@svenroth-ai/shipwright 0.26.0 → 0.28.0

package/server/dist/external/org/commit.test-fixtures.js

@@ -0,0 +1,67 @@
+/*
+ * commit.test-fixtures.ts — shared request/deps builders for commit.ts's
+ * test suite, split across commit.test.ts (validation/digest/write-order)
+ * and commit-lock.test.ts (lock/symlink error mapping) so neither file
+ * ratchets past the bloat ceiling.
+ */
+import { vi } from "vitest";
+import { computeProposalDigest } from "./leadwright-proposal-merge.js";
+export const EMPTY_ORG_CHART = { version: 2, po: "sven", leads: {} };
+export const VALID_LEAD = {
+    name: "New Lead",
+    domain: "billing",
+    reports_to: null,
+    manages: [],
+    charter_path: "new-lead/charter.md",
+    learnings_path: "new-lead/learnings.md",
+    triggers: { cron: "0 * * * *", on: [] },
+    max_concurrent_tasks: 1,
+    budget: { window: "rolling-7d", usd: null, pause_at: 0.85, hard_stop_at: 0.95 },
+    projects: ["p1"],
+    allowed_skills: ["/x"],
+    allowed_tools: [],
+    escalation_target: "po",
+    model: "balanced",
+    paused: false,
+};
+export const ADDITIONS = { path: "/abs/p1", actionId: "/x", pluginDirs: ["/abs/plugins"] };
+export function correctDigest() {
+    const merged = { ...EMPTY_ORG_CHART, leads: { "new-lead": VALID_LEAD } };
+    return computeProposalDigest({
+        orgChart: merged,
+        charters: [{ leadId: "new-lead", content: "# New Lead" }],
+        daemonConfig: {
+            orgChartPath: "/leads/org-chart.json",
+            webuiBaseUrl: "http://localhost:5173",
+            leadProjectRoots: { "new-lead": ADDITIONS.path },
+            leadActionIds: { "new-lead": ADDITIONS.actionId },
+            leadPluginDirs: { "new-lead": ADDITIONS.pluginDirs },
+        },
+    });
+}
+export function validBody(overrides = {}) {
+    return {
+        leadId: "new-lead",
+        lead: VALID_LEAD,
+        daemonConfigAdditions: ADDITIONS,
+        charterContent: "# New Lead",
+        expectedProposalDigest: correctDigest(),
+        ...overrides,
+    };
+}
+export function baseDeps(overrides = {}) {
+    return {
+        leadsRoot: "/leads",
+        leadwrightCheckoutRoot: "/leadwright",
+        webuiBaseUrl: "http://localhost:5173",
+        readOrgChartFullFn: vi.fn(() => ({ status: 200, body: EMPTY_ORG_CHART })),
+        daemonConfigReadFn: vi.fn(() => ({
+            status: 200,
+            body: { found: false, template: { orgChartPath: "/leads/org-chart.json", webuiBaseUrl: "http://localhost:5173" } },
+        })),
+        writeCharterFn: vi.fn(),
+        runLeadwrightPreflightFn: vi.fn(async () => ({ ranOk: true, result: { ok: true, findings: [] } })),
+        ...overrides,
+    };
+}
+//# sourceMappingURL=commit.test-fixtures.js.map

package/server/dist/external/org/commit.test-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit.test-fixtures.js","sourceRoot":"","sources":["../../../src/external/org/commit.test-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAGvE,MAAM,CAAC,MAAM,eAAe,GAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAExF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,qBAAqB;IACnC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE;IACvC,oBAAoB,EAAE,CAAC;IACvB,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;IAC/E,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,cAAc,EAAE,CAAC,IAAI,CAAC;IACtB,aAAa,EAAE,EAAE;IACjB,iBAAiB,EAAE,IAAI;IACvB,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,KAAK;CACU,CAAC;AAE1B,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;AAE3F,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAsB,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;IAC5F,OAAO,qBAAqB,CAAC;QAC3B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACzD,YAAY,EAAE;YACZ,YAAY,EAAE,uBAAuB;YACrC,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,IAAI,EAAE;YAChD,aAAa,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE;YACjD,cAAc,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE;SACrD;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,YAAwC,EAAE;IAClE,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,UAAU;QAChB,qBAAqB,EAAE,SAAS;QAChC,cAAc,EAAE,YAAY;QAC5B,sBAAsB,EAAE,aAAa,EAAE;QACvC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,YAAqC,EAAE;IAC9D,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,sBAAsB,EAAE,aAAa;QACrC,YAAY,EAAE,uBAAuB;QACrC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAY;YACpB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAc,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,uBAAuB,EAAE,EAAE;SAC5H,CAAC,CAAC;QACH,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;QACvB,wBAAwB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAa,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3G,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/server/dist/external/org/countersign-core.d.ts

@@ -0,0 +1,19 @@
+import { withDecisionsLock, type DecisionsLockDeps } from "./decisions-lock.js";
+export type CountersignOutcome = {
+    status: "countersigned";
+    number: number;
+} | {
+    status: "already_countersigned";
+    number: number;
+} | {
+    status: "not_found";
+} | {
+    status: "duplicate_identity";
+    count: number;
+};
+export interface CountersignCoreDeps extends DecisionsLockDeps {
+    /** Injectable for tests; production wires the real `withDecisionsLock`. */
+    withDecisionsLock?: typeof withDecisionsLock;
+}
+export declare function performCountersign(deps: CountersignCoreDeps, timestamp: string, leadId: string): Promise<CountersignOutcome>;
+//# sourceMappingURL=countersign-core.d.ts.map

package/server/dist/external/org/countersign-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"countersign-core.d.ts","sourceRoot":"","sources":["../../../src/external/org/countersign-core.ts"],"names":[],"mappings":"AAoCA,OAAO,EACL,iBAAiB,EAMjB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AA8B7B,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;CAC9C;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,mBAAmB,EACzB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAsE7B"}

package/server/dist/external/org/countersign-core.js

@@ -0,0 +1,122 @@
+/*
+ * external/org/countersign-core.ts — the pure countersign action
+ * (`performCountersign`), split out of `countersign.ts` so the SAME action
+ * can be shared, unmodified, by both the secret-gated route
+ * (`countersign.ts`) and the plain browser-facing proxy (`routes/org.ts`) —
+ * same rationale as `beat-register-release-core.ts` / `-request.ts`.
+ *
+ * Moves EXACTLY ONE entry from `decisions-proposed.md` to `decision_log.md`,
+ * assigning the next sequential `ADR-NNNN` number inside the FR-04.28 lock
+ * (`decisions-lock.ts`). Two plan-review fixes baked in from the start:
+ *
+ *   - Request identifies the entry by `{timestamp, leadId}`, not timestamp
+ *     alone (two leads, or two proposals in the same wall-clock second,
+ *     could otherwise collide).
+ *   - Crash-safe / idempotent retry: `decision_log.md` is the source of
+ *     truth for "already done" — if an entry with the same
+ *     (timestamp, leadId) is already logged, the action does NOT mint a
+ *     second number; it just makes sure the proposed-side copy is (still)
+ *     removed and returns the existing number. This is why the log write
+ *     happens BEFORE the proposed-side removal: a crash between the two
+ *     leaves `decision_log.md` durable and the retry finds it there.
+ *
+ * External-review fix (MEDIUM, edge-case): "(timestamp, leadId) as identity"
+ * does not guarantee UNIQUENESS by construction, only disambiguation in the
+ * common case — the daemon could still write two genuinely distinct
+ * proposals sharing the same pair (e.g. two rapid proposals from one lead in
+ * the same wall-clock second). Both the initial-match and the
+ * idempotent-retry path now count matches: exactly one proceeds as before;
+ * two or more is a `duplicate_identity` conflict rather than silently
+ * discarding every match past the first.
+ */
+import { writeFileSync, renameSync, existsSync, unlinkSync } from "node:fs";
+import { dirname, basename, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { withDecisionsLock, parseProposedEntries, parseLoggedEntries, findLoggedEntry, nextLoggedNumber, toLoggedBlock, } from "./decisions-lock.js";
+/** Body of a header-delimited block, i.e. everything after its first line —
+ *  used to tell genuine residual-cleanup (same body) from a genuinely
+ *  distinct proposal that happens to reuse the same (timestamp, leadId). */
+function bodyAfterHeader(block) {
+    const idx = block.indexOf("\n");
+    return idx === -1 ? "" : block.slice(idx + 1);
+}
+function atomicWrite(target, content) {
+    const tmp = join(dirname(target), `.${basename(target)}.tmp-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}`);
+    try {
+        writeFileSync(tmp, content, "utf8");
+        renameSync(tmp, target);
+    }
+    catch (err) {
+        // Doubt-review fix (minor): mirror file-write.ts's performWrite — don't
+        // leave an orphaned .tmp-* file behind on a failed rename.
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch {
+            /* swallow */
+        }
+        throw err;
+    }
+}
+export async function performCountersign(deps, timestamp, leadId) {
+    const lockFn = deps.withDecisionsLock ?? withDecisionsLock;
+    return lockFn(deps, (ctx) => {
+        const loggedRaw = ctx.readLogged();
+        const loggedEntries = parseLoggedEntries(loggedRaw);
+        const existing = findLoggedEntry(loggedEntries, timestamp, leadId);
+        if (existing) {
+            const proposedRaw = ctx.readProposed();
+            // External-review fix (MEDIUM, edge-case): two genuinely-distinct
+            // proposals can share the same (timestamp, leadId) pair (the ADR that
+            // adopted the pair as identity already acknowledged timestamp
+            // collisions are possible). `.find()` here used to silently discard
+            // every residual match past the first without ever logging it —
+            // indistinguishable from ordinary post-countersign cleanup. `.filter()`
+            // lets a genuine duplicate surface as a conflict instead.
+            const stillProposedMatches = parseProposedEntries(proposedRaw).filter((e) => e.timestamp === timestamp && e.leadId === leadId);
+            if (stillProposedMatches.length > 1) {
+                return { status: "duplicate_identity", count: stillProposedMatches.length };
+            }
+            if (stillProposedMatches.length === 1) {
+                const stillProposed = stillProposedMatches[0];
+                // Doubt-review fix (HIGH): a single still-proposed match is only
+                // safe to delete as residual cleanup if it's the SAME proposal
+                // that's already logged (crash between the log-write and the
+                // proposed-side removal). Without comparing bodies, a genuinely
+                // distinct proposal that later reuses the same (timestamp, leadId)
+                // pair — which this module's own header comment already treats as
+                // a possible, not merely theoretical, collision — would be
+                // silently deleted here and reported as "already countersigned"
+                // under the OLD entry's ADR number, with no trace left anywhere.
+                if (bodyAfterHeader(stillProposed.block) !== bodyAfterHeader(existing.block)) {
+                    return { status: "duplicate_identity", count: 2 };
+                }
+                const nextProposed = proposedRaw.slice(0, stillProposed.startIndex) +
+                    proposedRaw.slice(stillProposed.endIndex);
+                atomicWrite(ctx.proposedPath, nextProposed);
+            }
+            return { status: "already_countersigned", number: existing.number };
+        }
+        const proposedRaw = ctx.readProposed();
+        const matches = parseProposedEntries(proposedRaw).filter((e) => e.timestamp === timestamp && e.leadId === leadId);
+        if (matches.length === 0) {
+            return { status: "not_found" };
+        }
+        if (matches.length > 1) {
+            return { status: "duplicate_identity", count: matches.length };
+        }
+        const target = matches[0];
+        const number = nextLoggedNumber(loggedEntries);
+        const loggedBlock = toLoggedBlock(target.block, number);
+        const separator = loggedRaw.length > 0 && !loggedRaw.endsWith("\n") ? "\n" : "";
+        const nextLogged = loggedRaw + separator + loggedBlock;
+        const nextProposed = proposedRaw.slice(0, target.startIndex) + proposedRaw.slice(target.endIndex);
+        // Log FIRST (durable), then remove from proposed — the idempotent-retry
+        // check above trusts decision_log.md as "already done".
+        atomicWrite(ctx.loggedPath, nextLogged);
+        atomicWrite(ctx.proposedPath, nextProposed);
+        return { status: "countersigned", number };
+    });
+}
+//# sourceMappingURL=countersign-core.js.map

package/server/dist/external/org/countersign-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"countersign-core.js","sourceRoot":"","sources":["../../../src/external/org/countersign-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,GAEd,MAAM,qBAAqB,CAAC;AAE7B;;4EAE4E;AAC5E,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe;IAClD,MAAM,GAAG,GAAG,IAAI,CACd,OAAO,CAAC,MAAM,CAAC,EACf,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACF,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAyB,EACzB,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;YACvC,kEAAkE;YAClE,sEAAsE;YACtE,8DAA8D;YAC9D,oEAAoE;YACpE,gEAAgE;YAChE,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CACxD,CAAC;YACF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;gBAC9C,iEAAiE;gBACjE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,gEAAgE;gBAChE,mEAAmE;gBACnE,kEAAkE;gBAClE,2DAA2D;gBAC3D,gEAAgE;gBAChE,iEAAiE;gBACjE,IAAI,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7E,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACpD,CAAC;gBACD,MAAM,YAAY,GAChB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC;oBAC9C,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC5C,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CACxD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACjE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;QACvD,MAAM,YAAY,GAChB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/E,wEAAwE;QACxE,wDAAwD;QACxD,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAE5C,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/org/countersign-request.d.ts

@@ -0,0 +1,14 @@
+import { type CountersignCoreDeps } from "./countersign-core.js";
+export type HandleCountersignRequestDeps = CountersignCoreDeps;
+export interface CountersignRequestResult {
+    status: 200 | 400 | 403 | 404 | 409;
+    body: Record<string, unknown>;
+}
+/**
+ * `rawBody` is the already-JSON-parsed request body (or `undefined`/`null`
+ * on a parse failure the caller has already turned into its own 400) —
+ * parsing itself stays in each Hono shell since only it knows how to read
+ * `c.req`.
+ */
+export declare function handleCountersignRequest(deps: HandleCountersignRequestDeps, rawBody: unknown): Promise<CountersignRequestResult>;
+//# sourceMappingURL=countersign-request.d.ts.map

package/server/dist/external/org/countersign-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"countersign-request.d.ts","sourceRoot":"","sources":["../../../src/external/org/countersign-request.ts"],"names":[],"mappings":"AASA,OAAO,EAAsB,KAAK,mBAAmB,EAA2B,MAAM,uBAAuB,CAAC;AAQ9G,MAAM,MAAM,4BAA4B,GAAG,mBAAmB,CAAC;AAE/D,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,CAAC,CAyDnC"}

package/server/dist/external/org/countersign-request.js

@@ -0,0 +1,78 @@
+/*
+ * external/org/countersign-request.ts — request validation +
+ * `performCountersign` call + error-to-status mapping, as ONE function
+ * shared by both the secret-gated route (`countersign.ts`) and the plain
+ * browser-facing proxy (`routes/org.ts`) — same rationale as
+ * `beat-register-release-request.ts`: two independent route shells must not
+ * be free to duplicate (and silently drift on) this body.
+ */
+import { performCountersign } from "./countersign-core.js";
+import { OrgSymlinkEscapeError } from "./decisions-lock.js";
+import { LEAD_ID_RE } from "./_helpers.js";
+/** Canonical ISO-8601 UTC ('Z') timestamp — the transfer format's own shape
+ *  (spec: "Design decisions I own"). Tolerates 0-N fractional-second digits. */
+const ISO_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+/**
+ * `rawBody` is the already-JSON-parsed request body (or `undefined`/`null`
+ * on a parse failure the caller has already turned into its own 400) —
+ * parsing itself stays in each Hono shell since only it knows how to read
+ * `c.req`.
+ */
+export async function handleCountersignRequest(deps, rawBody) {
+    const { timestamp, leadId } = (rawBody ?? {});
+    if (typeof timestamp !== "string" || timestamp.length === 0) {
+        return { status: 400, body: { error: "timestamp_required" } };
+    }
+    if (typeof leadId !== "string" || leadId.length === 0) {
+        return { status: 400, body: { error: "leadId_required" } };
+    }
+    // External-review fix (MEDIUM, spec): the transfer format's identity pair
+    // is a canonical ISO-8601 timestamp + a kebab-case lead id, not merely
+    // "any non-empty string" — an arbitrary value silently 404s as
+    // proposal_not_found instead of being rejected as malformed input.
+    //
+    // Doubt-review fix (LOW): `$` without the `/m` flag still matches just
+    // before a single trailing "\n" (JS regex semantics, not just true
+    // end-of-input) — reject a literal newline explicitly first, so
+    // "<valid-ts>\n" 400s as timestamp_invalid instead of passing this check
+    // and only failing later, less precisely, as proposal_not_found.
+    if (timestamp.includes("\n") || !ISO_TIMESTAMP_RE.test(timestamp)) {
+        return { status: 400, body: { error: "timestamp_invalid", timestamp } };
+    }
+    if (!LEAD_ID_RE.test(leadId)) {
+        return { status: 400, body: { error: "leadId_invalid", leadId } };
+    }
+    let outcome;
+    try {
+        outcome = await performCountersign(deps, timestamp, leadId);
+    }
+    catch (err) {
+        // Code-review fix: without this, a symlinked decisions-proposed.md /
+        // decision_log.md fell through to the generic 500 error handler
+        // instead of the family's typed 403 symlink_forbidden (file-write.ts
+        // applies the same defense class explicitly).
+        if (err instanceof OrgSymlinkEscapeError) {
+            return { status: 403, body: { error: "symlink_forbidden", path: err.path } };
+        }
+        throw err;
+    }
+    if (outcome.status === "not_found") {
+        return { status: 404, body: { error: "proposal_not_found", timestamp, leadId } };
+    }
+    if (outcome.status === "duplicate_identity") {
+        return {
+            status: 409,
+            body: { error: "duplicate_proposal_identity", timestamp, leadId, count: outcome.count },
+        };
+    }
+    return {
+        status: 200,
+        body: {
+            countersigned: true,
+            alreadyCountersigned: outcome.status === "already_countersigned",
+            number: outcome.number,
+            adr: `ADR-${String(outcome.number).padStart(4, "0")}`,
+        },
+    };
+}
+//# sourceMappingURL=countersign-request.js.map

package/server/dist/external/org/countersign-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"countersign-request.js","sourceRoot":"","sources":["../../../src/external/org/countersign-request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAqD,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;gFACgF;AAChF,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;AAS1E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAkC,EAClC,OAAgB;IAEhB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAA8C,CAAC;IAC3F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;IAC7D,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,+DAA+D;IAC/D,mEAAmE;IACnE,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,gEAAgE;QAChE,qEAAqE;QACrE,8CAA8C;QAC9C,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;SACxF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,aAAa,EAAE,IAAI;YACnB,oBAAoB,EAAE,OAAO,CAAC,MAAM,KAAK,uBAAuB;YAChE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACtD;KACF,CAAC;AACJ,CAAC"}

package/server/dist/external/org/countersign.d.ts

@@ -1,8 +1,9 @@
 import type { Hono } from "hono";
-import { withDecisionsLock, type DecisionsLockDeps } from "./decisions-lock.js";
-export interface CountersignRouteDeps extends DecisionsLockDeps {
-    /** Injectable for tests; production wires the real `withDecisionsLock`. */
-    withDecisionsLock?: typeof withDecisionsLock;
-}
+import type { CountersignCoreDeps } from "./countersign-core.js";
+export { performCountersign } from "./countersign-core.js";
+export type { CountersignOutcome, CountersignCoreDeps } from "./countersign-core.js";
+export { handleCountersignRequest } from "./countersign-request.js";
+export type { HandleCountersignRequestDeps, CountersignRequestResult, } from "./countersign-request.js";
+export type CountersignRouteDeps = CountersignCoreDeps;
 export declare function registerCountersignRoute(app: Hono, deps: CountersignRouteDeps): void;
 //# sourceMappingURL=countersign.d.ts.map

package/server/dist/external/org/countersign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"countersign.d.ts","sourceRoot":"","sources":["../../../src/external/org/countersign.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,OAAO,EACL,iBAAiB,EAOjB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAiG7B,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;CAC9C;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI,CA2DpF"}
+{"version":3,"file":"countersign.d.ts","sourceRoot":"","sources":["../../../src/external/org/countersign.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,YAAY,EACV,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEvD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAWpF"}

package/server/dist/external/org/countersign.js

@@ -1,105 +1,17 @@
 /*
  * external/org/countersign.ts — POST /api/external/org/decisions/countersign.
  *
- * Moves EXACTLY ONE entry from `decisions-proposed.md` to `decision_log.md`,
- * assigning the next sequential `ADR-NNNN` number inside the FR-04.28 lock
- * (`decisions-lock.ts`). Two plan-review fixes baked in from the start:
- *
- *   - Request identifies the entry by `{timestamp, leadId}`, not timestamp
- *     alone (two leads, or two proposals in the same wall-clock second,
- *     could otherwise collide).
- *   - Crash-safe / idempotent retry: `decision_log.md` is the source of
- *     truth for "already done" — if an entry with the same
- *     (timestamp, leadId) is already logged, the action does NOT mint a
- *     second number; it just makes sure the proposed-side copy is (still)
- *     removed and returns the existing number. This is why the log write
- *     happens BEFORE the proposed-side removal: a crash between the two
- *     leaves `decision_log.md` durable and the retry finds it there.
- *
- * External-review fix (MEDIUM, edge-case): "(timestamp, leadId) as identity"
- * does not guarantee UNIQUENESS by construction, only disambiguation in the
- * common case — the daemon could still write two genuinely distinct
- * proposals sharing the same pair (e.g. two rapid proposals from one lead in
- * the same wall-clock second). Both the initial-match and the
- * idempotent-retry path now count matches: exactly one proceeds as before;
- * two or more is a `409 duplicate_proposal_identity` conflict rather than
- * silently discarding every match past the first.
+ * Hono route shell only — parses the request and hands off to
+ * `handleCountersignRequest` (`countersign-request.ts`), which is ALSO used
+ * by the plain browser-facing proxy's countersign route (`routes/org.ts`,
+ * iterate-2026-09-06-decisions-proposed-countersign) so the two route shells
+ * cannot drift on validation or status-mapping. The countersign action
+ * itself (locking, decision-log/proposed-file mutation) lives in
+ * `countersign-core.ts`.
  */
-import { writeFileSync, renameSync, existsSync, unlinkSync } from "node:fs";
-import { dirname, basename, join } from "node:path";
-import { randomBytes } from "node:crypto";
-import { withDecisionsLock, parseProposedEntries, parseLoggedEntries, findLoggedEntry, nextLoggedNumber, toLoggedBlock, OrgSymlinkEscapeError, } from "./decisions-lock.js";
-import { LEAD_ID_RE } from "./_helpers.js";
-/** Canonical ISO-8601 UTC ('Z') timestamp — the transfer format's own shape
- *  (spec: "Design decisions I own"). Tolerates 0-N fractional-second digits. */
-const ISO_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
-function atomicWrite(target, content) {
-    const tmp = join(dirname(target), `.${basename(target)}.tmp-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}`);
-    try {
-        writeFileSync(tmp, content, "utf8");
-        renameSync(tmp, target);
-    }
-    catch (err) {
-        // Doubt-review fix (minor): mirror file-write.ts's performWrite — don't
-        // leave an orphaned .tmp-* file behind on a failed rename.
-        try {
-            if (existsSync(tmp))
-                unlinkSync(tmp);
-        }
-        catch {
-            /* swallow */
-        }
-        throw err;
-    }
-}
-async function countersign(deps, timestamp, leadId) {
-    const lockFn = deps.withDecisionsLock ?? withDecisionsLock;
-    return lockFn(deps, (ctx) => {
-        const loggedRaw = ctx.readLogged();
-        const loggedEntries = parseLoggedEntries(loggedRaw);
-        const existing = findLoggedEntry(loggedEntries, timestamp, leadId);
-        if (existing) {
-            const proposedRaw = ctx.readProposed();
-            // External-review fix (MEDIUM, edge-case): two genuinely-distinct
-            // proposals can share the same (timestamp, leadId) pair (the ADR that
-            // adopted the pair as identity already acknowledged timestamp
-            // collisions are possible). `.find()` here used to silently discard
-            // every residual match past the first without ever logging it —
-            // indistinguishable from ordinary post-countersign cleanup. `.filter()`
-            // lets a genuine duplicate surface as a conflict instead.
-            const stillProposedMatches = parseProposedEntries(proposedRaw).filter((e) => e.timestamp === timestamp && e.leadId === leadId);
-            if (stillProposedMatches.length > 1) {
-                return { status: "duplicate_identity", count: stillProposedMatches.length };
-            }
-            if (stillProposedMatches.length === 1) {
-                const stillProposed = stillProposedMatches[0];
-                const nextProposed = proposedRaw.slice(0, stillProposed.startIndex) +
-                    proposedRaw.slice(stillProposed.endIndex);
-                atomicWrite(ctx.proposedPath, nextProposed);
-            }
-            return { status: "already_countersigned", number: existing.number };
-        }
-        const proposedRaw = ctx.readProposed();
-        const matches = parseProposedEntries(proposedRaw).filter((e) => e.timestamp === timestamp && e.leadId === leadId);
-        if (matches.length === 0) {
-            return { status: "not_found" };
-        }
-        if (matches.length > 1) {
-            return { status: "duplicate_identity", count: matches.length };
-        }
-        const target = matches[0];
-        const number = nextLoggedNumber(loggedEntries);
-        const loggedBlock = toLoggedBlock(target.block, number);
-        const separator = loggedRaw.length > 0 && !loggedRaw.endsWith("\n") ? "\n" : "";
-        const nextLogged = loggedRaw + separator + loggedBlock;
-        const nextProposed = proposedRaw.slice(0, target.startIndex) + proposedRaw.slice(target.endIndex);
-        // Log FIRST (durable), then remove from proposed — the idempotent-retry
-        // check above trusts decision_log.md as "already done".
-        atomicWrite(ctx.loggedPath, nextLogged);
-        atomicWrite(ctx.proposedPath, nextProposed);
-        return { status: "countersigned", number };
-    });
-}
+import { handleCountersignRequest } from "./countersign-request.js";
+export { performCountersign } from "./countersign-core.js";
+export { handleCountersignRequest } from "./countersign-request.js";
 export function registerCountersignRoute(app, deps) {
     app.post("/api/external/org/decisions/countersign", async (c) => {
         let body;
@@ -109,49 +21,8 @@ export function registerCountersignRoute(app, deps) {
         catch {
             return c.json({ error: "invalid_json" }, 400);
         }
-        const { timestamp, leadId } = (body ?? {});
-        if (typeof timestamp !== "string" || timestamp.length === 0) {
-            return c.json({ error: "timestamp_required" }, 400);
-        }
-        if (typeof leadId !== "string" || leadId.length === 0) {
-            return c.json({ error: "leadId_required" }, 400);
-        }
-        // External-review fix (MEDIUM, spec): the transfer format's identity pair
-        // is a canonical ISO-8601 timestamp + a kebab-case lead id, not merely
-        // "any non-empty string" — an arbitrary value silently 404s as
-        // proposal_not_found instead of being rejected as malformed input.
-        if (!ISO_TIMESTAMP_RE.test(timestamp)) {
-            return c.json({ error: "timestamp_invalid", timestamp }, 400);
-        }
-        if (!LEAD_ID_RE.test(leadId)) {
-            return c.json({ error: "leadId_invalid", leadId }, 400);
-        }
-        let outcome;
-        try {
-            outcome = await countersign(deps, timestamp, leadId);
-        }
-        catch (err) {
-            // Code-review fix: without this, a symlinked decisions-proposed.md /
-            // decision_log.md fell through to the generic 500 error handler
-            // instead of the family's typed 403 symlink_forbidden (file-write.ts
-            // applies the same defense class explicitly).
-            if (err instanceof OrgSymlinkEscapeError) {
-                return c.json({ error: "symlink_forbidden", path: err.path }, 403);
-            }
-            throw err;
-        }
-        if (outcome.status === "not_found") {
-            return c.json({ error: "proposal_not_found", timestamp, leadId }, 404);
-        }
-        if (outcome.status === "duplicate_identity") {
-            return c.json({ error: "duplicate_proposal_identity", timestamp, leadId, count: outcome.count }, 409);
-        }
-        return c.json({
-            countersigned: true,
-            alreadyCountersigned: outcome.status === "already_countersigned",
-            number: outcome.number,
-            adr: `ADR-${String(outcome.number).padStart(4, "0")}`,
-        });
+        const result = await handleCountersignRequest(deps, body);
+        return c.json(result.body, result.status);
     });
 }
 //# sourceMappingURL=countersign.js.map

package/server/dist/external/org/countersign.js.map

@@ -1 +1 @@
-{"version":3,"file":"countersign.js","sourceRoot":"","sources":["../../../src/external/org/countersign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;gFACgF;AAChF,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;AAE1E,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe;IAClD,MAAM,GAAG,GAAG,IAAI,CACd,OAAO,CAAC,MAAM,CAAC,EACf,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACF,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CACxB,IAA0B,EAC1B,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;YACvC,kEAAkE;YAClE,sEAAsE;YACtE,8DAA8D;YAC9D,oEAAoE;YACpE,gEAAgE;YAChE,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CACxD,CAAC;YACF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,YAAY,GAChB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC;oBAC9C,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC5C,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CACxD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACjE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;QACvD,MAAM,YAAY,GAChB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/E,wEAAwE;QACxE,wDAAwD;QACxD,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAE5C,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,wBAAwB,CAAC,GAAS,EAAE,IAA0B;IAC5E,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAGxC,CAAC;QACF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,+DAA+D;QAC/D,mEAAmE;QACnE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,gEAAgE;YAChE,qEAAqE;YACrE,8CAA8C;YAC9C,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,aAAa,EAAE,IAAI;YACnB,oBAAoB,EAAE,OAAO,CAAC,MAAM,KAAK,uBAAuB;YAChE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"countersign.js","sourceRoot":"","sources":["../../../src/external/org/countersign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAQpE,MAAM,UAAU,wBAAwB,CAAC,GAAS,EAAE,IAA0B;IAC5E,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/org/daemon-config-read.d.ts

@@ -0,0 +1,31 @@
+import type { Hono } from "hono";
+import type { PreflightDaemonConfig } from "../../types/leadwright-preflight.js";
+export interface DaemonConfigReadDeps {
+    leadsRoot: string;
+    webuiBaseUrl: string;
+    lstatSync?: (path: string) => {
+        isSymbolicLink(): boolean;
+    };
+}
+export type DaemonConfigReadCoreResult = {
+    status: 200;
+    body: {
+        found: true;
+        config: PreflightDaemonConfig;
+    } | {
+        found: false;
+        template: {
+            orgChartPath: string;
+            webuiBaseUrl: string;
+        };
+    };
+} | {
+    status: 403 | 500 | 502;
+    body: {
+        error: string;
+        detail?: string;
+    };
+};
+export declare function daemonConfigReadCore(deps: DaemonConfigReadDeps): DaemonConfigReadCoreResult;
+export declare function registerDaemonConfigReadRoute(app: Hono, deps: DaemonConfigReadDeps): void;
+//# sourceMappingURL=daemon-config-read.d.ts.map

package/server/dist/external/org/daemon-config-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-config-read.d.ts","sourceRoot":"","sources":["../../../src/external/org/daemon-config-read.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAIjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEjF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,cAAc,IAAI,OAAO,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,GAClJ;IAAE,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,0BAA0B,CAyC3F;AAED,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAKzF"}

package/server/dist/external/org/daemon-config-read.js

@@ -0,0 +1,50 @@
+import { readFileSync, lstatSync } from "node:fs";
+import path from "node:path";
+export function daemonConfigReadCore(deps) {
+    const { leadsRoot, webuiBaseUrl } = deps;
+    const lstat = deps.lstatSync ?? ((p) => lstatSync(p));
+    const target = path.join(leadsRoot, "daemon-config.json");
+    try {
+        if (lstat(target).isSymbolicLink()) {
+            return { status: 403, body: { error: "symlink_forbidden" } };
+        }
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code !== "ENOENT") {
+            return { status: 500, body: { error: "daemon_config_stat_failed", detail: String(err).slice(0, 200) } };
+        }
+    }
+    let raw;
+    try {
+        raw = readFileSync(target, "utf8");
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") {
+            return {
+                status: 200,
+                body: { found: false, template: { orgChartPath: path.join(leadsRoot, "org-chart.json"), webuiBaseUrl } },
+            };
+        }
+        return { status: 500, body: { error: "daemon_config_read_failed", detail: String(err).slice(0, 200) } };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { status: 502, body: { error: "daemon_config_invalid" } };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return { status: 502, body: { error: "daemon_config_invalid" } };
+    }
+    return { status: 200, body: { found: true, config: parsed } };
+}
+export function registerDaemonConfigReadRoute(app, deps) {
+    app.get("/api/external/org/daemon-config", async (c) => {
+        const result = daemonConfigReadCore(deps);
+        return c.json(result.body, result.status);
+    });
+}
+//# sourceMappingURL=daemon-config-read.js.map