-chart-lookup.js";
+import { type Staleness } from "./cron.js";
+export type CadenceUnresolvedReason = LeadOrgInfoReason | "invalid_cron";
+export type LastRunResponse = {
+    leadId: string;
+    measured: false;
+} | {
+    leadId: string;
+    measured: true;
+    lastRunAt: string;
+    sessionId: string;
+    staleness: Staleness | "unknown";
+    thresholdMs: number | null;
+    cadenceMs: number | null;
+    cadenceUnresolvedReason?: CadenceUnresolvedReason;
+};
+export interface LastRunRouteDeps {
+    leadsRoot: string;
+    /** Injectable for tests; production wires the real lstatSync. */
+    lstatSync?: (p: string) => {
+        isSymbolicLink(): boolean;
+    };
+    /** Injectable for deterministic boundary tests; production wires `() => new Date()`. */
+    now?: () => Date;
+}
+export declare function registerLastRunRoute(app: Hono, deps: LastRunRouteDeps): void;
+//# sourceMappingURL=last-run.d.ts.map

package/server/dist/external/org/last-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"last-run.d.ts","sourceRoot":"","sources":["../../../src/external/org/last-run.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAMjC,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAE9E,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEzE,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD,CAAC;AAcN,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK;QAAE,cAAc,IAAI,OAAO,CAAA;KAAE,CAAC;IACzD,wFAAwF;IACxF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CA0G5E"}