audit-tools 0.45.0 → 0.46.0

package/dist/shared/submission/expectedSubmissions.js

@@ -8,8 +8,25 @@ function compareIds(left, right) {
  * Build the set one emission owes. Entries are ordered by `submission_id` — a
  * content-derived key, never emission or filesystem order, so re-recording an
  * unchanged set produces byte-identical content.
+ *
+ * A lane declaring `expected: false` is REFUSED here, at the ONE seam every
+ * emitter builds its set through: the tool never reads that lane's submission,
+ * so an expectation recorded against it can never be satisfied or dropped —
+ * it would accumulate as a permanent, false shortfall the run reports forever.
+ * Throwing (not filtering) is the fail-closed shape: a caller that routes its
+ * un-expected lanes through this builder anyway has misstated what it owes,
+ * and a silently narrowed set would hide exactly that. The audit draw's
+ * materializer filters at its own boundary first; this is the backstop that
+ * makes the filter's omission non-optional.
  */
 export function buildExpectedSubmissionSet(params) {
+    const unexpected = params.lanes.filter((lane) => lane.expected === false);
+    if (unexpected.length > 0) {
+        throw new Error(`buildExpectedSubmissionSet refused ${unexpected.length} un-expected lane(s): ` +
+            `${unexpected.map((lane) => `'${lane.lane}'`).join(", ")}. The tool never reads ` +
+            "a lane whose submission another lane consumes, so recording one would mint an " +
+            "expectation no submission can ever satisfy — filter it out before building the set.");
+    }
     const entries = params.lanes.map((lane) => ({
         submission_id: lane.submissionId,
         lane: lane.lane,

package/dist/shared/submission/expectedSubmissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"expectedSubmissions.js","sourceRoot":"","sources":["../../../src/shared/submission/expectedSubmissions.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,CAAC,MAAM,6BAA6B,GACxC,kCAA2C,CAAC;AA0C9C,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAI1C;IACC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC;KACpE,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,gBAAgB,EAAE,6BAA6B;QAC/C,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAuC,EACvC,UAAiC;IAEjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO;QACL,GAAG,EAAE;YACH,gBAAgB,EAAE,6BAA6B;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjD,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CACpD;SACF;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,GAA0B,EAC1B,aAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO;QACL,gBAAgB,EAAE,6BAA6B;QAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA0B,EAC1B,QAAoD;IAEpD,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,eAAe;SACtC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,QAAQ,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"expectedSubmissions.js","sourceRoot":"","sources":["../../../src/shared/submission/expectedSubmissions.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,CAAC,MAAM,6BAA6B,GACxC,kCAA2C,CAAC;AAkD9C,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAI1C;IACC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,sCAAsC,UAAU,CAAC,MAAM,wBAAwB;YAC7E,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACjF,gFAAgF;YAChF,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC;KACpE,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,gBAAgB,EAAE,6BAA6B;QAC/C,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAuC,EACvC,UAAiC;IAEjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO;QACL,GAAG,EAAE;YACH,gBAAgB,EAAE,6BAA6B;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjD,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CACpD;SACF;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,GAA0B,EAC1B,aAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO;QACL,gBAAgB,EAAE,6BAA6B;QAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA0B,EAC1B,QAAoD;IAEpD,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,eAAe;SACtC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,QAAQ,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}

package/dist/shared/submission/handRecovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handRecovery.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AA6B5D;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,eAAe,GAAG,IAAI,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAuJ9B"}
+{"version":3,"file":"handRecovery.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AA6B5D;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,eAAe,GAAG,IAAI,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAqJ9B"}

package/dist/shared/submission/handRecovery.js

@@ -13,8 +13,8 @@
  * appends `recovered_by_hand`, so a run repaired by an operator stays
  * distinguishable from one the host got right.
  */
-import { readFile, unlink, writeFile } from "node:fs/promises";
-import { readOptionalJsonFile, writeJsonFile } from "../io/json.js";
+import { readFile, unlink } from "node:fs/promises";
+import { readOptionalJsonFile, writeFileAtomic, writeJsonFile, } from "../io/json.js";
 import { discardOnSchemaVersionMismatch } from "../io/schemaVersion.js";
 import { expectedSubmissionsPath, submissionsDir, } from "../io/auditToolsPaths.js";
 import { EXPECTED_SET_CONTRACT_VERSION } from "./expectedSubmissions.js";
@@ -145,15 +145,13 @@ export async function recoverSubmission(request, validate) {
                 await unlink(landingPath);
             }
             else {
-                // UNCOVERED HALF, stated: this restore is a RAW write while the forward
-                // write above is atomic (temp + rename). A crash between truncate and
-                // the last byte therefore leaves a TRUNCATED prior payload — worse than
-                // either outcome this rollback chooses between. Closing it needs
-                // `writeFileAtomic` to accept `string | Buffer` and be exported, which is
-                // the io module's node (CP-NODE-3) and named in its dispatch, not a
-                // change this module may make. Until it lands, the restore is atomic in
-                // intent and not in mechanism.
-                await writeFile(landingPath, priorContent);
+                // Restored through the SHARED atomic writer with the captured raw bytes,
+                // so the rollback is byte-for-byte AND crash-safe: the forward write is
+                // temp+rename and the restore must be no weaker, or a crash between
+                // truncate and the last byte would leave a TRUNCATED prior payload —
+                // worse than either outcome this rollback chooses between. (`writeFile`
+                // accepting a Buffer was not enough; only the atomic form closes it.)
+                await writeFileAtomic(landingPath, priorContent);
             }
         }
         catch (rollbackError) {

package/dist/shared/submission/handRecovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"handRecovery.js","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AA4B/B;;;;;;;;;;GAUG;AACH,KAAK,UAAU,WAAW,CACxB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,GAAG,GAAG,8BAA8B,CACxC,MAAM,oBAAoB,CACxB,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EACxB,6BAA6B,CAC9B,CAAC;IACF,OAAO,CACL,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,EAAE,IAAI;QACzE,YAAY,CACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAAoD;IAEpD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;KAC7E,CAAC;IACF,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE;gBACpD,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,kBAAkB,OAAO,CAAC,QAAQ,iBAAiB,IAAI,CAAC,MAAM,EAAE;gBACzE,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACL,6BAA6B,SAAS,uBAAuB,IAAI,IAAI,eAAe,KAAK;wBACzF,wEAAwE;wBACxE,uDAAuD;oBACzD,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,eAAe,EAAE,SAAS;iBAC3B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,OAAO,CAAC,YAAY,EAAE;YAChD,gBAAgB,EAAE,wCAAwC;YAC1D,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,IAAI;YACJ,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,0BAA0B,OAAO,CAAC,QAAQ,EAAE;YACrD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,yEAAyE;YACzE,uEAAuE;YACvE,yBAAyB;YACzB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,iEAAiE;gBACjE,0EAA0E;gBAC1E,oEAAoE;gBACpE,wEAAwE;gBACxE,+BAA+B;gBAC/B,MAAM,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4CAA4C;YAC5C,MAAM,cAAc,GAClB,aAAa,YAAY,KAAK;gBAC5B,CAAC,CAAC,aAAa,CAAC,OAAO;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,sCAAsC;gBAC9E,IAAI,MAAM,uDAAuD,cAAc,KAAK;gBACpF,6BAA6B,SAAS,sCAAsC;gBAC5E,wEAAwE;gBACxE,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,uEAAuE;wBACvE,mDAAmD,CAAC,EAC1D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,uCAAuC;YAC/E,GAAG,MAAM,kEAAkE;YAC3E,CAAC,YAAY,KAAK,IAAI;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gFAAgF,CAAC,EACvF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC"}
+{"version":3,"file":"handRecovery.js","sourceRoot":"","sources":["../../../src/shared/submission/handRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AA4B/B;;;;;;;;;;GAUG;AACH,KAAK,UAAU,WAAW,CACxB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,GAAG,GAAG,8BAA8B,CACxC,MAAM,oBAAoB,CACxB,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EACxB,6BAA6B,CAC9B,CAAC;IACF,OAAO,CACL,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,EAAE,IAAI;QACzE,YAAY,CACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAAoD;IAEpD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;KAC7E,CAAC;IACF,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE;gBACpD,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,kBAAkB,OAAO,CAAC,QAAQ,iBAAiB,IAAI,CAAC,MAAM,EAAE;gBACzE,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACL,6BAA6B,SAAS,uBAAuB,IAAI,IAAI,eAAe,KAAK;wBACzF,wEAAwE;wBACxE,uDAAuD;oBACzD,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,eAAe,EAAE,SAAS;iBAC3B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,OAAO,CAAC,YAAY,EAAE;YAChD,gBAAgB,EAAE,wCAAwC;YAC1D,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,IAAI;YACJ,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,0BAA0B,OAAO,CAAC,QAAQ,EAAE;YACrD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,yEAAyE;YACzE,uEAAuE;YACvE,yBAAyB;YACzB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,qEAAqE;gBACrE,wEAAwE;gBACxE,sEAAsE;gBACtE,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4CAA4C;YAC5C,MAAM,cAAc,GAClB,aAAa,YAAY,KAAK;gBAC5B,CAAC,CAAC,aAAa,CAAC,OAAO;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,sCAAsC;gBAC9E,IAAI,MAAM,uDAAuD,cAAc,KAAK;gBACpF,6BAA6B,SAAS,sCAAsC;gBAC5E,wEAAwE;gBACxE,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,uEAAuE;wBACvE,mDAAmD,CAAC,EAC1D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,YAAY,uCAAuC;YAC/E,GAAG,MAAM,kEAAkE;YAC3E,CAAC,YAAY,KAAK,IAAI;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gFAAgF,CAAC,EACvF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC"}

package/dist/shared/submission/hostHandoffCore.d.ts

@@ -0,0 +1,155 @@
+/** Code-unit lexical order — the shared comparator for every id sort here. */
+export declare function compareCodeUnits(left: string, right: string): number;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/** Exact key set, order-insensitive: a persisted envelope admits no extra keys. */
+export declare function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean;
+export declare function isSha256(value: unknown): value is string;
+/** Full sha1/sha256 commit id — the only form a baseline may take. */
+export declare function isCommit(value: unknown): value is string;
+export declare function requireNonEmptyString(value: unknown, label: string): string;
+export declare function stringArray(value: unknown): readonly string[] | null;
+/** Element-wise equality of two string arrays (order-significant). */
+export declare function sameStrings(left: readonly string[], right: readonly string[]): boolean;
+/** The dedupe key for an accepted binding: work item × prompt digest. */
+export declare function bindingIdentity(entry: {
+    readonly work_item_id: string;
+    readonly prompt_sha256: string;
+}): string;
+/**
+ * The run-scoped paths one host-handoff boundary lives at.
+ *
+ * Both twins resolved these with the same three calls (`assertSubmissionRunId`,
+ * containment on the artifacts dir, containment on `runs/<runId>`), differing
+ * only in whether the run directory carried a sub-segment. The sub-segment is a
+ * parameter here, not a fork: remediate's run dir sits under `runs/<id>/implement`
+ * because its runs dir also holds triage/closing lanes; audit's sits directly
+ * under `runs/<id>`.
+ */
+export interface HostHandoffPaths {
+    /** Absolute repository root everything is contained beneath. */
+    readonly root: string;
+    /** Absolute artifacts dir (`.audit-tools/<tool>/`). */
+    readonly artifactsDir: string;
+    /** Absolute run directory the workload and results live under. */
+    readonly runDir: string;
+    /** Absolute directory submissions land in. */
+    readonly resultDir: string;
+    /** Absolute path of the persisted workload document. */
+    readonly workloadPath: string;
+}
+/**
+ * Resolve the run-scoped boundary paths. Throws when the run id leaves the
+ * shared grammar or either declared root escapes containment — before any
+ * caller has a path to write to.
+ */
+export declare function resolveHostHandoffPaths(params: {
+    readonly root: string;
+    readonly artifactsDir: string;
+    readonly runId: string;
+    /**
+     * Segments between the RUN DIRECTORY and its lane sub-directory — i.e. AFTER
+     * the run id: `runs/<runId>/<segments…>`. Empty for audit's flat
+     * `runs/<runId>/`; `["implement"]` for remediate's lane-scoped one. Order is
+     * load-bearing: validators join submissions to their run by the FIRST path
+     * segment under `runs/`, so the run id must stay that segment.
+     */
+    readonly runDirSegments?: readonly string[];
+    /** Names this draw in the run-id refusal (`Invalid <label>: …`). */
+    readonly runIdLabel?: string;
+}): HostHandoffPaths;
+/**
+ * The bound path for one work item's submission — the SHARED rule, not a local
+ * copy of it. `<resultDir>/<sha256(id)>.json`, repository-relative and
+ * forward-slashed. This replaces the byte-equivalent private `resultPathFor`
+ * copies both twins carried; a divergence between them would have been silent
+ * on both sides.
+ */
+export declare function hostHandoffResultPath(paths: HostHandoffPaths, id: string): string;
+/** Absolute form of {@link hostHandoffResultPath}, for readers on disk. */
+export declare function absoluteHostHandoffResultPath(paths: HostHandoffPaths, id: string): string;
+/** Content digest of one prompt text — the binding between ask and answer. */
+export declare function promptSha256(promptText: string): string;
+/** Content digest of one canonical JSON rendering. */
+export declare function contentSha256(value: unknown): string;
+export type WorkloadEnvelopeParse = {
+    readonly ok: true;
+    readonly rawItems: readonly unknown[];
+} | {
+    readonly ok: false;
+};
+/**
+ * Validate a persisted workload ENVELOPE against this run: exact keys, the
+ * draw's contract version, the run id, and an array of raw items. Item-level
+ * shape is the draw's parser ({@link parseAllWorkloadItems}); anything the
+ * persisted trusted binding further pins (a digest, a baseline) is the draw's
+ * policy layered on top of the `ok` case.
+ */
+export declare function parseWorkloadEnvelope(value: unknown, params: {
+    readonly contractVersion: string;
+    readonly runId: string;
+}): WorkloadEnvelopeParse;
+/** Map raw items through the draw's parser; `null` when ANY item refuses. */
+export declare function parseAllWorkloadItems<T>(rawItems: readonly unknown[], parseItem: (raw: unknown) => T | null): readonly T[] | null;
+/** Every id distinct — the duplicate-work-item refusal. */
+export declare function idsAreUnique(ids: readonly string[]): boolean;
+/**
+ * Strictly ascending in code-unit order — which is BOTH "sorted" and
+ * "duplicate-free", the two properties every persisted workload's id list must
+ * have for a re-derivation to compare equal byte-for-byte.
+ */
+export declare function idsAreStrictlyAscending(ids: readonly string[]): boolean;
+/**
+ * The identity binding EVERY submitted result carries, identical on both
+ * draws: a non-empty `result_id`, this run's id, this work item's id, and the
+ * prompt digest of the ask. A refusal here is a REFUSAL, never a repair — the
+ * tool cannot know which of the three the host meant.
+ */
+export declare function resultIdentityIsBound(value: Record<string, unknown>, params: {
+    readonly runId: string;
+    readonly workItemId: string;
+    readonly promptSha256: string;
+}): boolean;
+/** The minimal view of a parsed work item the result-map check needs. */
+export interface ResultMappedItem {
+    readonly id: string;
+    readonly prompt: {
+        readonly sha256: string;
+    };
+    readonly result_path: string;
+}
+/** One `host-result-map.json` entry, as both draws persist it. */
+export interface ResultMapEntry {
+    readonly work_item_id: string;
+    readonly prompt_sha256: string;
+    readonly result_path: string;
+}
+/**
+ * RESULT-MAP IDENTITY: the map names exactly the workload's items, once each,
+ * with each item's own prompt digest and derived bound path. This was the
+ * second half of the audit twin's `validateHandoffBinding`, hand-inlined there;
+ * the remediate draw pins the same facts through its whole-document digest
+ * instead — but the CHECK itself is the draw-independent statement of "the map
+ * and the workload agree", so it lives here for whichever draw parses a map.
+ *
+ * The failure is CLASSIFIED, not collapsed: `coverage` means the map does not
+ * name this workload's items exactly once each; `identity` means an entry
+ * names the right item but pins another item's prompt digest or a bound path
+ * the shared rule does not derive. The two are not interchangeable to the
+ * caller — one says the MAP is wrong, the other names the BINDING that broke.
+ */
+export type ResultMapIdentity<TItem extends ResultMappedItem> = {
+    readonly ok: true;
+    readonly byId: ReadonlyMap<string, TItem>;
+} | {
+    readonly ok: false;
+    readonly reason: "coverage" | "identity";
+    readonly workItemId?: string;
+};
+export declare function resultMapIdentity<TItem extends ResultMappedItem>(items: readonly TItem[], entries: readonly ResultMapEntry[]): ResultMapIdentity<TItem>;
+/**
+ * First duplicate identity in `entries`, or null. The accepted-results ledger
+ * and any other keyed record derives its dedupe refusal from this rather than
+ * from a hand-rolled Set walk whose message and predicate can drift apart.
+ */
+export declare function firstDuplicateIdentity<T>(entries: readonly T[], identity: (entry: T) => string): T | null;
+//# sourceMappingURL=hostHandoffCore.d.ts.map

package/dist/shared/submission/hostHandoffCore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostHandoffCore.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/hostHandoffCore.ts"],"names":[],"mappings":"AA0BA,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAQT;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKxD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK3E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAIpE;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAKT;AASD,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,gBAAgB,CAoBnB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,GACT,MAAM,CAKR;AAED,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,GACT,MAAM,CAMR;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAcD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE;IACN,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACA,qBAAqB,CAWvB;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,IAAI,GACpC,SAAS,CAAC,EAAE,GAAG,IAAI,CAQrB;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAKvE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE;IACN,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,GACA,OAAO,CAQT;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,gBAAgB,IACxD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,GAChE;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,wBAAgB,iBAAiB,CAAC,KAAK,SAAS,gBAAgB,EAC9D,KAAK,EAAE,SAAS,KAAK,EAAE,EACvB,OAAO,EAAE,SAAS,cAAc,EAAE,GACjC,iBAAiB,CAAC,KAAK,CAAC,CAsB1B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,GAC7B,CAAC,GAAG,IAAI,CAQV"}

package/dist/shared/submission/hostHandoffCore.js

@@ -0,0 +1,210 @@
+/**
+ * The ONE host-handoff boundary both orchestrators draw from.
+ *
+ * The audit host handoff (`src/audit/cli/dispatch/hostHandoff.ts`) and the
+ * remediation one (`src/remediate/steps/dispatch/hostHandoff.ts`) were two
+ * independently evolved bodies that had already converged on the same skeleton:
+ * resolve a run-scoped boundary, derive each work item's bound result path
+ * through the shared submission-path rule, hash the prompt, validate the
+ * workload against its bindings, and refuse a result whose identity, prompt
+ * binding, or result-map entry does not match the derivation. Every place they
+ * differed in TEXT but not in MEANING is what this core owns now; what remains
+ * in each twin is its DRAW — the contract versions and shapes it persists, the
+ * domain validation it applies on top, the state it mutates.
+ */
+// Sibling modules imported DIRECTLY, never through ../index.js: the barrel
+// re-exports this module, so importing the barrel here would close a cycle
+// (index → hostHandoffCore → index) that check:depgraph refuses.
+import { hashContent } from "../hash.js";
+import { stableStringify } from "../stableStringify.js";
+import { assertSubmissionRunId, resolveContainedPath, submissionPathFor, } from "./submissionIdentity.js";
+import { join, resolve } from "node:path";
+/** Code-unit lexical order — the shared comparator for every id sort here. */
+export function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Exact key set, order-insensitive: a persisted envelope admits no extra keys. */
+export function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort(compareCodeUnits);
+    return (actual.length === expected.length &&
+        actual.every((key, index) => key === [...expected].sort(compareCodeUnits)[index]));
+}
+export function isSha256(value) {
+    return typeof value === "string" && /^[0-9a-f]{64}$/u.test(value);
+}
+/** Full sha1/sha256 commit id — the only form a baseline may take. */
+export function isCommit(value) {
+    return (typeof value === "string" &&
+        /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(value));
+}
+export function requireNonEmptyString(value, label) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`${label} must be a non-empty string`);
+    }
+    return value;
+}
+export function stringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string")
+        ? value
+        : null;
+}
+/** Element-wise equality of two string arrays (order-significant). */
+export function sameStrings(left, right) {
+    return (left.length === right.length &&
+        left.every((entry, index) => entry === right[index]));
+}
+/**
+ * The dedupe key for an accepted binding: work item × prompt digest, joined by
+ * NUL (`String.fromCharCode(0)` in source — never the raw control byte in this
+ * file, which git would treat as binary).
+ */
+const BINDING_IDENTITY_SEPARATOR = String.fromCharCode(0);
+/** The dedupe key for an accepted binding: work item × prompt digest. */
+export function bindingIdentity(entry) {
+    return `${entry.work_item_id}${BINDING_IDENTITY_SEPARATOR}${entry.prompt_sha256}`;
+}
+/**
+ * Resolve the run-scoped boundary paths. Throws when the run id leaves the
+ * shared grammar or either declared root escapes containment — before any
+ * caller has a path to write to.
+ */
+export function resolveHostHandoffPaths(params) {
+    assertSubmissionRunId(params.runId, params.runIdLabel ?? "host handoff run id");
+    const root = resolve(params.root);
+    const artifactsDir = resolveContainedPath(root, params.artifactsDir, "artifactsDir");
+    const segments = params.runDirSegments ?? [];
+    const runDir = resolveContainedPath(artifactsDir, join("runs", params.runId, ...segments), "host handoff run directory");
+    return {
+        root,
+        artifactsDir,
+        runDir,
+        resultDir: join(runDir, "host-results"),
+        workloadPath: join(runDir, "host-workload.json"),
+    };
+}
+/**
+ * The bound path for one work item's submission — the SHARED rule, not a local
+ * copy of it. `<resultDir>/<sha256(id)>.json`, repository-relative and
+ * forward-slashed. This replaces the byte-equivalent private `resultPathFor`
+ * copies both twins carried; a divergence between them would have been silent
+ * on both sides.
+ */
+export function hostHandoffResultPath(paths, id) {
+    return submissionPathFor({ root: paths.root, submissionDir: paths.resultDir }, id);
+}
+/** Absolute form of {@link hostHandoffResultPath}, for readers on disk. */
+export function absoluteHostHandoffResultPath(paths, id) {
+    return resolveContainedPath(paths.root, hostHandoffResultPath(paths, id), `result path for ${id}`);
+}
+/** Content digest of one prompt text — the binding between ask and answer. */
+export function promptSha256(promptText) {
+    return hashContent(promptText);
+}
+/** Content digest of one canonical JSON rendering. */
+export function contentSha256(value) {
+    return hashContent(stableStringify(value));
+}
+// ── Envelope, item, and binding validation ──────────────────────────────────
+//
+// Both draws parse the SAME document family out of the run directory — a
+// workload envelope carrying `work_items`, per-item trusted bindings keyed by
+// work item, and a result map naming where each answer lands — and both used to
+// re-derive the scaffolding by hand. The shapes below are the shared skeleton;
+// a draw adds only its own contract version, its own item parser, and whatever
+// domain fields its bindings carry.
+/** The `{ contract_version, run_id, work_items }` envelope both workloads use. */
+const WORKLOAD_ENVELOPE_KEYS = ["contract_version", "run_id", "work_items"];
+/**
+ * Validate a persisted workload ENVELOPE against this run: exact keys, the
+ * draw's contract version, the run id, and an array of raw items. Item-level
+ * shape is the draw's parser ({@link parseAllWorkloadItems}); anything the
+ * persisted trusted binding further pins (a digest, a baseline) is the draw's
+ * policy layered on top of the `ok` case.
+ */
+export function parseWorkloadEnvelope(value, params) {
+    if (!isRecord(value) ||
+        !hasExactKeys(value, WORKLOAD_ENVELOPE_KEYS) ||
+        value.contract_version !== params.contractVersion ||
+        value.run_id !== params.runId ||
+        !Array.isArray(value.work_items)) {
+        return { ok: false };
+    }
+    return { ok: true, rawItems: value.work_items };
+}
+/** Map raw items through the draw's parser; `null` when ANY item refuses. */
+export function parseAllWorkloadItems(rawItems, parseItem) {
+    const items = [];
+    for (const raw of rawItems) {
+        const item = parseItem(raw);
+        if (item === null)
+            return null;
+        items.push(item);
+    }
+    return items;
+}
+/** Every id distinct — the duplicate-work-item refusal. */
+export function idsAreUnique(ids) {
+    return new Set(ids).size === ids.length;
+}
+/**
+ * Strictly ascending in code-unit order — which is BOTH "sorted" and
+ * "duplicate-free", the two properties every persisted workload's id list must
+ * have for a re-derivation to compare equal byte-for-byte.
+ */
+export function idsAreStrictlyAscending(ids) {
+    return !ids.some((id, index) => index > 0 && compareCodeUnits(ids[index - 1], id) >= 0);
+}
+/**
+ * The identity binding EVERY submitted result carries, identical on both
+ * draws: a non-empty `result_id`, this run's id, this work item's id, and the
+ * prompt digest of the ask. A refusal here is a REFUSAL, never a repair — the
+ * tool cannot know which of the three the host meant.
+ */
+export function resultIdentityIsBound(value, params) {
+    return (typeof value.result_id === "string" &&
+        value.result_id.length > 0 &&
+        value.run_id === params.runId &&
+        value.work_item_id === params.workItemId &&
+        value.prompt_sha256 === params.promptSha256);
+}
+export function resultMapIdentity(items, entries) {
+    const byId = new Map(items.map((item) => [item.id, item]));
+    if (entries.length !== byId.size)
+        return { ok: false, reason: "coverage" };
+    const seen = new Set();
+    for (const entry of entries) {
+        const item = byId.get(entry.work_item_id);
+        if (item === undefined || seen.has(entry.work_item_id)) {
+            return { ok: false, reason: "coverage" };
+        }
+        if (entry.prompt_sha256 !== item.prompt.sha256 ||
+            entry.result_path !== item.result_path) {
+            return {
+                ok: false,
+                reason: "identity",
+                workItemId: entry.work_item_id,
+            };
+        }
+        seen.add(entry.work_item_id);
+    }
+    return { ok: true, byId };
+}
+/**
+ * First duplicate identity in `entries`, or null. The accepted-results ledger
+ * and any other keyed record derives its dedupe refusal from this rather than
+ * from a hand-rolled Set walk whose message and predicate can drift apart.
+ */
+export function firstDuplicateIdentity(entries, identity) {
+    const seen = new Set();
+    for (const entry of entries) {
+        const key = identity(entry);
+        if (seen.has(key))
+            return entry;
+        seen.add(key);
+    }
+    return null;
+}
+//# sourceMappingURL=hostHandoffCore.js.map

package/dist/shared/submission/hostHandoffCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostHandoffCore.js","sourceRoot":"","sources":["../../../src/shared/submission/hostHandoffCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,KAA8B,EAC9B,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,KAAK,CACV,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CACpE,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,KAAa;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC9E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CACzB,IAAuB,EACvB,KAAwB;IAExB,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAE1D,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,KAG/B;IACC,OAAO,GAAG,KAAK,CAAC,YAAY,GAAG,0BAA0B,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;AACpF,CAAC;AAyBD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAcvC;IACC,qBAAqB,CACnB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,UAAU,IAAI,qBAAqB,CAC3C,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,oBAAoB,CACjC,YAAY,EACZ,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,EACvC,4BAA4B,CAC7B,CAAC;IACF,OAAO;QACL,IAAI;QACJ,YAAY;QACZ,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;QACvC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,EAAU;IAEV,OAAO,iBAAiB,CACtB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,EACpD,EAAE,CACH,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B,CAC3C,KAAuB,EACvB,EAAU;IAEV,OAAO,oBAAoB,CACzB,KAAK,CAAC,IAAI,EACV,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,EAChC,mBAAmB,EAAE,EAAE,CACxB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AAEpC,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AAMrF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAGC;IAED,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,YAAY,CAAC,KAAK,EAAE,sBAAsB,CAAC;QAC5C,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,eAAe;QACjD,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK;QAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAChC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,SAAqC;IAErC,MAAM,KAAK,GAAQ,EAAE,CAAC;IACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CACZ,KAAK,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA8B,EAC9B,MAIC;IAED,OAAO,CACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC1B,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK;QAC7B,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,UAAU;QACxC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,CAC5C,CAAC;AACJ,CAAC;AAsCD,MAAM,UAAU,iBAAiB,CAC/B,KAAuB,EACvB,OAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3C,CAAC;QACD,IACE,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EACtC,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,KAAK,CAAC,YAAY;aAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAqB,EACrB,QAA8B;IAE9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/submission/submissionLedger.d.ts

@@ -22,7 +22,11 @@ export interface SubmissionLedgerEvent<TIssueCode extends string = SubmissionIss
 }
 /** `<artifactsDir>/submissions/submission-ledger.jsonl`. */
 export declare function submissionLedgerPath(artifactsDir: string): string;
-/** Append one event. The parent directory is created on demand. */
+/**
+ * Append one event under the shared file lock, so concurrent appends cannot
+ * interleave mid-line. The parent directory is created on demand (the lock
+ * acquire creates its own parent; `appendNdjsonFile` creates the ledger's).
+ */
 export declare function appendSubmissionEvent<TIssueCode extends string = SubmissionIssueCode>(artifactsDir: string, event: SubmissionLedgerEvent<TIssueCode>): Promise<void>;
 /** Why one ledger line did not become an event. */
 export type SubmissionLedgerDropReason = 

package/dist/shared/submission/submissionLedger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,oHA0BzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB,CACpC,UAAU,SAAS,MAAM,GAAG,mBAAmB;IAE/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,UAAU,SAAS,MAAM,GAAG,mBAAmB,EAC/C,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E;AAED,mDAAmD;AACnD,MAAM,MAAM,0BAA0B;AACpC,yEAAyE;AACvE,YAAY;AACd,sEAAsE;GACpE,yBAAyB,CAAC;AAE9B,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,qBAAqB,EAAE,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAkC/B"}
+{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,oHA0BzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB,CACpC,UAAU,SAAS,MAAM,GAAG,mBAAmB;IAE/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAcD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,SAAS,MAAM,GAAG,mBAAmB,EAC/C,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/E;AAED,mDAAmD;AACnD,MAAM,MAAM,0BAA0B;AACpC,yEAAyE;AACvE,YAAY;AACd,sEAAsE;GACpE,yBAAyB,CAAC;AAE9B,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,qBAAqB,EAAE,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA4C/B"}

package/dist/shared/submission/submissionLedger.js

@@ -17,6 +17,8 @@
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";
 import { appendNdjsonFile } from "../io/json.js";
+import { siblingLockPath } from "../io/lockedJsonStore.js";
+import { withFileLock } from "../io/fileLock.js";
 import { discardOnSchemaVersionMismatch } from "../io/schemaVersion.js";
 import { submissionsDir } from "../io/auditToolsPaths.js";
 export const SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION = "submission-ledger-event/v1alpha1";
@@ -51,9 +53,27 @@ export const SUBMISSION_EVENT_KINDS = [
 export function submissionLedgerPath(artifactsDir) {
     return join(submissionsDir(artifactsDir), "submission-ledger.jsonl");
 }
-/** Append one event. The parent directory is created on demand. */
+// Sibling lock serializing every append. Two concurrent appends used to be two
+// independent open-append syscalls on one file: on Windows (and wherever O_APPEND
+// is not what the runtime actually performs) they can interleave so one event's
+// line lands INSIDE the other's, and both lines are then torn — the ledger
+// silently loses an event, which is precisely the clean-vs-repaired collapse it
+// exists to prevent. The name is the locked-JSON-store module's OWN derivation
+// (`siblingLockPath`), so the ledger's lock is the same rule the stores use
+// rather than a second spelling of it.
+function ledgerLockPath(ledgerPath) {
+    return siblingLockPath(ledgerPath);
+}
+/**
+ * Append one event under the shared file lock, so concurrent appends cannot
+ * interleave mid-line. The parent directory is created on demand (the lock
+ * acquire creates its own parent; `appendNdjsonFile` creates the ledger's).
+ */
 export async function appendSubmissionEvent(artifactsDir, event) {
-    await appendNdjsonFile(submissionLedgerPath(artifactsDir), event);
+    const ledgerPath = submissionLedgerPath(artifactsDir);
+    await withFileLock(ledgerLockPath(ledgerPath), async () => {
+        await appendNdjsonFile(ledgerPath, event);
+    });
 }
 function ledgerRead(events, dropped) {
     Object.defineProperty(events, "events", {
@@ -115,7 +135,17 @@ export async function readSubmissionLedger(artifactsDir) {
             continue;
         let parsed;
         try {
-            parsed = JSON.parse(line);
+            const value = JSON.parse(line);
+            // A line that is valid JSON but not an OBJECT is still not an event: the
+            // version check below reads properties off it (`in`), which throws on a
+            // primitive or array and broke this function's documented never-throw
+            // guarantee — one stray line failed the whole call that records drift.
+            // Classified exactly like a torn line instead.
+            if (value === null || typeof value !== "object" || Array.isArray(value)) {
+                dropped.push({ line: lineNumber, reason: "unparsable" });
+                continue;
+            }
+            parsed = value;
         }
         catch {
             dropped.push({ line: lineNumber, reason: "unparsable" });

package/dist/shared/submission/submissionLedger.js.map

@@ -1 +1 @@
-{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;IACnB;;;;;;OAMG;IACH,uBAAuB;IACvB;;;;;;;OAOG;IACH,qBAAqB;CACb,CAAC;AAyBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAEzC,YAAoB,EAAE,KAAwC;IAC9D,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAqCD,SAAS,UAAU,CACjB,MAA+B,EAC/B,OAA+B;IAE/B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;QACtC,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;QACvC,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,MAAyC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,8EAA8E;IAC9E,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,UAAU,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,8BAA8B,CAC1C,MAAM,EACN,wCAAwC,CACzC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;IACnB;;;;;;OAMG;IACH,uBAAuB;IACvB;;;;;;;OAOG;IACH,qBAAqB;CACb,CAAC;AAyBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,uCAAuC;AACvC,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAEzC,YAAoB,EAAE,KAAwC;IAC9D,MAAM,UAAU,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,YAAY,CAChB,cAAc,CAAC,UAAU,CAAC,EAC1B,KAAK,IAAI,EAAE;QACT,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,CACF,CAAC;AACJ,CAAC;AAqCD,SAAS,UAAU,CACjB,MAA+B,EAC/B,OAA+B;IAE/B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;QACtC,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;QACvC,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,MAAyC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,8EAA8E;IAC9E,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,UAAU,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,+CAA+C;YAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,KAA8B,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,8BAA8B,CAC1C,MAAM,EACN,wCAAwC,CACzC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/shared/tooling/commandShape.d.ts

@@ -18,4 +18,33 @@ export declare function partitionCommandsByDeclaredShape(commands: readonly stri
     commands: string[];
     refusals: string[];
 };
+/**
+ * Split a command string into an argv array, so it can be spawned with
+ * `shell: false`.
+ *
+ * TOTAL, and its guarantee is stated in terms of `shell: false` — not in terms
+ * of a precondition a caller has to remember. Exactly two characters are
+ * special: an unquoted space ENDS a token, and a double quote toggles grouping
+ * and is dropped. EVERY other byte — including `' \ ^ % $` and backtick, and
+ * including `& | ; < > ( )` — is copied into the token literally, which under
+ * `shell: false` is precisely what the child receives, because no shell ever
+ * parses the result. So for any input this produces the argv that a shell-free
+ * spawn will actually deliver; it never silently drops meaning.
+ *
+ * What it does NOT do is decide whether a command was ADMISSIBLE. A string that
+ * fails {@link commandLeavesDeclaredShape} still splits — `a && b` becomes
+ * `["a", "&&", "b"]`, three literal argv tokens — and that argv is a faithful
+ * rendering of what `shell: false` would run, not an execution of the chain the
+ * author wrote. That is a declaration the contract cannot honour, so it must be
+ * REFUSED by the gate before it reaches a spawn; this function is not the place
+ * that decision is made, and it is not a shell parser standing in for one.
+ *
+ * Windows note: because `\` is an ordinary byte here, an absolute Windows path
+ * survives intact through the split (`C:\Program Files\nodejs\node.exe` stays
+ * one token when double-quoted). The declared-shape gate refuses `\` in every
+ * position, so such a path can only reach this function from a caller that did
+ * not gate — see {@link commandLeavesDeclaredShape}'s header for why the
+ * refusal is about the declaration rather than the spawn.
+ */
+export declare function parseCommandString(command: string): string[];
 //# sourceMappingURL=commandShape.d.ts.map