@svenroth-ai/shipwright 0.26.0 → 0.28.0

package/server/dist/external/org/audit-log.js

@@ -30,15 +30,17 @@ function clampLimit(raw) {
         return DEFAULT_LIMIT;
     return Math.min(MAX_LIMIT, Math.max(1, Math.trunc(raw)));
 }
-/** Pure core — reads and paginates `<leadsRoot>/<leadId>/audit.jsonl`. */
-export function auditLogCore(deps, params) {
+/**
+ * Guarded, single-read helper shared by `auditLogCore` (paginates the
+ * result for the Docs block's viewer) and `beat-effect-audit-read.ts`
+ * (wants every line in one pass, not a page at a time — see that file's
+ * header for why re-reading the file per page was a real cost, not just a
+ * style preference). Owns the open-first/`O_NOFOLLOW`/`fstat`/
+ * `realPathGuard`/`LEAD_ID_RE` chain exactly once.
+ */
+export function readAuditLinesGuarded(deps, leadId) {
     const { leadsRoot } = deps;
     const open = deps.openSync ?? openSync;
-    const { leadId } = params;
-    const limit = clampLimit(params.limit);
-    const before = params.before !== undefined && Number.isFinite(params.before) && params.before > 0
-        ? Math.trunc(params.before)
-        : 0;
     if (!leadId || !LEAD_ID_RE.test(leadId)) {
         return { status: 400, body: { error: "invalid_lead_id" } };
     }
@@ -70,17 +72,7 @@ export function auditLogCore(deps, params) {
         }
         const text = readFileSync(fd, "utf8");
         const lines = text.split(/\r?\n/).filter((l) => l.trim().length > 0);
-        const newestFirst = lines.slice().reverse();
-        const page = newestFirst.slice(before, before + limit).map((raw) => {
-            try {
-                return { raw, parsed: JSON.parse(raw) };
-            }
-            catch {
-                return { raw, parsed: null };
-            }
-        });
-        const nextCursor = before + limit < newestFirst.length ? before + limit : null;
-        return { status: 200, body: { entries: page, total: newestFirst.length, nextCursor } };
+        return { status: 200, linesNewestFirst: lines.slice().reverse() };
     }
     catch (err) {
         return { status: 500, body: { error: "file_read_failed", detail: String(err).slice(0, 200) } };
@@ -89,4 +81,27 @@ export function auditLogCore(deps, params) {
         closeSync(fd);
     }
 }
+/** Pure core — reads and paginates `<leadsRoot>/<leadId>/audit.jsonl`. */
+export function auditLogCore(deps, params) {
+    const { leadId } = params;
+    const limit = clampLimit(params.limit);
+    const before = params.before !== undefined && Number.isFinite(params.before) && params.before > 0
+        ? Math.trunc(params.before)
+        : 0;
+    const read = readAuditLinesGuarded(deps, leadId);
+    if (read.status !== 200) {
+        return read;
+    }
+    const { linesNewestFirst } = read;
+    const page = linesNewestFirst.slice(before, before + limit).map((raw) => {
+        try {
+            return { raw, parsed: JSON.parse(raw) };
+        }
+        catch {
+            return { raw, parsed: null };
+        }
+    });
+    const nextCursor = before + limit < linesNewestFirst.length ? before + limit : null;
+    return { status: 200, body: { entries: page, total: linesNewestFirst.length, nextCursor } };
+}
 //# sourceMappingURL=audit-log.js.map

package/server/dist/external/org/audit-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../../src/external/org/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAK3C,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AAmBtB,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,IAAkB,EAAE,MAAsB;IACrE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAC/F,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC,CAAC;IAEN,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAiB,EAAE;YAChF,IAAI,CAAC;gBACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,EAAE,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../../src/external/org/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAK3C,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AAmBtB,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAMD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAkB,EAAE,MAA0B;IAClF,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAEvC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,IAAkB,EAAE,MAAsB;IACrE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAC/F,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC,CAAC;IAEN,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAiB,EAAE;QACrF,IAAI,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,EAAE,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;AAC9F,CAAC"}

package/server/dist/external/org/beat-effect-audit-read.d.ts

@@ -0,0 +1,15 @@
+import { readAuditLinesGuarded, type AuditLogDeps } from "./audit-log.js";
+export type BeatEffectAuditResult = {
+    status: "ok";
+    unclaimedBeatIds: Set<string>;
+} | {
+    status: "unknown";
+    unclaimedBeatIds: Set<string>;
+};
+export interface BeatEffectAuditDeps extends AuditLogDeps {
+    /** Test seam — defaults to the real `readAuditLinesGuarded`. */
+    readAuditLinesFn?: typeof readAuditLinesGuarded;
+}
+/** Pure core — single full-file scan of a lead's `audit.jsonl`. */
+export declare function readBeatEffectAuditCore(deps: BeatEffectAuditDeps, leadId: string): BeatEffectAuditResult;
+//# sourceMappingURL=beat-effect-audit-read.d.ts.map

package/server/dist/external/org/beat-effect-audit-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-effect-audit-read.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-effect-audit-read.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAE,qBAAqB,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAI1E,MAAM,MAAM,qBAAqB,GAC7B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACjD;AAED,mEAAmE;AACnE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAyBxG"}

package/server/dist/external/org/beat-effect-audit-read.js

@@ -0,0 +1,73 @@
+/*
+ * external/org/beat-effect-audit-read.ts — per-lead lookup of which beats
+ * carry an unclaimed-effect audit entry (iterate-2026-09-08-lead-inventory-
+ * page, AC-2a/AC-9). Wraps `readAuditLinesGuarded` (`audit-log.ts`) rather
+ * than re-implementing the open-first read.
+ *
+ * Reads `audit.jsonl` in ONE pass, not page-by-page. The first version of
+ * this file called the paginated `auditLogCore` in a bounded loop
+ * (`before`-cursor, up to 10 pages) to avoid a false `{status:"clear"}` from
+ * only ever seeing the newest 200 lines — but `auditLogCore` re-reads and
+ * re-reverses the WHOLE file on every call (its own header discloses that
+ * whole-file-read cost as accepted for a single page); looping it therefore
+ * multiplied an already-accepted cost by up to 10x per lead per request
+ * (code review, Stage 2). A single full-file scan removes the multiplier
+ * AND the truncation risk in the same change: there is no page boundary to
+ * fall short of, so coverage is complete by construction and a genuine read
+ * failure is the only thing left that can produce `{status:"unknown"}`. The
+ * read is ATOMIC (one `readFileSync`), so there is no genuine mid-scan
+ * partial-failure state — it either fully succeeds (`unclaimedBeatIds`
+ * complete) or fully fails (`unknown`, `unclaimedBeatIds` empty). The
+ * caller (`org-inventory-composite.ts`) still checks `unclaimedBeatIds`
+ * BEFORE `status`, which is what would keep a "found" entry monotone if a
+ * future version of this reader ever did support a partial/incremental
+ * result — external code review correction: an earlier version of this
+ * comment described that as a live guarantee against a scenario this
+ * design cannot currently produce.
+ *
+ * A genuinely absent `audit.jsonl` (404 — the lead has never had an
+ * unclaimed-effect entry logged) is legitimately `{status:"ok", empty Set}`
+ * — a real "clear", not a degrade. Any other read failure (bad leadId,
+ * symlink, fs error) degrades to `unknown`. A malformed JSONL line is
+ * skipped, not fatal to the scan.
+ *
+ * Known limitation, stated rather than hidden (doubt review, medium/
+ * concurrency): the scan is synchronous Node fs, called once per lead
+ * inside `org-inventory-composite.ts`'s per-lead loop, on the single JS
+ * event loop — a large `audit.jsonl` blocks the whole server for the scan's
+ * duration, same as `audit-log.ts`'s own disclosed whole-file-read cost.
+ * Accepted for this iterate's scale (a single local operator's roster,
+ * `useLeadInventory` polling every 5 minutes — see
+ * `LEADS_USAGE_REFRESH_INTERVAL_MS`), same as `readAuditLinesGuarded`'s own
+ * accepted whole-file-read cost; a size/line-count ceiling degrading to
+ * `unknown` on breach is the natural follow-up if a lead's audit history
+ * ever grows large enough to make this measurably slow.
+ */
+import { readAuditLinesGuarded } from "./audit-log.js";
+const UNCLAIMED_EFFECT_KIND = "beat_effect_not_claimed";
+/** Pure core — single full-file scan of a lead's `audit.jsonl`. */
+export function readBeatEffectAuditCore(deps, leadId) {
+    const readFn = deps.readAuditLinesFn ?? readAuditLinesGuarded;
+    const read = readFn(deps, leadId);
+    if (read.status === 404) {
+        return { status: "ok", unclaimedBeatIds: new Set() };
+    }
+    if (read.status !== 200) {
+        return { status: "unknown", unclaimedBeatIds: new Set() };
+    }
+    const unclaimedBeatIds = new Set();
+    for (const raw of read.linesNewestFirst) {
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            continue;
+        }
+        if (parsed.kind === UNCLAIMED_EFFECT_KIND && typeof parsed.beat_id === "string") {
+            unclaimedBeatIds.add(parsed.beat_id);
+        }
+    }
+    return { status: "ok", unclaimedBeatIds };
+}
+//# sourceMappingURL=beat-effect-audit-read.js.map

package/server/dist/external/org/beat-effect-audit-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-effect-audit-read.js","sourceRoot":"","sources":["../../../src/external/org/beat-effect-audit-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,qBAAqB,EAAqB,MAAM,gBAAgB,CAAC;AAE1E,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAWxD,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,IAAyB,EAAE,MAAc;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxC,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChF,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AAC5C,CAAC"}

package/server/dist/external/org/beat-register-health.d.ts

@@ -0,0 +1,57 @@
+import type { Hono } from "hono";
+import { openSync } from "node:fs";
+import { type LstatFn } from "./beat-register.js";
+import type { BeatRegisterEntryView, BeatRegisterHealthResponse } from "../../types/org.js";
+export interface BeatRegisterRouteDeps {
+    leadsRoot: string;
+    lstatSync?: LstatFn;
+    openSync?: typeof openSync;
+}
+export type BeatRegisterHealthCoreResult = {
+    status: 200;
+    body: BeatRegisterHealthResponse;
+} | {
+    status: 400 | 403 | 500 | 502;
+    body: {
+        error: string;
+        leadId?: string;
+        detail?: string;
+    };
+};
+/** Pure core — shared by the secret-gated route and the plain-surface proxy. */
+export declare function beatRegisterHealthCore(deps: BeatRegisterRouteDeps, leadId: string): BeatRegisterHealthCoreResult;
+export type RegisterEntriesGuardedResult = {
+    ok: true;
+    entries: BeatRegisterEntryView[];
+} | {
+    ok: false;
+};
+/**
+ * Guarded, tolerant read of a lead's raw register entries — for a caller
+ * that needs the entries themselves (e.g. the Lead Inventory composite)
+ * rather than a derived health classification. Code review (Stage 2,
+ * high/correctness + medium/security): the original Lead Inventory
+ * composite called `readRegisterFileTolerant` directly on an UNVALIDATED
+ * `leadId` sourced from `org-chart.json`'s keys (which `orgChartCore` does
+ * not itself validate against `LEAD_ID_RE`), with no symlink refusal or
+ * containment check — and collapsed a genuine parse/structural failure
+ * (`ok:false`) into the same "zero beats" shape as a lead that has simply
+ * never run, exactly the false-positive-clear class this iterate exists to
+ * close elsewhere. `ok:false` here must be rendered as "beat history
+ * unavailable" by the caller, never silently treated as zero beats.
+ *
+ * Open-first (external code review, medium/security): unlike
+ * `beatRegisterHealthCore` above — which `lstat`s the pathname, then
+ * *reopens it by path* through `readRegisterFileTolerant`, leaving a TOCTOU
+ * window where a local writer can swap the checked regular file for a
+ * symlink between the two calls — this function opens the fd FIRST
+ * (`O_NOFOLLOW`), `fstat`s and containment-checks that SAME fd's path, then
+ * reads from the held fd. Matches the pattern `readAuditLinesGuarded`
+ * (`audit-log.ts`) and `beat-steps-read.ts` already use for every other
+ * reader this iterate added; `beatRegisterHealthCore` itself is
+ * pre-existing code from a prior iterate and is unchanged here — out of
+ * this iterate's scope.
+ */
+export declare function registerEntriesGuarded(deps: BeatRegisterRouteDeps, leadId: string): RegisterEntriesGuardedResult;
+export declare function registerBeatRegisterHealthRoute(app: Hono, deps: BeatRegisterRouteDeps): void;
+//# sourceMappingURL=beat-register-health.d.ts.map

package/server/dist/external/org/beat-register-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-register-health.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-register-health.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAA6D,QAAQ,EAAgB,MAAM,SAAS,CAAC;AAI5G,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE5F,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC;CAC5B;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,0BAA0B,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEjG,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,EAAE,MAAM,GACb,4BAA4B,CAsC9B;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,qBAAqB,EAAE,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAElB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,EAAE,MAAM,GACb,4BAA4B,CAuC9B;AAED,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAK5F"}

package/server/dist/external/org/beat-register-health.js

@@ -0,0 +1,125 @@
+/*
+ * external/org/beat-register-health.ts — GET
+ * /api/external/org/leads/:leadId/beat-register (iterate-2026-08-18-org-route-beat-register,
+ * V4a-2B point 7 — the open-register finding) plus `registerEntriesGuarded`,
+ * the same guard chain for a caller that needs the raw entries rather than
+ * a derived health classification (iterate-2026-09-08-lead-inventory-page).
+ *
+ * Split out of `beat-register.ts` (bloat gate — that file crossed the
+ * 300-line convention ceiling once this iterate's guarded-entries reader
+ * was added). `beat-register.ts` keeps the shared shapes/fs helpers used by
+ * BOTH this file and `beat-register-release.ts`'s POST route; this file
+ * keeps only the two guarded READ paths.
+ */
+import { closeSync, constants as fsConstants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
+import { LEAD_ID_RE } from "./_helpers.js";
+import { realPathGuard } from "../../core/path-guard.js";
+import { registerPathFor, readRegisterFileTolerant, parseRegisterFileText, evaluateRegisterHealth, } from "./beat-register.js";
+/** Pure core — shared by the secret-gated route and the plain-surface proxy. */
+export function beatRegisterHealthCore(deps, leadId) {
+    const { leadsRoot } = deps;
+    const lstat = deps.lstatSync ?? ((p) => lstatSync(p));
+    if (!LEAD_ID_RE.test(leadId)) {
+        return { status: 400, body: { error: "invalid_lead_id", leadId } };
+    }
+    const absolute = registerPathFor(leadsRoot, leadId);
+    let lst;
+    try {
+        lst = lstat(absolute);
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") {
+            return { status: 200, body: { leadId, status: "clear" } };
+        }
+        return {
+            status: 500,
+            body: { error: "beat_register_read_failed", detail: String(err).slice(0, 200) },
+        };
+    }
+    if (lst.isSymbolicLink()) {
+        return { status: 403, body: { error: "symlink_forbidden", leadId } };
+    }
+    const containment = realPathGuard(leadsRoot, absolute);
+    if (!containment.ok) {
+        return { status: 400, body: { error: "path_traversal", detail: containment.reason } };
+    }
+    const read = readRegisterFileTolerant(absolute);
+    if (!read.ok) {
+        return { status: 502, body: { error: "beat_register_invalid", leadId } };
+    }
+    const health = evaluateRegisterHealth(read.file);
+    return { status: 200, body: { leadId, ...health } };
+}
+/**
+ * Guarded, tolerant read of a lead's raw register entries — for a caller
+ * that needs the entries themselves (e.g. the Lead Inventory composite)
+ * rather than a derived health classification. Code review (Stage 2,
+ * high/correctness + medium/security): the original Lead Inventory
+ * composite called `readRegisterFileTolerant` directly on an UNVALIDATED
+ * `leadId` sourced from `org-chart.json`'s keys (which `orgChartCore` does
+ * not itself validate against `LEAD_ID_RE`), with no symlink refusal or
+ * containment check — and collapsed a genuine parse/structural failure
+ * (`ok:false`) into the same "zero beats" shape as a lead that has simply
+ * never run, exactly the false-positive-clear class this iterate exists to
+ * close elsewhere. `ok:false` here must be rendered as "beat history
+ * unavailable" by the caller, never silently treated as zero beats.
+ *
+ * Open-first (external code review, medium/security): unlike
+ * `beatRegisterHealthCore` above — which `lstat`s the pathname, then
+ * *reopens it by path* through `readRegisterFileTolerant`, leaving a TOCTOU
+ * window where a local writer can swap the checked regular file for a
+ * symlink between the two calls — this function opens the fd FIRST
+ * (`O_NOFOLLOW`), `fstat`s and containment-checks that SAME fd's path, then
+ * reads from the held fd. Matches the pattern `readAuditLinesGuarded`
+ * (`audit-log.ts`) and `beat-steps-read.ts` already use for every other
+ * reader this iterate added; `beatRegisterHealthCore` itself is
+ * pre-existing code from a prior iterate and is unchanged here — out of
+ * this iterate's scope.
+ */
+export function registerEntriesGuarded(deps, leadId) {
+    const { leadsRoot } = deps;
+    const open = deps.openSync ?? openSync;
+    if (!LEAD_ID_RE.test(leadId)) {
+        return { ok: false };
+    }
+    const absolute = registerPathFor(leadsRoot, leadId);
+    let fd;
+    try {
+        fd = open(absolute, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+    }
+    catch (err) {
+        if (err?.code === "ENOENT") {
+            return { ok: true, entries: [] };
+        }
+        return { ok: false };
+    }
+    try {
+        if (!fstatSync(fd).isFile()) {
+            return { ok: false };
+        }
+        const containment = realPathGuard(leadsRoot, absolute);
+        if (!containment.ok) {
+            return { ok: false };
+        }
+        const raw = readFileSync(fd, "utf8");
+        const parsed = parseRegisterFileText(raw);
+        if (!parsed.ok) {
+            return { ok: false };
+        }
+        return { ok: true, entries: parsed.file.entries };
+    }
+    catch {
+        return { ok: false };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function registerBeatRegisterHealthRoute(app, deps) {
+    app.get("/api/external/org/leads/:leadId/beat-register", async (c) => {
+        const result = beatRegisterHealthCore(deps, c.req.param("leadId"));
+        return c.json(result.body, result.status);
+    });
+}
+//# sourceMappingURL=beat-register-health.js.map

package/server/dist/external/org/beat-register-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-register-health.js","sourceRoot":"","sources":["../../../src/external/org/beat-register-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5G,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAa5B,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACpC,IAA2B,EAC3B,MAAc;IAEd,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEpD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAChF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;AACtD,CAAC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAA2B,EAC3B,MAAc;IAEd,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAEvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEpD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAAS,EAAE,IAA2B;IACpF,GAAG,CAAC,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/org/beat-register-release-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"beat-register-release-core.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-register-release-core.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAML,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,eAAO,MAAM,qBAAqB,QAGY,CAAC;AAE/C,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,KAAK,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrF,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED;;;;0EAI0E;AAC1E,eAAO,MAAM,oBAAoB,EAAE,uBAKlC,CAAC;AAEF,qBAAa,wBAAyB,SAAQ,KAAK;aACrB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAGzC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,uBAAuB,CAAC;IACrC,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAoCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,CAAC,CAmGzB"}
+{"version":3,"file":"beat-register-release-core.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-register-release-core.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAML,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,eAAO,MAAM,qBAAqB,QAGY,CAAC;AAE/C,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,KAAK,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrF,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED;;;;0EAI0E;AAC1E,eAAO,MAAM,oBAAoB,EAAE,uBAKlC,CAAC;AAEF,qBAAa,wBAAyB,SAAQ,KAAK;aACrB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAGzC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,uBAAuB,CAAC;IACrC,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAoCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,CAAC,CAmGzB"}

package/server/dist/external/org/beat-register-release-core.js

@@ -3,7 +3,10 @@
  * (iterate-2026-08-18-org-route-beat-register, V4a-2B point 4.4), split out
  * of `beat-register-release.ts` (the Hono route shell) to stay under the
  * 300-line file guideline. The `beat_recovered` audit-append half is split
- * further into `beat-register-release-audit.ts` for the same reason.
+ * further into `beat-register-release-audit.ts`, and the request-validation
+ * + status-mapping half shared by both route shells into
+ * `beat-register-release-request.ts` (iterate-2026-09-06-org-lead-
+ * staleness-register), for the same reason.
  *
  * A JSON-safe MIRROR of leadwright's `lib/beat-register.ts`
  * `recoverRegisterEntry` — not an import, cross-repo — matching its

package/server/dist/external/org/beat-register-release-core.js.map

@@ -1 +1 @@
-{"version":3,"file":"beat-register-release-core.js","sourceRoot":"","sources":["../../../src/external/org/beat-register-release-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,wBAAwB,GAEzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,CAAC,MAAM,qBAAqB,GAChC,wEAAwE;IACxE,2EAA2E;IAC3E,4CAA4C,CAAC;AAe/C;;;;0EAI0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAA4B;IAC3D,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IACrE,QAAQ,EAAE,IAAI;CACf,CAAC;AAEF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACrB;IAA5B,YAA4B,IAAY;QACtC,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;QADxC,SAAI,GAAJ,IAAI,CAAQ;IAExC,CAAC;CACF;AASD;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,IAAwB,EACxB,YAAoB,EACpB,SAAiB;IAEjB,oEAAoE;IACpE,oEAAoE;IACpE,yCAAyC;IACzC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,8DAA8D;IAC9D,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAwB,EACxB,MAAc,EACd,SAAiB,EACjB,MAAc;IAEd,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,+DAA+D;QAC/D,+DAA+D;QAC/D,qEAAqE;QACrE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,qBAAqB;QACrB,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,8CAA8C;QAC9C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAChE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACtE,+DAA+D;QAC/D,kEAAkE;QAClE,sEAAsE;QACtE,0DAA0D;QAC1D,gEAAgE;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,sEAAsE;QACtE,gEAAgE;QAChE,4DAA4D;QAC5D,mEAAmE;QACnE,iEAAiE;QACjE,kDAAkD;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9D,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACnC,kEAAkE;YAClE,oEAAoE;YACpE,6DAA6D;YAC7D,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,SAAS;YACT,OAAO,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1C,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,GAAG;gBACR,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,qBAAqB;gBAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,gDAAgD;IAChD,wEAAwE;IACxE,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"beat-register-release-core.js","sourceRoot":"","sources":["../../../src/external/org/beat-register-release-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,wBAAwB,GAEzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,CAAC,MAAM,qBAAqB,GAChC,wEAAwE;IACxE,2EAA2E;IAC3E,4CAA4C,CAAC;AAe/C;;;;0EAI0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAA4B;IAC3D,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IACrE,QAAQ,EAAE,IAAI;CACf,CAAC;AAEF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACrB;IAA5B,YAA4B,IAAY;QACtC,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;QADxC,SAAI,GAAJ,IAAI,CAAQ;IAExC,CAAC;CACF;AASD;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,IAAwB,EACxB,YAAoB,EACpB,SAAiB;IAEjB,oEAAoE;IACpE,oEAAoE;IACpE,yCAAyC;IACzC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,8DAA8D;IAC9D,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAwB,EACxB,MAAc,EACd,SAAiB,EACjB,MAAc;IAEd,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,+DAA+D;QAC/D,+DAA+D;QAC/D,qEAAqE;QACrE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,qBAAqB;QACrB,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,8CAA8C;QAC9C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAChE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACtE,+DAA+D;QAC/D,kEAAkE;QAClE,sEAAsE;QACtE,0DAA0D;QAC1D,gEAAgE;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,sEAAsE;QACtE,gEAAgE;QAChE,4DAA4D;QAC5D,mEAAmE;QACnE,iEAAiE;QACjE,kDAAkD;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9D,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACnC,kEAAkE;YAClE,oEAAoE;YACpE,6DAA6D;YAC7D,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,SAAS;YACT,OAAO,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1C,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,GAAG;gBACR,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,qBAAqB;gBAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,gDAAgD;IAChD,wEAAwE;IACxE,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/server/dist/external/org/beat-register-release-request.d.ts

@@ -0,0 +1,20 @@
+import type { LstatFn } from "./beat-register.js";
+import { type BeatRegisterLockOptions } from "./beat-register-release-core.js";
+export interface HandleReleaseRequestDeps {
+    leadsRoot: string;
+    lstatSync?: LstatFn;
+    lockOptions?: BeatRegisterLockOptions;
+    now?: () => Date;
+}
+export interface ReleaseRequestResult {
+    status: 200 | 400 | 403 | 404 | 409 | 502;
+    body: Record<string, unknown>;
+}
+/**
+ * `rawBody` is the already-JSON-parsed request body (or `undefined`/`null`
+ * on a parse failure the caller has already turned into its own 400) —
+ * parsing itself stays in each Hono shell since only it knows how to read
+ * `c.req`.
+ */
+export declare function handleReleaseRequest(deps: HandleReleaseRequestDeps, leadId: string, rawBody: unknown): Promise<ReleaseRequestResult>;
+//# sourceMappingURL=beat-register-release-request.d.ts.map

package/server/dist/external/org/beat-register-release-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-register-release-request.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-register-release-request.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAKL,KAAK,uBAAuB,EAE7B,MAAM,iCAAiC,CAAC;AAEzC,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAaD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,oBAAoB,CAAC,CA4D/B"}

package/server/dist/external/org/beat-register-release-request.js

@@ -0,0 +1,92 @@
+/*
+ * external/org/beat-register-release-request.ts — request validation +
+ * `performRelease` call + error-to-status mapping, as ONE function shared by
+ * both the secret-gated route (`beat-register-release.ts`) and the plain
+ * browser-facing proxy (`routes/org.ts`) — review finding: the two route
+ * shells were on track to duplicate this whole body, which would have let
+ * their contracts drift silently. Split out of `beat-register-release-
+ * core.ts` (which owns `performRelease` itself) to stay under the 300-line
+ * file guideline.
+ *
+ * External-review fix (Branch A, GLM, medium): `lstat`/`lockOptions`/`now`
+ * are defaulted HERE, once, rather than by each route shell separately —
+ * two independent `?? realDefault` sites for the same three deps would
+ * have been exactly the drift risk finding #5 already extracted this
+ * function to prevent, just moved one layer down.
+ */
+import { lstatSync } from "node:fs";
+import { performRelease, DEFAULT_LOCK_OPTIONS, OrgSymlinkEscapeError, BeatRegisterInvalidError, } from "./beat-register-release-core.js";
+const RELEASE_REASON_MAX_LENGTH = 500;
+// Doubt-review fix (Stage 3, medium/correctness): no `/i` flag. Entry
+// matching in `beat-register-release-core.ts` is an exact `===` string
+// comparison, never normalized — leadwright's own writer always produces
+// `crypto.randomUUID()`, which is defined to be lowercase, so the register
+// can never legitimately hold an uppercase-cased entry. Accepting a
+// differently-cased-but-otherwise-valid sessionId here let it pass
+// validation and then silently miss its real (lowercase) register entry,
+// returning 404 not-found for an entry that genuinely exists.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/**
+ * `rawBody` is the already-JSON-parsed request body (or `undefined`/`null`
+ * on a parse failure the caller has already turned into its own 400) —
+ * parsing itself stays in each Hono shell since only it knows how to read
+ * `c.req`.
+ */
+export async function handleReleaseRequest(deps, leadId, rawBody) {
+    const { sessionId, reason } = (rawBody ?? {});
+    if (typeof sessionId !== "string" || !UUID_RE.test(sessionId)) {
+        return { status: 400, body: { error: "sessionId_invalid" } };
+    }
+    // External-review fix (Branch A/OpenAI, medium): validate the TRIMMED
+    // reason, not the raw string. The client-side prompt already trims before
+    // calling, but this is the plain browser-facing route — any caller that
+    // skips the UI (a script, a differently-behaved future client) could send
+    // whitespace-only text, which `.length` alone would accept, forcing a
+    // release with an audit record that carries no real justification.
+    const trimmedReason = typeof reason === "string" ? reason.trim() : "";
+    if (typeof reason !== "string" ||
+        trimmedReason.length === 0 ||
+        trimmedReason.length > RELEASE_REASON_MAX_LENGTH) {
+        return {
+            status: 400,
+            body: { error: "reason_invalid", detail: `must be 1-${RELEASE_REASON_MAX_LENGTH} chars` },
+        };
+    }
+    const resolvedDeps = {
+        leadsRoot: deps.leadsRoot,
+        lockOptions: deps.lockOptions ?? DEFAULT_LOCK_OPTIONS,
+        now: deps.now ?? (() => new Date()),
+        lstat: deps.lstatSync ?? ((p) => lstatSync(p)),
+    };
+    let outcome;
+    try {
+        outcome = await performRelease(resolvedDeps, leadId, sessionId, trimmedReason);
+    }
+    catch (err) {
+        if (err instanceof OrgSymlinkEscapeError) {
+            return { status: 403, body: { error: "symlink_forbidden", path: err.path } };
+        }
+        if (err instanceof BeatRegisterInvalidError) {
+            return { status: 502, body: { error: "beat_register_invalid", leadId } };
+        }
+        const code = err?.code;
+        if (code === "ELOCKED") {
+            return { status: 409, body: { error: "beat_register_locked", leadId } };
+        }
+        throw err;
+    }
+    if (!outcome.ok) {
+        // "fault" (duplicate sessionId — trap #3, never resolved by picking
+        // one) is a structural data conflict, not "nothing here": 409, not 404.
+        const status = outcome.reason === "fault" ? 409 : 404;
+        return { status, body: { ok: false, reason: outcome.reason, detail: outcome.detail } };
+    }
+    if (!outcome.recovered) {
+        return { status: 200, body: { ok: true, recovered: false } };
+    }
+    return {
+        status: 200,
+        body: { ok: true, recovered: true, residualLockWarning: outcome.residualLockWarning },
+    };
+}
+//# sourceMappingURL=beat-register-release-request.js.map

package/server/dist/external/org/beat-register-release-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-register-release-request.js","sourceRoot":"","sources":["../../../src/external/org/beat-register-release-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,GAGzB,MAAM,iCAAiC,CAAC;AASzC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,oEAAoE;AACpE,mEAAmE;AACnE,yEAAyE;AACzE,8DAA8D;AAC9D,MAAM,OAAO,GAAG,gEAAgE,CAAC;AAOjF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B,EAC9B,MAAc,EACd,OAAgB;IAEhB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAA8C,CAAC;IAC3F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IAC/D,CAAC;IACD,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,aAAa,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,aAAa,CAAC,MAAM,KAAK,CAAC;QAC1B,aAAa,CAAC,MAAM,GAAG,yBAAyB,EAChD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,yBAAyB,QAAQ,EAAE;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,oBAAoB;QACrD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;IAEF,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,oEAAoE;QACpE,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE;KACtF,CAAC;AACJ,CAAC"}

package/server/dist/external/org/beat-register-release.d.ts

@@ -1,8 +1,10 @@
 import type { Hono } from "hono";
 import type { LstatFn } from "./beat-register.js";
-import { type BeatRegisterLockOptions } from "./beat-register-release-core.js";
+import type { BeatRegisterLockOptions } from "./beat-register-release-core.js";
 export { performRelease, DEFAULT_LOCK_OPTIONS, OrgSymlinkEscapeError, BeatRegisterInvalidError, RESIDUAL_LOCK_WARNING, } from "./beat-register-release-core.js";
 export type { ReleaseOutcome, BeatRegisterLockOptions } from "./beat-register-release-core.js";
+export { handleReleaseRequest } from "./beat-register-release-request.js";
+export type { ReleaseRequestResult } from "./beat-register-release-request.js";
 export interface ReleaseRouteDeps {
     leadsRoot: string;
     lstatSync?: LstatFn;

package/server/dist/external/org/beat-register-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"beat-register-release.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-register-release.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAIjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAa/F,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAsExF"}
+{"version":3,"file":"beat-register-release.d.ts","sourceRoot":"","sources":["../../../src/external/org/beat-register-release.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG/E,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAyBxF"}