audit-tools 0.42.1 → 0.44.0

package/dist/shared/submission/handRecovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handRecovery.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AA6B5D;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,eAAe,GAAG,IAAI,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAsF9B"}
+{"version":3,"file":"handRecovery.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AA6B5D;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,eAAe,GAAG,IAAI,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAuJ9B"}

package/dist/shared/submission/handRecovery.js

@@ -13,7 +13,7 @@
  * appends `recovered_by_hand`, so a run repaired by an operator stays
  * distinguishable from one the host got right.
  */
-import { unlink } from "node:fs/promises";
+import { readFile, unlink, writeFile } from "node:fs/promises";
 import { readOptionalJsonFile, writeJsonFile } from "../io/json.js";
 import { discardOnSchemaVersionMismatch } from "../io/schemaVersion.js";
 import { expectedSubmissionsPath, submissionsDir, } from "../io/auditToolsPaths.js";
@@ -82,6 +82,40 @@ export async function recoverSubmission(request, validate) {
     if (issue !== null) {
         return { ok: false, issue };
     }
+    // Captured BEFORE the overwrite, as raw bytes, because rollback has to be able
+    // to put back exactly what was there — byte-for-byte, not a re-serialization
+    // of something re-parsed. A rescue attempted over an ALREADY-LANDED submission
+    // is the case that made the old unconditional rollback destructive: deleting
+    // produced "no file", never "the previous file", so a failed rescue destroyed
+    // bytes the run already had.
+    //
+    // ONLY `ENOENT` MEANS ABSENT. Every other read failure — EISDIR, EACCES,
+    // EPERM, EBUSY — says something IS there and could not be read, which is the
+    // opposite fact. Treating them all as "nothing was there" set `priorContent`
+    // to null and routed rollback to `unlink`, so an existing-but-unreadable
+    // payload was DELETED by the recovery meant to protect it. There is no safe
+    // guess to make here: without the prior bytes a rollback can neither restore
+    // nor justify deleting, so the recovery is refused before anything is written.
+    let priorContent = null;
+    try {
+        priorContent = await readFile(landingPath);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT") {
+            return {
+                ok: false,
+                issue: {
+                    code: "submission_rejected",
+                    message: `the submission already at ${boundPath} could not be read (${code ?? "unknown error"}), ` +
+                        "so a failed recovery could not be rolled back without destroying it — " +
+                        "resolve what is at that path, then retry the recovery",
+                    submission_id: request.submissionId,
+                    submission_path: boundPath,
+                },
+            };
+        }
+    }
     const lane = request.lane ?? (await resolveLane(request.artifactsDir, request.submissionId));
     await writeJsonFile(landingPath, read.value);
     try {
@@ -104,19 +138,50 @@ export async function recoverSubmission(request, validate) {
         // failed rescue they can retry rather than a silent falsification.
         const detail = error instanceof Error ? error.message : String(error);
         try {
-            await unlink(landingPath);
+            // RESTORE-OR-DELETE, decided by what was captured above. Deleting is the
+            // right rollback for exactly one case — nothing was there — and it was
+            // being applied to both.
+            if (priorContent === null) {
+                await unlink(landingPath);
+            }
+            else {
+                // UNCOVERED HALF, stated: this restore is a RAW write while the forward
+                // write above is atomic (temp + rename). A crash between truncate and
+                // the last byte therefore leaves a TRUNCATED prior payload — worse than
+                // either outcome this rollback chooses between. Closing it needs
+                // `writeFileAtomic` to accept `string | Buffer` and be exported, which is
+                // the io module's node (CP-NODE-3) and named in its dispatch, not a
+                // change this module may make. Until it lands, the restore is atomic in
+                // intent and not in mechanism.
+                await writeFile(landingPath, priorContent);
+            }
         }
         catch (rollbackError) {
+            // UNCOVERED HALF, stated: this branch — the append AND the rollback both
+            // failing — has no test. Reaching it requires the landing path to be
+            // writable at T (the forward write succeeded) and unwritable at T+1 (the
+            // rollback did not), which is a genuine race rather than a state a fixture
+            // can seed; every deterministic trigger fails the forward write first and
+            // never arrives here. What IS covered is the message: the operator is told
+            // the payload is on disk, unrecorded, and what to do about it. The branch's
+            // reachability is argued, not demonstrated.
             const rollbackDetail = rollbackError instanceof Error
                 ? rollbackError.message
                 : String(rollbackError);
             throw new Error(`hand recovery for '${request.submissionId}' could not record the ledger event ` +
                 `(${detail}), and the landed payload could NOT be rolled back (${rollbackDetail}). ` +
                 `The payload IS on disk at ${boundPath} with no recovered_by_hand record — ` +
-                "remove it or retry the recovery before the next next-step consumes it.", { cause: error });
+                "remove it or retry the recovery before the next next-step consumes it." +
+                (priorContent === null
+                    ? ""
+                    : " It OVERWROTE a submission that was already there, which could not be" +
+                        " restored — recover that payload before retrying."), { cause: error });
         }
         throw new Error(`hand recovery for '${request.submissionId}' could not record the ledger event: ` +
-            `${detail}. The payload was NOT landed (rolled back) — retry the recovery.`, { cause: error });
+            `${detail}. The payload was NOT landed (rolled back) — retry the recovery.` +
+            (priorContent === null
+                ? ""
+                : " The submission that was already at that path has been restored byte-for-byte."), { cause: error });
     }
     return { ok: true, submission_path: boundPath };
 }

package/dist/shared/submission/handRecovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"handRecovery.js","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AA4B/B;;;;;;;;;;GAUG;AACH,KAAK,UAAU,WAAW,CACxB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,GAAG,GAAG,8BAA8B,CACxC,MAAM,oBAAoB,CACxB,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EACxB,6BAA6B,CAC9B,CAAC;IACF,OAAO,CACL,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,EAAE,IAAI;QACzE,YAAY,CACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAAoD;IAEpD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;KAC7E,CAAC;IACF,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE;gBACpD,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,kBAAkB,OAAO,CAAC,QAAQ,iBAAiB,IAAI,CAAC,MAAM,EAAE;gBACzE,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,OAAO,CAAC,YAAY,EAAE;YAChD,gBAAgB,EAAE,wCAAwC;YAC1D,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,IAAI;YACJ,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,0BAA0B,OAAO,CAAC,QAAQ,EAAE;YACrD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,MAAM,cAAc,GAClB,aAAa,YAAY,KAAK;gBAC5B,CAAC,CAAC,aAAa,CAAC,OAAO;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,sCAAsC;gBAC9E,IAAI,MAAM,uDAAuD,cAAc,KAAK;gBACpF,6BAA6B,SAAS,sCAAsC;gBAC5E,wEAAwE,EAC1E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,uCAAuC;YAC/E,GAAG,MAAM,kEAAkE,EAC7E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC"}
+{"version":3,"file":"handRecovery.js","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AA4B/B;;;;;;;;;;GAUG;AACH,KAAK,UAAU,WAAW,CACxB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,GAAG,GAAG,8BAA8B,CACxC,MAAM,oBAAoB,CACxB,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EACxB,6BAA6B,CAC9B,CAAC;IACF,OAAO,CACL,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,EAAE,IAAI;QACzE,YAAY,CACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAAoD;IAEpD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;KAC7E,CAAC;IACF,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE;gBACpD,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,kBAAkB,OAAO,CAAC,QAAQ,iBAAiB,IAAI,CAAC,MAAM,EAAE;gBACzE,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACL,6BAA6B,SAAS,uBAAuB,IAAI,IAAI,eAAe,KAAK;wBACzF,wEAAwE;wBACxE,uDAAuD;oBACzD,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,eAAe,EAAE,SAAS;iBAC3B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,OAAO,CAAC,YAAY,EAAE;YAChD,gBAAgB,EAAE,wCAAwC;YAC1D,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,IAAI;YACJ,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,0BAA0B,OAAO,CAAC,QAAQ,EAAE;YACrD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,yEAAyE;YACzE,uEAAuE;YACvE,yBAAyB;YACzB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,iEAAiE;gBACjE,0EAA0E;gBAC1E,oEAAoE;gBACpE,wEAAwE;gBACxE,+BAA+B;gBAC/B,MAAM,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4CAA4C;YAC5C,MAAM,cAAc,GAClB,aAAa,YAAY,KAAK;gBAC5B,CAAC,CAAC,aAAa,CAAC,OAAO;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,sCAAsC;gBAC9E,IAAI,MAAM,uDAAuD,cAAc,KAAK;gBACpF,6BAA6B,SAAS,sCAAsC;gBAC5E,wEAAwE;gBACxE,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,uEAAuE;wBACvE,mDAAmD,CAAC,EAC1D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,uCAAuC;YAC/E,GAAG,MAAM,kEAAkE;YAC3E,CAAC,YAAY,KAAK,IAAI;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gFAAgF,CAAC,EACvF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC"}

package/dist/shared/submission/submissionIdentity.d.ts

@@ -26,7 +26,16 @@ export interface SubmissionIdParts {
  * what makes distinct lanes distinct.
  */
 export declare function mintSubmissionId(parts: SubmissionIdParts): string;
-/** Absolute on-disk path of one submission payload. */
+/**
+ * Absolute on-disk path of one submission payload.
+ *
+ * The containment of the landing path is CHECKED, never inferred from the fact
+ * that `submissionFilename` happens to hash. Hashing is what makes an escape
+ * impossible today; `resolveContainedPath` is what makes it impossible to
+ * REINTRODUCE one — a future filename derivation that passed the id through
+ * would otherwise steer a write outside `submissionDir` with nothing going red.
+ * The refusal fires here, before any caller has a path to write to.
+ */
 export declare function absoluteSubmissionPath(paths: SubmissionRoots, submissionId: string): string;
 /**
  * The bound path as it is declared in a step contract and rendered to a host:

package/dist/shared/submission/submissionIdentity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submissionIdentity.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAMjE;AAUD,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,MAAM,CAWR;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAW,GAAG,IAAI,CAQ3E"}
+{"version":3,"file":"submissionIdentity.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAMjE;AAUD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAMR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,MAAM,CAWR;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAW,GAAG,IAAI,CAQ3E"}

package/dist/shared/submission/submissionIdentity.js

@@ -11,7 +11,7 @@
  * it. It replaces the two hand-rolled `resultPathFor` copies that carried the
  * same rule in two places.
  */
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import { hashContent } from "../hash.js";
 import { stableStringify } from "../stableStringify.js";
 /** Non-path-safe characters collapse so the id stays readable in a ledger. */
@@ -39,9 +39,18 @@ function submissionFilename(submissionId) {
     }
     return `${hashContent(submissionId)}.json`;
 }
-/** Absolute on-disk path of one submission payload. */
+/**
+ * Absolute on-disk path of one submission payload.
+ *
+ * The containment of the landing path is CHECKED, never inferred from the fact
+ * that `submissionFilename` happens to hash. Hashing is what makes an escape
+ * impossible today; `resolveContainedPath` is what makes it impossible to
+ * REINTRODUCE one — a future filename derivation that passed the id through
+ * would otherwise steer a write outside `submissionDir` with nothing going red.
+ * The refusal fires here, before any caller has a path to write to.
+ */
 export function absoluteSubmissionPath(paths, submissionId) {
-    return join(resolve(paths.submissionDir), submissionFilename(submissionId));
+    return resolveContainedPath(paths.submissionDir, submissionFilename(submissionId), `submission landing path for ${submissionId}`);
 }
 /**
  * The bound path as it is declared in a step contract and rendered to a host:

package/dist/shared/submission/submissionIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"submissionIdentity.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqBxD,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,MAAM,GAAG,WAAW,CACxB,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAC5E,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,sBAAsB,CACpC,KAAsB,EACtB,YAAoB;IAEpB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,YAAoB;IAEpB,OAAO,gBAAgB,CACrB,KAAK,CAAC,IAAI,EACV,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,YAAY,EAAE,CACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,SAAiB,EACjB,KAAa;IAEb,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,iBAAiB,GAAG,UAAU,CAAC,SAAS,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,YAAoB,EACpB,KAAa;IAEb,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAK,GAAG,QAAQ;IACnE,IACE,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}
+{"version":3,"file":"submissionIdentity.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqBxD,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,MAAM,GAAG,WAAW,CACxB,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAC5E,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAsB,EACtB,YAAoB;IAEpB,OAAO,oBAAoB,CACzB,KAAK,CAAC,aAAa,EACnB,kBAAkB,CAAC,YAAY,CAAC,EAChC,+BAA+B,YAAY,EAAE,CAC9C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,YAAoB;IAEpB,OAAO,gBAAgB,CACrB,KAAK,CAAC,IAAI,EACV,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,YAAY,EAAE,CACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,SAAiB,EACjB,KAAa;IAEb,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,iBAAiB,GAAG,UAAU,CAAC,SAAS,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,YAAoB,EACpB,KAAa;IAEb,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAK,GAAG,QAAQ;IACnE,IACE,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/shared/submission/submissionLedger.d.ts

@@ -1,6 +1,6 @@
 import type { SubmissionIssueCode } from "./submissionClassifier.js";
 export declare const SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION: "submission-ledger-event/v1alpha1";
-export declare const SUBMISSION_EVENT_KINDS: readonly ["expected", "accepted", "rejected", "recovered_by_hand"];
+export declare const SUBMISSION_EVENT_KINDS: readonly ["expected", "accepted", "rejected", "recovered_by_hand", "accepted_via_recovery"];
 export type SubmissionEventKind = (typeof SUBMISSION_EVENT_KINDS)[number];
 export interface SubmissionLedgerEvent {
     readonly contract_version: typeof SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION;
@@ -17,6 +17,38 @@ export interface SubmissionLedgerEvent {
 export declare function submissionLedgerPath(artifactsDir: string): string;
 /** Append one event. The parent directory is created on demand. */
 export declare function appendSubmissionEvent(artifactsDir: string, event: SubmissionLedgerEvent): Promise<void>;
+/** Why one ledger line did not become an event. */
+export type SubmissionLedgerDropReason = 
+/** The line is not JSON — a torn write, typically a crash mid-append. */
+"unparsable"
+/** The line parsed but carries another release's contract version. */
+ | "schema_version_mismatch";
+/** One line the reader skipped, with enough to find it in the file. */
+export interface SubmissionLedgerDrop {
+    /** 1-based physical line number in the ledger file. */
+    readonly line: number;
+    readonly reason: SubmissionLedgerDropReason;
+}
+/**
+ * What {@link readSubmissionLedger} returns: the events AND what it could not
+ * read.
+ *
+ * SHAPE, and why it is this shape. The contract calls for a record carrying
+ * both `events` and `dropped`. It is also still the events ARRAY, because the
+ * consumers that adapt to the record — the audit bundle's `submission_ledger`,
+ * promotion-time archiving, the remediate ingest's recovery-mark scan — adapt
+ * in their OWN nodes, not this one, and a bare `{events, dropped}` would break
+ * every one of them at once. So `events` and `dropped` are non-enumerable
+ * properties on the array itself: `result.events` and `result.dropped` read as
+ * the contract names them, while `for…of`, `.filter`, `.map` and a deep-equal
+ * against a plain array keep working unchanged for a caller that has not been
+ * updated yet. Non-enumerable specifically so `toEqual([])` still holds — a
+ * drop signal must not change what an unrelated assertion sees.
+ */
+export type SubmissionLedgerRead = readonly SubmissionLedgerEvent[] & {
+    readonly events: readonly SubmissionLedgerEvent[];
+    readonly dropped: readonly SubmissionLedgerDrop[];
+};
 /**
  * Read the ledger in arrival order. An absent ledger reads as empty — a run
  * that never drifted has nothing to say — and a partially-written tail is
@@ -32,6 +64,15 @@ export declare function appendSubmissionEvent(artifactsDir: string, event: Submi
  * those field semantics is how a run gets MISreported; skipping it degrades to
  * the same shape as a ledger that had not recorded that event yet. The skip is
  * per line, so the current release's events on either side of it still load.
+ *
+ * EVERY SKIP IS REPORTED. Skipping used to be silent — no counter, no warning,
+ * nothing in the return value — which made a `rejected` or `recovered_by_hand`
+ * event that was dropped indistinguishable from one that was never recorded at
+ * all, defeating the single thing the ledger exists to guarantee: that a
+ * drifted-and-repaired run stays distinguishable after the fact. Each skipped
+ * line now lands in `dropped` with its 1-based line number and a classified
+ * reason, so no caller can be handed a ledger cleaner than the run actually
+ * was.
  */
-export declare function readSubmissionLedger(artifactsDir: string): Promise<readonly SubmissionLedgerEvent[]>;
+export declare function readSubmissionLedger(artifactsDir: string): Promise<SubmissionLedgerRead>;
 //# sourceMappingURL=submissionLedger.d.ts.map

package/dist/shared/submission/submissionLedger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,oEASzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAsB3C"}
+{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,6FAiBzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,mDAAmD;AACnD,MAAM,MAAM,0BAA0B;AACpC,yEAAyE;AACvE,YAAY;AACd,sEAAsE;GACpE,yBAAyB,CAAC;AAE9B,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,qBAAqB,EAAE,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAkC/B"}

package/dist/shared/submission/submissionLedger.js

@@ -29,6 +29,14 @@ export const SUBMISSION_EVENT_KINDS = [
     "rejected",
     /** An operator re-landed a submission by hand through the recovery lane. */
     "recovered_by_hand",
+    /**
+     * A submission was applied through a recovery verb that RELAXED one of the
+     * normal lane's corroboration checks. Distinct from `recovered_by_hand`
+     * (which re-lands a payload the normal validator still fully accepts) and
+     * from `accepted`: the evidence bar that admitted this one was lower, so the
+     * record must say so rather than let the run read as clean.
+     */
+    "accepted_via_recovery",
 ];
 /** `<artifactsDir>/submissions/submission-ledger.jsonl`. */
 export function submissionLedgerPath(artifactsDir) {
@@ -38,6 +46,21 @@ export function submissionLedgerPath(artifactsDir) {
 export async function appendSubmissionEvent(artifactsDir, event) {
     await appendNdjsonFile(submissionLedgerPath(artifactsDir), event);
 }
+function ledgerRead(events, dropped) {
+    Object.defineProperty(events, "events", {
+        value: events,
+        enumerable: false,
+    });
+    Object.defineProperty(events, "dropped", {
+        value: dropped,
+        enumerable: false,
+    });
+    // Through `unknown`: the two properties are installed by `defineProperty`,
+    // which the type system cannot follow, so this is the one place the shape is
+    // asserted rather than inferred. It is asserted immediately after the
+    // properties are set, in the only function that builds this value.
+    return events;
+}
 /**
  * Read the ledger in arrival order. An absent ledger reads as empty — a run
  * that never drifted has nothing to say — and a partially-written tail is
@@ -53,6 +76,15 @@ export async function appendSubmissionEvent(artifactsDir, event) {
  * those field semantics is how a run gets MISreported; skipping it degrades to
  * the same shape as a ledger that had not recorded that event yet. The skip is
  * per line, so the current release's events on either side of it still load.
+ *
+ * EVERY SKIP IS REPORTED. Skipping used to be silent — no counter, no warning,
+ * nothing in the return value — which made a `rejected` or `recovered_by_hand`
+ * event that was dropped indistinguishable from one that was never recorded at
+ * all, defeating the single thing the ledger exists to guarantee: that a
+ * drifted-and-repaired run stays distinguishable after the fact. Each skipped
+ * line now lands in `dropped` with its 1-based line number and a classified
+ * reason, so no caller can be handed a ledger cleaner than the run actually
+ * was.
  */
 export async function readSubmissionLedger(artifactsDir) {
     let content;
@@ -60,22 +92,33 @@ export async function readSubmissionLedger(artifactsDir) {
         content = await readFile(submissionLedgerPath(artifactsDir), "utf8");
     }
     catch {
-        return [];
+        return ledgerRead([], []);
     }
     const events = [];
+    const dropped = [];
+    // Physical, 1-based, counting blank lines: the number has to send a reader to
+    // the right line of the actual file, so it cannot be an index over the
+    // non-blank subset.
+    let lineNumber = 0;
     for (const line of content.split(/\r?\n/u)) {
+        lineNumber += 1;
         if (line.trim().length === 0)
             continue;
+        let parsed;
         try {
-            const event = discardOnSchemaVersionMismatch(JSON.parse(line), SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION);
-            if (event !== undefined)
-                events.push(event);
+            parsed = JSON.parse(line);
         }
         catch {
-            // A torn final line (crash mid-append) drops; every complete event before
-            // it stays readable, which is the whole point of an append-only record.
+            dropped.push({ line: lineNumber, reason: "unparsable" });
+            continue;
         }
+        const event = discardOnSchemaVersionMismatch(parsed, SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION);
+        if (event === undefined) {
+            dropped.push({ line: lineNumber, reason: "schema_version_mismatch" });
+            continue;
+        }
+        events.push(event);
     }
-    return events;
+    return ledgerRead(events, dropped);
 }
 //# sourceMappingURL=submissionLedger.js.map

package/dist/shared/submission/submissionLedger.js.map

@@ -1 +1 @@
-{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;CACX,CAAC;AAgBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,KAA4B;IAE5B,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,8BAA8B,CAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,EACzC,wCAAwC,CACzC,CAAC;YACF,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;IACnB;;;;;;OAMG;IACH,uBAAuB;CACf,CAAC;AAgBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,KAA4B;IAE5B,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAqCD,SAAS,UAAU,CACjB,MAA+B,EAC/B,OAA+B;IAE/B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;QACtC,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;QACvC,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,MAAyC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,8EAA8E;IAC9E,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,UAAU,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,8BAA8B,CAC1C,MAAM,EACN,wCAAwC,CACzC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/shared/tooling/allowlistedExec.d.ts

@@ -27,6 +27,15 @@ export interface AllowlistedExecOutcome {
     spawn_error?: string;
     /** Full combined stdout+stderr (bounded), used to evaluate output matches. */
     output: string;
+    /**
+     * True when `output` was cut short by `MAX_CAPTURED_OUTPUT` — the command
+     * produced more combined stdout+stderr than this outcome contains. A caller
+     * must treat `output` as an incomplete prefix, never as proof that missing
+     * text is absent: "the capture was cut off" is a distinct state from "the
+     * command genuinely produced/omitted X" and must not be read as the latter.
+     * Absent (not `false`) on every outcome whose `output` is the full capture.
+     */
+    truncated?: boolean;
     /**
      * True when the internal allowlist gate refused `command` BEFORE any spawn
      * was attempted (`isAllowedAnchorCommand` returned false) — a structured

package/dist/shared/tooling/allowlistedExec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allowlistedExec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"AAiCA,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAgJlD,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAUvD,CAAC;AAkBH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAG/C,CAAC;AAEH,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQxD;AA8DD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CASjE;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAiD3C,CAAC"}
+{"version":3,"file":"allowlistedExec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"AAiCA,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAgJlD,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAUvD,CAAC;AAkBH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAG/C,CAAC;AAEH,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQxD;AA8DD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CASjE;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAkE3C,CAAC"}

package/dist/shared/tooling/allowlistedExec.js

@@ -332,9 +332,20 @@ export const runAllowlistedReadOnlyCommand = (command, cwd, timeoutMs) => {
             windowsHide: true,
         });
         let output = "";
+        // A chunk that arrives once the cap is already reached is genuinely
+        // DROPPED (never appended) — that is the only condition that makes the
+        // capture an incomplete prefix, so it is the only condition that sets the
+        // signal. A single chunk that pushes `output` past the cap in one shot is
+        // still recorded in full (unchanged cap-application behavior); nothing was
+        // lost in that case, so `truncated` correctly stays unset.
+        let truncated = false;
         const capture = (chunk) => {
-            if (output.length < MAX_CAPTURED_OUTPUT)
+            if (output.length < MAX_CAPTURED_OUTPUT) {
                 output += String(chunk);
+            }
+            else {
+                truncated = true;
+            }
         };
         child.stdout?.on("data", capture);
         child.stderr?.on("data", capture);
@@ -353,11 +364,17 @@ export const runAllowlistedReadOnlyCommand = (command, cwd, timeoutMs) => {
                 timed_out: timedOut,
                 spawn_error: error.message,
                 output,
+                ...(truncated ? { truncated: true } : {}),
             });
         });
         child.on("close", (code) => {
             clearTimeout(timer);
-            resolvePromise({ exit_code: code, timed_out: timedOut, output });
+            resolvePromise({
+                exit_code: code,
+                timed_out: timedOut,
+                output,
+                ...(truncated ? { truncated: true } : {}),
+            });
         });
     });
 };

package/dist/shared/tooling/allowlistedExec.js.map

@@ -1 +1 @@
-{"version":3,"file":"allowlistedExec.js","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,kFAAkF;AAClF,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AAevC;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAmC,IAAI,GAAG,CAAoB;IAC9E;QACE,MAAM;QACN;YACE,yCAAyC;YACzC,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI;gBACtD,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI;gBACnD,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB;gBACjE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB;gBACpE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB;gBACpE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe;gBACrE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB;gBAClE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU;gBAClE,IAAI,EAAE,QAAQ,EAAE,IAAI;aACrB,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,IAAI;QACJ;YACE,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB;gBACrE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;gBACrD,sBAAsB,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS;gBAChE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe;gBACjE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;gBACtE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB;gBACnE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;gBACrE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB;gBACzE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa;gBACjE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;gBAClE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;aAC3D,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,SAAS;QACT;YACE,oDAAoD;YACpD,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB;gBACrE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;gBACrD,sBAAsB,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS;gBAChE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe;gBACjE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;gBACtE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB;gBACnE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;gBACrE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB;gBACzE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa;gBACjE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;gBAClE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;aAC3D,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,SAAS;QACT;YACE,2EAA2E;YAC3E,8EAA8E;YAC9E,KAAK,EAAE,IAAI,GAAG,EAAE;YAChB,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,IAAI;SACxB;KACF;IACD;QACE,OAAO;QACP;YACE,wEAAwE;YACxE,2DAA2D;YAC3D,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI;gBAC9D,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;gBAChE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB;aAChE,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,UAAU;QACV;YACE,wEAAwE;YACxE,+EAA+E;YAC/E,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;gBACpE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW;gBACjE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ;aACxC,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,IAAI;QACJ;YACE,wDAAwD;YACxD,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;gBACpE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW;gBACjE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ;aACxC,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;CACF,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,aAAa;IACb,cAAc;IACd,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,GAAG,YAAY,CAAC,IAAI,EAAE;IACtB,KAAK;CACN,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,KAAK;SACT,IAAI,EAAE;SACN,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAG;SACN,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,KAAa,EAAE,iBAA0B;IAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAc,EAAE,MAAiB;IAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACnC,2EAA2E;YAC3E,oCAAoC;YACpC,IAAI,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrD,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAc;IACzC,IAAI,UAA8B,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AA0BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA0B,CAClE,OAAO,EACP,GAAG,EACH,SAAS,EACT,EAAE;IACF,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,CAAC,eAAe,EAAE,GAAG,YAAY,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,YAAY,EAAE;YACjD,GAAG;YACH,GAAG,EAAE,yBAAyB,EAAE;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE;YACjC,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC3E,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC;gBACb,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"allowlistedExec.js","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,kFAAkF;AAClF,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AAevC;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAmC,IAAI,GAAG,CAAoB;IAC9E;QACE,MAAM;QACN;YACE,yCAAyC;YACzC,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI;gBACtD,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI;gBACnD,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB;gBACjE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB;gBACpE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB;gBACpE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe;gBACrE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB;gBAClE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU;gBAClE,IAAI,EAAE,QAAQ,EAAE,IAAI;aACrB,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,IAAI;QACJ;YACE,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB;gBACrE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;gBACrD,sBAAsB,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS;gBAChE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe;gBACjE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;gBACtE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB;gBACnE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;gBACrE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB;gBACzE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa;gBACjE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;gBAClE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;aAC3D,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,SAAS;QACT;YACE,oDAAoD;YACpD,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB;gBACrE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;gBACrD,sBAAsB,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS;gBAChE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe;gBACjE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;gBACtE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB;gBACnE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;gBACrE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB;gBACzE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa;gBACjE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;gBAClE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;aAC3D,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,SAAS;QACT;YACE,2EAA2E;YAC3E,8EAA8E;YAC9E,KAAK,EAAE,IAAI,GAAG,EAAE;YAChB,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,IAAI;SACxB;KACF;IACD;QACE,OAAO;QACP;YACE,wEAAwE;YACxE,2DAA2D;YAC3D,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI;gBAC9D,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;gBAChE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB;aAChE,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,UAAU;QACV;YACE,wEAAwE;YACxE,+EAA+E;YAC/E,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;gBACpE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW;gBACjE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ;aACxC,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,IAAI;QACJ;YACE,wDAAwD;YACxD,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;gBACpE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW;gBACjE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ;aACxC,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;CACF,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,aAAa;IACb,cAAc;IACd,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,GAAG,YAAY,CAAC,IAAI,EAAE;IACtB,KAAK;CACN,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,KAAK;SACT,IAAI,EAAE;SACN,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAG;SACN,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,KAAa,EAAE,iBAA0B;IAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAc,EAAE,MAAiB;IAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACnC,2EAA2E;YAC3E,oCAAoC;YACpC,IAAI,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrD,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAc;IACzC,IAAI,UAA8B,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA0B,CAClE,OAAO,EACP,GAAG,EACH,SAAS,EACT,EAAE;IACF,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,CAAC,eAAe,EAAE,GAAG,YAAY,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,YAAY,EAAE;YACjD,GAAG;YACH,GAAG,EAAE,yBAAyB,EAAE;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,oEAAoE;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE;YACjC,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBACxC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC3E,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC;gBACb,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,MAAM;gBACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC;gBACb,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,QAAQ;gBACnB,MAAM;gBACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/shared/tooling/commandShape.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Does `command` leave the declared single-invocation shape?
+ *
+ * `true` ⇒ REFUSE. This is the whole rule; callers add only how a refusal is
+ * reported (a thrown `BlockContractError`, a refusal line, a non-spawn).
+ */
+export declare function commandLeavesDeclaredShape(command: string): boolean;
+/**
+ * Partition declared commands into the admitted ones and refusal LINES —
+ * refusals as data, never a throw, for producers that must turn a malformed
+ * command into a bounded re-emit rather than an unclassified stack.
+ *
+ * Entries are trimmed; an entry that is absent, non-string or blank is refused
+ * as `"empty"`. `describeRefusal` owns the wording (which artifact field, which
+ * block), so this module stays the RULE and never the vocabulary.
+ */
+export declare function partitionCommandsByDeclaredShape(commands: readonly string[], describeRefusal: (kind: "empty" | "leaves-shape", raw: unknown) => string): {
+    commands: string[];
+    refusals: string[];
+};
+//# sourceMappingURL=commandShape.d.ts.map

package/dist/shared/tooling/commandShape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandShape.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAgEA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,GACxE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAgB5C"}