vouchington-tooling 0.35.0 → 0.36.0

package/README.md

@@ -242,7 +242,6 @@ import {
   validateFixtureContracts,
   writeGeneratedFiles,
 } from 'vouchington-tooling/api-fixtures'
-import { discoverAppRouteCtxContractsV1 } from 'vouchington-tooling/api-contract-discovery'
 import { decide, deriveRetryAttempt } from 'vouchington-tooling/transient-retry'
 import { parseCsvRows, streamCsvRows } from 'vouchington-tooling/csv'
 import {
@@ -470,226 +469,6 @@ token-source router remains deprecated for one release line.
 filenames, tolerates partial files, returns only a bounded field allowlist, and never emits raw
 native frame symbols. Both structured reads and text rendering have hard report-count limits.
 
-`api-contract-discovery` is the version-one adapter for `app.route('/path').get/post/...` and
-`ctx` response conventions. Pass a classic TypeScript `program` and its route `sourceFiles` to
-`discoverAppRouteCtxContractsV1`. The result contains registered routes and response, request,
-query, and header contracts. The caller owns program construction, route-file selection, and
-generation. Pass `options.formatAliases` and `options.boundedArrayAlias` for application type
-aliases; `options.onRouteError` enables lenient response and request extraction. The adapter
-does not cache programs or depend on the caller's repository layout. OpenAPI document assembly
-remains a separate `openapi-document` call.
-
-`options.onAmbiguousAttribution` optionally emits facts for response calls lexically inside handler
-functions registered to multiple routes, plus inline response calls within those handlers. Facts
-are delivered after discovery succeeds, ordered by normalized source location; each callback gets
-its own copy of the sorted route list. It recognizes direct property handlers on `const`
-object-literal receivers, shorthand properties, immutable aliases, and inline handlers. Mutable
-receivers whose properties may be reassigned, variable receivers without object-literal initializers,
-and non-identifier receiver expressions fail closed for attribution.
-Direct identifier assignment, identifier writes through array/object destructuring or loop targets,
-identifier updates, and dot-property assignment or updates make that binding ineligible for attribution.
-Computed receiver-property writes, `delete`, runtime reflection, and other indirect mutation are not
-analyzed. Named helper calls are not followed transitively: for example, an
-emission inside `emit(ctx)` is not attributed when a registered `shared(ctx)` handler calls
-`emit(ctx)`. The callback does not change the discovered contract result.
-
-Query contracts (`apiQuery`) carry requiredness. A top-level parameter descriptor type may include
-`required: true` (inline or through an intersection such as `{ readonly required: true }`); the
-extracted descriptor then has `required: true` and the OpenAPI parameter emits `required: true`,
-otherwise `required: false`. `required` must be the literal `true`; `false`, `boolean`, optional, or
-non-literal values fail as a malformed query parameter, as do `required` together with `default` and
-`required` on `csv-array` `items`.
-
-`discoverRequestValidationFacts({ program, sourceFiles, validators, factories, executedCallbacks })`
-reports, per registered route (`METHOD:/template`), the route `kind` and `source`, every configured
-validator call its handlers reach (`validatorSites`), every configured handler-factory call
-(`factorySites`), and the raw request carriers the handlers read (`carrierReads`). It reports
-facts only; which routes must validate and what counts as covered stay with the caller.
-
-```ts
-import { discoverRequestValidationFacts } from 'vouchington-tooling/api-contract-discovery'
-
-const facts = discoverRequestValidationFacts({
-  program,
-  sourceFiles,
-  validators: [
-    {
-      module: 'lib/validation.ts', // resolved declaration path suffix, or a package specifier
-      exportName: 'validateInput',
-      operationArgument: 1,
-      carriers: { kind: 'input-object', argument: 2 }, // or { kind: 'fixed', carriers, optionCarriers }
-    },
-  ],
-  factories: [
-    {
-      module: 'lib/factory.ts',
-      exportName: 'createThingHandler',
-      optionsArgument: 0,
-      operationProperty: 'operation',
-      carriers: ['path', 'body'],
-    },
-  ],
-  executedCallbacks: [
-    {
-      module: 'lib/admit.ts',
-      exportName: 'admitWork',
-      argument: 0,
-      properties: ['beforeCapacity'],
-    },
-  ],
-})
-```
-
-A call matches only when its callee resolves, through aliases, re-exports and path mappings, to the
-configured export of a declaration file matching `module` (`.d.ts`, `.d.mts` and `.d.cts` suffixes
-are ignored when comparing, and the configured `module` may be written with or without a `.ts`,
-`.mts`, `.cts`, `.js`, `.mjs` or `.cjs` extension, so `lib/validation.js` matches `lib/validation.ts`
-and `lib/validation.d.ts`); import specifier text and same-named local functions never match.
-Operation keys resolve through literals, `const`s (including imported ones), `as const`,
-`satisfies`, helper parameters bound to static arguments, and, for factories, the option property
-including spread `const` objects; anything else, including a name with no symbol, gives
-`operation: null` with `unresolvedReason`. Each validated carrier reports `origins`, the request
-carriers (`path`, `query`, `body`, `header`) its value derives from, traced through calls, followed
-helper returns, branches, logical operands, spreads and earlier assignments; `unresolved` is set
-when part of the value depends on an unbound parameter. An unconditional reassignment of the
-identifier itself earlier in the same function body (not inside a branch, loop or `try`) replaces
-the earlier origins, conditional reassignments merge, and property writes such as `x.limit = n`
-always add; an assignment on a statically dead path (`if (false)`) is ignored. A destructured
-local traces only the property or element it binds (`const { chosen } = pair`), resolved through
-object and array literals, `const`s and followed helper returns (also awaited), and falls back to the
-whole initializer when it cannot be selected (rest, computed key, spread, unknown source).
-A destructured handler context parameter (`({ query, params, request }) => ...`) binds each member
-to its carrier. A helper parameter that is reassigned is not trusted as the bound operation key:
-only a lone unconditional reassignment is used, anything else gives `operation: null`.
-Generator functions are not followed, because calling one does not run its body.
-Fixed-carrier validators report the carrier itself as their origin.
-
-An input-object validator's input is resolved through `const` objects and spreads with
-last-write-wins semantics, like the factory option resolver. When it cannot be fully resolved (a
-non-literal input, a spread of something that is not a resolvable `const` object, a cyclic spread,
-or a computed property name), `carriers` lists what was found and the site sets
-`unresolvedCarriers` to the reason, so a consumer must not treat `carriers` as complete. A `const`
-object (input or factory options) with a property write before the use (`o.p = x`, `o[k] = x`,
-`delete o.p`, `o.n++`, `Object.assign(o, ...)`) is unresolvable too, and a factory then reports
-`operation: null`.
-
-`conditional` is true under `if`/ternary branches, the right of `&&`/`||`/`??`, `switch` cases,
-loop bodies, `catch` and `finally`. Handlers are walked into function declarations and `const`
-function expressions in `sourceFiles`, and only through bindings that are never reassigned (`let`
-and reassigned bindings are not trusted as handlers). A callback passed to a followed helper is
-followed only when the helper runs it, and is conditional unless it is invoked directly from the
-helper's own body outside any condition. Known limit: the invocations of an inline callback are
-found only in the callback's own source file, so a callback passed to a helper declared in another
-file (`withTx(ctx, async () => { validateInput(...) })`) is not walked. Inline callback properties of an `executedCallbacks` host,
-written as identifiers or string literals, are walked as executed and take only the condition of
-the call to the configured host, never how its implementation invokes them. Configured validator
-and factory implementations are never entered, but their callee and arguments are still walked for
-nested validator sites and reads; only reads that build a validator's input are left out, including
-reads inside a followed helper that only prepares that input. Validators evaluated while a handler is
-built (registration time) are not sites: only the walk of the handler reports validators. A handler a
-helper returns under a runtime branch (`if (flag) return ctx => ...`) reports `conditional: true`. Factory
-sites are reported for factory calls whose returned handler is a registration-time value (a route
-registration argument, a module `const` used as one, or a helper-returned handler); a factory call
-inside a handler body, such as a discarded `createThingHandler(options);`, is not a factory site.
-A factory site is also found through a module `const` initialized by a factory call that a handler
-calls (`const handler = createThingHandler({...})`, then `handler(ctx)`). Like validator sites,
-`FactorySite.conditional` is true when the site is reached only under a condition, and a site
-reached both ways is reported unconditional. A template-literal operation key folds to a string
-when every substitution resolves (literals, `const`s, bound parameters); otherwise it is `null`.
-
-Pass the `program` you already built: the function uses it as given and never builds its own.
-Helpers are followed only within `sourceFiles`, so pass every file that declares a followed helper,
-not just the route files; a helper declared elsewhere is not entered, which silently yields empty
-`origins` rather than an error. An omitted optional or defaulted helper argument contributes no
-origin and is not `unresolved`; an omitted required argument is `unresolved`. Per-call caches make
-repeated helpers cheap, so a 700-route program completes in seconds once the program exists.
-
-Each `carrierReads` entry has `access`: `key` for a static key (`ctx.query.limit`, destructured
-names, a resolvable `ctx.query[name]`), `computed` for a non-static key (`ctx.query[name]`, a
-computed destructuring key; `key: null`), and `whole` for the carrier used as a value
-(`consume(ctx.query)`, `{ ...ctx.params }`, `return ctx.headers`, a rest element) or a body read
-such as `ctx.request.json()` (`key: null`). A `const` alias of a carrier is not itself a read; its
-uses are.
-
-Version one recognizes literal-key `apiResponse`, `apiNoContent`, `apiOpenApiRawResponse`,
-`apiRequest`, `apiRequestContract`, `apiNoRequestBody`, `apiQuery`, and `apiHeaders` markers inside
-`app.route(...).get/post/put/patch/delete(...)` handlers. It also inspects unmarked `ctx.json`,
-`ctx.pipeline`, `ctx.response.empty/buffer/xml`, `ctx.request.json/buffer`, `parseJsonBody`,
-`ctx.setStatus`, and static `Content-Type` setters. The input source files and TypeScript checker
-are the source representation; the adapter does not parse or discover a repository on its own.
-Reading the handler context in another object's computed assignment key preserves its binding;
-assignments or updates to the context itself, including side effects inside that key, still reject it.
-
-Error-only 405 routes require a terminal throw on the handler's own context. Named handlers and
-imported wrappers are followed through compiler declarations; conditional, caught, recursive,
-fallthrough, and callback-only throws do not prove an error-only route. Empty `never[]` contracts
-render as arrays with no items, and `Record<string, never>` renders as a closed empty object.
-Standalone `never` and `any` remain unsupported contracts.
-
-Caller-owned `apiSseFrame(key, { event, data })` markers expose literal event names and concrete
-payloads from the frames actually written by a route, including callbacks passed to a handler
-factory. SSE responses keep a string body schema and describe each payload under the media
-type's `x-sse-events` map. Callback arguments require a concrete helper invocation path; ignored,
-declaration-only, deferred, or rewritten callbacks fail closed. Callback options passed to a callee
-without a concrete implementation also fail closed. Opaque callback escape checks include array and
-tuple containers, nested object properties, and literal array spreads. Factory callbacks must execute
-from the returned request handler; registration-time invocations do not prove a request emission. Compiler-resolved platform timers
-and Promise executors supply invocation paths using the caller Program's actual standard-library
-identities; shadowed, custom, or reassigned platform APIs do not. Mutation checks recognize Node's
-compiler-declared `global` as well as `globalThis`. Fluent route registrations retain their method. Stable named
-handlers and called local helpers are followed within their declaring source file. Ordinary response,
-request, query, and header markers also require callback invocation before route attribution.
-Broad names, unknown root payloads, executable unmarked frames through stream aliases, and
-conditional or mutable-context status changes fail closed. Called SSE helpers inherit the proven
-request context and its status at the invocation; mutually exclusive complete status branches retain
-their separate responses. Explicit SSE statuses must be integers from 100 through 599.
-Unconditional blocks preserve the last proven status setter; conditional or foreign overwrites fail closed.
-Indirect `setStatus.call`, `apply`, and `bind` forms fail closed instead of assuming status 200.
-Ambiguous caller contexts fail closed. A raw stream failure invalidates all
-selected SSE rows, including when only one protocol variant was requested. Object-literal wrapper
-receivers fail closed for marked frames because their properties can mutate; raw wrapper writes
-are matched to the original stream, including proven helper-parameter forwarding, overloaded helper
-implementations, and literal bracket
-methods. Compiler-resolved `Reflect.apply` calls use their actual receiver and payload.
-Unsupported computed methods on that receiver fail closed. Byte-bearing
-stream `end` calls and streams used as pipe destinations are raw emissions; empty terminal cleanup
-is preserved. Replacing a selected stream's `write` implementation invalidates its frame evidence.
-Binding a selected stream's `write` or `end` method fails closed because the bound
-method can escape the proven emission path. A callback that captures
-the route's stream or HTTP context and escapes to a callee without a concrete implementation can
-write undocumented bytes, so the affected response contracts fail closed. Uncalled local callbacks,
-dead branches, and implemented helpers that ignore their callback preserve the proven contracts.
-Cataloged SSE routes with only extracted non-SSE variants retain an unavailable event-stream
-possibility alongside those responses until the extracted variants describe the stream.
-
-Caller-owned `apiOpenApiHttpResponse(key, response)` markers bind a constant opaque response
-carrying optional readonly `apiHttpResponseVariants` metadata. Each concrete union variant has
-`status` and `bodyKind`; content variants also have `mediaType` and `body`. Discovery associates
-the marked variable's status and body emissions without reading or replacing response bytes.
-Feasible assignments, deletions, or updates to its body or status, including cast and constant
-aliases, invalidate the selected contracts because their metadata no longer proves the dispatch.
-A status setter must dominate each body emission, including separate branches; constant context
-aliases are followed, assigned mutable context aliases and object-literal context wrappers fail closed,
-and helper parameters must resolve to the registered caller's unchanged response context.
-Helper-owned contracts also account for response emissions in their proven caller scopes.
-Opaque callees receiving the canonical HTTP context or its response object invalidate its contract;
-implemented helpers and consumed callbacks retain their proven dispatch behavior.
-Feasible assignments or deletions of response methods through canonical context aliases invalidate
-that dispatch evidence; dead, ignored, or unrelated method mutations preserve the contract.
-Indirect response `call`, `apply`, and `bind` forms fail closed, including borrowed context receivers.
-Compiler-resolved standard `Reflect.apply` uses its target and actual receiver to reject unrepresented
-HTTP emissions; project implementations, unrelated contexts, and non-executed calls are preserved.
-SSE frames and branded content variants reject body-forbidden 1xx, 204, 205, and 304 statuses.
-Literal bracket response methods have the same emission checks as property methods. Unrelated raw emissions
-remain unavailable. Separate branded response branches are checked together, and the nearest
-proven status setter for each body must belong to that response. Observed content and bodyless
-emissions must match the complete metadata union, including an empty response in the `else` branch
-of a positive body check. Exact requested protocol rows are selected before
-other payloads, media types, or statuses are validated. In lenient mode, incomplete marker evidence
-keeps every selected sibling unavailable. Explicit 400 content variants also include the framework's
-JSON error schema independently of their own media type. Explicit bodyless 400 metadata also
-retains that framework JSON possibility and fails closed on the conflicting body kinds.
-
 Fork diagnostics use a caller-selected `recordDirectory` in both the worker setup file and the
 main-process reporter. Call `registerForkExitSentinel({ recordDirectory })` once per fork, then
 update `setCurrentForkExitModule` and `setCurrentForkExitProject` around tests. Construct
@@ -897,3 +676,27 @@ in `.tsx`. Template expressions join their static fragments for DML matching, wh
 for generated-table facts come from templates rather than ordinary quoted strings. Dynamic
 eligibility-table matching expects an unquoted literal immediately after the DML prefix and does
 not recognize `DELETE FROM ONLY`.
+
+## Publication reader source facts
+
+The same subpath exports `sourceImportsAndComposesAny`, `sourceImportsAndUsesBoundaryAny`, and
+`sourceFiltersWithPublicBoundary`. Each accepts source text, selected imported symbols, and
+`ReaderSourceAnalysisOptions`. Configure allowed modules per imported symbol, SQL tag and executor
+imports through the existing `ReaderSqlTemplateOptions`, the ignored-call identifier, and the
+candidate ID property. Missing import configuration admits no module.
+
+These functions preserve the existing lexical source heuristics: named import aliases, local
+builder bindings, reassignment rejection, append/push consumption, returned boundary results,
+and collection filtering with the selected ID set. They do not prove runtime execution, general
+call graphs, or type identity. Malformed source throws through the ESTree parser. Inventory
+selection, classifications, exceptions, and diagnostics remain consumer policy.
+
+`composesPublicEligibilityView(source, options)` checks live SQL fragments with
+`ReaderPublicViewOptions`: SQL extraction settings, source and eligibility relation names, and
+their ID columns. Await `initSqlAst()` from `vouchington-tooling/sql-ast` before calling it. The
+existing parser is reused; no separate SQL facts or parser dependency is introduced.
+
+The check preserves the existing nested SELECT/CTE, equality, inner-join, and correlated EXISTS
+heuristics. It rejects weakened OR/NOT/boolean/CASE predicates and non-filtering left joins. Every
+recognized live source reader must be protected. Unparseable SQL fragments are skipped; malformed
+source returns false. These are bounded syntactic heuristics, not a general SQL safety proof.

package/dist/agent-blackboard/feedback-audit-source.mjs

@@ -1,5 +1,5 @@
-import { buildSessionFrictionReport, } from '../session-friction/index.mjs';
-import { buildJournalAuditReport, } from './feedback-journal-audit.mjs';
+import { buildSessionFrictionReport, } from "../session-friction/index.mjs";
+import { buildJournalAuditReport, } from "./feedback-journal-audit.mjs";
 const ASSESSED_SOURCE_ERROR = 'complete feedback coverage requires assessed available factual and finding sources';
 const NOT_ASSESSED_MARKDOWN = '## CI Failures\nStatus: unavailable (not assessed)\n\n## Sandbox & Permission Audit\nStatus: unavailable (not assessed)';
 export function assertSingleAuditSource(input) {

package/dist/agent-blackboard/feedback-canonical.mjs

@@ -1,4 +1,4 @@
-import { isObject } from './snapshot-partition-guards.mjs';
+import { isObject } from "./snapshot-partition-guards.mjs";
 export function canonicalFeedback(value) {
     return JSON.stringify(ordered(value));
 }

package/dist/agent-blackboard/feedback-codec.mjs

@@ -1,6 +1,6 @@
-import { normalizeRepositories, validateFeedbackText, validateFeedbackReferences, } from './feedback-fields.mjs';
-export { normalizeRepositories } from './feedback-fields.mjs';
-import { isCount, isObject } from './snapshot-partition-guards.mjs';
+import { normalizeRepositories, validateFeedbackText, validateFeedbackReferences, } from "./feedback-fields.mjs";
+export { normalizeRepositories } from "./feedback-fields.mjs";
+import { isCount, isObject } from "./snapshot-partition-guards.mjs";
 const FEEDBACK_MAX_BYTES = 16_384;
 const OUTCOMES = [
     'in-progress',

package/dist/agent-blackboard/feedback-compose.mjs

@@ -1,8 +1,8 @@
-import { runRetrospectiveFactsReport, } from '../retrospective-facts/index.mjs';
-import { runRetrospectiveTranscriptReport, } from '../retrospective-transcript/index.mjs';
-import { assertSingleAuditSource, auditAssessed, buildAuditReport, completeCoverageError, } from './feedback-audit-source.mjs';
-import { createFeedbackEnvelope, redactFeedbackText } from './feedback-codec.mjs';
-import { validateFeedbackText } from './feedback-fields.mjs';
+import { runRetrospectiveFactsReport, } from "../retrospective-facts/index.mjs";
+import { runRetrospectiveTranscriptReport, } from "../retrospective-transcript/index.mjs";
+import { assertSingleAuditSource, auditAssessed, buildAuditReport, completeCoverageError, } from "./feedback-audit-source.mjs";
+import { createFeedbackEnvelope, redactFeedbackText } from "./feedback-codec.mjs";
+import { validateFeedbackText } from "./feedback-fields.mjs";
 function assessment(title, value) {
     if (!['findings', 'none-observed', 'not-assessed', 'unavailable'].includes(value.status))
         throw new Error('assessment status must be explicit');

package/dist/agent-blackboard/feedback-deadline.mjs

@@ -1,4 +1,4 @@
-import { FeedbackDeliveryError } from './feedback-online-error.mjs';
+import { FeedbackDeliveryError } from "./feedback-online-error.mjs";
 export async function feedbackDeadline(operation, timeoutMs = 20_000) {
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 20_000)
         throw new Error('feedback timeoutMs must be between 1 and 20000');

package/dist/agent-blackboard/feedback-delivery.mjs

@@ -1,9 +1,9 @@
-import { createFeedbackEnvelope, validateFeedbackEnvelope } from './feedback-codec.mjs';
-import { validateFeedbackIdentity } from './feedback-identity.mjs';
-import { deliverFeedbackOnline } from './feedback-online.mjs';
-import { FeedbackDeliveryError, feedbackDiagnostic } from './feedback-online-error.mjs';
-import { feedbackOutboxStatus, listFeedbackOutbox, persistFeedbackOutbox, removeFeedbackOutbox, } from './feedback-outbox.mjs';
-export { FeedbackDeliveryError } from './feedback-online-error.mjs';
+import { createFeedbackEnvelope, validateFeedbackEnvelope } from "./feedback-codec.mjs";
+import { validateFeedbackIdentity } from "./feedback-identity.mjs";
+import { deliverFeedbackOnline } from "./feedback-online.mjs";
+import { FeedbackDeliveryError, feedbackDiagnostic } from "./feedback-online-error.mjs";
+import { feedbackOutboxStatus, listFeedbackOutbox, persistFeedbackOutbox, removeFeedbackOutbox, } from "./feedback-outbox.mjs";
+export { FeedbackDeliveryError } from "./feedback-online-error.mjs";
 export async function writeFeedback(input) {
     if (input.mode !== 'interactive' && input.mode !== 'autonomous')
         throw new Error('feedback mode must be explicitly interactive or autonomous');

package/dist/agent-blackboard/feedback-fields.mjs

@@ -1,4 +1,4 @@
-import { isWellFormedUnicode } from '../session-friction/text.mjs';
+import { isWellFormedUnicode } from "../session-friction/text.mjs";
 export function validateFeedbackText(value, label, maximum) {
     if (typeof value !== 'string' ||
         !value.trim() ||

package/dist/agent-blackboard/feedback-identity.mjs

@@ -1,6 +1,6 @@
-import { isWellFormedUnicode } from '../session-friction/text.mjs';
-import { assertSessionId } from './session-id.mjs';
-import { isObject } from './snapshot-partition-guards.mjs';
+import { isWellFormedUnicode } from "../session-friction/text.mjs";
+import { assertSessionId } from "./session-id.mjs";
+import { isObject } from "./snapshot-partition-guards.mjs";
 export function validateFeedbackIdentity(identity) {
     if (!isObject(identity) || typeof identity.sessionId !== 'string')
         throw new Error('explicit feedback identity is required');

package/dist/agent-blackboard/feedback-journal-audit.mjs

@@ -1,7 +1,7 @@
-import { buildCiFailuresSection, getConformingGroups, incompleteCiSection, } from '../session-friction/ci-failures.mjs';
-import { scanJournal } from '../session-friction/journal.mjs';
-import { validateSessionId } from '../session-friction/session-id.mjs';
-import { getConformingSandboxBlocks, journalSandboxSection, unavailableSandboxSection, } from './feedback-journal-sandbox.mjs';
+import { buildCiFailuresSection, getConformingGroups, incompleteCiSection, } from "../session-friction/ci-failures.mjs";
+import { scanJournal } from "../session-friction/journal.mjs";
+import { validateSessionId } from "../session-friction/session-id.mjs";
+import { getConformingSandboxBlocks, journalSandboxSection, unavailableSandboxSection, } from "./feedback-journal-sandbox.mjs";
 function report(journalStatus, markdown) {
     return { coverage: { journalStatus, frictionStatus: 'journal-only', truncated: false }, markdown };
 }

package/dist/agent-blackboard/feedback-journal-sandbox.mjs

@@ -1,4 +1,4 @@
-import { conformingBlocks, matchAuditBlock } from '../session-friction/audit-block.mjs';
+import { conformingBlocks, matchAuditBlock } from "../session-friction/audit-block.mjs";
 const SANDBOX_SECTION_HEADER = '## Sandbox & Permission Audit';
 const SOURCE = 'journal entries only; no friction log observed';
 const EVIDENCE = /^ {2}- Evidence: .*[^\s]$/;

package/dist/agent-blackboard/feedback-online-error.mjs

@@ -1,4 +1,4 @@
-import { isObject } from './snapshot-partition-guards.mjs';
+import { isObject } from "./snapshot-partition-guards.mjs";
 export class FeedbackDeliveryError extends Error {
     status = 'blocked';
     diagnostic;

package/dist/agent-blackboard/feedback-online.mjs

@@ -1,10 +1,10 @@
-import { feedbackDeadline } from './feedback-deadline.mjs';
-import { FeedbackDeliveryError, feedbackDiagnostic } from './feedback-online-error.mjs';
-import { canonicalFeedback, canonicalFeedbackEvent } from './feedback-canonical.mjs';
-import { loadClient, resolveBlackboardConnection } from './client.mjs';
-import { normalizeRepositories, validateFeedbackEnvelope } from './feedback-codec.mjs';
-import { validateFeedbackIdentity } from './feedback-identity.mjs';
-import { isObject } from './snapshot-partition-guards.mjs';
+import { feedbackDeadline } from "./feedback-deadline.mjs";
+import { FeedbackDeliveryError, feedbackDiagnostic } from "./feedback-online-error.mjs";
+import { canonicalFeedback, canonicalFeedbackEvent } from "./feedback-canonical.mjs";
+import { loadClient, resolveBlackboardConnection } from "./client.mjs";
+import { normalizeRepositories, validateFeedbackEnvelope } from "./feedback-codec.mjs";
+import { validateFeedbackIdentity } from "./feedback-identity.mjs";
+import { isObject } from "./snapshot-partition-guards.mjs";
 async function ensureSession(sessions, identity) {
     try {
         return await sessions.ensure({

package/dist/agent-blackboard/feedback-outbox-counts.mjs

@@ -1,5 +1,5 @@
-import { assertSessionId } from './session-id.mjs';
-import { readFeedbackOutbox } from './feedback-outbox.mjs';
+import { assertSessionId } from "./session-id.mjs";
+import { readFeedbackOutbox } from "./feedback-outbox.mjs";
 /** Counts a session separately from all retry records in the shared worktree outbox. */
 export function feedbackOutboxCounts(directory, sessionId) {
     assertSessionId(sessionId);

package/dist/agent-blackboard/feedback-outbox.mjs

@@ -1,13 +1,13 @@
-import { canonicalFeedback, canonicalFeedbackEvent } from './feedback-canonical.mjs';
+import { canonicalFeedback, canonicalFeedbackEvent } from "./feedback-canonical.mjs";
 import { createHash, randomUUID } from 'node:crypto';
 import { closeSync, constants, fsyncSync, fstatSync, openSync, readdirSync, renameSync, unlinkSync, } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
-import { ensureOutboxDirectory } from './feedback-outbox-directory.mjs';
-import { withFileLock } from '../session-friction/lock.mjs';
-import { openLogFile, readLogContent, writeAll } from '../session-friction/log-file.mjs';
-import { validateFeedbackEnvelope } from './feedback-codec.mjs';
-import { validateFeedbackIdentity } from './feedback-identity.mjs';
-import { isObject } from './snapshot-partition-guards.mjs';
+import { ensureOutboxDirectory } from "./feedback-outbox-directory.mjs";
+import { withFileLock } from "../session-friction/lock.mjs";
+import { openLogFile, readLogContent, writeAll } from "../session-friction/log-file.mjs";
+import { validateFeedbackEnvelope } from "./feedback-codec.mjs";
+import { validateFeedbackIdentity } from "./feedback-identity.mjs";
+import { isObject } from "./snapshot-partition-guards.mjs";
 const FEEDBACK_OUTBOX_MAX_RECORDS = 128;
 const FEEDBACK_OUTBOX_MAX_BYTES = 2_000_000;
 const RECORD_MAX_BYTES = 18_000;

package/dist/agent-blackboard/index.mjs

@@ -1,11 +1,11 @@
-import { appendJournalMarkdown, checkJournalInput } from './journal.mjs';
-import { loadClient, resolveBlackboardConnection, } from './client.mjs';
+import { appendJournalMarkdown, checkJournalInput } from "./journal.mjs";
+import { loadClient, resolveBlackboardConnection, } from "./client.mjs";
 import { readFile } from 'node:fs/promises';
-import { assertSessionId } from './session-id.mjs';
-export { cleanupSnapshotPartitions, partitionSnapshot } from './snapshot.mjs';
-export { assertSessionId } from './session-id.mjs';
-export { appendJournalMarkdown } from './journal.mjs';
-export { archiveBlackboardSession, ensureBlackboardSession, exportSnapshot, } from './session-tools.mjs';
+import { assertSessionId } from "./session-id.mjs";
+export { cleanupSnapshotPartitions, partitionSnapshot } from "./snapshot.mjs";
+export { assertSessionId } from "./session-id.mjs";
+export { appendJournalMarkdown } from "./journal.mjs";
+export { archiveBlackboardSession, ensureBlackboardSession, exportSnapshot, } from "./session-tools.mjs";
 export async function probeBlackboard(env, dependencies) {
     const { Sessions } = await loadClient(dependencies);
     await new Sessions(resolveBlackboardConnection(env)).list({ limit: 1 });
@@ -58,9 +58,9 @@ export function formatJournalEntries(sessionId, entries) {
         .map(({ createdAt, markdown }) => `## ${createdAt}\n\n${markdown}`)
         .join('\n\n');
 }
-export { resolveBlackboardConnection } from './client.mjs';
-export { createFeedbackEnvelope, validateFeedbackEnvelope } from './feedback-codec.mjs';
-export { writeFeedback, verifyFreshFeedback, flushFeedbackOutbox, FeedbackDeliveryError, } from './feedback-delivery.mjs';
-export { feedbackOutboxStatus, readFeedbackOutbox } from './feedback-outbox.mjs';
-export { composeRetrospective } from './feedback-compose.mjs';
-export { feedbackOutboxCounts } from './feedback-outbox-counts.mjs';
+export { resolveBlackboardConnection } from "./client.mjs";
+export { createFeedbackEnvelope, validateFeedbackEnvelope } from "./feedback-codec.mjs";
+export { writeFeedback, verifyFreshFeedback, flushFeedbackOutbox, FeedbackDeliveryError, } from "./feedback-delivery.mjs";
+export { feedbackOutboxStatus, readFeedbackOutbox } from "./feedback-outbox.mjs";
+export { composeRetrospective } from "./feedback-compose.mjs";
+export { feedbackOutboxCounts } from "./feedback-outbox-counts.mjs";

package/dist/agent-blackboard/journal.mjs

@@ -1,6 +1,6 @@
-import { createFeedbackEnvelope, normalizeRepositories } from './feedback-codec.mjs';
-import { writeFeedback } from './feedback-delivery.mjs';
-import { assertSessionId } from './session-id.mjs';
+import { createFeedbackEnvelope, normalizeRepositories } from "./feedback-codec.mjs";
+import { writeFeedback } from "./feedback-delivery.mjs";
+import { assertSessionId } from "./session-id.mjs";
 /** Validates the identity, repositories, and timestamp before any note text is read. */
 export function checkJournalInput(input) {
     assertSessionId(input.sessionId);

package/dist/agent-blackboard/session-tools.mjs

@@ -1,7 +1,7 @@
-import { loadClient, resolveBlackboardConnection, } from './client.mjs';
-import { validateFeedbackIdentity } from './feedback-identity.mjs';
-import { assertSessionId } from './session-id.mjs';
-import { isObject } from './snapshot-partition-guards.mjs';
+import { loadClient, resolveBlackboardConnection, } from "./client.mjs";
+import { validateFeedbackIdentity } from "./feedback-identity.mjs";
+import { assertSessionId } from "./session-id.mjs";
+import { isObject } from "./snapshot-partition-guards.mjs";
 const UPGRADE_HINT = 'upgrade agent-blackboard in the consumer package';
 /** Idempotently creates the session; an existing session must match the supplied identity. */
 export async function ensureBlackboardSession(input) {

package/dist/agent-blackboard/snapshot-cleanup-directory.mjs

@@ -1,7 +1,7 @@
 import { join } from 'node:path';
-import { RECEIPT_NAME, sameCleanupReceipt } from './snapshot-cleanup-receipt.mjs';
-import { removeResumeReceipt, writeResumeReceipt } from './snapshot-cleanup-resume.mjs';
-import { assertPartitionFile, validatePartition } from './snapshot-partition-validate.mjs';
+import { RECEIPT_NAME, sameCleanupReceipt } from "./snapshot-cleanup-receipt.mjs";
+import { removeResumeReceipt, writeResumeReceipt } from "./snapshot-cleanup-resume.mjs";
+import { assertPartitionFile, validatePartition } from "./snapshot-partition-validate.mjs";
 const PARTITION = /^partition-([1-9][0-9]*)\.jsonl$/;
 export async function removePartitionDirectory(filesystem, path, originalPath, receipt, directory, resume, startDeleting) {
     const names = await filesystem.readdir(path);

package/dist/agent-blackboard/snapshot-cleanup-receipt.mjs

@@ -1,7 +1,7 @@
 import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
 import { chmod, lstat, writeFile } from 'node:fs/promises';
 import { basename, join } from 'node:path';
-import { loadCleanupSigningKey } from './snapshot-cleanup-key.mjs';
+import { loadCleanupSigningKey } from "./snapshot-cleanup-key.mjs";
 export const RECEIPT_NAME = '.agent-blackboard-cleanup-receipt.json';
 function record(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);

package/dist/agent-blackboard/snapshot-cleanup-resume.mjs

@@ -3,7 +3,7 @@ import { constants } from 'node:fs';
 import { link, lstat, open, readFile, readdir, rm, unlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { sameCleanupReceipt, verifyCleanupReceipt } from './snapshot-cleanup-receipt.mjs';
+import { sameCleanupReceipt, verifyCleanupReceipt } from "./snapshot-cleanup-receipt.mjs";
 const defaults = { link, lstat, open, readFile, readdir, rm, unlink };
 let filesystem = defaults;
 export function setResumeFilesystemForTest(overrides) {
@@ -65,7 +65,7 @@ export async function writeResumeReceipt(receipt) {
     let file;
     try {
         file = await filesystem.open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o400);
-        const { serializeCleanupReceipt } = await import('./snapshot-cleanup-receipt.mjs');
+        const { serializeCleanupReceipt } = await import("./snapshot-cleanup-receipt.mjs");
         await file.writeFile(serializeCleanupReceipt(receipt));
         await file.sync();
         await file.close();

package/dist/agent-blackboard/snapshot-partition-cleanup.mjs

@@ -2,9 +2,9 @@ import { randomUUID } from 'node:crypto';
 import { lstat, readFile, readdir, rename, rm, rmdir } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
-import { verifyCleanupReceipt } from './snapshot-cleanup-receipt.mjs';
-import { removePartitionDirectory } from './snapshot-cleanup-directory.mjs';
-import { removeResumeReceipt, requireResumeReceipt, writeResumeReceipt, } from './snapshot-cleanup-resume.mjs';
+import { verifyCleanupReceipt } from "./snapshot-cleanup-receipt.mjs";
+import { removePartitionDirectory } from "./snapshot-cleanup-directory.mjs";
+import { removeResumeReceipt, requireResumeReceipt, writeResumeReceipt, } from "./snapshot-cleanup-resume.mjs";
 const SOURCE_NAME = /^agent-blackboard-snapshot-[0-9a-f-]{36}\.jsonl$/;
 const DIRECTORY_NAME = /^agent-blackboard-partitions-[A-Za-z0-9]+$/;
 const defaults = { lstat, readFile, readdir, rename, rm, rmdir };

package/dist/agent-blackboard/snapshot-partition-format.mjs

@@ -1,6 +1,6 @@
-import { assertSessionId } from './session-id.mjs';
-import { isManifest, isSession } from './snapshot-partition-predicates.mjs';
-import { isObject, isTimestamp } from './snapshot-partition-guards.mjs';
+import { assertSessionId } from "./session-id.mjs";
+import { isManifest, isSession } from "./snapshot-partition-predicates.mjs";
+import { isObject, isTimestamp } from "./snapshot-partition-guards.mjs";
 function isEntry(value) {
     if (isObject(value) &&
         typeof value.sessionId === 'string' &&

package/dist/agent-blackboard/snapshot-partition-predicates.mjs

@@ -1,5 +1,5 @@
-import { assertSessionId } from './session-id.mjs';
-import { isCount, isObject, isTimestamp } from './snapshot-partition-guards.mjs';
+import { assertSessionId } from "./session-id.mjs";
+import { isCount, isObject, isTimestamp } from "./snapshot-partition-guards.mjs";
 function isSelection(value) {
     if (!isObject(value) || value.archived !== false)
         return false;

package/dist/agent-blackboard/snapshot-partition-read.mjs

@@ -1,8 +1,8 @@
 import { createHash } from 'node:crypto';
 import { open } from 'node:fs/promises';
 import { join } from 'node:path';
-import { assertManifest, consumeSnapshotRecord, parseSnapshotRecord, snapshotLine, } from './snapshot-partition-format.mjs';
-import { readLines, writeAll } from './snapshot-partition-io.mjs';
+import { assertManifest, consumeSnapshotRecord, parseSnapshotRecord, snapshotLine, } from "./snapshot-partition-format.mjs";
+import { readLines, writeAll } from "./snapshot-partition-io.mjs";
 export async function stageSnapshot(source, directory) {
     const index = join(directory, 'index.jsonl');
     const indexFile = await open(index, 'wx', 0o600);

package/dist/agent-blackboard/snapshot-partition-validate.mjs

@@ -1,8 +1,8 @@
 import { createHash } from 'node:crypto';
 import { constants } from 'node:fs';
 import { open } from 'node:fs/promises';
-import { consumeSnapshotRecord, assertManifest, parseSnapshotRecord, } from './snapshot-partition-format.mjs';
-import { readLines } from './snapshot-partition-io.mjs';
+import { consumeSnapshotRecord, assertManifest, parseSnapshotRecord, } from "./snapshot-partition-format.mjs";
+import { readLines } from "./snapshot-partition-io.mjs";
 export function assertPartitionFile(info) {
     if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (info.mode & 0o222) !== 0)
         throw new Error('partition directory contains an unsafe partition');

package/dist/agent-blackboard/snapshot-partition-write.mjs

@@ -2,8 +2,8 @@ import { createHash } from 'node:crypto';
 import { constants } from 'node:fs';
 import { chmod, open, rename } from 'node:fs/promises';
 import { join } from 'node:path';
-import { countsFor, manifestFor, snapshotLine, } from './snapshot-partition-format.mjs';
-import { readLines, writeAll } from './snapshot-partition-io.mjs';
+import { countsFor, manifestFor, snapshotLine, } from "./snapshot-partition-format.mjs";
+import { readLines, writeAll } from "./snapshot-partition-io.mjs";
 async function copyBlock(block, output, hash) {
     const input = await open(block.path, constants.O_RDONLY | constants.O_NOFOLLOW);
     const buffer = Buffer.allocUnsafe(64 * 1024);