openplanr 1.25.2 → 2.0.0

package/dist/services/operate/replay-safe-retry-service.js

@@ -0,0 +1,66 @@
+import { createHash } from 'node:crypto';
+const DEFAULT_MAXIMUM_ATTEMPTS = 5;
+const mutationLanes = new Map();
+function closedRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+/**
+ * Only optimistic-generation conflicts with both custody generations are safe to
+ * replay. The predicate is deliberately total so an unrelated error is preserved
+ * byte-for-byte instead of being replaced by adapter validation.
+ */
+export function isReplaySafeGenerationConflict(error) {
+    const candidate = closedRecord(error);
+    const context = closedRecord(candidate?.context);
+    return (candidate?.code === 'OPERATE_STORE_CONFLICT' &&
+        context !== null &&
+        Object.hasOwn(context, 'expectedGeneration') &&
+        Object.hasOwn(context, 'currentGeneration'));
+}
+export function replaySafeRetryDelay(requestKey, retryOrdinal) {
+    const jitter = createHash('sha256').update(`${requestKey}:${retryOrdinal}`).digest()[0] % 41;
+    return Math.min(200, 20 * 2 ** (retryOrdinal - 1) + jitter);
+}
+/** Initial attempt plus at most four byte-identical optimistic retries. */
+export async function retryReplaySafeGenerationConflict(requestKey, attempt, options = {}) {
+    const maximumAttempts = options.maximumAttempts ?? DEFAULT_MAXIMUM_ATTEMPTS;
+    if (!Number.isSafeInteger(maximumAttempts) || maximumAttempts < 1 || maximumAttempts > 5) {
+        throw new TypeError('maximumAttempts must be an integer between 1 and 5.');
+    }
+    const wait = options.wait ??
+        (async (milliseconds) => {
+            await new Promise((resolve) => setTimeout(resolve, milliseconds));
+        });
+    for (let attemptIndex = 0; attemptIndex < maximumAttempts; attemptIndex += 1) {
+        try {
+            return await attempt();
+        }
+        catch (error) {
+            if (attemptIndex === maximumAttempts - 1 || !isReplaySafeGenerationConflict(error)) {
+                throw error;
+            }
+            await wait(replaySafeRetryDelay(requestKey, attemptIndex + 1));
+        }
+    }
+    throw new TypeError('Replay-safe retry exhausted without returning or throwing.');
+}
+/**
+ * Prevents same-process clients for one Store from manufacturing a live-lock.
+ * Cross-process custody remains protected by the durable Store lock; this lane
+ * only orders the full load/transition/commit attempt in the current adapter.
+ */
+export async function withOperateMutationLane(storeRoot, mutation) {
+    const previous = mutationLanes.get(storeRoot) ?? Promise.resolve();
+    const current = previous.catch(() => undefined).then(mutation);
+    mutationLanes.set(storeRoot, current);
+    try {
+        return await current;
+    }
+    finally {
+        if (mutationLanes.get(storeRoot) === current)
+            mutationLanes.delete(storeRoot);
+    }
+}
+//# sourceMappingURL=replay-safe-retry-service.js.map

package/dist/services/operate/replay-safe-retry-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-safe-retry-service.js","sourceRoot":"","sources":["../../../src/services/operate/replay-safe-retry-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAC;AAO1D,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,CACL,SAAS,EAAE,IAAI,KAAK,wBAAwB;QAC5C,OAAO,KAAK,IAAI;QAChB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,YAAoB;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,UAAkB,EAClB,OAAyB,EACzB,UAAkC,EAAE;IAEpC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,CAAC,KAAK,EAAE,YAAoB,EAAE,EAAE;YAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IAEL,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,eAAe,EAAE,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,KAAK,eAAe,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,QAA0B;IAE1B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO;YAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/services/operate/repository-read-service.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Resolve one bounded repository evidence file. Adapters may grant repository.read
+ * only when all reads are forced through this boundary; native shell adapters do not qualify.
+ */
+export declare function resolveScreenedRepositoryFile(projectDir: string, relativePath: string): Promise<string>;
+export declare function readScreenedRepositoryText(projectDir: string, relativePath: string, options?: {
+    maxBytes?: number;
+}): Promise<string>;
+export declare function adapterRepositoryReadCapabilities(input: {
+    adapterId: string;
+    enforcesScreenedBoundary: boolean;
+}): readonly string[];
+//# sourceMappingURL=repository-read-service.d.ts.map

package/dist/services/operate/repository-read-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-read-service.d.ts","sourceRoot":"","sources":["../../../src/services/operate/repository-read-service.ts"],"names":[],"mappings":"AAgFA;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,OAAO,CAAC;CACnC,GAAG,SAAS,MAAM,EAAE,CAEpB"}

package/dist/services/operate/repository-read-service.js

@@ -0,0 +1,153 @@
+import { constants } from 'node:fs';
+import { lstat, open, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+const BLOCKED_SEGMENTS = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    'generated',
+    'vendor',
+    '.next',
+    '.cache',
+]);
+const SECRET_FILE_PATTERNS = Object.freeze([
+    /^\.env(?:\..+)?$/u,
+    /^\.npmrc$/u,
+    /^\.pypirc$/u,
+    /^credentials(?:\..+)?$/iu,
+    /^secrets?(?:\..+)?$/iu,
+    /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/u,
+    /\.(?:key|pem|p12|pfx)$/iu,
+]);
+const PRIVATE_OPERATE_PREFIXES = Object.freeze([
+    ['.planr', 'operate', 'state'],
+    ['.planr', 'operate', 'packets'],
+    ['.planr', 'operate', 'archive'],
+    ['.planr', 'operate-v2'],
+]);
+function refuse(message, context = {}) {
+    throw Object.assign(new Error(message), {
+        code: 'E_OPERATE_REPOSITORY_PATH_DENIED',
+        context,
+    });
+}
+function normalizedSegments(relativePath) {
+    if (!relativePath || path.isAbsolute(relativePath) || relativePath.includes('\0')) {
+        refuse('Repository evidence paths must be non-empty project-relative paths.');
+    }
+    const portable = relativePath.replaceAll('\\', '/');
+    const segments = portable.split('/').filter((segment) => segment !== '' && segment !== '.');
+    if (segments.length === 0 || segments.includes('..')) {
+        refuse('Repository evidence paths cannot traverse outside the project.', { relativePath });
+    }
+    return segments;
+}
+function startsWithSegments(value, prefix) {
+    return prefix.every((segment, index) => value[index] === segment);
+}
+function assertPublicSegments(segments) {
+    const securitySegments = segments.map((segment) => segment.normalize('NFKC').toLowerCase());
+    const blocked = securitySegments.find((segment) => BLOCKED_SEGMENTS.has(segment));
+    if (blocked)
+        refuse(`Repository evidence path enters blocked tree ${blocked}.`);
+    if (PRIVATE_OPERATE_PREFIXES.some((prefix) => startsWithSegments(securitySegments, prefix))) {
+        refuse('Repository evidence path enters private Operate storage.');
+    }
+    const fileName = securitySegments.at(-1) ?? '';
+    if (SECRET_FILE_PATTERNS.some((pattern) => pattern.test(fileName))) {
+        refuse('Repository evidence path names a credential or secret file.');
+    }
+}
+async function assertNoSymlink(root, segments) {
+    let cursor = root;
+    for (const segment of segments) {
+        cursor = path.join(cursor, segment);
+        const metadata = await lstat(cursor);
+        if (metadata.isSymbolicLink()) {
+            refuse('Repository evidence paths cannot cross symbolic links.');
+        }
+    }
+}
+/**
+ * Resolve one bounded repository evidence file. Adapters may grant repository.read
+ * only when all reads are forced through this boundary; native shell adapters do not qualify.
+ */
+export async function resolveScreenedRepositoryFile(projectDir, relativePath) {
+    const segments = normalizedSegments(relativePath);
+    assertPublicSegments(segments);
+    const root = await realpath(path.resolve(projectDir));
+    await assertNoSymlink(root, segments);
+    const candidate = await realpath(path.join(root, ...segments));
+    if (candidate !== root && !candidate.startsWith(`${root}${path.sep}`)) {
+        refuse('Repository evidence path resolves outside the project.');
+    }
+    const metadata = await stat(candidate);
+    if (!metadata.isFile())
+        refuse('Repository evidence path must identify one regular file.');
+    return candidate;
+}
+export async function readScreenedRepositoryText(projectDir, relativePath, options = {}) {
+    const maxBytes = options.maxBytes ?? 256 * 1024;
+    if (!Number.isInteger(maxBytes) || maxBytes < 1) {
+        refuse('Repository evidence file exceeds the bounded read limit.', {
+            maxBytes,
+        });
+    }
+    const segments = normalizedSegments(relativePath);
+    assertPublicSegments(segments);
+    const root = await realpath(path.resolve(projectDir));
+    await assertNoSymlink(root, segments);
+    const target = path.join(root, ...segments);
+    let handle;
+    try {
+        handle = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const before = await handle.stat();
+        if (!before.isFile() || before.size > maxBytes) {
+            refuse('Repository evidence file exceeds the bounded read limit.', {
+                byteLength: before.size,
+                maxBytes,
+            });
+        }
+        const resolved = await realpath(target);
+        if (resolved !== root && !resolved.startsWith(`${root}${path.sep}`)) {
+            refuse('Repository evidence path resolves outside the project.');
+        }
+        const resolvedMetadata = await stat(resolved);
+        if (resolvedMetadata.dev !== before.dev || resolvedMetadata.ino !== before.ino) {
+            refuse('Repository evidence path changed while it was being opened.');
+        }
+        const bytes = await handle.readFile();
+        const after = await handle.stat();
+        if (after.dev !== before.dev ||
+            after.ino !== before.ino ||
+            after.size !== before.size ||
+            bytes.byteLength > maxBytes) {
+            refuse('Repository evidence file changed during the bounded read.', {
+                byteLength: bytes.byteLength,
+                maxBytes,
+            });
+        }
+        try {
+            return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        }
+        catch {
+            refuse('Repository evidence text must be verified UTF-8.');
+        }
+    }
+    catch (cause) {
+        if (cause.code === 'ELOOP') {
+            refuse('Repository evidence paths cannot cross symbolic links.');
+        }
+        throw cause;
+    }
+    finally {
+        await handle?.close();
+    }
+    refuse('Repository evidence read did not complete.');
+}
+export function adapterRepositoryReadCapabilities(input) {
+    return input.enforcesScreenedBoundary ? Object.freeze(['repository.read']) : Object.freeze([]);
+}
+//# sourceMappingURL=repository-read-service.js.map

package/dist/services/operate/repository-read-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-read-service.js","sourceRoot":"","sources":["../../../src/services/operate/repository-read-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,UAAU;IACV,WAAW;IACX,QAAQ;IACR,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,uBAAuB;IACvB,2CAA2C;IAC3C,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IAC9B,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;IAChC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;IAChC,CAAC,QAAQ,EAAE,YAAY,CAAC;CACzB,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,OAAe,EAAE,UAAmC,EAAE;IACpE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE;QACtC,IAAI,EAAE,kCAAkC;QACxC,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,qEAAqE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,gEAAgE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,MAAyB;IACpE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAkB;IAC9C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,IAAI,OAAO;QAAE,MAAM,CAAC,gDAAgD,OAAO,GAAG,CAAC,CAAC;IAChF,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,0DAA0D,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,6DAA6D,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,QAAkB;IAC7D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC9B,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,UAAkB,EAClB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAClD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,wDAAwD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,0DAA0D,CAAC,CAAC;IAC3F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,YAAoB,EACpB,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,0DAA0D,EAAE;YACjE,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAClD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC5C,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,0DAA0D,EAAE;gBACjE,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,gBAAgB,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAC/E,MAAM,CAAC,6DAA6D,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IACE,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAC1B,KAAK,CAAC,UAAU,GAAG,QAAQ,EAC3B,CAAC;YACD,MAAM,CAAC,2DAA2D,EAAE;gBAClE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,4CAA4C,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,OAAO,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC"}

package/dist/services/operate/review-lifecycle-service.d.ts

@@ -0,0 +1,50 @@
+import { type OperateReviewBoundSubmissionV1 } from 'planr-pipeline/operate/runtime-v2';
+import type { JsonRecord } from './composition.js';
+import type { OperateStoredRuntime } from './store.js';
+type ReviewActor = Readonly<{
+    actorId: string;
+    kind: 'human';
+    runtime: string;
+}>;
+export type OperateReviewReadRequest = Readonly<{
+    reviewId: string;
+    cycleId: string;
+    actor: ReviewActor;
+    scope: {
+        scopeId: string;
+        domainId: string;
+        domainVersion: string;
+    };
+}>;
+export type OperateReviewSubmitRequest = OperateReviewReadRequest & Readonly<{
+    disposition: 'approved' | 'changes_requested' | 'rejected' | 'cancelled';
+    workDispositions: JsonRecord[];
+}>;
+type ReplaySafeIssue = Readonly<{
+    id(prefix: string): string;
+    stableId(prefix: string, value: string): string;
+    timestamp(): string;
+}>;
+type Commit = (runtime: OperateStoredRuntime, nextState: JsonRecord, events: JsonRecord[]) => Promise<OperateStoredRuntime>;
+/** Read one exact owner-bound Review without projecting or re-synthesizing choices. */
+export declare function readOperateReview(runtime: OperateStoredRuntime, request: OperateReviewReadRequest): unknown;
+/** Read one immutable terminal receipt through the same exact owner custody. */
+export declare function readCommittedOperateReviewReceipt(runtime: OperateStoredRuntime, request: OperateReviewReadRequest): unknown;
+/** Own the replay-safe Review mutation lane and exact protocol submission transaction. */
+export declare function submitOperateReview(input: {
+    root: string;
+    request: OperateReviewSubmitRequest;
+    issueFactory: () => () => ReplaySafeIssue;
+    requiredRuntime: () => Promise<OperateStoredRuntime>;
+    commit: Commit;
+}): Promise<unknown>;
+/** Own the replay-safe lane for one head- and choice-bound Review submission. */
+export declare function submitBoundOperateReview(input: {
+    root: string;
+    submission: OperateReviewBoundSubmissionV1;
+    issueFactory: () => () => ReplaySafeIssue;
+    requiredRuntime: () => Promise<OperateStoredRuntime>;
+    commit: Commit;
+}): Promise<unknown>;
+export {};
+//# sourceMappingURL=review-lifecycle-service.d.ts.map

package/dist/services/operate/review-lifecycle-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-lifecycle-service.d.ts","sourceRoot":"","sources":["../../../src/services/operate/review-lifecycle-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,8BAA8B,EAKpC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD,KAAK,WAAW,GAAG,QAAQ,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACrE,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,GAC/D,QAAQ,CAAC;IACP,WAAW,EAAE,UAAU,GAAG,mBAAmB,GAAG,UAAU,GAAG,WAAW,CAAC;IACzE,gBAAgB,EAAE,UAAU,EAAE,CAAC;CAChC,CAAC,CAAC;AAEL,KAAK,eAAe,GAAG,QAAQ,CAAC;IAC9B,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAChD,SAAS,IAAI,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH,KAAK,MAAM,GAAG,CACZ,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,UAAU,EACrB,MAAM,EAAE,UAAU,EAAE,KACjB,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEnC,uFAAuF;AACvF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAMT;AAED,gFAAgF;AAChF,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAKT;AAED,0FAA0F;AAC1F,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,0BAA0B,CAAC;IACpC,YAAY,EAAE,MAAM,MAAM,eAAe,CAAC;IAC1C,eAAe,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnB;AAED,iFAAiF;AACjF,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,8BAA8B,CAAC;IAC3C,YAAY,EAAE,MAAM,MAAM,eAAe,CAAC;IAC1C,eAAe,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnB"}

package/dist/services/operate/review-lifecycle-service.js

@@ -0,0 +1,63 @@
+import { readCommittedOperatingReviewReceiptV2, readOperatingReviewV2, submitBoundOperatingReviewV2, submitOperatingReviewV2, } from 'planr-pipeline/operate/runtime-v2';
+import { sha256Jcs } from 'planr-pipeline/protocol';
+import { retryReplaySafeGenerationConflict, withOperateMutationLane, } from './replay-safe-retry-service.js';
+const REVIEW_SUBMIT_CAPABILITY = Object.freeze({
+    id: 'operate-review-submit',
+    version: '2.0.0',
+});
+/** Read one exact owner-bound Review without projecting or re-synthesizing choices. */
+export function readOperateReview(runtime, request) {
+    return readOperatingReviewV2(request, {
+        initialState: runtime.state,
+        capabilities: ['operate.review.get'],
+        readAt: new Date().toISOString(),
+    });
+}
+/** Read one immutable terminal receipt through the same exact owner custody. */
+export function readCommittedOperateReviewReceipt(runtime, request) {
+    return readCommittedOperatingReviewReceiptV2(request, {
+        initialState: runtime.state,
+        capabilities: ['operate.review.get'],
+    });
+}
+/** Own the replay-safe Review mutation lane and exact protocol submission transaction. */
+export async function submitOperateReview(input) {
+    const nextIssue = input.issueFactory();
+    return await retryReplaySafeGenerationConflict(`review-submit:${sha256Jcs(input.request)}`, () => withOperateMutationLane(input.root, async () => {
+        const runtime = await input.requiredRuntime();
+        const issue = nextIssue();
+        const submitted = submitOperatingReviewV2(input.request, {
+            eventId: issue.id('evt'),
+            timestamp: issue.timestamp(),
+            correlationId: issue.id('corr'),
+        }, {
+            initialState: runtime.state,
+            capabilities: [REVIEW_SUBMIT_CAPABILITY],
+        });
+        if (!submitted.replayed) {
+            await input.commit(runtime, submitted.state, [...submitted.events]);
+        }
+        return submitted.response;
+    }));
+}
+/** Own the replay-safe lane for one head- and choice-bound Review submission. */
+export async function submitBoundOperateReview(input) {
+    const nextIssue = input.issueFactory();
+    return await retryReplaySafeGenerationConflict(`review-submit-bound:${input.submission.boundSubmissionHash}`, () => withOperateMutationLane(input.root, async () => {
+        const runtime = await input.requiredRuntime();
+        const issue = nextIssue();
+        const submitted = submitBoundOperatingReviewV2(input.submission, {
+            eventId: issue.id('evt'),
+            timestamp: issue.timestamp(),
+            correlationId: issue.id('corr'),
+        }, {
+            initialState: runtime.state,
+            capabilities: [REVIEW_SUBMIT_CAPABILITY],
+        });
+        if (!submitted.replayed) {
+            await input.commit(runtime, submitted.state, [...submitted.events]);
+        }
+        return submitted.response;
+    }));
+}
+//# sourceMappingURL=review-lifecycle-service.js.map

package/dist/services/operate/review-lifecycle-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-lifecycle-service.js","sourceRoot":"","sources":["../../../src/services/operate/review-lifecycle-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qCAAqC,EACrC,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAGxC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,uBAAuB;IAC3B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAiCH,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAC/B,OAA6B,EAC7B,OAAiC;IAEjC,OAAO,qBAAqB,CAAC,OAAgB,EAAE;QAC7C,YAAY,EAAE,OAAO,CAAC,KAAc;QACpC,YAAY,EAAE,CAAC,oBAAoB,CAAC;QACpC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACjC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iCAAiC,CAC/C,OAA6B,EAC7B,OAAiC;IAEjC,OAAO,qCAAqC,CAAC,OAAgB,EAAE;QAC7D,YAAY,EAAE,OAAO,CAAC,KAAc;QACpC,YAAY,EAAE,CAAC,oBAAoB,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACvC,OAAO,MAAM,iCAAiC,CAC5C,iBAAiB,SAAS,CAAC,KAAK,CAAC,OAAgB,CAAC,EAAE,EACpD,GAAG,EAAE,CACH,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,uBAAuB,CACvC,KAAK,CAAC,OAAgB,EACtB;YACE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAC5B,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;SAChC,EACD;YACE,YAAY,EAAE,OAAO,CAAC,KAAc;YACpC,YAAY,EAAE,CAAC,wBAAwB,CAAU;SAClD,CACF,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,MAAM,CAChB,OAAO,EACP,SAAS,CAAC,KAA8B,EACxC,CAAC,GAAG,SAAS,CAAC,MAAM,CAA4B,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC5B,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACvC,OAAO,MAAM,iCAAiC,CAC5C,uBAAuB,KAAK,CAAC,UAAU,CAAC,mBAAmB,EAAE,EAC7D,GAAG,EAAE,CACH,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,4BAA4B,CAC5C,KAAK,CAAC,UAAU,EAChB;YACE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAC5B,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;SAChC,EACD;YACE,YAAY,EAAE,OAAO,CAAC,KAAc;YACpC,YAAY,EAAE,CAAC,wBAAwB,CAAC;SACzC,CACF,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,MAAM,CAChB,OAAO,EACP,SAAS,CAAC,KAA8B,EACxC,CAAC,GAAG,SAAS,CAAC,MAAM,CAA4B,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC5B,CAAC,CAAC,CACL,CAAC;AACJ,CAAC"}

package/dist/services/operate/review-read-gateway.d.ts

@@ -0,0 +1,21 @@
+import { type OperateReviewDisplayWorkspaceV1 } from 'planr-pipeline/dashboard/operate-review-display-workspace-contract';
+import type { OperateClient } from './client.js';
+export type OperatingReviewDisplayReadRequestV1 = Readonly<{
+    cycleId: string;
+    reviewId: string;
+    actorId: string;
+    scopeId: string;
+    domainId: string;
+    domainVersion: string;
+}>;
+type ReviewReadClient = Pick<OperateClient, 'dispatch' | 'readCommittedReviewReceipt' | 'readExperienceAtEventHead'>;
+/**
+ * OpenPlanr-owned access gateway for one exact Review display. The dashboard
+ * receives only the pipeline-validated display workspace; Store/runtime state
+ * and legacy projections never cross this boundary.
+ */
+export declare function createOperatingReviewReadGatewayV1(input: {
+    client: ReviewReadClient;
+}): (request: OperatingReviewDisplayReadRequestV1) => Promise<OperateReviewDisplayWorkspaceV1>;
+export {};
+//# sourceMappingURL=review-read-gateway.d.ts.map

package/dist/services/operate/review-read-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-read-gateway.d.ts","sourceRoot":"","sources":["../../../src/services/operate/review-read-gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,oEAAoE,CAAC;AAO5E,OAAO,KAAK,EAAwC,aAAa,EAAE,MAAM,aAAa,CAAC;AAGvF,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CAAC;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AAIH,KAAK,gBAAgB,GAAG,IAAI,CAC1B,aAAa,EACb,UAAU,GAAG,4BAA4B,GAAG,2BAA2B,CACxE,CAAC;AA0DF;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,CAAC,OAAO,EAAE,mCAAmC,KAAK,OAAO,CAAC,+BAA+B,CAAC,CA8E7F"}

package/dist/services/operate/review-read-gateway.js

@@ -0,0 +1,119 @@
+import { selectOperateReviewDisplayWorkspace } from 'planr-pipeline/dashboard/operate-experience-reader';
+import { assertOperateReviewDisplayWorkspaceV1, } from 'planr-pipeline/dashboard/operate-review-display-workspace-contract';
+import { sha256Jcs } from 'planr-pipeline/protocol';
+function gatewayError(code, message, status = 409) {
+    return Object.assign(new Error(message), { code, status });
+}
+function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw gatewayError('OPERATE_PROJECTION_INVALID', `${label} is unavailable from the verified operating projection.`);
+    }
+    return value;
+}
+function sourceFromEnvelope(envelope) {
+    if (!envelope.ok) {
+        throw gatewayError(envelope.error.code, envelope.error.message);
+    }
+    const source = record(envelope.data, 'The Review source');
+    if (source.kind !== 'operating-review-read' && source.kind !== 'operating-review-receipt') {
+        throw gatewayError('OPERATE_PROJECTION_INVALID', 'The Review source does not satisfy the closed pending-or-terminal contract.');
+    }
+    return source;
+}
+function viewFromEnvelope(envelope) {
+    if (!envelope.ok) {
+        throw gatewayError(envelope.error.code, envelope.error.message);
+    }
+    return record(envelope.data, 'The operating experience');
+}
+function expectedBinding(workspace) {
+    const payload = workspace.payload;
+    return {
+        actorId: payload.actorId,
+        scopeId: payload.scopeId,
+        domainId: payload.domainId,
+        domainVersion: payload.domainVersion,
+        cycleId: payload.cycleId,
+        reviewId: payload.reviewId,
+        sourceArtifactKind: payload.sourceArtifactKind,
+        sourceArtifactHash: payload.sourceArtifactHash,
+        sourceEventHead: payload.sourceEventHead,
+        sourceReadEventHead: payload.sourceReadEventHead,
+        sourceViewHash: payload.sourceViewHash,
+    };
+}
+/**
+ * OpenPlanr-owned access gateway for one exact Review display. The dashboard
+ * receives only the pipeline-validated display workspace; Store/runtime state
+ * and legacy projections never cross this boundary.
+ */
+export function createOperatingReviewReadGatewayV1(input) {
+    return async (request) => {
+        const actor = {
+            actorId: request.actorId,
+            kind: 'human',
+            runtime: 'openplanr',
+        };
+        const scope = {
+            scopeId: request.scopeId,
+            domainId: request.domainId,
+            domainVersion: request.domainVersion,
+        };
+        const reviewRequest = {
+            reviewId: request.reviewId,
+            cycleId: request.cycleId,
+            actor,
+            scope,
+        };
+        const pending = await input.client.dispatch({
+            operation: 'operate.review.get',
+            request: reviewRequest,
+        });
+        const source = pending.ok
+            ? sourceFromEnvelope(pending)
+            : pending.error.code === 'REVIEW_NOT_PENDING'
+                ? sourceFromEnvelope(await input.client.readCommittedReviewReceipt(reviewRequest))
+                : (() => {
+                    throw gatewayError(pending.error.code, pending.error.message);
+                })();
+        const experienceRequest = {
+            cycleId: request.cycleId,
+            actor,
+            actionBinding: { cycleId: request.cycleId, actorId: request.actorId },
+        };
+        const view = viewFromEnvelope(source.kind === 'operating-review-receipt'
+            ? await input.client.readExperienceAtEventHead(experienceRequest, source.eventHead)
+            : await input.client.dispatch({
+                operation: 'operate.experience.get',
+                request: experienceRequest,
+            }));
+        const sourceReadEventHead = source.kind === 'operating-review-read' ? source.eventHead : source.readEventHead;
+        const generatedAt = source.kind === 'operating-review-read' ? source.readAt : source.committedAt;
+        const selected = selectOperateReviewDisplayWorkspace(view, source, {
+            subjectId: request.reviewId,
+            binding: {
+                actorId: request.actorId,
+                scopeId: request.scopeId,
+                domainId: request.domainId,
+                domainVersion: request.domainVersion,
+                cycleId: request.cycleId,
+                reviewId: request.reviewId,
+                generatedAt,
+                sourceArtifactKind: source.kind,
+                sourceArtifactHash: sha256Jcs(source),
+                sourceEventHead: structuredClone(source.eventHead),
+                sourceReadEventHead: structuredClone(sourceReadEventHead),
+                sourceViewHash: view.viewHash,
+            },
+        });
+        const candidate = record(selected, 'The Review display workspace');
+        if (candidate.ok === false) {
+            const failure = record(candidate.error, 'The Review display refusal');
+            throw gatewayError(String(failure.reasonCode ?? 'OPERATE_PROJECTION_INVALID'), 'The Review display is unavailable for this exact actor and scope.', Number(failure.status ?? 409));
+        }
+        const workspace = candidate;
+        assertOperateReviewDisplayWorkspaceV1(workspace, expectedBinding(workspace));
+        return structuredClone(workspace);
+    };
+}
+//# sourceMappingURL=review-read-gateway.js.map

package/dist/services/operate/review-read-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-read-gateway.js","sourceRoot":"","sources":["../../../src/services/operate/review-read-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,oDAAoD,CAAC;AACzG,OAAO,EACL,qCAAqC,GAEtC,MAAM,oEAAoE,CAAC;AAM5E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAoBpD,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,YAAY,CAChB,4BAA4B,EAC5B,GAAG,KAAK,yDAAyD,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA8E;IAE9E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;QAC1F,MAAM,YAAY,CAChB,4BAA4B,EAC5B,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAwD;IAExD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAuC,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CAAC,SAA0C;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAElD;IACC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,KAAK,GAAuC;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,WAAW;SACrB,CAAC;QACF,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC;QACF,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK;YACL,KAAK;SACN,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC1C,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE;YACvB,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB;gBAC3C,CAAC,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;gBAClF,CAAC,CAAC,CAAC,GAAG,EAAE;oBACJ,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChE,CAAC,CAAC,EAAE,CAAC;QAEX,MAAM,iBAAiB,GAAG;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK;YACL,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SACtE,CAAC;QACF,MAAM,IAAI,GAAG,gBAAgB,CAC3B,MAAM,CAAC,IAAI,KAAK,0BAA0B;YACxC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC;YACnF,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1B,SAAS,EAAE,wBAAwB;gBACnC,OAAO,EAAE,iBAAiB;aAC3B,CAAC,CACP,CAAC;QACF,MAAM,mBAAmB,GACvB,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QACpF,MAAM,WAAW,GACf,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAC/E,MAAM,QAAQ,GAAG,mCAAmC,CAAC,IAAI,EAAE,MAAM,EAAE;YACjE,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW;gBACX,kBAAkB,EAAE,MAAM,CAAC,IAAI;gBAC/B,kBAAkB,EAAE,SAAS,CAAC,MAAe,CAAC;gBAC9C,eAAe,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;gBAClD,mBAAmB,EAAE,eAAe,CAAC,mBAAmB,CAAC;gBACzD,cAAc,EAAE,IAAI,CAAC,QAAQ;aAC9B;SACF,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;QACnE,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YACtE,MAAM,YAAY,CAChB,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,4BAA4B,CAAC,EAC1D,mEAAmE,EACnE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,SAAuD,CAAC;QAC1E,qCAAqC,CAAC,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7E,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC"}

package/dist/services/operate/screened-evidence-service.d.ts

@@ -0,0 +1,24 @@
+import type { JsonRecord, ScreenedEvidenceResolverSource } from './composition.js';
+export type ScreenedEvidencePreparation = Readonly<{
+    candidate: JsonRecord;
+    source: ScreenedEvidenceResolverSource;
+    relativePath: string;
+    sourceContractId: 'repository-architecture' | 'planning-acceptance' | 'ci-test-evidence';
+}>;
+type Scope = Readonly<{
+    scopeId: string;
+    domainId: string;
+    domainVersion: string;
+}>;
+/**
+ * Builds only adapter-owned Candidates for a tiny public-file allowlist. Callers supply
+ * scope and runtime IDs, never source contracts, capabilities, roots, or arbitrary paths.
+ */
+export declare function prepareScreenedOperateEvidence(input: {
+    projectDir: string;
+    scope: Scope;
+    sourceArtifactId: string;
+    issueCandidateId: () => string;
+}): Promise<readonly ScreenedEvidencePreparation[]>;
+export {};
+//# sourceMappingURL=screened-evidence-service.d.ts.map

package/dist/services/operate/screened-evidence-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screened-evidence-service.d.ts","sourceRoot":"","sources":["../../../src/services/operate/screened-evidence-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAqCnF,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IACjD,SAAS,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE,8BAA8B,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,yBAAyB,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;CAC1F,CAAC,CAAC;AAEH,KAAK,KAAK,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAkFpF;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,MAAM,CAAC;CAChC,GAAG,OAAO,CAAC,SAAS,2BAA2B,EAAE,CAAC,CA8ElD"}