@tokenfactory/acc-runner 0.42.0 → 0.44.0

package/dist/mcp-spawn.d.ts

@@ -1,4 +1,8 @@
 export declare const ACC_MCP_KEY = "acc";
+/** Env var acc-mcp-server reads the per-turn delegation JWT from (see cli.ts). */
+export declare const ACC_MCP_DELEGATION_TOKEN_ENV = "ACC_MCP_DELEGATION_TOKEN";
+/** Env var acc-mcp-server (future-facing) reads the calling agent's id from. */
+export declare const ACC_AGENT_ID_ENV = "ACC_AGENT_ID";
 export interface McpSpawnOptions {
     cwd: string;
     taskId: string;
@@ -7,6 +11,21 @@ export interface McpSpawnOptions {
     publicUrl: string;
     supabaseUrl: string;
     supabaseAnonKey: string;
+    /**
+     * Optional per-turn delegation JWT (FU-5), narrower than `accessToken`.
+     * Env-only — never written to argv. Blank/whitespace-only is treated as
+     * absent.
+     */
+    delegationToken?: string;
+    /**
+     * Optional id of the agent this session is acting for, used for
+     * attribution of mutating tool calls. Forwarded via env
+     * (`ACC_AGENT_ID`) AND `--agent-id` argv (acc-mcp-server's current CLI
+     * only reads argv for this one; the env copy is forward-compatible, per
+     * the same pattern already used for `ACC_TASK_ID`/`ACC_RUNNER_ID`).
+     * Blank/whitespace-only is treated as absent.
+     */
+    agentId?: string;
 }
 export interface McpConfigCleanup {
     /** Restore .mcp.json to its pre-spawn state (or delete if we created it). */

package/dist/mcp-spawn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-spawn.d.ts","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,WAAW,QAAQ,CAAC;AAKjC,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAMD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUtE;AA+ED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClD;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}
+{"version":3,"file":"mcp-spawn.d.ts","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,WAAW,QAAQ,CAAC;AAKjC,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAMD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUtE;AAmFD,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClD;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}

package/dist/mcp-spawn.js

@@ -12,6 +12,22 @@
  * merging our entry under `mcpServers.acc`, and restoring the prior
  * contents on cleanup. If our entry is the only one, we delete the
  * file entirely.
+ *
+ * NS MCP-2: the acc-mcp-server subprocess's argv is visible for its whole
+ * lifetime to anything that can run `ps` on the host. The access token is a
+ * broad runner JWT — it MUST NOT appear there. It travels via env only
+ * (`ACC_MCP_ACCESS_TOKEN`); acc-mcp-server's `cli.ts` already falls back to
+ * that env var when `--access-token` is absent from argv, so dropping the
+ * argv copy is a pure hardening change, not a protocol break.
+ *
+ * When a caller has a narrower per-turn delegation token (FU-5) and/or a
+ * calling agent's id available, forwarding them lets acc-mcp-server (a) swap
+ * the delegation token in as the Supabase Bearer — scoping tool calls to the
+ * delegation's claims instead of the full runner JWT, and gating them at the
+ * MC-12 bus risk gate under that narrower identity — and (b) attribute the
+ * turn's mutating calls to the right `agent_id` instead of falling back to
+ * the task's current agent. Both are OPTIONAL and env-only: no caller is
+ * required to supply them today, and neither is ever written to argv.
  */
 import { promises as fs } from "node:fs";
 import path from "node:path";
@@ -20,6 +36,10 @@ export const ACC_MCP_KEY = "acc";
 const MCP_CONFIG_FILENAME = ".mcp.json";
 const ACC_MCP_PACKAGE = "@tokenfactory/acc-mcp-server";
 const ACC_MCP_BIN = "acc-mcp-server";
+/** Env var acc-mcp-server reads the per-turn delegation JWT from (see cli.ts). */
+export const ACC_MCP_DELEGATION_TOKEN_ENV = "ACC_MCP_DELEGATION_TOKEN";
+/** Env var acc-mcp-server (future-facing) reads the calling agent's id from. */
+export const ACC_AGENT_ID_ENV = "ACC_AGENT_ID";
 /**
  * Locate a globally installed binary by name. Returns the absolute
  * path when found, or null otherwise. Used to skip the per-task
@@ -43,12 +63,13 @@ export async function whichBinary(name) {
     }
 }
 function buildEnvBlock(opts) {
-    return {
+    const env = {
         SUPABASE_URL: opts.supabaseUrl,
         SUPABASE_ANON_KEY: opts.supabaseAnonKey,
-        // Token in env is preferable to argv (no ps-output visibility);
-        // we still pass --access-token for back-compat with the current
-        // acc-mcp-server build.
+        // NS MCP-2: env-only. acc-mcp-server's cli.ts falls back to this var
+        // whenever `--access-token` is absent from argv, so the broad runner
+        // JWT never has to appear in argv (`ps`-visible for the subprocess's
+        // whole lifetime).
         ACC_MCP_ACCESS_TOKEN: opts.accessToken,
         ACC_PUBLIC_URL: opts.publicUrl,
         // Task + runner IDs are CLI-passed today (cli > env > default at
@@ -59,39 +80,44 @@ function buildEnvBlock(opts) {
         ACC_TASK_ID: opts.taskId,
         ACC_RUNNER_ID: opts.runnerId,
     };
+    // NS MCP-2: forwarded ONLY via env, never argv — mirrors the chat lane's
+    // ACC_MCP_DELEGATION_TOKEN_ENV convention (engines/claude-code-chat.ts) so
+    // acc-mcp-server swaps this narrower per-turn identity in as the Supabase
+    // Bearer in place of the broad access token.
+    const delegationToken = (opts.delegationToken ?? "").trim();
+    if (delegationToken)
+        env[ACC_MCP_DELEGATION_TOKEN_ENV] = delegationToken;
+    // NS MCP-2: forward-compatible env copy of the agent id also passed via
+    // --agent-id below, so mutating tool calls attribute to the right agent.
+    const agentId = (opts.agentId ?? "").trim();
+    if (agentId)
+        env[ACC_AGENT_ID_ENV] = agentId;
+    return env;
+}
+/** Non-secret coordinate flags shared by both the global-bin and npx spawn shapes. */
+function coordinateArgs(opts) {
+    const args = ["--task-id", opts.taskId, "--runner-id", opts.runnerId, "--public-url", opts.publicUrl];
+    const agentId = (opts.agentId ?? "").trim();
+    if (agentId)
+        args.push("--agent-id", agentId);
+    return args;
 }
 async function buildEntry(opts, which) {
     const globalBin = await which(ACC_MCP_BIN);
+    // NS MCP-2: neither the access token nor the delegation token is ever
+    // written to argv — both travel exclusively via buildEnvBlock()'s env
+    // block (ps shows only non-secret coordinates: task/runner/agent ids and
+    // the public URL).
     if (globalBin) {
         return {
             command: globalBin,
-            args: [
-                "--task-id",
-                opts.taskId,
-                "--runner-id",
-                opts.runnerId,
-                "--access-token",
-                opts.accessToken,
-                "--public-url",
-                opts.publicUrl,
-            ],
+            args: coordinateArgs(opts),
             env: buildEnvBlock(opts),
         };
     }
     return {
         command: "npx",
-        args: [
-            "-y",
-            ACC_MCP_PACKAGE,
-            "--task-id",
-            opts.taskId,
-            "--runner-id",
-            opts.runnerId,
-            "--access-token",
-            opts.accessToken,
-            "--public-url",
-            opts.publicUrl,
-        ],
+        args: ["-y", ACC_MCP_PACKAGE, ...coordinateArgs(opts)],
         env: buildEnvBlock(opts),
     };
 }

package/dist/mcp-spawn.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-spawn.js","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAqBrC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAqB;IAC1C,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,iBAAiB,EAAE,IAAI,CAAC,eAAe;QACvC,gEAAgE;QAChE,gEAAgE;QAChE,wBAAwB;QACxB,oBAAoB,EAAE,IAAI,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,oBAAoB;QACpB,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,aAAa,EAAE,IAAI,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAqB,EACrB,KAA+C;IAE/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE;gBACJ,WAAW;gBACX,IAAI,CAAC,MAAM;gBACX,aAAa;gBACb,IAAI,CAAC,QAAQ;gBACb,gBAAgB;gBAChB,IAAI,CAAC,WAAW;gBAChB,cAAc;gBACd,IAAI,CAAC,SAAS;aACf;YACD,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;SACzB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE;YACJ,IAAI;YACJ,eAAe;YACf,WAAW;YACX,IAAI,CAAC,MAAM;YACX,aAAa;YACb,IAAI,CAAC,QAAQ;YACb,gBAAgB;YAChB,IAAI,CAAC,WAAW;YAChB,cAAc;YACd,IAAI,CAAC,SAAS;SACf;QACD,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAExC,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,MAAM,GAAmB,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1E,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtF,OAAO;QACL,KAAK,CAAC,OAAO;YACX,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,4CAA4C;gBAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACnC,kBAAkB;gBACpB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,+DAA+D;YAC/D,gEAAgE;YAChE,8BAA8B;YAC9B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-spawn.js","sourceRoot":"","sources":["../src/mcp-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAoC/C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAqB;IAC1C,MAAM,GAAG,GAA2B;QAClC,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,iBAAiB,EAAE,IAAI,CAAC,eAAe;QACvC,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,mBAAmB;QACnB,oBAAoB,EAAE,IAAI,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,oBAAoB;QACpB,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,aAAa,EAAE,IAAI,CAAC,QAAQ;KAC7B,CAAC;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,eAAe;QAAE,GAAG,CAAC,4BAA4B,CAAC,GAAG,eAAe,CAAC;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO;QAAE,GAAG,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,IAAqB;IAC3C,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAqB,EACrB,KAA+C;IAE/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,mBAAmB;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;YAC1B,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;SACzB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtD,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAExC,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,MAAM,GAAmB,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1E,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtF,OAAO;QACL,KAAK,CAAC,OAAO;YACX,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,4CAA4C;gBAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACnC,kBAAkB;gBACpB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,+DAA+D;YAC/D,gEAAgE;YAChE,8BAA8B;YAC9B,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/migration-seq-guard.d.ts

@@ -0,0 +1,78 @@
+/** Kill switch. Set to `0`/`false` to skip the pre-push re-validation entirely. */
+export declare const SEQ_GUARD_ENV = "ACC_MIGRATION_SEQ_GUARD";
+/** Every reason the guard can decline to renumber, for the runner log. */
+export type SeqGuardSkipReason = "disabled" | "no-base-ref" | "no-new-migrations" | "no-remote-seqs" | "seq-free" | "renumber-noop" | "renumber-failed";
+export interface SeqGuardRenumber {
+    /** Repo-relative path the migration had before the guard ran. */
+    file: string;
+    /** Repo-relative path it now has. */
+    newFile: string;
+    /** Numeric seq before → after. */
+    fromSeq: number;
+    toSeq: number;
+    /** Tail of the renumber tool's own log (which refs it rewrote). */
+    output: string;
+}
+export interface SeqGuardResult {
+    /** True iff a migration was renumbered AND the rename was committed. */
+    renumbered: boolean;
+    /** Why nothing happened. Unset when `renumbered` is true. */
+    skipped?: SeqGuardSkipReason;
+    /** Human-readable one-liner for the runner log — always set. */
+    detail: string;
+    /** Highest seq seen on the freshly-fetched integration head (null if unread). */
+    remoteMaxSeq?: number | null;
+    /** The move, when one happened. */
+    move?: SeqGuardRenumber;
+}
+export interface SeqGuardOptions {
+    /** Integration branch this task will target, e.g. `acc/integration`. */
+    integrationBranch: string;
+    /** Merge-base ref the new-migration diff is taken against. */
+    baseRef?: string;
+    /** Remote to re-fetch. Defaults to `origin`. */
+    remote?: string;
+    /**
+     * Live `acc.applied_migrations` seqs, when the caller can read them. Unioned
+     * with the fresh remote head so a migration applied out-of-band still counts
+     * as claimed. Omitted → the remote head alone is the baseline.
+     */
+    appliedSeqs?: number[] | null;
+}
+export interface SeqGuardDeps {
+    env?: NodeJS.ProcessEnv;
+    /** `git fetch <remote> <branch>`. Rejects → treated as "no fresh head". */
+    fetchRef?: (workdir: string, remote: string, branch: string) => Promise<void>;
+    /**
+     * Migration paths present on the freshly-fetched head, repo-relative. Returns
+     * `null` when the ref could not be read (the guard then stands down).
+     */
+    listRemoteMigrations?: (workdir: string, ref: string) => Promise<string[] | null>;
+    /** Migration files this branch ADDED vs `baseRef`, repo-relative. */
+    listAddedMigrations?: (workdir: string, baseRef?: string) => Promise<string[]>;
+    /** Run the renumber pass with an out-of-tree baseline roster. */
+    runRenumber?: (workdir: string, files: string[], baselineSeqs: number[]) => Promise<{
+        output: string;
+    }>;
+    /** True when the working tree has uncommitted changes (did the renumber act?). */
+    isDirty?: (workdir: string) => Promise<boolean>;
+    /** Commit the rename so the push carries it. */
+    commit?: (workdir: string, message: string) => Promise<void>;
+}
+/**
+ * The numeric sequence prefix of a migration path (`…/0315_acc_x.sql` → 315),
+ * or null when the filename does not carry one. Mirrors `parseSeq` in
+ * scripts/ci/migration-lint.mjs — the two must agree on what counts as a
+ * migration, so both accept `_` and `-` after the digits.
+ */
+export declare function migrationSeq(file: string): number | null;
+/** Whether the guard is enabled. ON by default; `0`/`false`/`no` turns it off. */
+export declare function seqGuardEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Re-validate this branch's NEW migration seq against a freshly-fetched
+ * integration head and auto-renumber it when a sibling has since taken the
+ * number. Returns what happened; NEVER throws (a crash inside the guard is
+ * reported as `renumber-failed` and the push proceeds).
+ */
+export declare function revalidateMigrationSeq(workdir: string, opts: SeqGuardOptions, deps?: SeqGuardDeps): Promise<SeqGuardResult>;
+//# sourceMappingURL=migration-seq-guard.d.ts.map

package/dist/migration-seq-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-seq-guard.d.ts","sourceRoot":"","sources":["../src/migration-seq-guard.ts"],"names":[],"mappings":"AAkDA,mFAAmF;AACnF,eAAO,MAAM,aAAa,4BAA4B,CAAC;AAIvD,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,UAAU,GACV,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;IACpB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mCAAmC;IACnC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAClF,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,iEAAiE;IACjE,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,EACf,YAAY,EAAE,MAAM,EAAE,KACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,kFAAkF;IAClF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,gDAAgD;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxD;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAI7E;AAwGD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAgKzB"}

package/dist/migration-seq-guard.js

@@ -0,0 +1,304 @@
+/**
+ * MIG-SEQ-GUARD — re-validate a branch's migration sequence against a FRESHLY
+ * FETCHED integration head, immediately before push.
+ *
+ * The recurring failure it closes (0310 → 0314 → 0315, two collisions in 24h):
+ * an agent computes its next-free migration seq at worktree-FORK time — the max
+ * of `supabase/migrations/` in the fork snapshot plus the applied ledger. That
+ * number is correct when it is chosen and stale by the time the branch pushes,
+ * because a sibling migration merged into `acc/integration` in between and took
+ * it. `scripts/ci/migration-lint.mjs` catches the collision at PR time, but only
+ * after the whole run is spent: the task rework-loops for a rename it could have
+ * done itself. Two migration tasks dispatched concurrently hit it every time.
+ *
+ * MIGFIX-01 (prepr-gate.ts) already auto-renumbers, but it reads the SAME stale
+ * worktree snapshot, so it recomputes exactly the seq the sibling took. The fix
+ * is not a better computation — it is a fresher input. So right before push:
+ *
+ *   1. `git fetch <remote> <integration>` — a real network read, not the fork's
+ *      remote-tracking ref.
+ *   2. Read the migration seqs present on that fresh head (`git ls-tree`), and
+ *      union them with the live `acc.applied_migrations` roster when the caller
+ *      has one.
+ *   3. If this branch's NEW migration no longer holds a free seq (its number is
+ *      at or below that fresh baseline), hand the roster to
+ *      `migration-lint.mjs --renumber --baseline-seqs …`, which already rewrites
+ *      the filename, the `record_migration_applied` self-record, the verify
+ *      RAISE messages and every sibling test that reads the file by path.
+ *   4. Commit the rename so the push carries it, and report the move so the
+ *      caller can emit an event.
+ *
+ * FAIL-OPEN by construction. Every step that touches the network or git is
+ * best-effort: an unreachable remote, a missing ref, a renumber that changed
+ * nothing — each returns a `ran: false` result with a reason, and the push
+ * proceeds exactly as it does today. The guard may only ever turn a PR that CI
+ * would reject into one it accepts; it must never be the reason a push fails.
+ *
+ * Two deliberate non-behaviours:
+ *   • It does NOT act on a forward GAP (a seq ABOVE the fresh baseline + 1).
+ *     A gap is MIGFIX-01's job at fork time, and after a sibling merges, the
+ *     local `supabase/migrations/` is legitimately behind the remote — closing
+ *     "gaps" against a tree that is missing files would renumber healthy
+ *     branches. Only a seq that is provably TAKEN is moved.
+ *   • It commits, it never amends. A rework branch's history is already pushed;
+ *     amending it would force a non-fast-forward push. Same posture as
+ *     MIGFIX-01's `defaultCommitRenumbered`.
+ */
+import path from "node:path";
+import { execa } from "execa";
+import { buildEnv } from "./bin-resolve.js";
+/** Kill switch. Set to `0`/`false` to skip the pre-push re-validation entirely. */
+export const SEQ_GUARD_ENV = "ACC_MIGRATION_SEQ_GUARD";
+const MIGRATIONS_DIR = "supabase/migrations";
+/**
+ * The numeric sequence prefix of a migration path (`…/0315_acc_x.sql` → 315),
+ * or null when the filename does not carry one. Mirrors `parseSeq` in
+ * scripts/ci/migration-lint.mjs — the two must agree on what counts as a
+ * migration, so both accept `_` and `-` after the digits.
+ */
+export function migrationSeq(file) {
+    const base = String(file).split(/[\\/]/).pop() ?? "";
+    const m = /^(\d+)[_-].+\.sql$/i.exec(base);
+    if (!m)
+        return null;
+    const n = parseInt(m[1], 10);
+    return Number.isFinite(n) && n > 0 ? n : null;
+}
+/** Whether the guard is enabled. ON by default; `0`/`false`/`no` turns it off. */
+export function seqGuardEnabled(env = process.env) {
+    const raw = env[SEQ_GUARD_ENV]?.trim().toLowerCase();
+    if (raw === undefined || raw === "")
+        return true;
+    return !(raw === "0" || raw === "false" || raw === "no" || raw === "off");
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Default I/O (every one is injectable; the unit suite never shells out)
+// ─────────────────────────────────────────────────────────────────────────────
+async function defaultFetchRef(workdir, remote, branch) {
+    // A single-branch fetch, not `--all`: this runs on the push hot path and the
+    // only ref whose freshness matters is the integration head.
+    const res = await execa("git", ["fetch", "--quiet", remote, branch], {
+        cwd: workdir,
+        env: buildEnv(),
+        reject: false,
+    });
+    if (res.exitCode !== 0) {
+        throw new Error(`git fetch ${remote} ${branch} exited ${res.exitCode ?? "signal"}`);
+    }
+}
+async function defaultListRemoteMigrations(workdir, ref) {
+    const res = await execa("git", ["ls-tree", "-r", "--name-only", ref, "--", MIGRATIONS_DIR], { cwd: workdir, env: buildEnv(), reject: false });
+    if (res.exitCode !== 0)
+        return null;
+    return (res.stdout ?? "")
+        .split("\n")
+        .map((s) => s.trim())
+        .filter((s) => s.toLowerCase().endsWith(".sql"));
+}
+async function defaultListAddedMigrations(workdir, baseRef) {
+    if (!baseRef)
+        return [];
+    // `--diff-filter=A` (added only): a MODIFIED published migration must never be
+    // renumbered — that is the forward-only violation the linter already rejects.
+    const res = await execa("git", ["diff", "--name-only", "--diff-filter=A", `${baseRef}...HEAD`, "--", MIGRATIONS_DIR], { cwd: workdir, env: buildEnv(), reject: false });
+    if (res.exitCode !== 0)
+        return [];
+    return (res.stdout ?? "")
+        .split("\n")
+        .map((s) => s.trim())
+        .filter((s) => s.toLowerCase().endsWith(".sql"));
+}
+async function defaultRunRenumber(workdir, files, baselineSeqs) {
+    const script = path.join(workdir, "scripts", "ci", "migration-lint.mjs");
+    const args = ["--renumber"];
+    if (baselineSeqs.length > 0)
+        args.push("--baseline-seqs", baselineSeqs.join(","));
+    // `process.execPath`, not a bare "node": the runner may be launched by
+    // launchd with a PATH that has no node at all, and a silently-unspawnable
+    // renumber reads exactly like a clean no-op (empty output, clean tree).
+    const res = await execa(process.execPath, [script, ...args, ...files], {
+        cwd: workdir,
+        env: buildEnv(),
+        reject: false,
+    });
+    // `reject: false` resolves with the failure rather than throwing, so a spawn
+    // error (no node on PATH) arrives as a result whose exit code is not 0 and
+    // whose explanation lives on `shortMessage` — present at runtime on the
+    // failure shape, absent from execa's success type.
+    const shortMessage = res.shortMessage;
+    const spawnFailure = res.exitCode === 0 ? "" : `\n[exit ${res.exitCode ?? "signal"}] ${shortMessage ?? ""}`;
+    return { output: `${res.stdout ?? ""}\n${res.stderr ?? ""}${spawnFailure}`.trim() };
+}
+async function defaultIsDirty(workdir) {
+    const res = await execa("git", ["status", "--porcelain"], {
+        cwd: workdir,
+        env: buildEnv(),
+        reject: false,
+    });
+    return (res.stdout ?? "").trim().length > 0;
+}
+async function defaultCommit(workdir, message) {
+    await execa("git", ["add", "-A"], { cwd: workdir, env: buildEnv(), reject: false });
+    await execa("git", ["commit", "-m", message], {
+        cwd: workdir,
+        env: buildEnv(),
+        reject: false,
+    });
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// The guard
+// ─────────────────────────────────────────────────────────────────────────────
+const OUTPUT_TAIL = 2_000;
+/**
+ * Re-validate this branch's NEW migration seq against a freshly-fetched
+ * integration head and auto-renumber it when a sibling has since taken the
+ * number. Returns what happened; NEVER throws (a crash inside the guard is
+ * reported as `renumber-failed` and the push proceeds).
+ */
+export async function revalidateMigrationSeq(workdir, opts, deps = {}) {
+    const env = deps.env ?? process.env;
+    if (!seqGuardEnabled(env)) {
+        return {
+            renumbered: false,
+            skipped: "disabled",
+            detail: `${SEQ_GUARD_ENV} disables the pre-push migration seq re-validation`,
+        };
+    }
+    if (!opts.baseRef) {
+        return {
+            renumbered: false,
+            skipped: "no-base-ref",
+            detail: "no base ref — cannot tell which migrations this branch added",
+        };
+    }
+    const remote = opts.remote ?? "origin";
+    const listAdded = deps.listAddedMigrations ?? defaultListAddedMigrations;
+    try {
+        // Cheapest check first: a task that adds no migration never fetches. This is
+        // the overwhelming majority of pushes, and the whole happy path stays a
+        // single `git diff`.
+        const added = (await listAdded(workdir, opts.baseRef)).filter((f) => migrationSeq(f) !== null);
+        if (added.length === 0) {
+            return {
+                renumbered: false,
+                skipped: "no-new-migrations",
+                detail: "branch adds no migration — seq re-validation not needed",
+            };
+        }
+        const fetchRef = deps.fetchRef ?? defaultFetchRef;
+        const listRemote = deps.listRemoteMigrations ?? defaultListRemoteMigrations;
+        // The fetch is the entire point: the fork-time remote-tracking ref is what
+        // produced the stale seq in the first place.
+        let fetched = true;
+        try {
+            await fetchRef(workdir, remote, opts.integrationBranch);
+        }
+        catch {
+            fetched = false;
+        }
+        // Prefer FETCH_HEAD (what this fetch just wrote) over the remote-tracking
+        // ref, which a fetch refspec may not have updated. Fall back to the
+        // tracking ref so a failed fetch can still be checked against whatever the
+        // worktree already knows.
+        const refs = fetched
+            ? ["FETCH_HEAD", `${remote}/${opts.integrationBranch}`]
+            : [`${remote}/${opts.integrationBranch}`];
+        let remoteFiles = null;
+        for (const ref of refs) {
+            remoteFiles = await listRemote(workdir, ref);
+            if (remoteFiles && remoteFiles.length > 0)
+                break;
+        }
+        if (!remoteFiles || remoteFiles.length === 0) {
+            return {
+                renumbered: false,
+                skipped: "no-remote-seqs",
+                detail: `could not read ${MIGRATIONS_DIR} on a fresh ${remote}/${opts.integrationBranch} ` +
+                    `(fetch ${fetched ? "ok" : "failed"}) — seq left as-is`,
+                remoteMaxSeq: null,
+            };
+        }
+        // The baseline: everything claimed OUTSIDE this worktree. The remote head's
+        // seqs, plus the live ledger when the caller could read it (a migration can
+        // be applied before its file merges).
+        const claimed = new Set();
+        for (const f of remoteFiles) {
+            const n = migrationSeq(f);
+            if (n !== null)
+                claimed.add(n);
+        }
+        for (const n of opts.appliedSeqs ?? []) {
+            if (Number.isFinite(n) && n > 0)
+                claimed.add(Math.trunc(n));
+        }
+        const baselineSeqs = [...claimed].sort((a, b) => a - b);
+        const remoteMaxSeq = baselineSeqs.length > 0 ? baselineSeqs[baselineSeqs.length - 1] : null;
+        // Stale = at or below the fresh baseline: either the exact number a sibling
+        // took, or one behind it. A seq ABOVE the baseline is left alone (see the
+        // module header — a forward gap is MIGFIX-01's call, not the guard's).
+        const stale = added.filter((f) => {
+            const n = migrationSeq(f);
+            return n !== null && remoteMaxSeq !== null && n <= remoteMaxSeq;
+        });
+        if (stale.length === 0) {
+            return {
+                renumbered: false,
+                skipped: "seq-free",
+                detail: `migration seq still free on a fresh ${remote}/${opts.integrationBranch} ` +
+                    `(head max ${remoteMaxSeq ?? "n/a"}) — pushing unchanged`,
+                remoteMaxSeq,
+            };
+        }
+        const runRenumber = deps.runRenumber ?? defaultRunRenumber;
+        const isDirty = deps.isDirty ?? defaultIsDirty;
+        const commit = deps.commit ?? defaultCommit;
+        const { output } = await runRenumber(workdir, stale, baselineSeqs);
+        if (!(await isDirty(workdir))) {
+            return {
+                renumbered: false,
+                skipped: "renumber-noop",
+                // Carry the tool's own log: "left unchanged" is either a genuine no-op
+                // or a renumber that could not run, and only the log tells them apart.
+                detail: `renumber left the worktree unchanged — seq kept: ${stale.join(", ")}; ` +
+                    `tool said: ${output.slice(-500) || "(no output)"}`,
+                remoteMaxSeq,
+            };
+        }
+        // `move` describes the FIRST stale file. A branch adding several colliding
+        // migrations at once is vanishingly rare, and the renumber tool chains them
+        // correctly anyway (each pass re-reads the directory, so the second lands
+        // above the first). The full tool log rides along in `move.output`, so the
+        // event is never lossy even then.
+        const first = stale[0];
+        const fromSeq = migrationSeq(first);
+        // The tool's own log names the move (`0315 → 0316`); prefer it, and fall
+        // back to the arithmetic the tool would have used so the event is never
+        // empty just because the log format shifts.
+        const moved = /(\d{2,})\s*→\s*(\d{2,})/.exec(output);
+        const toSeq = moved ? Number(moved[2]) : (remoteMaxSeq ?? fromSeq) + 1;
+        const newFile = path.join(path.dirname(first), path.basename(first).replace(/^\d+/, String(toSeq).padStart(4, "0")));
+        await commit(workdir, `chore(acc): re-validate migration seq against fresh ${opts.integrationBranch} (MIG-SEQ-GUARD)`);
+        return {
+            renumbered: true,
+            detail: `migration seq ${fromSeq} was taken on a fresh ${remote}/${opts.integrationBranch} ` +
+                `(head max ${remoteMaxSeq}) — auto-renumbered to ${toSeq} before push`,
+            remoteMaxSeq,
+            move: {
+                file: first,
+                newFile,
+                fromSeq,
+                toSeq,
+                output: output.slice(-OUTPUT_TAIL),
+            },
+        };
+    }
+    catch (err) {
+        // Fail-open: the guard may only ever IMPROVE a push's odds.
+        return {
+            renumbered: false,
+            skipped: "renumber-failed",
+            detail: `seq re-validation crashed (push proceeds): ${err.message?.slice(0, 300)}`,
+        };
+    }
+}
+//# sourceMappingURL=migration-seq-guard.js.map

package/dist/migration-seq-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-seq-guard.js","sourceRoot":"","sources":["../src/migration-seq-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEvD,MAAM,cAAc,GAAG,qBAAqB,CAAC;AA2E7C;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAEhF,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc;IAC5E,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QACnE,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,QAAQ,EAAE;QACf,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,IAAI,MAAM,WAAW,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAe,EACf,GAAW;IAEX,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,KAAK,EACL,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,EAC3D,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CACjD,CAAC;IACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,OAAe,EACf,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,OAAO,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EACrF,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CACjD,CAAC;IACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,KAAe,EACf,YAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE;QACrE,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,QAAQ,EAAE;QACf,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,YAAY,GAAI,GAAiC,CAAC,YAAY,CAAC;IACrE,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,QAAQ,IAAI,QAAQ,KAAK,YAAY,IAAI,EAAE,EAAE,CAAC;IACzF,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE;QACxD,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,QAAQ,EAAE;QACf,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,OAAe;IAC3D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAC5C,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,QAAQ,EAAE;QACf,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,IAAqB,EACrB,OAAqB,EAAE;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,GAAG,aAAa,oDAAoD;SAC7E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,8DAA8D;SACvE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC;IAEzE,IAAI,CAAC;QACH,6EAA6E;QAC7E,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,yDAAyD;aAClE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;QAE5E,2EAA2E;QAC3E,6CAA6C;QAC7C,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,0EAA0E;QAC1E,oEAAoE;QACpE,2EAA2E;QAC3E,0BAA0B;QAC1B,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvD,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5C,IAAI,WAAW,GAAoB,IAAI,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,WAAW,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;QACnD,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,gBAAgB;gBACzB,MAAM,EACJ,kBAAkB,cAAc,eAAe,MAAM,IAAI,IAAI,CAAC,iBAAiB,GAAG;oBAClF,UAAU,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,oBAAoB;gBACzD,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAE7F,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,IAAI,YAAY,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,UAAU;gBACnB,MAAM,EACJ,uCAAuC,MAAM,IAAI,IAAI,CAAC,iBAAiB,GAAG;oBAC1E,aAAa,YAAY,IAAI,KAAK,uBAAuB;gBAC3D,YAAY;aACb,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;QAE5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,eAAe;gBACxB,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,EACJ,oDAAoD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACxE,cAAc,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE;gBACrD,YAAY;aACb,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAE,CAAC;QACrC,yEAAyE;QACzE,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CACrE,CAAC;QACF,MAAM,MAAM,CACV,OAAO,EACP,uDAAuD,IAAI,CAAC,iBAAiB,kBAAkB,CAChG,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EACJ,iBAAiB,OAAO,yBAAyB,MAAM,IAAI,IAAI,CAAC,iBAAiB,GAAG;gBACpF,aAAa,YAAY,0BAA0B,KAAK,cAAc;YACxE,YAAY;YACZ,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK;gBACX,OAAO;gBACP,OAAO;gBACP,KAAK;gBACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;aACnC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4DAA4D;QAC5D,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,8CAA+C,GAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC9F,CAAC;IACJ,CAAC;AACH,CAAC"}