@telora/mcp-products 0.22.159 → 0.22.166

package/dist/handlers/migrationObservation.d.ts

@@ -0,0 +1,181 @@
+/** What the claimant's own repository holds, right now. */
+export interface MigrationObservation {
+    /** Every ordinal any local branch holds, deduplicated. */
+    observedHeld: string[];
+    /** How many refs were read -- evidence the observation is not vacuous. */
+    observedRefs: number;
+    /** When it was taken (epoch ms). */
+    observedAt: number;
+    /**
+     * Refs this observation could NOT read.
+     *
+     * NAMED RATHER THAN DROPPED. A ref that could not be read holds an unknown
+     * set of ordinals, and "unknown" silently folded in as "none" is the exact
+     * shape of fail-open the daemon's own reader refuses. The handler treats a
+     * non-empty list as a partial view and refuses the grant, retryably --
+     * symmetric with `migration_held_set_unavailable` on the daemon's side. A
+     * caller with NO repository at all reports no observation and is unaffected;
+     * this is only about a repository that exists and could not be fully read.
+     */
+    observedUnreadable: string[];
+    /**
+     * Every ref that was read, with the commit it pointed at. Recorded on the
+     * granted row, so "which commits did the allocator look at?" is answered by
+     * the claim rather than reconstructed afterwards.
+     */
+    observedTips: Record<string, string>;
+}
+/** A repo's migration declaration, as much of it as this reader needs. */
+interface Declaration {
+    dir: string;
+    filePattern: string;
+    scheme: MigrationScheme;
+    journal?: {
+        path?: string;
+    };
+}
+/** The two numbering schemes; an unrecognised value is malformed, never defaulted. */
+type MigrationScheme = "sequential" | "timestamp";
+/** The ordinals a declaration's pattern reads out of a list of paths. */
+export declare function ordinalsFromPaths(paths: readonly string[], declaration: Declaration): string[];
+/**
+ * The width the declaration's own ordinal group fixes, when it fixes one.
+ *
+ * WHY THE DECLARATION AND NOT THE FILES. A journal entry is a bare index --
+ * `2`, not `0002` -- so placing it needs a width, and reading that width from
+ * the matching migration FILES fails in exactly the case that matters: a
+ * sibling branch that has advanced its journal but has no file this pattern
+ * matches, or a ref carrying journal entries and no migration file at all.
+ * The idx was then dropped, and against a stale heartbeat the allocator could
+ * grant the very number the journal already holds. The declaration fixes the
+ * width independently of what any ref happens to contain.
+ *
+ * Only a pattern that PINS the width answers -- `\d{4}` or `[0-9]{4}`. A
+ * variable-width group (`\d+`) fixes nothing and returns null, which is the
+ * honest answer rather than a guess.
+ */
+export declare function declaredOrdinalWidth(filePattern: string): number | null;
+/**
+ * What reading a declared journal produced.
+ *
+ * A JOURNAL THAT CANNOT BE READ IS NOT AN EMPTY JOURNAL. This used to answer
+ * `[]` for unparseable text, a missing `entries` array, and an index it could
+ * not place -- indistinguishable from a journal that genuinely registers
+ * nothing. Against a heartbeat taken before a journal-only advance, that drops
+ * the held idx and lets the allocator grant the number again: the exact
+ * fail-open the observation exists to close, arriving through the one input
+ * that has no file to corroborate it.
+ */
+export type JournalReading = {
+    ok: true;
+    ordinals: string[];
+} | {
+    ok: false;
+    reason: "unparseable" | "no_entries" | "unplaceable_entry";
+};
+/** The idx values a journal registers, normalised to the width in use. */
+export declare function readJournalOrdinals(text: string, width: number | null): JournalReading;
+/**
+ * What reading a file produced.
+ *
+ * ABSENT AND UNREADABLE ARE DIFFERENT ANSWERS, and collapsing them to `null` is
+ * how a transient failure came to mean "this product opted out". A missing
+ * declaration is a product that does not use the allocator; a declaration that
+ * exists and could not be read is a repository this process cannot currently
+ * describe, and granting against the daemon's older snapshot alone is exactly
+ * what the claimant's reading exists to prevent.
+ */
+export type FileReading = {
+    kind: "read";
+    text: string;
+} | {
+    kind: "absent";
+} | {
+    kind: "unreadable";
+    reason: string;
+};
+/**
+ * VALIDATE TO THE CANONICAL CONTRACT.
+ *
+ * The rules here are the daemon's, transcribed:
+ * `packages/daemon/src/migrations/migration-manifest.ts` is the single
+ * definition, and `migration-manifest-parity.test.ts` pins that this reader
+ * accepts and rejects the same declarations it does.
+ *
+ * WHY TRANSCRIBED RATHER THAN IMPORTED. This package is published and installed
+ * on daemon hosts by itself; it cannot depend on `@telora/daemon`. The parity
+ * test is what keeps a transcription from drifting into a second, laxer
+ * contract.
+ *
+ * WHY IT MATTERS THAT THEY AGREE. A claimant that accepts a declaration the
+ * daemon calls unreadable reports a COMPLETE observation of a repository it
+ * cannot actually read -- an empty one, because a pattern that does not compile
+ * matches nothing -- and a focus-scoped claim then grants against the daemon's
+ * older published snapshot with an empty "current" reading vouching for it.
+ * Every present-but-invalid declaration must reach the same verdict on both
+ * sides: not usable.
+ */
+export declare function validateDeclaration(parsed: unknown): {
+    ok: true;
+    declaration: Declaration;
+} | {
+    ok: false;
+    problem: string;
+};
+/** Injected seams, so the reader is testable over a real temp repo or a fake. */
+export interface ObservationDeps {
+    cwd: () => string;
+    runGit: (args: string[], cwd: string) => string | null;
+    readFile: (path: string) => FileReading;
+    now: () => number;
+}
+export declare const defaultObservationDeps: ObservationDeps;
+/**
+ * What observing this process's repository produced.
+ *
+ * THE THREE OUTCOMES ARE NOT INTERCHANGEABLE, and collapsing them to
+ * "observation or null" is what let a failed read be served as though the
+ * caller simply had no repository. The edge then treated the absence as an
+ * empty VALID report and granted against the daemon's older leased snapshot
+ * alone -- which is precisely the window the observation exists to close.
+ *
+ *   - `not_applicable` -- there is genuinely nothing to observe: no repository,
+ *     or a product that declares no numbering. The grant proceeds on the
+ *     daemon's reading exactly as it did before this reader existed. This is
+ *     the ONLY silent path, and it is silent on purpose: refusing here would
+ *     block claiming for every caller outside a checkout.
+ *   - `incomplete` -- there IS a declared repository and it could not be read
+ *     whole. Nothing is sent and the claim is not attempted: a partial view
+ *     folded in as "nothing" is how a held number reads as free.
+ *   - `observed` -- a complete reading, taken over a ref set that did not move
+ *     while it was being taken.
+ */
+export type ObservationOutcome = {
+    kind: "observed";
+    observation: MigrationObservation;
+} | {
+    kind: "not_applicable";
+    reason: "no_repository" | "no_declaration";
+} | {
+    kind: "incomplete";
+    reason: string;
+};
+/**
+ * Observe every local branch's migration ordinals, right now.
+ *
+ * READ BY COMMIT, NOT BY NAME. The tips are captured once, up front, and every
+ * tree and journal below is read through the captured SHA. Reading through the
+ * mutable branch NAME meant a branch that moved mid-scan was reported at its
+ * OLD tip while its NEW tree had been folded in -- `granted_against_tips` then
+ * recorded provenance that was simply false, naming commits the allocator had
+ * not looked at.
+ *
+ * AND THE SET IS RE-CHECKED AFTERWARDS. Reading each ref by SHA makes the
+ * individual reads coherent; it does not make the SET of them a single moment.
+ * A sibling that commits, or a branch created, between the first ref and the
+ * last is invisible to a scan that never looks again -- so the enumeration is
+ * repeated at the end, and any difference makes the whole reading `incomplete`
+ * rather than a snapshot of no particular instant.
+ */
+export declare function observeLocalMigrations(deps?: ObservationDeps): ObservationOutcome;
+export {};

package/dist/handlers/migrationObservation.js

@@ -0,0 +1,446 @@
+// ---------------------------------------------------------------------------
+// WHAT THE CLAIMANT CAN SEE, AT THE MOMENT IT CLAIMS.
+//
+// THE HOLE THIS CLOSES. The allocator grants against a held set the daemon
+// PUBLISHED -- a snapshot of branch tips taken at some earlier instant. The
+// grant is atomic against other CLAIMS (the partial unique index sees to
+// that), and a lease bounds how old the snapshot may be, but neither makes the
+// snapshot CURRENT. Between the reading and the grant a sibling branch can
+// acquire a migration nobody claimed, and the handler -- which has no git --
+// cannot know. It then grants that very number to somebody else.
+//
+// WHO CAN KNOW. The claimant. Every focus team works in a worktree of the SAME
+// repository, sharing one object store, so a sibling branch's commit is
+// visible from here the instant it is made -- which is exactly how the daemon
+// reads those branches in the first place. The party asking for a number is
+// the one party that both holds the repo and is present at grant time.
+//
+// SO THE CLAIMANT REPORTS WHAT IT SEES, and the handler folds that into the
+// numbers already taken. This is SAFE BY CONSTRUCTION, and the direction
+// matters: an observation can only ever ADD to what is taken, so a wrong or
+// stale one can make a granted number higher than it needed to be and can
+// never make two teams share one. It does not decide; the index still decides.
+//
+// FAILURE IS SILENT AND HARMLESS. No repo, no declaration, no git, a pattern
+// that does not parse -- any of them yields no observation, and the grant
+// proceeds exactly as it did before. A refusal here would block claiming for
+// every caller that runs outside a checkout, which is a worse failure than the
+// one being narrowed.
+// ---------------------------------------------------------------------------
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+const MIGRATION_SCHEMES = ["sequential", "timestamp"];
+const MAX_OBSERVED_ORDINALS = 5000;
+const GIT_TIMEOUT_MS = 10_000;
+/** Run git in `cwd`, or null when it fails for any reason. */
+function git(args, cwd) {
+    try {
+        return execFileSync("git", args, {
+            cwd,
+            encoding: "utf-8",
+            timeout: GIT_TIMEOUT_MS,
+            maxBuffer: 16 * 1024 * 1024,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/** The ordinals a declaration's pattern reads out of a list of paths. */
+export function ordinalsFromPaths(paths, declaration) {
+    let pattern;
+    try {
+        pattern = new RegExp(declaration.filePattern);
+    }
+    catch {
+        return [];
+    }
+    const ordinals = [];
+    for (const path of paths) {
+        const basename = path.slice(path.lastIndexOf("/") + 1);
+        const ordinal = pattern.exec(basename)?.groups?.ordinal;
+        if (ordinal)
+            ordinals.push(ordinal);
+    }
+    return ordinals;
+}
+/**
+ * The width the declaration's own ordinal group fixes, when it fixes one.
+ *
+ * WHY THE DECLARATION AND NOT THE FILES. A journal entry is a bare index --
+ * `2`, not `0002` -- so placing it needs a width, and reading that width from
+ * the matching migration FILES fails in exactly the case that matters: a
+ * sibling branch that has advanced its journal but has no file this pattern
+ * matches, or a ref carrying journal entries and no migration file at all.
+ * The idx was then dropped, and against a stale heartbeat the allocator could
+ * grant the very number the journal already holds. The declaration fixes the
+ * width independently of what any ref happens to contain.
+ *
+ * Only a pattern that PINS the width answers -- `\d{4}` or `[0-9]{4}`. A
+ * variable-width group (`\d+`) fixes nothing and returns null, which is the
+ * honest answer rather than a guess.
+ */
+export function declaredOrdinalWidth(filePattern) {
+    const group = /\(\?<ordinal>((?:\\.|[^()\\])*)\)/.exec(filePattern)?.[1];
+    if (group === undefined)
+        return null;
+    const fixed = /^(?:\\d|\[0-9\])\{(\d+)\}$/.exec(group);
+    return fixed ? Number(fixed[1]) : null;
+}
+/** The idx values a journal registers, normalised to the width in use. */
+export function readJournalOrdinals(text, width) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, reason: "unparseable" };
+    }
+    const entries = parsed?.entries;
+    if (!Array.isArray(entries))
+        return { ok: false, reason: "no_entries" };
+    const ordinals = [];
+    for (const entry of entries) {
+        const idx = String(entry?.idx ?? "").trim();
+        // An entry this reader cannot place is reported, never dropped. Dropping
+        // was safe only under the assumption that the daemon's reading covers it --
+        // and a journal-only advance on a branch the heartbeat predates is exactly
+        // the case the daemon's reading does NOT cover.
+        if (!/^\d+$/.test(idx) || width === null || idx.length > width) {
+            return { ok: false, reason: "unplaceable_entry" };
+        }
+        ordinals.push(idx.padStart(width, "0"));
+    }
+    return { ok: true, ordinals };
+}
+/**
+ * A repo-relative path safe to hand to git as a pathspec.
+ *
+ * Mirrors `requireRepoRelativePath` in the canonical reader.
+ */
+function repoRelativePath(raw, key) {
+    if (typeof raw !== "string") {
+        return {
+            ok: false,
+            problem: raw === undefined
+                ? `missing required "${key}" string (check for a typo in the key)`
+                : `"${key}" must be a string (got ${typeof raw})`,
+        };
+    }
+    const value = raw.trim();
+    if (value === "")
+        return { ok: false, problem: `"${key}" must not be empty` };
+    if (value.startsWith("/")) {
+        return { ok: false, problem: `"${key}" must be repo-relative, not absolute (got ${JSON.stringify(value)})` };
+    }
+    if (value.split("/").includes("..")) {
+        return { ok: false, problem: `"${key}" must not escape the repo with ".." (got ${JSON.stringify(value)})` };
+    }
+    return { ok: true, value: value.replace(/\/+$/, "") };
+}
+/**
+ * VALIDATE TO THE CANONICAL CONTRACT.
+ *
+ * The rules here are the daemon's, transcribed:
+ * `packages/daemon/src/migrations/migration-manifest.ts` is the single
+ * definition, and `migration-manifest-parity.test.ts` pins that this reader
+ * accepts and rejects the same declarations it does.
+ *
+ * WHY TRANSCRIBED RATHER THAN IMPORTED. This package is published and installed
+ * on daemon hosts by itself; it cannot depend on `@telora/daemon`. The parity
+ * test is what keeps a transcription from drifting into a second, laxer
+ * contract.
+ *
+ * WHY IT MATTERS THAT THEY AGREE. A claimant that accepts a declaration the
+ * daemon calls unreadable reports a COMPLETE observation of a repository it
+ * cannot actually read -- an empty one, because a pattern that does not compile
+ * matches nothing -- and a focus-scoped claim then grants against the daemon's
+ * older published snapshot with an empty "current" reading vouching for it.
+ * Every present-but-invalid declaration must reach the same verdict on both
+ * sides: not usable.
+ */
+export function validateDeclaration(parsed) {
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return { ok: false, problem: `declaration must be a JSON object (got ${Array.isArray(parsed) ? "an array" : typeof parsed})` };
+    }
+    const raw = parsed;
+    const dir = repoRelativePath(raw.dir, "dir");
+    if (!dir.ok)
+        return dir;
+    // The pattern must COMPILE and capture both groups. A claim is recorded by
+    // number AND tag, and the confirm pass matches the file that lands by both.
+    const pattern = raw.filePattern;
+    if (typeof pattern !== "string") {
+        return {
+            ok: false,
+            problem: pattern === undefined
+                ? `missing required "filePattern" string (check for a typo in the key)`
+                : `"filePattern" must be a string (got ${typeof pattern})`,
+        };
+    }
+    if (pattern.trim() === "")
+        return { ok: false, problem: `"filePattern" must not be empty` };
+    let compiled;
+    try {
+        compiled = new RegExp(pattern);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            problem: `"filePattern" is not a valid regular expression (${String(err?.message ?? err)})`,
+        };
+    }
+    for (const group of ["ordinal", "tag"]) {
+        if (!compiled.source.includes(`(?<${group}>`)) {
+            return { ok: false, problem: `"filePattern" must carry a named capture group (?<${group}>...)` };
+        }
+    }
+    // The scheme is required and never inferred: guessing it from the ordinal's
+    // width reads a 14-digit sequential scheme as a timestamp, silently.
+    const scheme = raw.scheme;
+    if (typeof scheme !== "string") {
+        return {
+            ok: false,
+            problem: scheme === undefined
+                ? `missing required "scheme" string -- one of ${MIGRATION_SCHEMES.join(" | ")}`
+                : `"scheme" must be a string (got ${typeof scheme})`,
+        };
+    }
+    const matched = MIGRATION_SCHEMES.find((value) => value === scheme.trim());
+    if (matched === undefined) {
+        return {
+            ok: false,
+            problem: `"scheme" must be one of ${MIGRATION_SCHEMES.join(" | ")} (got ${JSON.stringify(scheme)})`,
+        };
+    }
+    // The journal is optional; present-but-wrong is malformed like every other field.
+    let journal;
+    if (raw.journal !== undefined) {
+        const value = raw.journal;
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            return {
+                ok: false,
+                problem: `"journal" must be an object with a "path" (got ${Array.isArray(value) ? "an array" : typeof value})`,
+            };
+        }
+        const journalPath = repoRelativePath(value.path, "journal.path");
+        if (!journalPath.ok)
+            return journalPath;
+        journal = { path: journalPath.value };
+    }
+    return {
+        ok: true,
+        declaration: {
+            dir: dir.value,
+            filePattern: pattern,
+            scheme: matched,
+            ...(journal ? { journal } : {}),
+        },
+    };
+}
+/**
+ * Read the repo's declaration.
+ *
+ * MALFORMED IS NOT MISSING. Unparseable JSON, and any shape the canonical
+ * contract rejects, are a declaration that EXISTS and cannot be used -- the
+ * same loud-on-malformed posture the daemon's own manifest reader takes. Read
+ * as "absent", any of them silently opts the product out of the allocator at
+ * the exact moment it is being asked for a number.
+ */
+function readDeclaration(repoRoot, readFile) {
+    const reading = readFile(`${repoRoot}/telora.migrations.json`);
+    if (reading.kind === "absent")
+        return { kind: "absent" };
+    if (reading.kind === "unreadable")
+        return { kind: "unreadable", reason: reading.reason };
+    let parsed;
+    try {
+        parsed = JSON.parse(reading.text);
+    }
+    catch (err) {
+        return { kind: "unreadable", reason: `declaration is not valid JSON: ${String(err?.message ?? err)}` };
+    }
+    const validated = validateDeclaration(parsed);
+    if (!validated.ok)
+        return { kind: "unreadable", reason: validated.problem };
+    return { kind: "declared", declaration: validated.declaration };
+}
+export const defaultObservationDeps = {
+    cwd: () => process.cwd(),
+    runGit: git,
+    // Imported at the top of the module, NOT `require`d here. This package is
+    // NodeNext ESM: `require` is not defined in it, so the call threw, the catch
+    // turned that into "no declaration", and every production claim sent no
+    // observation at all -- silently, because the same null means "this caller is
+    // not in a repo". The tests injected their own readFile and never ran this.
+    readFile: (path) => {
+        try {
+            return { kind: "read", text: readFileSync(path, "utf-8") };
+        }
+        catch (err) {
+            // ENOENT is an ANSWER -- this product declares no numbering. Anything
+            // else (a permission error, an I/O error, a directory where a file was
+            // expected) is the read not happening, and must not read as an opt-out.
+            const code = err?.code;
+            if (code === "ENOENT" || code === "ENOTDIR")
+                return { kind: "absent" };
+            return { kind: "unreadable", reason: String(err?.message ?? err) };
+        }
+    },
+    now: () => Date.now(),
+};
+/** Enumerate local branches with the commit each points at, right now. */
+function enumerateRefs(deps, root) {
+    const output = deps.runGit(["for-each-ref", "--format=%(refname:short) %(objectname)", "refs/heads"], root);
+    if (output === null)
+        return null;
+    const refs = new Map();
+    for (const line of output.split("\n")) {
+        const [name, tip] = line.trim().split(/\s+/);
+        if (name)
+            refs.set(name, tip ?? "");
+    }
+    return refs;
+}
+/** Whether two ref enumerations describe the same branches at the same commits. */
+function sameRefs(a, b) {
+    if (a.size !== b.size)
+        return false;
+    for (const [name, tip] of a)
+        if (b.get(name) !== tip)
+            return false;
+    return true;
+}
+/**
+ * Observe every local branch's migration ordinals, right now.
+ *
+ * READ BY COMMIT, NOT BY NAME. The tips are captured once, up front, and every
+ * tree and journal below is read through the captured SHA. Reading through the
+ * mutable branch NAME meant a branch that moved mid-scan was reported at its
+ * OLD tip while its NEW tree had been folded in -- `granted_against_tips` then
+ * recorded provenance that was simply false, naming commits the allocator had
+ * not looked at.
+ *
+ * AND THE SET IS RE-CHECKED AFTERWARDS. Reading each ref by SHA makes the
+ * individual reads coherent; it does not make the SET of them a single moment.
+ * A sibling that commits, or a branch created, between the first ref and the
+ * last is invisible to a scan that never looks again -- so the enumeration is
+ * repeated at the end, and any difference makes the whole reading `incomplete`
+ * rather than a snapshot of no particular instant.
+ */
+export function observeLocalMigrations(deps = defaultObservationDeps) {
+    const cwd = deps.cwd();
+    const root = deps.runGit(["rev-parse", "--show-toplevel"], cwd)?.trim();
+    if (!root)
+        return { kind: "not_applicable", reason: "no_repository" };
+    const declared = readDeclaration(root, deps.readFile);
+    if (declared.kind === "unreadable") {
+        // A declaration that EXISTS and cannot be used. Answering "no_declaration"
+        // here told the handler this product had opted out, and the grant was made
+        // against the daemon's older snapshot alone.
+        return { kind: "incomplete", reason: `migration declaration unreadable: ${declared.reason}` };
+    }
+    if (declared.kind === "absent")
+        return { kind: "not_applicable", reason: "no_declaration" };
+    const declaration = declared.declaration;
+    // Name and tip in ONE call: the tips are recorded on the granted row, so the
+    // commits the allocator looked at are readable from the claim afterwards.
+    const refs = enumerateRefs(deps, root);
+    if (refs === null) {
+        // A DECLARED repository whose branches could not be enumerated. This used
+        // to answer null -- the same answer as "not in a repository" -- so the
+        // claim went out with no observation and the grant was made blind.
+        return { kind: "incomplete", reason: "could not enumerate local branches" };
+    }
+    if (refs.size === 0) {
+        return { kind: "incomplete", reason: "a declared repository reported no local branches" };
+    }
+    const held = new Set();
+    const journalTexts = [];
+    const observedTips = {};
+    const observedUnreadable = [];
+    const journalPath = declaration.journal?.path;
+    for (const [name, tip] of refs) {
+        // By SHA. The name is carried only for reporting.
+        const listed = deps.runGit(["ls-tree", "-r", "--name-only", tip, "--", declaration.dir], root);
+        if (listed === null) {
+            // NAMED, not skipped. What this ref holds is unknown, and unknown folded
+            // in as "nothing" is how a held number reads as free.
+            observedUnreadable.push(name);
+            continue;
+        }
+        observedTips[name] = tip;
+        for (const ordinal of ordinalsFromPaths(listed.split("\n"), declaration)) {
+            held.add(ordinal);
+        }
+        if (!journalPath)
+            continue;
+        // ABSENT vs UNREADABLE, asked separately. `git show` returns nothing for
+        // both "no such path" and "the object cannot be read", and most refs
+        // legitimately have no journal -- so the tree is asked whether the path
+        // EXISTS on this commit before its contents are held against anyone.
+        const present = deps.runGit(["ls-tree", tip, "--", journalPath], root);
+        if (present === null) {
+            observedUnreadable.push(`${name}:${journalPath}`);
+            continue;
+        }
+        if (present.trim() === "")
+            continue; // genuinely absent
+        const text = deps.runGit(["show", `${tip}:${journalPath}`], root);
+        if (text === null) {
+            // The ref SAYS it has one and it could not be read. Reading that as an
+            // empty journal drops whatever indexes it registers.
+            observedUnreadable.push(`${name}:${journalPath}`);
+            continue;
+        }
+        journalTexts.push({ ref: name, text });
+    }
+    // The journal's bare indexes are normalised to the DECLARED width, falling
+    // back to the width the files themselves use when the pattern does not fix
+    // one. A bare 352 and a padded 0352 are two widths in one set, and the
+    // candidate rule refuses a product whose ordinals are not one fixed width.
+    const fileWidths = [...new Set([...held].map((o) => o.length))];
+    const width = declaredOrdinalWidth(declaration.filePattern)
+        ?? (fileWidths.length === 1 ? (fileWidths[0] ?? null) : null);
+    for (const { ref, text } of journalTexts) {
+        const reading = readJournalOrdinals(text, width);
+        if (!reading.ok) {
+            // Malformed, or carrying an index this reader cannot place. Either way it
+            // is a declared journal whose contents are not established.
+            observedUnreadable.push(`${ref}:${journalPath ?? "journal"}`);
+            continue;
+        }
+        for (const ordinal of reading.ordinals)
+            held.add(ordinal);
+    }
+    // THE SET, RE-CHECKED. Every read above is coherent with its own commit; that
+    // says nothing about whether the branches moved underneath the scan as a
+    // whole.
+    const after = enumerateRefs(deps, root);
+    if (after === null) {
+        return { kind: "incomplete", reason: "could not re-read local branches after the scan" };
+    }
+    if (!sameRefs(refs, after)) {
+        return { kind: "incomplete", reason: "local branches moved while they were being read" };
+    }
+    // Bounded from the HIGH end. At one fixed width lexicographic order is
+    // numeric order, and it is the newest ordinals that decide the next number --
+    // keeping the oldest 5,000 and discarding the rest would drop exactly the
+    // evidence a sequential grant depends on.
+    const sorted = [...held].sort();
+    const observedHeld = sorted.length > MAX_OBSERVED_ORDINALS
+        ? sorted.slice(-MAX_OBSERVED_ORDINALS)
+        : sorted;
+    return {
+        kind: "observed",
+        observation: {
+            observedHeld,
+            observedRefs: Object.keys(observedTips).length,
+            observedAt: deps.now(),
+            observedUnreadable,
+            observedTips,
+        },
+    };
+}
+//# sourceMappingURL=migrationObservation.js.map

package/dist/handlers/migrationObservation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrationObservation.js","sourceRoot":"","sources":["../../src/handlers/migrationObservation.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,sDAAsD;AACtD,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,iEAAiE;AACjE,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAC/E,sBAAsB;AACtB,8EAA8E;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAwCvC,MAAM,iBAAiB,GAA+B,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AAElF,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,8DAA8D;AAC9D,SAAS,GAAG,CAAC,IAAc,EAAE,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,WAAwB;IAExB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC;QACxD,IAAI,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAiBD,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAoB;IACpE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAI,MAAiD,EAAE,OAAO,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAExE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,gDAAgD;QAChD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACpD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAuBD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAY,EAAE,GAAW;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,KAAK,SAAS;gBACxB,CAAC,CAAC,qBAAqB,GAAG,wCAAwC;gBAClE,CAAC,CAAC,IAAI,GAAG,2BAA2B,OAAO,GAAG,GAAG;SACpD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB,EAAE,CAAC;IAC9E,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,8CAA8C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,6CAA6C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,MAAM,GAAG,EAAE,CAAC;IACjI,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC;IAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,KAAK,SAAS;gBAC5B,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,uCAAuC,OAAO,OAAO,GAAG;SAC7D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IAC5F,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,oDAAoD,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,GAAG;SACvG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,CAAU,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,KAAK,OAAO,EAAE,CAAC;QACnG,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,KAAK,SAAS;gBAC3B,CAAC,CAAC,8CAA8C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC/E,CAAC,CAAC,kCAAkC,OAAO,MAAM,GAAG;SACvD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,2BAA2B,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;SACpG,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,IAAI,OAAsC,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,kDAAkD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG;aAC/G,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,gBAAgB,CAAE,KAAiC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9F,IAAI,CAAC,WAAW,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC;QACxC,OAAO,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE;YACX,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,OAAO;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,QAAoC;IAEpC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,QAAQ,yBAAyB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACzD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAEzF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,kCAAkC,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IACpH,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAUD,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACrD,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IACxB,MAAM,EAAE,GAAG;IACX,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,8EAA8E;IAC9E,4EAA4E;IAC5E,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACvE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;CACtB,CAAC;AA2BF,0EAA0E;AAC1E,SAAS,aAAa,CACpB,IAAqB,EACrB,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CACxB,CAAC,cAAc,EAAE,yCAAyC,EAAE,YAAY,CAAC,EACzE,IAAI,CACL,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,CAAsB,EAAE,CAAsB;IAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,sBAAsB;IAE9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEtE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACnC,2EAA2E;QAC3E,2EAA2E;QAC3E,6CAA6C;QAC7C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5F,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IAEzC,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAyC,EAAE,CAAC;IAC9D,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;IAE9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CACxB,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAC5D,IAAI,CACL,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,yEAAyE;YACzE,sDAAsD;YACtD,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACtF,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS,CAAc,mBAAmB;QAErE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,uEAAuE;YACvE,qDAAqD;YACrD,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC;WACtD,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,0EAA0E;YAC1E,4DAA4D;YAC5D,kBAAkB,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,SAAS;IACT,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC3F,CAAC;IAED,uEAAuE;IACvE,8EAA8E;IAC9E,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,qBAAqB;QACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC;IAEX,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE;YACX,YAAY;YACZ,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM;YAC9C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,kBAAkB;YAClB,YAAY;SACb;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/organizationHandlers.js

@@ -26,7 +26,7 @@ import { callProductApi, successResult, validationError, wrapHandler, } from "..
 // write that omits that pass leaves it untouched.
 // '' clears (inherit the builtin stage / backend default).
 export const SELECTABLE_PASS_MODEL_IDS = new Set([
-    "claude-fable-5-1", "claude-opus-5", "claude-opus-4-8", "claude-sonnet-5",
+    "claude-fable-5-1", "claude-opus-5-5", "claude-opus-5", "claude-opus-4-8", "claude-sonnet-5",
     "claude-haiku-4-5-20251001", "gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
 ]);
 export function isSelectablePassModelId(id) {