orizu 0.4.0 → 0.5.0

package/dist/session-timeline.js

@@ -0,0 +1,103 @@
+/**
+ * reconstructSessionTimeline — the G6 audit-replay proof (ALI-1007).
+ *
+ * Acceptance ("replaying run events reconstructs the session"): given ONLY the
+ * server-side, append-only workbench run events (each `{ sequence, eventType }`,
+ * fetched from the events cursor — nothing client-held), rebuild the ordered
+ * session timeline and assert its COMPLETENESS as a behavioral proof:
+ *   - every lifecycle PHASE is represented (bootstrap → ready → work → completion);
+ *   - sequences are gapless, or the gaps are enumerated (the sink documents that
+ *     an ambiguous append burns a sequence, so a gap is tolerated-but-recorded);
+ *   - the terminal status is derivable (the run row's terminal status, itself
+ *     server-side, corroborated by the pre-terminal `agent_transcript` marker).
+ *
+ * Pure: no I/O, no clock. The caller supplies the events (and the server run
+ * status, which is also server-side) so this composes into an e2e test or a
+ * server-side watchdog without a network.
+ */
+// The lifecycle phases a hosted session passes through, in order. `completion`
+// is the transcript tail (an optional pre-terminal event); the actual terminal
+// transition is a run-row status set via PATCH, NOT an event — so completeness
+// requires the terminal STATUS (see terminalDerivable), while the completion
+// EVENT only corroborates it.
+export const SESSION_PHASES = ['bootstrap', 'ready', 'work', 'completion'];
+// The phases that MUST be represented by events for a session to reconstruct.
+// `completion` is excluded: the terminal is a PATCH-set run status, not an event.
+export const REQUIRED_EVENT_PHASES = ['bootstrap', 'ready', 'work'];
+// Map each known server-side event type onto its lifecycle phase. Types absent
+// here are still ordered in the timeline but tagged `phase: null` (they do not
+// satisfy a required phase). Kept as a const map (no enums, per house style).
+const PHASE_BY_EVENT_TYPE = {
+    // bootstrap: run start + sandbox/repo/runtime provisioning
+    run_started: 'bootstrap',
+    sandbox_provisioned: 'bootstrap',
+    repo_cloned: 'bootstrap',
+    cli_installed: 'bootstrap',
+    setup_hook_completed: 'bootstrap',
+    setup_hook_skipped: 'bootstrap',
+    // P3-a: for enforced-egress providers bootstrap defers the hook to the loop
+    // (which runs it after the egress canary); this marks the deferral in-timeline.
+    setup_hook_deferred: 'bootstrap',
+    // ready: the agent harness is up and holds a live credential
+    agent_ready: 'ready',
+    agent_token: 'ready',
+    // The startup egress canary (G5) fires in the ready window, right after
+    // bootstrap and before any agent work — proof the firewall is live.
+    egress_blocked: 'ready',
+    egress_allowed: 'ready',
+    // credential_rotated / credential_mint_failed are RESERVED vocabulary, NOT
+    // emitted today (host-side run-stream emission was rejected as a single-writer
+    // violation; the durable credential-use audit is the per-mint DB row). They
+    // stay mapped so a FUTURE single-writer emitter classifies correctly, but the
+    // `ready` phase is satisfied independently by agent_ready/agent_token — replay
+    // completeness never depends on a credential event.
+    credential_rotated: 'ready',
+    credential_mint_failed: 'ready',
+    // work: the agent acts (tool calls/results, steps, repo writes, artifacts)
+    agent_tool_call: 'work',
+    agent_tool_result: 'work',
+    agent_step_start: 'work',
+    agent_step_finish: 'work',
+    repo_sync: 'work',
+    artifact: 'work',
+    session_title: 'work',
+    // completion: the bounded transcript tail recorded just before the terminal PATCH
+    agent_transcript: 'completion',
+};
+const TERMINAL_STATUSES = new Set(['succeeded', 'failed', 'cancelled']);
+export function reconstructSessionTimeline(events, opts = {}) {
+    const ordered = [...events]
+        .sort((a, b) => a.sequence - b.sequence)
+        .map(event => ({
+        sequence: event.sequence,
+        eventType: event.eventType,
+        phase: PHASE_BY_EVENT_TYPE[event.eventType] ?? null,
+    }));
+    const phasesPresent = Object.fromEntries(SESSION_PHASES.map(phase => [phase, ordered.some(entry => entry.phase === phase)]));
+    const missingPhases = REQUIRED_EVENT_PHASES.filter(phase => !phasesPresent[phase]);
+    const sequenceGaps = [];
+    for (let i = 1; i < ordered.length; i += 1) {
+        const previous = ordered[i - 1].sequence;
+        const current = ordered[i].sequence;
+        if (current > previous + 1) {
+            sequenceGaps.push([previous, current]);
+        }
+    }
+    const gapless = sequenceGaps.length === 0;
+    const runStatus = opts.runStatus ?? null;
+    const terminalStatus = runStatus && TERMINAL_STATUSES.has(runStatus) ? runStatus : null;
+    // The terminal is the run-row status (PATCH-set, server-side). The completion
+    // event (`agent_transcript`), when present, corroborates it but is not required.
+    const terminalDerivable = terminalStatus !== null;
+    const complete = missingPhases.length === 0 && terminalDerivable;
+    return {
+        ordered,
+        phasesPresent,
+        missingPhases,
+        sequenceGaps,
+        gapless,
+        terminalStatus,
+        terminalDerivable,
+        complete,
+    };
+}

package/dist/setup-prompt.js

@@ -1,7 +1,7 @@
 export function renderAgentSetupPrompt(options) {
     const workspaceLine = options?.workspacePath
-        ? `- Local Orizu artifacts belong under ${options.workspacePath} (gitignored). Keep secrets out of the repo; credentials live in ~/.config/orizu.`
-        : '- If local Orizu artifacts are needed, suggest creating a gitignored .orizu/ workspace (orizu setup can do this).';
+        ? `- The Orizu workbench root is ${options.workspacePath}. Read AGENTS.md, Memory.md, project READMEs, and orizu.*.json manifests before changing anything.`
+        : '- If this repo is not initialized yet, suggest running `orizu setup --team <slug>` from the desired directory to create the local Orizu workbench contract.';
     return `Help me embed Orizu (eval-first LLM optimization) into this repository's workflow.
 
 Start by learning the Orizu workflow:
@@ -14,6 +14,8 @@ Then inspect this repository and propose how Orizu should fit it:
 - Propose datasets: existing data that can be uploaded now, or a concrete plan to collect examples if none exists.
 - Propose which prompts to version in Orizu, and which scorers or LLM judges would capture quality for them.
 - Propose runner artifacts where local execution is needed.
+- Use root AGENTS.md, CLAUDE.md, and Memory.md for team context. Discover project and primitive context through README files and orizu.<kind>.json manifests.
+- Keep Git-tracked source/context separate from Orizu DB state, object-storage bytes, and local/ephemeral files. Treat .orizu/ as ignored cache/generated state.
 ${workspaceLine}
 
 Important boundaries:

package/dist/skill-installer.js

@@ -3,10 +3,12 @@ import { dirname, isAbsolute, join, relative, resolve } from 'path';
 import { fileURLToPath } from 'url';
 import { homedir } from 'os';
 import { createHash } from 'crypto';
+import { workspaceExists } from './workspace.js';
 export const SKILL_NAME = 'orizu-cli';
 export const AGENTS_START_MARKER = '<!-- orizu-cli:start -->';
 export const AGENTS_END_MARKER = '<!-- orizu-cli:end -->';
 export const SKILL_INSTALL_TARGETS = [
+    'codex-user',
     'agent-user',
     'agents-project',
     'codex-project',
@@ -114,6 +116,9 @@ function resolveCwd(options) {
 export function getSkillInstallPath(target, options) {
     const home = resolveHome(options);
     const cwd = resolveCwd(options);
+    if (target === 'codex-user') {
+        return resolve(home, '.codex', 'skills', SKILL_NAME);
+    }
     if (target === 'agent-user') {
         return resolve(home, '.agents', 'skills', SKILL_NAME);
     }
@@ -135,7 +140,7 @@ export function getTargetForAgent(agent, scope) {
     if (agent === 'claude') {
         return scope === 'global' ? 'claude-user' : 'claude-project';
     }
-    return scope === 'global' ? 'agent-user' : 'agents-project';
+    return scope === 'global' ? 'codex-user' : 'agents-project';
 }
 export function isSkillInstallAgent(value) {
     return SKILL_INSTALL_AGENTS.includes(value);
@@ -212,6 +217,9 @@ function buildAgentsSection(sourceDir) {
     return `${AGENTS_START_MARKER}\n${body}\n${AGENTS_END_MARKER}\n`;
 }
 function installAgentsMd(sourceDir, targetPath, options) {
+    if (workspaceExists(dirname(targetPath))) {
+        throw new Error(`${targetPath} belongs to an Orizu workspace. Keep root AGENTS.md as concise workspace guidance; use global skill installs or project skill directories for detailed Orizu CLI reference material.`);
+    }
     const section = buildAgentsSection(sourceDir);
     const exists = existsSync(targetPath);
     const existing = exists ? readFileSync(targetPath, 'utf8') : '';

package/dist/smoke.js

@@ -0,0 +1,250 @@
+/**
+ * Terminal-only Phase 2 smoke workflow (ALI-908).
+ *
+ * Pure, importable step logic with an injected fetcher factory. It drives the
+ * REAL Phase 2 CLI command modules (workbench-cli sessions/runs/tail/terminal)
+ * plus the RunAPI / promotion-manifest routes over HTTP. The `scripts/workbench-
+ * smoke.mjs` driver supplies a live-server fetcher from env; the unit test
+ * supplies an in-memory fake server. No process/argv/print here.
+ *
+ * The workflow proves, against server-side state only:
+ *  - create-or-attach workspace idempotency (reused on a second run),
+ *  - a session + workbench run with persisted append-only events,
+ *  - terminal-death reconnect (a fresh client re-reads every prior event),
+ *  - promotion-manifest create + apply idempotency,
+ *  - run-completion idempotency (one terminal event under a retried PATCH).
+ *
+ * Phase 2 boundaries: no OpenInspect, no hosted sandbox, no Slack/web entry,
+ * no Cloudflare Artifacts, no durable overnight jobs.
+ */
+import { runSessionEnd, runSessionStart, runWorkbenchRunStart, runWorkbenchRunStatus, runWorkbenchRunTerminal, tailOnce, } from './workbench-cli.js';
+export const SMOKE_RUN_TITLE = 'smoke: highlight-derived workflow';
+// Deterministic, HIP/highlight-shaped events appended after run start (seq 1 is
+// the server-emitted run_started). Stable event_ids make the append idempotent.
+export const SMOKE_EVENTS = [
+    {
+        eventId: 'smoke-evt-1',
+        eventType: 'highlight_ingested',
+        sequence: 2,
+        payload: { highlightId: 'hl-smoke-001', source: 'hip', span: { start: 0, end: 42 } },
+    },
+    {
+        eventId: 'smoke-evt-2',
+        eventType: 'eval_scored',
+        sequence: 3,
+        payload: { metricKey: 'faithfulness', score: 0.87, comparable: true },
+    },
+    {
+        eventId: 'smoke-evt-3',
+        eventType: 'notes_recorded',
+        sequence: 4,
+        payload: { note: 'Highlight-derived smoke: no regression detected.' },
+    },
+];
+const STEP_PLAN = [
+    { key: 'workspace', title: 'Workspace resolve-or-attach', plan: 'POST /api/cli/workspaces (idempotent on team+slug)' },
+    { key: 'session', title: 'Session start', plan: 'POST /api/cli/workspaces/{id}/sessions' },
+    { key: 'run', title: 'Workbench run start', plan: 'POST /api/cli/workbench-runs + verify seq-1 run_started via tail' },
+    { key: 'events', title: 'Append highlight-derived events', plan: 'POST /workbench-runs/{id}/events x3 (smoke-evt-1..3)' },
+    { key: 'reconnect', title: 'Terminal-death reconnect', plan: 'fresh client re-fetches run + tails from cursor 0' },
+    { key: 'manifest', title: 'Promotion manifest no_change', plan: 'create (idempotent) -> approve -> apply -> re-apply' },
+    { key: 'complete', title: 'Complete run + end session', plan: 'PATCH succeeded (idempotent) + PATCH session ended' },
+    { key: 'summary', title: 'Re-run accounting', plan: 'classify reused vs created rows' },
+];
+export function planSmokeSteps(_config) {
+    return STEP_PLAN.map((step, i) => ({ index: i + 1, key: step.key, title: step.title, plan: step.plan }));
+}
+function titleFor(key) {
+    return STEP_PLAN.find(step => step.key === key)?.title ?? key;
+}
+function indexFor(key) {
+    return STEP_PLAN.findIndex(step => step.key === key) + 1;
+}
+async function readBody(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return {};
+    }
+}
+async function errorMessage(response) {
+    const body = await readBody(response.clone());
+    const error = typeof body.error === 'string' ? body.error : null;
+    return error || response.statusText || String(response.status);
+}
+async function postJson(fetcher, path, payload) {
+    const response = await fetcher(path, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+    });
+    if (!response.ok) {
+        throw new Error(`${path} failed (${response.status}): ${await errorMessage(response)}`);
+    }
+    return { status: response.status, body: await readBody(response) };
+}
+function requireObject(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} missing from response`);
+    }
+    return value;
+}
+function requireId(value, label) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`${label} missing from response`);
+    }
+    return value;
+}
+export async function runSmokeWorkflow(opts) {
+    const { config } = opts;
+    const fetcher = opts.makeFetcher();
+    const steps = [];
+    const summary = { created: [], reused: [], verified: [] };
+    const ids = {};
+    const record = (key, disposition, detail) => {
+        const step = { index: indexFor(key), key, title: titleFor(key), ok: true, disposition, detail };
+        steps.push(step);
+        if (disposition === 'created')
+            summary.created.push(key);
+        if (disposition === 'reused')
+            summary.reused.push(key);
+        if (disposition === 'verified')
+            summary.verified.push(key);
+        opts.onStep?.(step);
+        return step;
+    };
+    try {
+        // 1 — Workspace resolve-or-attach (201 created / 200 reused).
+        const workspace = await postJson(fetcher, '/api/cli/workspaces', {
+            teamSlug: config.teamSlug,
+            name: config.workspaceSlug,
+            slug: config.workspaceSlug,
+        });
+        const workspaceId = requireId(requireObject(workspace.body.workspace, 'workspace').id, 'workspace id');
+        ids.workspaceId = workspaceId;
+        const workspaceDisposition = workspace.status === 201 ? 'created' : 'reused';
+        record('workspace', workspaceDisposition, `${workspaceDisposition} workspace ${workspaceId} (slug=${config.workspaceSlug})`);
+        // 2 — Session start (always a new row).
+        const session = await runSessionStart({
+            fetcher,
+            workspaceId,
+            projectSlug: config.projectSlug,
+            clientInfo: { source: 'orizu-smoke' },
+        });
+        const sessionId = requireId(session.session.id, 'session id');
+        ids.sessionId = sessionId;
+        record('session', 'created', `created session ${sessionId}`);
+        // 3 — Workbench run start + verify the server-emitted seq-1 run_started.
+        const runStart = await runWorkbenchRunStart({ fetcher, sessionId, title: SMOKE_RUN_TITLE, projectSlug: config.projectSlug });
+        const runId = requireId(runStart.run.id, 'run id');
+        ids.runId = runId;
+        const opening = await tailOnce(fetcher, runId, 0);
+        const started = opening.events.find(event => event.sequence === 1);
+        if (!started || started.eventType !== 'run_started') {
+            throw new Error('seq-1 run_started event was not present on tail');
+        }
+        record('run', 'created', `created run ${runId}; verified seq-1 run_started`);
+        // 4 — Append the three highlight-derived events (deterministic ids).
+        for (const event of SMOKE_EVENTS) {
+            const payload = { ...event.payload };
+            if (event.eventType === 'eval_scored' && config.scoreRunId) {
+                payload.scoreRunId = config.scoreRunId;
+            }
+            const appended = await postJson(fetcher, `/api/cli/workbench-runs/${encodeURIComponent(runId)}/events`, {
+                eventId: event.eventId,
+                eventType: event.eventType,
+                sequence: event.sequence,
+                payload,
+            });
+            if (appended.status !== 201 && appended.status !== 200) {
+                throw new Error(`unexpected append status ${appended.status} for ${event.eventId}`);
+            }
+        }
+        record('events', 'created', `appended ${SMOKE_EVENTS.length} events (${SMOKE_EVENTS.map(e => e.eventId).join(', ')})`);
+        // 5 — Simulated terminal death: a fresh, stateless client re-reads the run.
+        const reconnectFetcher = opts.makeFetcher();
+        const reread = await runWorkbenchRunStatus({ fetcher: reconnectFetcher, runId });
+        if (reread.run.id !== runId) {
+            throw new Error('reconnected client resolved a different run id');
+        }
+        const replay = await tailOnce(reconnectFetcher, runId, 0);
+        const expectedTypes = ['run_started', ...SMOKE_EVENTS.map(e => e.eventType)];
+        const seenTypes = replay.events.filter(e => e.sequence <= expectedTypes.length).map(e => e.eventType);
+        for (const expected of expectedTypes) {
+            if (!seenTypes.includes(expected)) {
+                throw new Error(`reconnect did not see ${expected}; state was lost`);
+            }
+        }
+        record('reconnect', 'verified', `fresh client re-read ${expectedTypes.length} events after kill (${expectedTypes.join(', ')})`);
+        // 6 — Promotion manifest: create (idempotent), approve, apply, re-apply.
+        const projectRef = `${config.teamSlug}/${config.projectSlug}`;
+        const idempotencyKey = `smoke:no_change:${runId}`;
+        const manifestBody = {
+            actionType: 'no_change',
+            idempotencyKey,
+            workspaceId,
+            workspaceSessionId: sessionId,
+            workbenchRunId: runId,
+            impactNotes: 'Smoke workflow: no primitive change; substrate proof only.',
+            rollbackNotes: 'No-op; nothing to roll back.',
+            evidence: { workbench_run_ids: [runId], notes: ['highlight-derived smoke run'] },
+            currentState: {},
+            proposedState: {},
+        };
+        const manifestPath = `/api/cli/promotion-manifests?project=${encodeURIComponent(projectRef)}`;
+        const created = await postJson(fetcher, manifestPath, manifestBody);
+        const manifestId = requireId(requireObject(created.body.manifest, 'manifest').id, 'manifest id');
+        ids.manifestId = manifestId;
+        // Create idempotency: same key returns the same row.
+        const recreated = await postJson(fetcher, manifestPath, manifestBody);
+        const recreatedId = requireId(requireObject(recreated.body.manifest, 'manifest').id, 'manifest id');
+        if (recreatedId !== manifestId) {
+            throw new Error('manifest create was not idempotent on the idempotency key');
+        }
+        const actionPath = `/api/cli/promotion-manifests/${encodeURIComponent(manifestId)}`;
+        await postJson(fetcher, actionPath, { action: 'approve' });
+        const applied = await postJson(fetcher, actionPath, { action: 'apply' });
+        const appliedOutcome = requireObject(applied.body.manifest, 'manifest').outcome;
+        const reapplied = await postJson(fetcher, actionPath, { action: 'apply' });
+        const reappliedOutcome = requireObject(reapplied.body.manifest, 'manifest').outcome;
+        if (JSON.stringify(appliedOutcome) !== JSON.stringify(reappliedOutcome)) {
+            throw new Error('manifest re-apply produced a different outcome (not idempotent)');
+        }
+        record('manifest', 'created', `manifest ${manifestId} no_change applied; re-apply idempotent`);
+        // 7 — Complete the run (idempotent) + end the session.
+        await runWorkbenchRunTerminal({
+            fetcher,
+            runId,
+            status: 'succeeded',
+            summary: 'smoke workflow completed with no promotion change',
+            evidence: { promotion_manifest_ids: [manifestId] },
+        });
+        // Retry the terminal PATCH: still exactly one terminal event server-side.
+        await runWorkbenchRunTerminal({ fetcher, runId, status: 'succeeded', summary: 'idempotent retry' });
+        const finalTail = await tailOnce(fetcher, runId, 0, 500);
+        const terminalCount = finalTail.events.filter(e => e.eventType === 'run_completed').length;
+        if (terminalCount !== 1) {
+            throw new Error(`expected exactly one run_completed event, saw ${terminalCount}`);
+        }
+        await runSessionEnd({ fetcher, sessionId });
+        record('complete', 'verified', `run completed (single terminal event) and session ${sessionId} ended`);
+        // 8 — Re-run accounting: distinguish reused vs created rows.
+        record('summary', 'verified', `reused=[${summary.reused.join(', ') || 'none'}] created=[${summary.created.join(', ')}]`);
+        return { ok: true, steps, failedStep: null, summary, ids };
+    }
+    catch (error) {
+        const key = STEP_PLAN[steps.length]?.key ?? 'unknown';
+        const failedStep = {
+            index: indexFor(key),
+            key,
+            title: titleFor(key),
+            ok: false,
+            disposition: 'verified',
+            detail: error instanceof Error ? error.message : String(error),
+        };
+        steps.push(failedStep);
+        opts.onStep?.(failedStep);
+        return { ok: false, steps, failedStep, summary, ids };
+    }
+}

package/dist/task-assignment-manifest.js

@@ -0,0 +1,96 @@
+import { readFileSync, statSync } from 'node:fs';
+export const DEFAULT_ASSIGNMENT_MANIFEST_LIMITS = {
+    maxBytes: 5 * 1024 * 1024,
+    maxLines: 100_000,
+};
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function formatLimit(value) {
+    return value.toLocaleString('en-US');
+}
+function resolveLimits(limits = {}) {
+    return {
+        maxBytes: limits.maxBytes ?? DEFAULT_ASSIGNMENT_MANIFEST_LIMITS.maxBytes,
+        maxLines: limits.maxLines ?? DEFAULT_ASSIGNMENT_MANIFEST_LIMITS.maxLines,
+    };
+}
+function assertAssignmentManifestSize(bytes, limits = {}) {
+    const resolvedLimits = resolveLimits(limits);
+    if (bytes > resolvedLimits.maxBytes) {
+        throw new Error(`Assignment manifest file is ${formatLimit(bytes)} bytes; maximum supported size is ${formatLimit(resolvedLimits.maxBytes)} bytes`);
+    }
+}
+function assertAssignmentManifestLimits(content, limits = {}) {
+    const resolvedLimits = resolveLimits(limits);
+    assertAssignmentManifestSize(Buffer.byteLength(content, 'utf8'), resolvedLimits);
+    return resolvedLimits;
+}
+export function parseAssignmentManifestJsonl(content, limits) {
+    const resolvedLimits = assertAssignmentManifestLimits(content, limits);
+    // Keep these JSONL field rules in sync with the server's explicitAssignments parser.
+    const entries = [];
+    let records = 0;
+    const lines = content.split(/\r?\n/);
+    lines.forEach((line, lineIndex) => {
+        const trimmed = line.trim();
+        if (!trimmed) {
+            return;
+        }
+        records += 1;
+        if (records > resolvedLimits.maxLines) {
+            throw new Error(`Assignment manifest has ${formatLimit(records)} non-empty assignment records; maximum supported record count is ${formatLimit(resolvedLimits.maxLines)}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch (_error) {
+            throw new Error(`Assignment manifest line ${lineIndex + 1} is not valid JSON`);
+        }
+        if (!isRecord(parsed)) {
+            throw new Error(`Assignment manifest line ${lineIndex + 1} must be a JSON object`);
+        }
+        const rowId = typeof parsed.rowId === 'string' ? parsed.rowId.trim() : '';
+        if (!rowId) {
+            throw new Error(`Assignment manifest line ${lineIndex + 1} must include a non-empty rowId`);
+        }
+        const hasAssignee = Object.hasOwn(parsed, 'assignee');
+        const hasAssignees = Object.hasOwn(parsed, 'assignees');
+        if (hasAssignee && hasAssignees) {
+            throw new Error(`Assignment manifest line ${lineIndex + 1} must provide either assignee or assignees, not both`);
+        }
+        if (hasAssignee) {
+            const assignee = typeof parsed.assignee === 'string' ? parsed.assignee.trim() : '';
+            if (!assignee) {
+                throw new Error(`Assignment manifest line ${lineIndex + 1} assignee must be a non-empty string`);
+            }
+            entries.push({ rowId, assignee });
+            return;
+        }
+        if (hasAssignees) {
+            if (!Array.isArray(parsed.assignees) || parsed.assignees.length === 0) {
+                throw new Error(`Assignment manifest line ${lineIndex + 1} assignees must be a non-empty string array`);
+            }
+            parsed.assignees.forEach((assigneeValue, assigneeIndex) => {
+                const assignee = typeof assigneeValue === 'string' ? assigneeValue.trim() : '';
+                if (!assignee) {
+                    throw new Error(`Assignment manifest line ${lineIndex + 1} assignees[${assigneeIndex}] must be a non-empty string`);
+                }
+                entries.push({ rowId, assignee });
+            });
+            return;
+        }
+        throw new Error(`Assignment manifest line ${lineIndex + 1} must include assignee or assignees`);
+    });
+    if (entries.length === 0) {
+        throw new Error('Assignment manifest must contain at least one assignment');
+    }
+    return entries;
+}
+export function readAssignmentManifestJsonlFile(path, limits) {
+    const stats = statSync(path);
+    assertAssignmentManifestSize(stats.size, limits);
+    const content = readFileSync(path, 'utf8');
+    return parseAssignmentManifestJsonl(content, limits);
+}