review-council 4.4.15 → 4.4.16

package/dist/converge/correction-anchors.d.ts

@@ -0,0 +1 @@
+export * from '../evidence/claim-recovery/validation/anchors.js';

package/dist/converge/correction-anchors.js

@@ -0,0 +1,2 @@
+export * from '../evidence/claim-recovery/validation/anchors.js';
+//# sourceMappingURL=correction-anchors.js.map

package/dist/converge/correction-anchors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"correction-anchors.js","sourceRoot":"","sources":["../../src/converge/correction-anchors.ts"],"names":[],"mappings":"AAAA,cAAc,kDAAkD,CAAC"}

package/dist/converge/ordinary-pending-package.js

@@ -1,6 +1,9 @@
 import { guardedInputSha256, stableStringify } from '../report/run-header.js';
 export function validateOrdinaryPendingPackage(value, expected) {
-    const input = value?.guardedInput, keys = ['asyncRoles', 'config', 'diff', 'head', 'kind', 'pr', 'prompts', 'repo', 'roster', 'spec'];
+    const input = value?.guardedInput;
+    const specPresent = !!input && Object.hasOwn(input, 'spec');
+    const keys = ['asyncRoles', 'config', 'diff', 'head', 'kind', 'pr', 'prompts', 'repo', 'roster',
+        ...(specPresent ? ['spec'] : [])];
     const digest = (candidate) => typeof candidate === 'string' && /^[a-f0-9]{64}$/.test(candidate);
     const structuredInput = input && input.kind === 'patch' && typeof input.repo === 'string' && /^[^/\s]+\/[^/\s]+$/.test(input.repo) &&
         Number.isSafeInteger(input.pr) && input.pr > 0 && digest(input.diff) && digest(input.config) &&
@@ -11,7 +14,7 @@ export function validateOrdinaryPendingPackage(value, expected) {
             const role = item;
             return item && typeof item === 'object' && typeof role.name === 'string' && role.name.length > 0;
         }) &&
-        input.spec && typeof input.spec === 'object';
+        (!specPresent || (input.spec && typeof input.spec === 'object'));
     if (!value || value.target !== expected.target || value.headSha !== expected.headSha || value.baseSha !== expected.baseSha || value.attempt !== expected.attempt || value.round !== expected.round || value.pid !== expected.pid || !/^[a-f0-9]{40}$/.test(value.baseSha) ||
         !Number.isSafeInteger(value.attempt) || value.attempt < 1 || !Number.isSafeInteger(value.round) || value.round < 1 ||
         !Number.isSafeInteger(value.pid) || value.pid < 1 || !input || Object.keys(input).sort().join(',') !== keys.join(',') ||

package/dist/converge/ordinary-pending-package.js.map

@@ -1 +1 @@
-{"version":3,"file":"ordinary-pending-package.js","sourceRoot":"","sources":["../../src/converge/ordinary-pending-package.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAK9E,MAAM,UAAU,8BAA8B,CAAC,KAA6B,EAAE,QAA+B;IAC3G,MAAM,KAAK,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,YAAY,EAAC,QAAQ,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,SAAS,EAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,CAAC,CAAC;IAC7H,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9H,MAAM,eAAe,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAChI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAK,KAAK,CAAC,EAAa,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACxG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9F,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC5D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC7D,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YAC5B,MAAM,IAAI,GAAG,IAA+B,CAAC;YAC7C,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACnG,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACvQ,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;QAClH,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACrH,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClS,IAAI,CAAC,eAAe,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,IAAI;QACrG,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC5E,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5F,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/D,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM;QAC1F,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9B,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YACjF,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5F,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAC5E,CAAE,KAAK,CAAC,MAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,KAAK;gBAClF,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpJ,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAA2B,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"ordinary-pending-package.js","sourceRoot":"","sources":["../../src/converge/ordinary-pending-package.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAK9E,MAAM,UAAU,8BAA8B,CAAC,KAA6B,EAAE,QAA+B;IAC3G,MAAM,KAAK,GAAG,KAAK,EAAE,YAAY,CAAC;IAClC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,CAAC,YAAY,EAAC,QAAQ,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,SAAS,EAAC,MAAM,EAAC,QAAQ;QACrF,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9H,MAAM,eAAe,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAChI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAK,KAAK,CAAC,EAAa,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACxG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9F,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC5D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC7D,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YAC5B,MAAM,IAAI,GAAG,IAA+B,CAAC;YAC7C,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACnG,CAAC,CAAC;QACF,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACvQ,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;QAClH,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACrH,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClS,IAAI,CAAC,eAAe,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,IAAI;QACrG,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC5E,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5F,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC,mBAAmB,CAAC,MAAM;QAC/D,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM;QAC1F,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9B,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YACjF,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5F,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAC5E,CAAE,KAAK,CAAC,MAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,KAAK;gBAClF,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpJ,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAA2B,CAAC,CAAC;AACrF,CAAC"}

package/dist/evidence/claim-recovery/authenticated-receipts.d.ts

@@ -0,0 +1,46 @@
+import { type StoredEventReceipt } from '../event-receipts.js';
+import { type ClaimRecoverySelection } from './context.js';
+import type { NativeOccurrenceReadRequirement } from './validation/native-occurrences.js';
+import type { HarnessSink } from '../../telemetry/sink.js';
+type SelectedReceiptRequirement = Extract<NativeOccurrenceReadRequirement, {
+    kind: 'selected-event-receipts';
+}>;
+/** Explicit original source and exact server receipts expected for that source. */
+export interface AuthenticatedReceiptSelection {
+    selection: ClaimRecoverySelection;
+    expectedReceipts: readonly StoredEventReceipt[];
+    /** Selected receipt requirements produced by native occurrence preparation. */
+    readRequirements: readonly SelectedReceiptRequirement[];
+}
+/** A live token only the verifier can create. Use the accessor for defensive content. */
+export interface AuthenticatedSelectedReceipts {
+    readonly qualification: 'authenticated-selected-receipts';
+}
+export interface AuthenticatedReceiptContent {
+    actorUserId: string;
+    selections: Array<{
+        selection: ClaimRecoverySelection;
+        eventIds: string[];
+        eventSequence: number;
+        receipts: StoredEventReceipt[];
+    }>;
+}
+/** Reject serialized or caller-forged tokens and return only a defensive snapshot. */
+export declare function authenticatedReceiptContent(verification: AuthenticatedSelectedReceipts): AuthenticatedReceiptContent;
+export type AuthenticatedReceiptVerification = {
+    kind: 'verified';
+    value: AuthenticatedSelectedReceipts;
+} | {
+    kind: 'conflict';
+    reason: string;
+} | {
+    kind: 'unknown';
+    reason: string;
+};
+/**
+ * Authenticate exact selected receipts in one stable, ordinary-authenticated
+ * read window. This is read-only and establishes neither inventory closure nor
+ * disposition standing.
+ */
+export declare function verifyAuthenticatedSelectedReceipts(sink: HarnessSink, expectedActorUserId: string, selections: readonly AuthenticatedReceiptSelection[]): Promise<AuthenticatedReceiptVerification>;
+export {};

package/dist/evidence/claim-recovery/authenticated-receipts.js

@@ -0,0 +1,120 @@
+import { isDeepStrictEqual } from 'node:util';
+import { MAX_SELECTED_EVENT_RECEIPTS, readEventReceipts } from '../event-receipts.js';
+import { readClaimRecoveryContext } from './context.js';
+import { isStoredEventReceipt } from './validation/receipts.js';
+import { uuidSchema } from './validation/primitives.js';
+const accepted = new WeakMap();
+/** Reject serialized or caller-forged tokens and return only a defensive snapshot. */
+export function authenticatedReceiptContent(verification) {
+    const content = accepted.get(verification);
+    if (!content)
+        throw new Error('unverified_authenticated_receipts');
+    return structuredClone(content);
+}
+const sameScope = (a, b) => a.base_url === b.base_url && a.org_id === b.org_id && a.run_id === b.run_id && a.repo === b.repo && a.pr_number === b.pr_number;
+const sameOperation = (a, b) => a.scope.base_url === b.scope.base_url && a.scope.org_id === b.scope.org_id && a.scope.repo.toLowerCase() === b.scope.repo.toLowerCase() &&
+    a.scope.pr_number === b.scope.pr_number && a.target === b.target;
+function selectedIds(input) {
+    const requirements = input.readRequirements;
+    if (!requirements.length || !input.expectedReceipts.length)
+        throw new Error('invalid_authenticated_receipt_selection');
+    const ids = [];
+    for (const requirement of requirements) {
+        if (!sameScope(input.selection.scope, requirement.scope) || !Array.isArray(requirement.eventIds) ||
+            requirement.eventIds.length < 1)
+            throw new Error('invalid_authenticated_receipt_selection');
+        ids.push(...requirement.eventIds);
+    }
+    const uniqueIds = [...new Set(ids)];
+    if (new Set(input.expectedReceipts.map(receipt => receipt.id)).size !== input.expectedReceipts.length ||
+        !input.expectedReceipts.every(receipt => isStoredEventReceipt(receipt, input.selection.scope)) ||
+        !isDeepStrictEqual([...uniqueIds].sort(), input.expectedReceipts.map(receipt => receipt.id).sort())) {
+        throw new Error('invalid_authenticated_receipt_selection');
+    }
+    return uniqueIds;
+}
+function unknown(reason) { return { kind: 'unknown', reason }; }
+function conflict(reason) { return { kind: 'conflict', reason }; }
+/**
+ * Authenticate exact selected receipts in one stable, ordinary-authenticated
+ * read window. This is read-only and establishes neither inventory closure nor
+ * disposition standing.
+ */
+export async function verifyAuthenticatedSelectedReceipts(sink, expectedActorUserId, selections) {
+    if (!uuidSchema.safeParse(expectedActorUserId).success || !Array.isArray(selections) || !selections.length) {
+        throw new Error('invalid_authenticated_receipt_selection');
+    }
+    // Pin every nested source before the first await. The caller retains no live
+    // path to later receipt, context, or operation comparisons.
+    const pinned = structuredClone(selections);
+    const seenSourceRuns = new Set();
+    const seenEvents = new Map();
+    const operations = pinned.map(input => input.selection);
+    if (!operations.every(selection => sameOperation(operations[0], selection)))
+        throw new Error('authenticated_receipt_operation_conflict');
+    const entries = pinned.map(input => {
+        const ids = selectedIds(input);
+        const sourceRunKey = JSON.stringify([input.selection.scope.base_url, input.selection.scope.org_id, input.selection.scope.run_id]);
+        if (seenSourceRuns.has(sourceRunKey))
+            throw new Error('duplicate_authenticated_receipt_selection');
+        seenSourceRuns.add(sourceRunKey);
+        const sequences = new Map();
+        for (const receipt of input.expectedReceipts) {
+            const sequenceId = sequences.get(receipt.sequence);
+            if (sequenceId && sequenceId !== receipt.id)
+                throw new Error('authenticated_receipt_sequence_conflict');
+            sequences.set(receipt.sequence, receipt.id);
+            const eventScope = JSON.stringify([input.selection.scope.base_url, input.selection.scope.org_id, input.selection.scope.run_id, receipt.id]);
+            const previousScope = seenEvents.get(receipt.id);
+            if (previousScope && previousScope !== eventScope)
+                throw new Error('authenticated_receipt_event_scope_conflict');
+            if (previousScope)
+                throw new Error('authenticated_receipt_event_scope_conflict');
+            seenEvents.set(receipt.id, eventScope);
+        }
+        return { input, ids };
+    });
+    // All source contexts precede any receipt material, yielding one operation-wide window.
+    for (const entry of entries) {
+        const before = await readClaimRecoveryContext(sink, entry.input.selection);
+        if (before.kind !== 'ok')
+            return unknown('authenticated_context_unavailable');
+        if (before.value.actorUserId !== expectedActorUserId)
+            return conflict('authenticated_actor_changed');
+        if (entry.input.expectedReceipts.some(receipt => receipt.sequence > before.value.eventSequence)) {
+            return conflict('selected_receipt_sequence_conflict');
+        }
+        entry.before = before.value;
+    }
+    for (const entry of entries) {
+        const expected = new Map(entry.input.expectedReceipts.map((receipt) => [receipt.id, receipt]));
+        for (let offset = 0; offset < entry.ids.length; offset += MAX_SELECTED_EVENT_RECEIPTS) {
+            const batch = entry.ids.slice(offset, offset + MAX_SELECTED_EVENT_RECEIPTS);
+            const result = await readEventReceipts(sink, entry.input.selection.scope, batch);
+            if (result.kind !== 'ok')
+                return unknown('selected_receipt_read_unavailable');
+            if (result.value.missing.length)
+                return conflict('selected_receipt_missing');
+            if (result.value.receipts.length !== batch.length || result.value.receipts.some(receipt => !expected.has(receipt.id) || !isDeepStrictEqual(receipt, expected.get(receipt.id)))) {
+                return conflict('selected_receipt_mismatch');
+            }
+        }
+    }
+    for (const entry of entries) {
+        const after = await readClaimRecoveryContext(sink, entry.input.selection);
+        if (after.kind !== 'ok')
+            return unknown('authenticated_context_unavailable');
+        if (after.value.actorUserId !== expectedActorUserId || after.value.actorUserId !== entry.before.actorUserId) {
+            return conflict('authenticated_actor_changed');
+        }
+        if (after.value.eventSequence !== entry.before.eventSequence)
+            return conflict('source_event_sequence_changed');
+    }
+    const token = Object.freeze({ qualification: 'authenticated-selected-receipts' });
+    accepted.set(token, structuredClone({ actorUserId: expectedActorUserId, selections: entries.map(entry => ({
+            selection: entry.input.selection, eventIds: entry.ids, eventSequence: entry.before.eventSequence,
+            receipts: [...entry.input.expectedReceipts],
+        })) }));
+    return { kind: 'verified', value: token };
+}
+//# sourceMappingURL=authenticated-receipts.js.map

package/dist/evidence/claim-recovery/authenticated-receipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-receipts.js","sourceRoot":"","sources":["../../../src/evidence/claim-recovery/authenticated-receipts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAmD,MAAM,sBAAsB,CAAC;AACvI,OAAO,EAAE,wBAAwB,EAA+B,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAoBxD,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA8D,CAAC;AAE3F,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAAC,YAA2C;IACrF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAOD,MAAM,SAAS,GAAG,CAAC,CAAoB,EAAE,CAAoB,EAAW,EAAE,CACxE,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC;AAClI,MAAM,aAAa,GAAG,CAAC,CAAyB,EAAE,CAAyB,EAAW,EAAE,CACtF,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE;IACvI,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AAEnE,SAAS,WAAW,CAAC,KAAoC;IACvD,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC5C,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACvH,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC5F,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChG,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM;QACjG,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9F,CAAC,iBAAiB,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,IAAsC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAC1G,SAAS,QAAQ,CAAC,MAAc,IAAsC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAI5G;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,IAAiB,EAAE,mBAA2B,EAAE,UAAoD;IAEpG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAoC,CAAC;IAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1I,MAAM,OAAO,GAAsB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACpD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAClI,IAAI,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACnG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,UAAU,IAAI,UAAU,KAAK,OAAO,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5I,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,aAAa,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjH,IAAI,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjF,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,wFAAwF;IACxF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,mCAAmC,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,mBAAmB;YAAE,OAAO,QAAQ,CAAC,6BAA6B,CAAC,CAAC;QACrG,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAChG,OAAO,QAAQ,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAA6B,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAA2B,EAAgC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7K,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,2BAA2B,EAAE,CAAC;YACtF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACjF,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,mCAAmC,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACxF,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,OAAO,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,mCAAmC,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,mBAAmB,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAO,CAAC,WAAW,EAAE,CAAC;YAC7G,OAAO,QAAQ,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,MAAO,CAAC,aAAa;YAAE,OAAO,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,iCAA0C,EAAE,CAAC,CAAC;IAC3F,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxG,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,MAAO,CAAC,aAAa;YACjG,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC;SAC5C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACR,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC"}

package/dist/evidence/claim-recovery/carrier-inventory.d.ts

@@ -0,0 +1,49 @@
+import type { HarnessSink, SinkOutcome } from '../../telemetry/sink.js';
+import type { StoredEventReceipt } from '../event-receipts.js';
+import type { CarrierSourceInventory, OccurrenceCarrierSelector, OccurrenceRunSelector } from './validation/carrier-types.js';
+import type { NativeCarrierInventory } from './validation/native-occurrences.js';
+/** A live read token. Serialized/caller-supplied objects cannot recreate it. */
+export interface AuthenticatedCarrierInventory {
+    readonly qualification: 'authenticated-carrier-inventory-read';
+}
+export interface CarrierInventoryContent {
+    actorUserId: string;
+    inventory: NativeCarrierInventory;
+    runSequences: Array<{
+        runId: string;
+        eventSequence: number;
+    }>;
+}
+export declare const MAX_CARRIER_READ_BYTES: number;
+/** Return defensive content, never a persisted flag authorizing native mutation. */
+export declare function carrierInventoryContent(read: AuthenticatedCarrierInventory): CarrierInventoryContent;
+/**
+ * Enumerate the exact PR's retained original sources and selected receipts. All
+ * initial contexts precede material reads; all final contexts and re-enumeration
+ * follow them. This authenticates a stable read window, never global historical
+ * absence, carrier retirement, disposition standing or permission to mutate.
+ * Missing source parts remain explicit inputs to the residual projection.
+ */
+export declare function readCarrierInventory(sink: HarnessSink, carrier: OccurrenceCarrierSelector, actorUserId: string): Promise<SinkOutcome<AuthenticatedCarrierInventory>>;
+export interface AuthenticatedClaimHistory {
+    readonly qualification: 'authenticated-claim-history';
+}
+export interface ClaimHistoryContent {
+    readWindow: {
+        startedAt: string;
+        completedAt: string;
+    };
+    actorUserId: string;
+    sources: CarrierSourceInventory[];
+    histories: Array<{
+        runId: string;
+        eventSequence: number;
+        receipts: StoredEventReceipt[];
+    }>;
+}
+export declare function claimHistoryContent(token: AuthenticatedClaimHistory): ClaimHistoryContent;
+/** All retained same-target sources, including later rounds, with a complete pinned
+ * index followed by exact selected receipt reads. Inline truncation alone never
+ * authenticates completeness. Both source and event ceilings are read again. */
+export declare function readClaimTargetHistory(sink: HarnessSink, selection: OccurrenceRunSelector, expectedActor?: string): Promise<SinkOutcome<AuthenticatedClaimHistory>>;
+export declare function sameClaimHistoryEvidence(first: ClaimHistoryContent, second: ClaimHistoryContent): boolean;

package/dist/evidence/claim-recovery/carrier-inventory.js

@@ -0,0 +1,340 @@
+import { isDeepStrictEqual } from 'node:util';
+import { readClaimEventIndex, claimEventSelector } from './claim-index.js';
+import { readEventReceipts } from '../event-receipts.js';
+import { object, uuidSchema } from './validation/primitives.js';
+import { isEventReceiptScope } from './validation/receipts.js';
+import { MAX_CARRIER_INVENTORY, MAX_CARRIER_PREFIX_ROUNDS } from './validation/carrier-projection.js';
+export const MAX_CARRIER_READ_BYTES = 64 * 1024 * 1024;
+const accepted = new WeakMap();
+/** Return defensive content, never a persisted flag authorizing native mutation. */
+export function carrierInventoryContent(read) {
+    const content = accepted.get(read);
+    if (!content)
+        throw new Error('unverified_carrier_inventory');
+    return structuredClone(content);
+}
+class FailedRead extends Error {
+    result;
+    constructor(result) {
+        super('carrier_inventory_read_failed');
+        this.result = result;
+    }
+}
+function conflict(message) { throw new FailedRead({ kind: 'conflict', message }); }
+function value(result) { if (result.kind !== 'ok')
+    throw new FailedRead(result); return result.value; }
+const uuid = (x) => uuidSchema.safeParse(x).success;
+const count = (x) => typeof x === 'number' && Number.isSafeInteger(x) && x >= 0;
+const sha = (x) => typeof x === 'string' && x.length === 64 && /^[a-f0-9]{64}$/.test(x);
+const head = (x) => typeof x === 'string' && [40, 64].includes(x.length) && /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(x) && !/^0+$/.test(x);
+function scopedTarget(target, carrier) {
+    return object(target) && typeof target.repo === 'string' && target.repo.toLowerCase() === carrier.scope.repo.toLowerCase() &&
+        target.pr_number === carrier.scope.pr_number;
+}
+function sameRunSelection(a, b) {
+    return isDeepStrictEqual({ ...a, scope: { ...a.scope, repo: a.scope.repo.toLowerCase() } }, { ...b, scope: { ...b.scope, repo: b.scope.repo.toLowerCase() } });
+}
+async function listRuns(sink, carrier) {
+    const rows = [];
+    let total;
+    let pages = 1;
+    for (let page = 1; page <= Math.max(pages, 1); page++) {
+        const query = new URLSearchParams({ repo: carrier.scope.repo, pr: String(carrier.scope.pr_number),
+            page: String(page), page_size: '100', order_by: 'received_at', order_dir: 'asc' });
+        const answer = value(await sink.getJson(`/api/v1/reviews/runs?${query}`, (data, meta) => {
+            if (!object(meta) || meta.org_id !== carrier.scope.org_id || meta.evidence_protocol_version !== 2 ||
+                meta.page !== page || meta.page_size !== 100 || !count(meta.total) || meta.total > MAX_CARRIER_INVENTORY ||
+                meta.total_pages !== Math.ceil(meta.total / 100) || !Array.isArray(data) ||
+                data.length !== Math.min(100, Math.max(0, meta.total - (page - 1) * 100)))
+                return null;
+            const runs = [];
+            for (const row of data) {
+                if (!object(row) || !uuid(row.id) || !scopedTarget(row.target, carrier) ||
+                    !(row.converge === null || object(row.converge) && typeof row.converge.target === 'string' &&
+                        row.converge.target.trim() === row.converge.target && row.converge.target.length > 0 &&
+                        count(row.converge.round) && row.converge.round > 0))
+                    return null;
+                runs.push({ id: row.id, target: row.target, converge: row.converge });
+            }
+            return { runs, total: meta.total, pages: meta.total_pages };
+        }, { requireCompleteRead: true }));
+        if (total !== undefined && total !== answer.total)
+            conflict('carrier_inventory_pagination_changed');
+        total = answer.total;
+        pages = answer.pages;
+        rows.push(...answer.runs);
+    }
+    if (rows.length !== total || new Set(rows.map(r => r.id)).size !== rows.length)
+        conflict('carrier_inventory_duplicate_or_missing_run');
+    return rows.sort((a, b) => a.id.localeCompare(b.id));
+}
+async function runView(sink, carrier, listed, actor, fullHistory = false) {
+    return value(await sink.getJson(`/api/v1/reviews/runs/${listed.id}`, (data, meta) => {
+        if (!object(meta) || meta.org_id !== carrier.scope.org_id || meta.actor_user_id !== actor ||
+            meta.evidence_protocol_version !== 2 || meta.claim_recovery_version !== 1 || !object(meta.recovery) ||
+            (fullHistory ? typeof meta.recovery.truncated !== 'boolean' : meta.recovery.truncated !== false) || !count(meta.recovery.event_sequence) ||
+            !object(data) || data.id !== listed.id || !scopedTarget(data.target, carrier) ||
+            !['pr', 'patch'].includes(data.target.kind) || !head(data.target.head_sha) ||
+            !isDeepStrictEqual(data.target, listed.target) || !isDeepStrictEqual(data.converge, listed.converge) ||
+            !object(data.converge) || !count(data.converge.round) || data.converge.round < 1 ||
+            data.converge.target !== carrier.target || !Array.isArray(data.artifacts))
+            return null;
+        const artifacts = data.artifacts.filter(a => object(a) && a.kind === 'report_json');
+        if (artifacts.length !== 1 || !sha(artifacts[0].declared_sha256) || !count(artifacts[0].declared_bytes) ||
+            artifacts[0].declared_bytes > 25_000_000 || typeof artifacts[0].stored !== 'boolean')
+            return null;
+        const sequence = meta.recovery.event_sequence;
+        const recovery = meta.recovery;
+        const classification = recovery.classification_event;
+        if (!(classification === null || object(classification) && uuid(classification.id) && count(classification.sequence) &&
+            classification.sequence > 0 && classification.sequence <= sequence && classification.round === data.converge.round) ||
+            !Array.isArray(recovery.native_corrections) || recovery.native_corrections.length > MAX_CARRIER_INVENTORY)
+            return null;
+        const corrections = [];
+        const eventSelectors = classification === null ? [] : [{ id: classification.id,
+                sequence: classification.sequence, kind: 'round_processed' }];
+        const correctionIds = new Set();
+        const eventSequences = new Set(eventSelectors.map(event => event.sequence));
+        for (const correction of recovery.native_corrections) {
+            if (!object(correction) || !uuid(correction.id) || !count(correction.sequence) || correction.sequence < 1 ||
+                correction.sequence > sequence || correctionIds.has(correction.id) ||
+                classification !== null && correction.id === classification.id)
+                return null;
+            if (eventSequences.has(correction.sequence))
+                return null;
+            correctionIds.add(correction.id);
+            eventSequences.add(correction.sequence);
+            corrections.push(correction.id);
+            eventSelectors.push({ id: correction.id, sequence: correction.sequence, kind: 'finding_identity_corrected' });
+        }
+        return { data, recovery, sequence,
+            classificationId: classification === null ? null : classification.id,
+            correctionIds: corrections, eventSelectors, bytes: artifacts[0].declared_bytes, stored: artifacts[0].stored,
+            source: { selector: { scope: { ...carrier.scope, repo: data.target.repo, run_id: listed.id },
+                    target: carrier.target, round: data.converge.round, headSha: data.target.head_sha,
+                    reportSha256: artifacts[0].declared_sha256 }, reportJson: null, storedRun: data,
+                classifications: [], correctionIds: corrections, corrections: [] } };
+    }, { requireCompleteRead: true }));
+}
+async function material(sink, view, retainedBytes) {
+    const source = view.source;
+    if (view.stored) {
+        const read = value(await sink.getArtifact(source.selector.scope.run_id, 'report_json', view.bytes));
+        if (read.sha256 !== source.selector.reportSha256 || read.bytes.length !== view.bytes)
+            conflict('carrier_inventory_artifact_changed');
+        const report = read.bytes.toString('utf8');
+        if (!Buffer.from(report, 'utf8').equals(read.bytes))
+            conflict('carrier_inventory_invalid_utf8');
+        source.reportJson = report;
+    }
+    const ids = [...(view.classificationId ? [view.classificationId] : []), ...view.correctionIds];
+    const selectorsById = new Map(view.eventSelectors.map(selector => [selector.id, selector]));
+    for (let offset = 0; offset < ids.length; offset += 50) {
+        const read = value(await readEventReceipts(sink, source.selector.scope, ids.slice(offset, offset + 50)));
+        for (const receipt of read.receipts) {
+            retainedBytes += Buffer.byteLength(JSON.stringify(receipt), 'utf8');
+            if (retainedBytes > MAX_CARRIER_READ_BYTES)
+                conflict('carrier_inventory_read_limit');
+            const selector = selectorsById.get(receipt.id);
+            if (!selector || receipt.sequence !== selector.sequence || receipt.kind !== selector.kind ||
+                receipt.sequence > view.sequence || receipt.converge_target !== source.selector.target || receipt.round !== source.selector.round) {
+                conflict('carrier_inventory_receipt_selector_conflict');
+            }
+            if (receipt.id === view.classificationId)
+                source.classifications.push(receipt);
+            else
+                source.corrections.push(receipt);
+        }
+    }
+    return retainedBytes;
+}
+/**
+ * Enumerate the exact PR's retained original sources and selected receipts. All
+ * initial contexts precede material reads; all final contexts and re-enumeration
+ * follow them. This authenticates a stable read window, never global historical
+ * absence, carrier retirement, disposition standing or permission to mutate.
+ * Missing source parts remain explicit inputs to the residual projection.
+ */
+export async function readCarrierInventory(sink, carrier, actorUserId) {
+    carrier = structuredClone(carrier);
+    if (!carrier || !isEventReceiptScope(carrier.scope) || !uuid(actorUserId) || !uuid(carrier.classificationId) ||
+        !head(carrier.headSha) || !sha(carrier.reportSha256) || !/^[a-f0-9]{16}$/.test(carrier.identity) ||
+        !['classified_group', 'legacy_pending'].includes(carrier.kind) || !count(carrier.round) || carrier.round < 1 ||
+        carrier.round > MAX_CARRIER_PREFIX_ROUNDS || typeof carrier.target !== 'string' ||
+        !carrier.target || carrier.target.trim() !== carrier.target || carrier.target.length > 500) {
+        throw new Error('invalid_carrier_inventory_selection');
+    }
+    if (sink.credentialSource === 'attest')
+        throw new Error('unsupported_attested_recovery');
+    if (sink.baseUrl !== carrier.scope.base_url)
+        throw new Error('carrier_inventory_destination_conflict');
+    try {
+        const listed = await listRuns(sink, carrier);
+        const selected = listed.filter(run => {
+            if (carrier.kind === 'classified_group')
+                return run.id === carrier.scope.run_id;
+            if (run.converge?.target !== carrier.target)
+                return false;
+            if (!count(run.converge.round) || run.converge.round < 1)
+                conflict('carrier_inventory_invalid_round');
+            return run.converge.round <= carrier.round;
+        });
+        if (!selected.some(run => run.id === carrier.scope.run_id))
+            conflict('carrier_inventory_carrier_unavailable');
+        const views = [];
+        let retainedBytes = 0;
+        for (const run of selected) {
+            const view = await runView(sink, carrier, run, actorUserId);
+            retainedBytes += view.bytes + Buffer.byteLength(JSON.stringify([view.data, view.recovery]), 'utf8');
+            if (retainedBytes > MAX_CARRIER_READ_BYTES)
+                conflict('carrier_inventory_read_limit');
+            views.push(view);
+        }
+        const own = views.find(view => view.source.selector.scope.run_id === carrier.scope.run_id);
+        if (own.classificationId !== carrier.classificationId || !sameRunSelection(own.source.selector, { scope: carrier.scope, target: carrier.target, round: carrier.round,
+            headSha: carrier.headSha, reportSha256: carrier.reportSha256 }))
+            conflict('carrier_inventory_carrier_binding_conflict');
+        for (const view of views)
+            retainedBytes = await material(sink, view, retainedBytes);
+        for (let index = 0; index < selected.length; index++) {
+            const after = await runView(sink, carrier, selected[index], actorUserId);
+            const before = views[index];
+            if (!isDeepStrictEqual(after.data, before.data) || !isDeepStrictEqual(after.recovery, before.recovery)) {
+                conflict('carrier_inventory_source_changed');
+            }
+        }
+        if (!isDeepStrictEqual(await listRuns(sink, carrier), listed))
+            conflict('carrier_inventory_run_set_changed');
+        const token = Object.freeze({ qualification: 'authenticated-carrier-inventory-read' });
+        accepted.set(token, structuredClone({ actorUserId, inventory: { carrier, inventoryStatus: 'complete',
+                sources: views.map(view => view.source) }, runSequences: views.map(view => ({
+                runId: view.source.selector.scope.run_id, eventSequence: view.sequence
+            })) }));
+        return { kind: 'ok', httpStatus: 200, value: token };
+    }
+    catch (error) {
+        if (error instanceof FailedRead)
+            return error.result;
+        return { kind: 'unavailable', reason: 'carrier_inventory_read_failed' };
+    }
+}
+const histories = new WeakMap();
+export function claimHistoryContent(token) {
+    const content = histories.get(token);
+    if (!content)
+        throw new Error('unverified_claim_history');
+    return structuredClone(content);
+}
+function prefix(actual, complete, exhaustive) {
+    if (!Array.isArray(actual) || !actual.every(claimEventSelector) || actual.length > complete.length)
+        return false;
+    return isDeepStrictEqual(actual, complete.slice(0, actual.length)) && (!exhaustive || actual.length === complete.length);
+}
+/** All retained same-target sources, including later rounds, with a complete pinned
+ * index followed by exact selected receipt reads. Inline truncation alone never
+ * authenticates completeness. Both source and event ceilings are read again. */
+export async function readClaimTargetHistory(sink, selection, expectedActor) {
+    selection = structuredClone(selection);
+    if (!isEventReceiptScope(selection.scope) || !head(selection.headSha) || !sha(selection.reportSha256) ||
+        !count(selection.round) || selection.round < 1 || !selection.target || selection.target.trim() !== selection.target ||
+        expectedActor !== undefined && !uuid(expectedActor))
+        throw new Error('invalid_claim_history_selection');
+    if (sink.credentialSource === 'attest' || sink.baseUrl !== selection.scope.base_url)
+        throw new Error('claim_history_destination_conflict');
+    const startedAt = new Date().toISOString();
+    try {
+        // Bootstrap only the actor; this response grants no mutation authority.
+        const actor = value(await sink.getJson(`/api/v1/reviews/runs/${selection.scope.run_id}`, (data, meta) => object(data) && data.id === selection.scope.run_id && object(meta) && meta.org_id === selection.scope.org_id &&
+            meta.evidence_protocol_version === 2 && meta.claim_recovery_version === 1 && uuid(meta.actor_user_id) &&
+            (expectedActor === undefined || expectedActor === meta.actor_user_id) ? meta.actor_user_id : null, { requireCompleteRead: true }));
+        // Only scope fields are used by list/run readers. No synthetic carrier proof
+        // is exposed or accepted: the result contains original sources and receipts.
+        const scope = selection;
+        const listed = await listRuns(sink, scope);
+        const selected = listed.filter(run => run.converge?.target === selection.target);
+        if (!selected.some(run => run.id === selection.scope.run_id))
+            conflict('claim_history_source_unavailable');
+        const views = [];
+        let bytes = 0;
+        for (const row of selected) {
+            const view = await runView(sink, scope, row, actor, true);
+            bytes += view.bytes + Buffer.byteLength(JSON.stringify([view.data, view.recovery]));
+            if (bytes > MAX_CARRIER_READ_BYTES)
+                conflict('claim_history_read_limit');
+            views.push(view);
+        }
+        const own = views.find(v => v.source.selector.scope.run_id === selection.scope.run_id);
+        if (!sameRunSelection(own.source.selector, selection))
+            conflict('claim_history_source_binding_conflict');
+        const content = { readWindow: { startedAt, completedAt: startedAt }, actorUserId: actor, sources: [], histories: [] };
+        for (const view of views) {
+            const index = value(await readClaimEventIndex(sink, view.source.selector.scope, view.sequence));
+            if (typeof view.recovery.claim_events_complete !== 'boolean' ||
+                !prefix(view.recovery.claim_events, index, view.recovery.claim_events_complete))
+                conflict('claim_history_inline_index_conflict');
+            const corrections = index.filter(e => e.kind === 'finding_identity_corrected');
+            const inline = view.eventSelectors.filter(e => e.kind === 'finding_identity_corrected').sort((a, b) => a.sequence - b.sequence);
+            if (!prefix(inline, corrections, view.recovery.truncated === false))
+                conflict('claim_history_correction_prefix_conflict');
+            const classifications = index.filter(e => e.kind === 'round_processed');
+            if (view.classificationId === null ? classifications.length !== 0 :
+                !classifications.some(e => e.id === view.classificationId && view.eventSelectors.some(i => isDeepStrictEqual(i, e)))) {
+                conflict('claim_history_classification_selector_conflict');
+            }
+            const receipts = [];
+            for (let offset = 0; offset < index.length; offset += 50) {
+                const chunk = index.slice(offset, offset + 50);
+                const read = value(await readEventReceipts(sink, view.source.selector.scope, chunk.map(e => e.id)));
+                if (read.missing.length || read.receipts.length !== chunk.length)
+                    conflict('claim_history_receipt_unavailable');
+                for (const receipt of read.receipts) {
+                    const selected = chunk.find(e => e.id === receipt.id);
+                    if (receipt.sequence !== selected.sequence || receipt.kind !== selected.kind ||
+                        receipt.converge_target !== selection.target || receipt.round !== view.source.selector.round) {
+                        conflict('claim_history_receipt_selector_conflict');
+                    }
+                    bytes += Buffer.byteLength(JSON.stringify(receipt));
+                    if (bytes > MAX_CARRIER_READ_BYTES)
+                        conflict('claim_history_read_limit');
+                    receipts.push(receipt);
+                }
+            }
+            receipts.sort((a, b) => a.sequence - b.sequence);
+            view.source.classifications = receipts.filter(e => e.kind === 'round_processed');
+            view.source.corrections = receipts.filter(e => e.kind === 'finding_identity_corrected');
+            view.source.correctionIds = view.source.corrections.map(e => e.id);
+            if (view.stored) {
+                const raw = value(await sink.getArtifact(view.source.selector.scope.run_id, 'report_json', view.bytes));
+                if (raw.sha256 !== view.source.selector.reportSha256 || raw.bytes.length !== view.bytes ||
+                    !Buffer.from(raw.bytes.toString('utf8')).equals(raw.bytes))
+                    conflict('claim_history_artifact_conflict');
+                view.source.reportJson = raw.bytes.toString('utf8');
+            }
+            content.sources.push(view.source);
+            content.histories.push({ runId: view.source.selector.scope.run_id, eventSequence: view.sequence, receipts });
+        }
+        for (let i = 0; i < selected.length; i++) {
+            const after = await runView(sink, scope, selected[i], actor, true);
+            const before = views[i];
+            if (!isDeepStrictEqual(after.data, before.data) || !isDeepStrictEqual(after.recovery, before.recovery))
+                conflict('claim_history_changed');
+        }
+        if (!isDeepStrictEqual(await listRuns(sink, scope), listed))
+            conflict('claim_history_run_set_changed');
+        content.readWindow.completedAt = new Date().toISOString();
+        const token = Object.freeze({ qualification: 'authenticated-claim-history' });
+        histories.set(token, structuredClone(content));
+        return { kind: 'ok', httpStatus: 200, value: token };
+    }
+    catch (error) {
+        if (error instanceof FailedRead)
+            return error.result;
+        return { kind: 'unavailable', reason: 'claim_history_read_failed' };
+    }
+}
+export function sameClaimHistoryEvidence(first, second) {
+    const { readWindow: _first, ...a } = first;
+    const { readWindow: _second, ...b } = second;
+    return isDeepStrictEqual(a, b);
+}
+//# sourceMappingURL=carrier-inventory.js.map