harnery 0.25.0 → 0.27.0

package/dist/core/workflow/types.d.ts

@@ -123,6 +123,12 @@ export interface HarnessEvidenceCoverage {
      * itself a proof unknown. */
     attestation?: HarnessAttestationCitation;
 }
+export interface WorkflowSandboxProjectionEvidence {
+    mode: SpawnFilesystemPolicy["mode"];
+    writable_roots: string[];
+    /** Which Git administrative grant the run asked for (ADR 0040). */
+    git_grant: GitAdministrativeGrant;
+}
 export interface WorkflowProofUnknown {
     code: "tool_evidence_unavailable" | "harness_capability_unregistered" | "agent_cost_unreported" | "agent_session_unreported" | "repository_drift_incomplete";
     message: string;
@@ -156,6 +162,10 @@ export interface WorkflowProof {
     /** Immutable terminal provider evidence for isolated execution. */
     execution?: WorkspaceExecutionEvidence;
     repository: WorkflowRepoEvidence;
+    /** Filesystem policy projected into every child's vendor sandbox (ADR 0039).
+     * Absent means no projection was applied, which is the default. Present means
+     * the run can be audited for exactly what its children could write. */
+    sandbox_projection?: WorkflowSandboxProjectionEvidence;
     harnesses: HarnessEvidenceCoverage[];
     unknowns: WorkflowProofUnknown[];
     integrity: {
@@ -271,6 +281,31 @@ export interface SpawnRequest {
     /** Scrub all API-key vars from the child env so it can only authenticate
      * via its stored (subscription) login. See billing.ts. */
     subscriptionOnly?: boolean;
+    /** Filesystem policy to project into the child's own vendor sandbox
+     * (ADR 0039). Absent leaves the adapter's default invocation untouched, which
+     * is what shared-checkout runs use. An adapter that cannot represent the
+     * requested projection refuses before launch rather than downgrading. */
+    filesystemPolicy?: SpawnFilesystemPolicy;
+}
+/**
+ * Whether a run may write the Git administrative directory (ADR 0040).
+ *
+ * There is no middle setting, and the reason is a property of Git rather than a
+ * design choice. A linked worktree has a private administrative directory and a
+ * shared one, but object writes and branch refs live in the shared half, so even
+ * `git add` fails without it. A grant that enables a commit is therefore always
+ * a grant on the repository every worktree shares, including the operator's own
+ * checkout. That is why it has to be asked for by name.
+ */
+export type GitAdministrativeGrant = "none" | "shared-repository";
+/** What the host has decided the child may write. `full-access` is deliberately
+ * not a mode: Harnery does not project a no-sandbox state into a vendor CLI. */
+export interface SpawnFilesystemPolicy {
+    mode: "read-only" | "workspace-write";
+    /** Explicit absolute paths the child may write, declared rather than derived
+     * from `cwd`. The path that needs writing (a repository's administrative
+     * directory, for instance) is routinely outside the working directory. */
+    writableRoots?: readonly string[];
 }
 /** One headless-subagent runner. The engine is adapter-agnostic; claude-code
  * ships first, codex/cursor land behind the same signature (plan Phase 4). */
@@ -388,6 +423,22 @@ export interface EngineOpts {
     /** Live attestations backing each harness's claims (ADR 0038). Read once by
      * the host and injected, so the engine performs no capability lookups. */
     harnessAttestations?: Readonly<Record<HarnessName, HarnessAttestationCitation | undefined>>;
+    /** Filesystem policy projected into every child's own vendor sandbox
+     * (ADR 0039). Validated against the workspace binding before the first spawn,
+     * and recorded in proof. Absent leaves every adapter invocation unchanged. */
+    filesystemPolicy?: SpawnFilesystemPolicy;
+    /**
+     * Whether children may write the repository's administrative directory
+     * (ADR 0040). Defaults to `"none"`.
+     *
+     * The caller asks for the grant by name and never supplies the path: the
+     * engine resolves it from the workspace binding the provider already
+     * verified. That asymmetry is deliberate. `filesystemPolicy.writableRoots` is
+     * caller-supplied and must stay inside the workspace, so a caller cannot use
+     * it to reach the source repository; this grant can, which is exactly why it
+     * is a named capability rather than another path.
+     */
+    gitWrite?: GitAdministrativeGrant;
     /** Immutable host policy. Workflow scripts and model prompts cannot replace it. */
     policy?: PolicySpec | NormalizedPolicy;
     /** Host callback for ASK. Missing, invalid, throwing, or timed-out resolution denies. */

package/dist/core/workflow/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AACxD,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAC/D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAElE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,CAAC;AACnD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AACvE,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,QAAQ,CAAC;AACvD,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,0EAA0E;IAC1E,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,KAAK,EAAE;QACL,cAAc,EAAE,OAAO,CAAC;QACxB,YAAY,EAAE,OAAO,CAAC;QACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,kFAAkF;QAClF,UAAU,EAAE,OAAO,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;uEACuE;AACvE,MAAM,WAAW,0BAA0B;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,aAAa,EAAE;QACb,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;QAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,QAAQ,EAAE;QACR,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF;;iCAE6B;IAC7B,WAAW,CAAC,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EACA,2BAA2B,GAC3B,iCAAiC,GACjC,uBAAuB,GACvB,0BAA0B,GAC1B,6BAA6B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,OAAO,6BAA6B,CAAC;IACrD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;QACX,wEAAwE;QACxE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,iBAAiB,CAAC;QAC1B,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,UAAU,EAAE;QACV,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAC7B,OAAO,EAAE,iBAAiB,CAAC;KAC5B,CAAC;IACF,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,mEAAmE;IACnE,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,UAAU,EAAE,oBAAoB,CAAC;IACjC,SAAS,EAAE,uBAAuB,EAAE,CAAC;IACrC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,SAAS,EAAE;QACT,OAAO,EAAE;YACP,IAAI,EAAE,eAAe,CAAC;YACtB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,mBAAmB,CAAC;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,uBAAuB,CAAC,eAAe,CAAC,CAAC;CACxD;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3D,oEAAoE;IACpE,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB,kBAAkB;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,iBAAiB;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB;gFAC4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;8EAE0E;IAC1E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;uDACmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;sDACkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;kBAEc;IACd,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED;;kCAEkC;AAClC,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC;8EAC8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;2EACuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;8DAC0D;IAC1D,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;8EAC8E;AAC9E,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAElE;+EAC+E;AAC/E,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACrC;gFAC4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3E,+DAA+D;IAC/D,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,2CAA2C;IAC3C,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC;IACnD,0EAA0E;IAC1E,SAAS,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,2BAA2B,GACnC,gBAAgB,GAChB,wBAAwB,GACxB,oBAAoB,GACpB,MAAM,CAAC;AAEX,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACpE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,EAAE,OAAO,uCAAuC,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;iDAC6C;IAC7C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7D,kFAAkF;IAClF,cAAc,CAAC,EAAE,WAAW,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;6EAEyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;8DAE0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;6EACyE;IACzE,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;4EACwE;IACxE,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;+BAE2B;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;iCAG6B;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B;mDAC+C;IAC/C,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF;8EAC0E;IAC1E,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,MAAM,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACvC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,4FAA4F;IAC5F,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,6DAA6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,uEAAuE;IACvE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,6FAA6F;IAC7F,SAAS,CAAC,EAAE;QACV,QAAQ,EAAE,iBAAiB,CAAC;QAC5B,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,iBAAiB,CAAC;IAC9B;;gFAE4E;IAC5E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC5D,6DAA6D;IAC7D,MAAM,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxC,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AACxD,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAC/D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAElE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;AACjG,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,CAAC;AACnD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AACvE,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,QAAQ,CAAC;AACvD,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,0EAA0E;IAC1E,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,KAAK,EAAE;QACL,cAAc,EAAE,OAAO,CAAC;QACxB,YAAY,EAAE,OAAO,CAAC;QACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,kFAAkF;QAClF,UAAU,EAAE,OAAO,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;uEACuE;AACvE,MAAM,WAAW,0BAA0B;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,aAAa,EAAE;QACb,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;QAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,QAAQ,EAAE;QACR,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF;;iCAE6B;IAC7B,WAAW,CAAC,EAAE,0BAA0B,CAAC;CAC1C;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mEAAmE;IACnE,SAAS,EAAE,sBAAsB,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EACA,2BAA2B,GAC3B,iCAAiC,GACjC,uBAAuB,GACvB,0BAA0B,GAC1B,6BAA6B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,OAAO,6BAA6B,CAAC;IACrD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;QACX,wEAAwE;QACxE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,iBAAiB,CAAC;QAC1B,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,UAAU,EAAE;QACV,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAC7B,OAAO,EAAE,iBAAiB,CAAC;KAC5B,CAAC;IACF,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,mEAAmE;IACnE,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,UAAU,EAAE,oBAAoB,CAAC;IACjC;;2EAEuE;IACvE,kBAAkB,CAAC,EAAE,iCAAiC,CAAC;IACvD,SAAS,EAAE,uBAAuB,EAAE,CAAC;IACrC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,SAAS,EAAE;QACT,OAAO,EAAE;YACP,IAAI,EAAE,eAAe,CAAC;YACtB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,mBAAmB,CAAC;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,uBAAuB,CAAC,eAAe,CAAC,CAAC;CACxD;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3D,oEAAoE;IACpE,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB,kBAAkB;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,iBAAiB;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB;gFAC4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;8EAE0E;IAC1E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;uDACmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;sDACkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;kBAEc;IACd,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED;;kCAEkC;AAClC,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC;8EAC8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;2EACuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;8DAC0D;IAC1D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;6EAGyE;IACzE,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAElE;gFACgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAAC;IACtC;;8EAE0E;IAC1E,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;8EAC8E;AAC9E,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAElE;+EAC+E;AAC/E,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACrC;gFAC4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3E,+DAA+D;IAC/D,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,2CAA2C;IAC3C,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC;IACnD,0EAA0E;IAC1E,SAAS,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,2BAA2B,GACnC,gBAAgB,GAChB,wBAAwB,GACxB,oBAAoB,GACpB,MAAM,CAAC;AAEX,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,kCAAkC,EAAE,CAAC;CACpE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,EAAE,OAAO,uCAAuC,CAAC;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;iDAC6C;IAC7C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7D,kFAAkF;IAClF,cAAc,CAAC,EAAE,WAAW,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;6EAEyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;8DAE0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;6EACyE;IACzE,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;4EACwE;IACxE,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;+BAE2B;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;iCAG6B;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B;mDAC+C;IAC/C,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF;8EAC0E;IAC1E,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5F;;kFAE8E;IAC9E,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,mFAAmF;IACnF,MAAM,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACvC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,4FAA4F;IAC5F,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,6DAA6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,uEAAuE;IACvE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,6FAA6F;IAC7F,SAAS,CAAC,EAAE;QACV,QAAQ,EAAE,iBAAiB,CAAC;QAC5B,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,iBAAiB,CAAC;IAC9B;;gFAE4E;IAC5E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC5D,6DAA6D;IAC7D,MAAM,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxC,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC"}

package/dist/core/workflow/workspaces/index.d.ts

@@ -10,6 +10,8 @@ export type { WorkspaceLifecycleProjection, WorkspaceLifecycleProjectionInput, }
 export { assertWorkspaceLifecycleTransition, deriveWorkspaceLifecycle, isWorkspaceLifecycleState, validateProviderEventChain, } from "./lifecycle.js";
 export type { LocalGitWorktreeProviderOptions } from "./local-git.js";
 export { createLocalGitWorktreeProvider, probe as probeLocalGitWorktreeProvider, } from "./local-git.js";
+export type { PrepareReclaimInput, ReclaimMode, ReclaimPreparation } from "./reclaim.js";
+export { prepareReclaim } from "./reclaim.js";
 export type { AuthorizedIntegrationPlan, AuthorizedProviderIntegrationInput, FilesystemIdentity, GitRepositoryBinding, IntegrationApplyAttempt, IntegrationApplyReceipt, IntegrationAuthorization, IntegrationPlan, IntegrationReviewRecord, IntegrationTarget, ProviderIntegrationInput, ProviderIntegrationPreview, ProviderIntegrationResult, ProviderUnknown, ProviderUnsupportedReason, RepositoryBinding, RepositoryObservation, ValidatedFilesystemPath, ValidatedFilesystemRoot, WorkspaceAllocationRequest, WorkspaceAttestation, WorkspaceBinding, WorkspaceBoundExecutionEvidence, WorkspaceCancellationReceipt, WorkspaceCancellationResult, WorkspaceCleanupAttempt, WorkspaceCleanupIntent, WorkspaceCleanupMode, WorkspaceCleanupReceipt, WorkspaceCleanupResult, WorkspaceCompatibilityExecutionEvidence, WorkspaceExecutionEvidence, WorkspaceIntegrationState, WorkspaceIsolation, WorkspaceLifecycleState, WorkspaceObservation, WorkspaceOwner, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProofLifecycleState, WorkspaceProofOutcome, WorkspaceProvider, WorkspaceProviderCapabilities, WorkspaceProviderRef, WorkspaceResourceState, WorkspaceUnsupportedExecutionEvidence, } from "./types.js";
 export { WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/workspaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EACL,8BAA8B,EAC9B,KAAK,IAAI,6BAA6B,GACvC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EACL,8BAA8B,EAC9B,KAAK,IAAI,6BAA6B,GACvC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EACV,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,YAAY,CAAC"}

package/dist/core/workflow/workspaces/index.js

@@ -4,4 +4,5 @@ export { inspectWorkflowWorkspace, listWorkflowWorkspaceInspections, readWorkflo
 export { applyIntegration, IntegrationPrepareParkedError, prepareIntegration, } from "./integration.js";
 export { assertWorkspaceLifecycleTransition, deriveWorkspaceLifecycle, isWorkspaceLifecycleState, validateProviderEventChain, } from "./lifecycle.js";
 export { createLocalGitWorktreeProvider, probe as probeLocalGitWorktreeProvider, } from "./local-git.js";
+export { prepareReclaim } from "./reclaim.js";
 export { WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./types.js";

package/dist/core/workflow/workspaces/inspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/inspect.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAA4B,KAAK,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAS7F,OAAO,KAAK,EAQV,uCAAuC,EACvC,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB,MAAM,MAAM,0BAA0B,GAAG,QAAQ,GAAG,eAAe,GAAG,UAAU,CAAC;AACjF,MAAM,MAAM,6BAA6B,GACrC,gBAAgB,GAChB,SAAS,GACT,IAAI,GACJ,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,CAAC,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,0BAA0B,CAAC;IACtC,mBAAmB,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IACnD,mBAAmB,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IACnD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,uCAAuC,CAAC,kBAAkB,CAAC,CAAC;QACpE,WAAW,EAAE,uCAAuC,CAAC,aAAa,CAAC,CAAC;QACpE,QAAQ,EAAE,uCAAuC,CAAC,UAAU,CAAC,CAAC;KAC/D,CAAC;IACF,UAAU,CAAC,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE,4BAA4B,CAAC;IACxC,YAAY,EAAE;QACZ,MAAM,EAAE,6BAA6B,CAAC;QACtC,eAAe,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpD,CAAC;IACF,WAAW,EAAE;QACX,KAAK,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;QACzD,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,iBAAiB,GAAG,SAAS,CAAC;QAChF,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,sBAAsB,EAAE,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,SAAS,EAAE;QACT,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUjD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,uBAAuB,CAqKzB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,2BAA2B,CAU7B;AAED,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAOjG;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAiCrF"}
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/inspect.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAA4B,KAAK,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAS7F,OAAO,KAAK,EAQV,uCAAuC,EACvC,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB,MAAM,MAAM,0BAA0B,GAAG,QAAQ,GAAG,eAAe,GAAG,UAAU,CAAC;AACjF,MAAM,MAAM,6BAA6B,GACrC,gBAAgB,GAChB,SAAS,GACT,IAAI,GACJ,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,CAAC,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,0BAA0B,CAAC;IACtC,mBAAmB,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IACnD,mBAAmB,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IACnD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,uCAAuC,CAAC,kBAAkB,CAAC,CAAC;QACpE,WAAW,EAAE,uCAAuC,CAAC,aAAa,CAAC,CAAC;QACpE,QAAQ,EAAE,uCAAuC,CAAC,UAAU,CAAC,CAAC;KAC/D,CAAC;IACF,UAAU,CAAC,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE,4BAA4B,CAAC;IACxC,YAAY,EAAE;QACZ,MAAM,EAAE,6BAA6B,CAAC;QACtC,eAAe,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpD,CAAC;IACF,WAAW,EAAE;QACX,KAAK,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;QACzD,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,iBAAiB,GAAG,SAAS,CAAC;QAChF,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,sBAAsB,EAAE,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,SAAS,EAAE;QACT,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUjD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,uBAAuB,CAqKzB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,2BAA2B,CAU7B;AAED,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAOjG;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CA8CrF"}

package/dist/core/workflow/workspaces/inspect.js

@@ -188,8 +188,22 @@ export function renderWorkflowWorkspaceStatus(status) {
     lines.push(`verification: ${status.verification.status}; workflow ${status.verification.workflow_status ?? "not terminal"}; ${status.verification.drift.length} drift; ${status.verification.unknowns.length} unknown`, `repository: ${status.repository.dirty_paths.length} dirty; ${status.repository.conflicts.length} conflict; ${status.repository.operations_in_progress.length} operation in progress`, `integration: ${status.integration.state}; ${status.integration.changed_paths.length} changed path`, `cleanup: ${status.cleanup.state}; ${status.cleanup.attempts} attempt`);
     if (status.cleanup.reason)
         lines.push(`cleanup reason: ${status.cleanup.reason}`);
+    // A count alone cannot be acted on: an operator deciding whether to salvage or
+    // discard has to know what is actually uncommitted, and leaving Harnery to run
+    // `git status` is the gap `reclaim` exists to close (ADR 0042). Bounded,
+    // because a dirty tree can be arbitrarily large.
+    if (status.repository.dirty_paths.length > 0) {
+        // Entries arrive in porcelain form (` M path`), so the status code is worth
+        // keeping and the leading pad is not.
+        const shown = status.repository.dirty_paths
+            .slice(0, MAX_LISTED_DIRTY_PATHS)
+            .map((path) => path.trim());
+        const remainder = status.repository.dirty_paths.length - shown.length;
+        lines.push(`dirty paths: ${shown.join(", ")}${remainder > 0 ? ` (+${remainder} more)` : ""}`);
+    }
     return `${lines.join("\n")}\n`;
 }
+const MAX_LISTED_DIRTY_PATHS = 12;
 function readWorkspaceJournal(runDir, runId) {
     const path = join(runDir, "journal.jsonl");
     if (!existsSync(path))

package/dist/core/workflow/workspaces/reclaim.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Resolve a workspace stuck at `preserved_dirty` (ADR 0042).
+ *
+ * When a run ends with uncommitted work, the provider preserves the worktree
+ * rather than destroying the only copy of that work. That decision is correct,
+ * and until this existed it was also permanent: cleanup re-attempted, found the
+ * tree still dirty, preserved again, and incremented a counter. The only exit
+ * was to leave Harnery and remove the directory by hand, after which Harnery's
+ * records described a workspace that no longer existed.
+ *
+ * The shape of the fix is deliberate. Neither mode deletes anything directly.
+ * Each one makes the working tree *clean* by an explicit, named act, and then
+ * hands off to the ordinary cleanup path, which releases a clean workspace as it
+ * always has. So reclaim adds no second removal path that could diverge from the
+ * audited one, and a force-delete of live work exists nowhere in the codebase.
+ */
+export type ReclaimMode = "salvage" | "discard";
+export type ReclaimPreparation = {
+    action: "salvaged";
+    branch: string;
+    commit: string;
+    detail: string;
+} | {
+    action: "discarded";
+    detail: string;
+} | {
+    action: "already_clean";
+    detail: string;
+} | {
+    action: "already_gone";
+    detail: string;
+};
+export interface PrepareReclaimInput {
+    worktreePath: string;
+    mode: ReclaimMode;
+    runId: string;
+}
+/**
+ * Bring the worktree to a clean state so ordinary cleanup can release it.
+ *
+ * Returns `already_gone` rather than throwing when the directory has been
+ * removed out from under us. A workspace whose worktree no longer exists has
+ * effectively been reclaimed; treating that as an error is what produced an
+ * attempt counter that only ever went up.
+ */
+export declare function prepareReclaim(input: PrepareReclaimInput): ReclaimPreparation;
+/** Named for the run rather than the workspace, because the run id is what an
+ * operator has in hand when they come looking for the work later. */
+export declare function salvageBranch(runId: string): string;
+//# sourceMappingURL=reclaim.d.ts.map

package/dist/core/workflow/workspaces/reclaim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reclaim.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,kBAAkB,CAkD7E;AAYD;qEACqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/dist/core/workflow/workspaces/reclaim.js

@@ -0,0 +1,88 @@
+/**
+ * Resolve a workspace stuck at `preserved_dirty` (ADR 0042).
+ *
+ * When a run ends with uncommitted work, the provider preserves the worktree
+ * rather than destroying the only copy of that work. That decision is correct,
+ * and until this existed it was also permanent: cleanup re-attempted, found the
+ * tree still dirty, preserved again, and incremented a counter. The only exit
+ * was to leave Harnery and remove the directory by hand, after which Harnery's
+ * records described a workspace that no longer existed.
+ *
+ * The shape of the fix is deliberate. Neither mode deletes anything directly.
+ * Each one makes the working tree *clean* by an explicit, named act, and then
+ * hands off to the ordinary cleanup path, which releases a clean workspace as it
+ * always has. So reclaim adds no second removal path that could diverge from the
+ * audited one, and a force-delete of live work exists nowhere in the codebase.
+ */
+import { existsSync } from "node:fs";
+import { git, gitMaybe } from "./git.js";
+/**
+ * Bring the worktree to a clean state so ordinary cleanup can release it.
+ *
+ * Returns `already_gone` rather than throwing when the directory has been
+ * removed out from under us. A workspace whose worktree no longer exists has
+ * effectively been reclaimed; treating that as an error is what produced an
+ * attempt counter that only ever went up.
+ */
+export function prepareReclaim(input) {
+    if (!existsSync(input.worktreePath)) {
+        return {
+            action: "already_gone",
+            detail: "the worktree directory is already gone; nothing to reclaim",
+        };
+    }
+    const status = gitMaybe(input.worktreePath, ["status", "--porcelain"]);
+    if (!status.ok) {
+        throw new Error(`cannot read worktree status for reclaim: ${status.err || "git failed"}`);
+    }
+    if (status.out.trim().length === 0) {
+        return { action: "already_clean", detail: "the worktree has no uncommitted changes" };
+    }
+    if (input.mode === "discard") {
+        // Ordered: reset drops tracked modifications, clean removes what reset
+        // cannot see. Running clean first would leave staged deletions behind.
+        git(input.worktreePath, ["reset", "--hard"]);
+        git(input.worktreePath, ["clean", "-fd"]);
+        return { action: "discarded", detail: "uncommitted changes were discarded on request" };
+    }
+    // Salvage onto a ref of its own, then put the checked-out branch back exactly
+    // where it was. Two reasons, both learned by doing it the obvious way first:
+    //
+    //  1. Cleanup DELETES the provider's workspace branch. Committing the salvage
+    //     there would have parked the work on a ref that the very next step
+    //     removes, leaving it unreachable and eventually collectable.
+    //  2. Cleanup pins the workspace ref's OID in a frozen intent and refuses when
+    //     it moves, which is a guard worth keeping. Advancing that branch turned
+    //     every reclaim into `blocked`.
+    //
+    // Committing and rewinding satisfies both: the tree ends clean, the workspace
+    // ref ends untouched, and the work lives on a ref cleanup has no reason to
+    // touch.
+    const before = git(input.worktreePath, ["rev-parse", "HEAD"]).trim();
+    git(input.worktreePath, ["add", "-A"]);
+    git(input.worktreePath, ["commit", "--no-verify", "-m", salvageMessage(input.runId)]);
+    const commit = git(input.worktreePath, ["rev-parse", "HEAD"]).trim();
+    const branch = salvageBranch(input.runId);
+    git(input.worktreePath, ["branch", "--force", branch, commit]);
+    git(input.worktreePath, ["reset", "--hard", before]);
+    return {
+        action: "salvaged",
+        branch,
+        commit,
+        detail: `salvaged to ${branch} at ${commit.slice(0, 12)}`,
+    };
+}
+/**
+ * `--no-verify` above is not a shortcut. A salvage commit is an archival act on
+ * an abandoned workspace, so a repository hook that rejects work in progress
+ * would convert "preserve the work" into "cannot preserve the work", which is
+ * the failure this whole path exists to prevent.
+ */
+function salvageMessage(runId) {
+    return `chore(workspace): salvage uncommitted work from run ${runId}`;
+}
+/** Named for the run rather than the workspace, because the run id is what an
+ * operator has in hand when they come looking for the work later. */
+export function salvageBranch(runId) {
+    return `harnery/salvage/${runId}`;
+}

package/dist/lib/tunnel/error-page.d.ts

@@ -0,0 +1,15 @@
+export interface TunnelErrorPageOptions {
+    kind: "access-denied" | "upstream-unavailable";
+    incidentId: string;
+    timestamp: string;
+    tunnelName: string;
+    method: string;
+    path: string;
+    clientIp: string;
+    cloudflareRay: string;
+    target?: string;
+    errorCode?: string;
+    errorMessage?: string;
+}
+export declare function renderTunnelErrorPage(options: TunnelErrorPageOptions): string;
+//# sourceMappingURL=error-page.d.ts.map

package/dist/lib/tunnel/error-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-page.d.ts","sourceRoot":"","sources":["../../../src/lib/tunnel/error-page.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,eAAe,GAAG,sBAAsB,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA6BD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAwE7E"}

package/dist/lib/tunnel/error-page.js

@@ -0,0 +1,98 @@
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#039;");
+}
+function diagnosticText(options) {
+    const lines = [
+        `Tunnel incident: ${options.incidentId}`,
+        `Time: ${options.timestamp}`,
+        `Problem: ${options.kind}`,
+        `Tunnel: ${options.tunnelName}`,
+        `Request: ${options.method} ${options.path}`,
+        `Client IP: ${options.clientIp || "(not provided by proxy)"}`,
+        `Cloudflare Ray: ${options.cloudflareRay || "(not provided)"}`,
+    ];
+    if (options.target)
+        lines.push(`Upstream: ${options.target}`);
+    if (options.errorCode)
+        lines.push(`Error code: ${options.errorCode}`);
+    if (options.errorMessage)
+        lines.push(`Error: ${options.errorMessage}`);
+    return lines.join("\n");
+}
+export function renderTunnelErrorPage(options) {
+    const denied = options.kind === "access-denied";
+    const title = denied ? "This device is not allowed yet" : "The preview is temporarily offline";
+    const summary = denied
+        ? "The tunnel is running, but this device's public IP is not on its access list."
+        : "The public tunnel and access check are working, but the local preview server is not responding.";
+    const nextStep = denied
+        ? "Copy the diagnostic below and send it to the person running the tunnel. It includes the public IP that needs to be allowed."
+        : "Copy the diagnostic below and send it to the person running the tunnel. The incident ID can be matched to the server log.";
+    const diagnostic = diagnosticText(options);
+    const safeDiagnosticForScript = JSON.stringify(diagnostic).replaceAll("<", "\\u003c");
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="robots" content="noindex,nofollow">
+  <title>${escapeHtml(title)}</title>
+  <style>
+    :root { color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; background: #f4f2ed; color: #17211c; display: grid; place-items: center; padding: 24px; }
+    main { width: min(100%, 720px); background: #fff; border: 1px solid #d8d4ca; border-radius: 18px; box-shadow: 0 18px 50px rgba(23, 33, 28, .10); overflow: hidden; }
+    .bar { height: 8px; background: ${denied ? "#b54708" : "#b42318"}; }
+    .content { padding: clamp(24px, 5vw, 48px); }
+    .eyebrow { margin: 0 0 10px; color: ${denied ? "#8a3708" : "#912018"}; font-size: 13px; font-weight: 750; letter-spacing: .09em; text-transform: uppercase; }
+    h1 { margin: 0; max-width: 18ch; font-size: clamp(30px, 7vw, 48px); line-height: 1.02; letter-spacing: -.04em; }
+    .summary { margin: 20px 0 10px; max-width: 58ch; font-size: 18px; line-height: 1.55; }
+    .next { margin: 0 0 24px; max-width: 62ch; color: #536058; line-height: 1.55; }
+    .diagnostic-wrap { position: relative; }
+    pre { margin: 0; padding: 18px; border: 1px solid #ccd2cd; border-radius: 12px; background: #111814; color: #edf5ef; font: 13px/1.55 ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; white-space: pre-wrap; overflow-wrap: anywhere; }
+    button { width: 100%; margin-top: 12px; border: 0; border-radius: 11px; padding: 14px 18px; background: #17643a; color: #fff; font: inherit; font-weight: 750; cursor: pointer; }
+    button:hover { background: #0e5230; }
+    button:focus-visible { outline: 3px solid #87c89f; outline-offset: 3px; }
+    .incident { margin: 18px 0 0; color: #68736c; font-size: 13px; text-align: center; }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="bar"></div>
+    <div class="content">
+      <p class="eyebrow">Tunnel diagnostic</p>
+      <h1>${escapeHtml(title)}</h1>
+      <p class="summary">${escapeHtml(summary)}</p>
+      <p class="next">${escapeHtml(nextStep)}</p>
+      <div class="diagnostic-wrap">
+        <pre id="diagnostic">${escapeHtml(diagnostic)}</pre>
+        <button id="copy" type="button">Copy diagnostic</button>
+      </div>
+      <p class="incident">Incident ${escapeHtml(options.incidentId)}</p>
+    </div>
+  </main>
+  <script>
+    const diagnostic = ${safeDiagnosticForScript};
+    const button = document.getElementById("copy");
+    button.addEventListener("click", async () => {
+      try {
+        await navigator.clipboard.writeText(diagnostic);
+        button.textContent = "Copied";
+      } catch {
+        const range = document.createRange();
+        range.selectNodeContents(document.getElementById("diagnostic"));
+        const selection = window.getSelection();
+        selection.removeAllRanges();
+        selection.addRange(range);
+        button.textContent = "Selected — copy now";
+      }
+    });
+  </script>
+</body>
+</html>`;
+}

package/dist/lib/tunnel/gate.d.ts

@@ -1,13 +1,2 @@
-declare function argvFlag(flag: string): string | undefined;
-declare const ALLOW: Set<string>;
-declare const TARGET: string;
-declare const VHOST: string;
-declare const PORT: number;
-declare const ACCESS: string;
-declare const UPSTREAM_HTTP: string;
-declare const UPSTREAM_WS: string;
-interface WsData {
-    path: string;
-}
-declare const server: Bun.Server<WsData>;
+export {};
 //# sourceMappingURL=gate.d.ts.map

package/dist/lib/tunnel/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/lib/tunnel/gate.ts"],"names":[],"mappings":"AAiBA,iBAAS,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGlD;AAED,QAAA,MAAM,KAAK,aAKV,CAAC;AACF,QAAA,MAAM,MAAM,QAAwD,CAAC;AACrE,QAAA,MAAM,KAAK,QAAkD,CAAC;AAC9D,QAAA,MAAM,IAAI,QAA0E,CAAC;AACrF,QAAA,MAAM,MAAM,QAA8D,CAAC;AAE3E,QAAA,MAAM,aAAa,QAAqB,CAAC;AACzC,QAAA,MAAM,WAAW,QAAmB,CAAC;AAErC,UAAU,MAAM;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,QAAA,MAAM,MAAM,oBA4EV,CAAC"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/lib/tunnel/gate.ts"],"names":[],"mappings":""}

package/dist/lib/tunnel/gate.js

@@ -1,4 +1,3 @@
-"use strict";
 // Reverse-proxy worker spawned by `tunnel up`. Listens on 127.0.0.1:<port>
 // and forwards HTTP + WebSocket requests to an upstream with a Host header
 // rewrite and Content-Encoding stripped (Bun's fetch auto-decompresses the
@@ -9,6 +8,7 @@
 // Runs detached, outside the CLI command framework; no command context is
 // available; stdout/stderr is captured into .cache/tunnel/gate.log by the
 // spawner.
+import { renderTunnelErrorPage } from "./error-page";
 // `--port`/`--name` are also passed on argv (not just env) so the gate's port
 // and instance name show up in its process command line. That's what lets
 // `tunnel down` scope its stray-process sweep to a single instance via
@@ -27,8 +27,27 @@ const TARGET = process.env.HARNERY_TUNNEL_TARGET ?? "127.0.0.1:8001";
 const VHOST = process.env.HARNERY_TUNNEL_VHOST ?? "localhost";
 const PORT = Number(process.env.HARNERY_TUNNEL_PORT ?? argvFlag("--port") ?? "9001");
 const ACCESS = process.env.HARNERY_TUNNEL_ACCESS ?? "cloudflare-allowlist";
+const NAME = argvFlag("--name") ?? "default";
 const UPSTREAM_HTTP = `http://${TARGET}`;
 const UPSTREAM_WS = `ws://${TARGET}`;
+function requestDetails(req, url) {
+    return {
+        incidentId: crypto.randomUUID().slice(0, 8),
+        timestamp: new Date().toISOString(),
+        tunnelName: NAME,
+        method: req.method,
+        path: url.pathname + url.search,
+        clientIp: req.headers.get("cf-connecting-ip") ?? "",
+        cloudflareRay: req.headers.get("cf-ray") ?? "",
+    };
+}
+function errorDetails(error) {
+    if (!(error instanceof Error)) {
+        return { code: "UnknownError", message: String(error) };
+    }
+    const code = "code" in error && typeof error.code === "string" ? error.code : error.name || "Error";
+    return { code, message: error.message || "The upstream request failed." };
+}
 const server = Bun.serve({
     port: PORT,
     hostname: "127.0.0.1",
@@ -42,12 +61,20 @@ const server = Bun.serve({
         if (ACCESS === "cloudflare-allowlist") {
             const ip = req.headers.get("cf-connecting-ip") ?? "";
             if (!ALLOW.has(ip)) {
+                const details = requestDetails(req, url);
                 // Log denials so operators can whitelist a phone/laptop that just
                 // hit 403 without asking the human to dig up their public IP.
                 console.log(
                 // lint-ok-emission: detached worker, see file note above
-                `deny: ${ip || "(missing-cf-connecting-ip)"} ${req.method} ${url.pathname}`);
-                return new Response("403 Forbidden\n", { status: 403 });
+                `deny: incident=${details.incidentId} ip=${ip || "(missing-cf-connecting-ip)"} ray=${details.cloudflareRay || "(missing)"} ${req.method} ${details.path}`);
+                return new Response(renderTunnelErrorPage({ ...details, kind: "access-denied" }), {
+                    status: 403,
+                    headers: {
+                        "cache-control": "no-store",
+                        "content-type": "text/html; charset=utf-8",
+                        "x-harnery-tunnel-incident": details.incidentId,
+                    },
+                });
             }
         }
         if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
@@ -68,7 +95,35 @@ const server = Bun.serve({
         if (!["GET", "HEAD"].includes(req.method)) {
             init.body = await req.arrayBuffer();
         }
-        const resp = await fetch(UPSTREAM_HTTP + url.pathname + url.search, init);
+        let resp;
+        try {
+            resp = await fetch(UPSTREAM_HTTP + url.pathname + url.search, init);
+        }
+        catch (error) {
+            const details = requestDetails(req, url);
+            const failure = errorDetails(error);
+            console.log(
+            // lint-ok-emission: detached worker, see file note above
+            `upstream-error: incident=${details.incidentId} ip=${details.clientIp || "(missing-cf-connecting-ip)"} ray=${details.cloudflareRay || "(missing)"} code=${failure.code} ${req.method} ${details.path}`);
+            return new Response(renderTunnelErrorPage({
+                ...details,
+                kind: "upstream-unavailable",
+                target: UPSTREAM_HTTP,
+                errorCode: failure.code,
+                errorMessage: failure.message,
+            }), {
+                // Cloudflare replaces 502 response bodies with its own generic error
+                // page. Return the diagnostic as a successful document and preserve
+                // the semantic status in a header so the human can actually see it.
+                status: 200,
+                headers: {
+                    "cache-control": "no-store",
+                    "content-type": "text/html; charset=utf-8",
+                    "x-harnery-tunnel-incident": details.incidentId,
+                    "x-harnery-tunnel-status": "502",
+                },
+            });
+        }
         const respHeaders = new Headers(resp.headers);
         respHeaders.delete("content-encoding");
         respHeaders.delete("content-length");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harnery",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Multi-agent coordination for AI coding agents - Claude Code, Cursor, and Codex.",
   "license": "MIT",
   "author": "Ryan Kelly",
@@ -186,7 +186,9 @@
     "smoke": "node scripts/smoke-test.mjs",
     "docs:dev": "bun run --cwd docs dev",
     "docs:build": "bun run --cwd docs build",
-    "brand:showcase": "node scripts/build-brand-showcase.mjs"
+    "brand:showcase": "node scripts/build-brand-showcase.mjs",
+    "verify:contracts": "bun run scripts/sync-verified-contracts.ts",
+    "verify:contracts:check": "bun run scripts/sync-verified-contracts.ts --check"
   },
   "dependencies": {
     "@mozilla/readability": "^0.6.0",