@cleocode/core 2026.6.13 → 2026.6.15

package/dist/playbooks/guarded-deterministic-runner.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Guarded deterministic-node runner — routes EVERY `deterministic` (shell/tool)
+ * dispatch in `executePlaybook` through the `guard.ts` deny-first chokepoint
+ * (T11802 · M4 cantbook done-gate).
+ *
+ * ## The gap this closes (AC1)
+ *
+ * The playbook runtime (`@cleocode/playbooks/runtime`) executes `deterministic`
+ * nodes through an INJECTED `DeterministicRunner`. When no runner is injected it
+ * degrades to `AgentDispatcher.dispatch` with a synthetic `deterministic:<cmd>`
+ * agent id — a path that NEVER touches the `guard.ts` shell denylist. So a
+ * `.cantbook` shell step could spawn a subprocess that bypasses the single
+ * policy point.
+ *
+ * This factory builds the CANONICAL production `DeterministicRunner`: every
+ * command is funnelled through the injected {@link GuardedToolSurface}'s
+ * `executeShell` — the SAME deny-first command policy + env-scrub chokepoint
+ * (`createToolGuard`) that in-process skill nodes already use (T11477). There is
+ * NO second subprocess code path: shell steps and skill→tool calls share ONE
+ * guard. The runtime stays a pure state machine (it imports no `child_process`);
+ * the guard owns the spawn (AC1).
+ *
+ * ## Deny semantics (AC3)
+ *
+ * The guard's `executeShell` checks the command basename against the policy
+ * denylist BEFORE any process is spawned. In `mode: 'enforce'` a denied command
+ * rejects with {@link GuardDeniedError} (`E_TOOL_GUARD_DENIED`); this runner
+ * catches that rejection and maps it to a contract-clean
+ * `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * semantics stay intact (the runtime contract is non-throwing). In `mode: 'warn'`
+ * the guard logs-and-proceeds — the denylist is advisory — so a guarded runner
+ * built for enforcement MUST be constructed from an `enforce`-mode guard.
+ *
+ * ## Why a factory over a guard (DIP)
+ *
+ * The runner depends on the abstract {@link GuardedToolSurface} (the contract
+ * shape of `createToolGuard()`), NOT on the concrete guard — so the policy point
+ * is injected, exactly mirroring {@link createSkillNodeExecutor}. `core` builds
+ * the guard once (`createToolGuard({ allowedRoots, deniedCommands, mode })`) and
+ * hands the same surface to BOTH the skill executor and this deterministic
+ * runner.
+ *
+ * @epic T11391
+ * @task T11802
+ * @saga T11387
+ * @see ../tools/guard.ts — the deny-first chokepoint
+ * @see ./skill-node-executor.ts — the sibling in-process skill path
+ */
+import type { GuardedToolSurface } from '@cleocode/contracts/tools/skill-executor';
+/**
+ * Canonical deny-list of destructive command basenames a `.cantbook`
+ * `deterministic` node may NOT run (T11802 · AC3). This is the SSoT the
+ * production dispatcher hands to `createToolGuard({ deniedCommands })` so the
+ * SAME chokepoint that guards in-process skill→tool calls also rejects a
+ * dangerous shell step. Matched against the command's last path segment by the
+ * guard, so `/bin/rm` and `rm` are both denied.
+ *
+ * Intentionally conservative — destructive disk / process / system operations a
+ * planning playbook should never invoke. Extend deliberately; every addition is
+ * a policy decision.
+ */
+export declare const DEFAULT_DETERMINISTIC_DENIED_COMMANDS: readonly string[];
+/**
+ * Minimal projection of the playbook runtime's `DeterministicRunInput` that the
+ * guarded runner consumes. Declared structurally so `@cleocode/core` does NOT
+ * import `@cleocode/playbooks` (preserves the directed layering
+ * `contracts → core → playbooks`). The runtime's input is structurally
+ * assignable to this shape.
+ */
+export interface GuardedDeterministicInput {
+    /** Playbook run identifier (FK into `playbook_runs.run_id`). */
+    readonly runId: string;
+    /** Node identifier within the run graph. */
+    readonly nodeId: string;
+    /** Executable to run (NOT a shell string — args are passed separately). */
+    readonly command: string;
+    /** Arguments passed to {@link GuardedDeterministicInput.command}. */
+    readonly args: readonly string[];
+    /** Working directory. Defaults to `process.cwd()` in the shell primitive. */
+    readonly cwd?: string;
+    /** Extra environment variables merged (and scrubbed) over the child env. */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Hard timeout in milliseconds; the process is killed when exceeded. */
+    readonly timeout_ms?: number;
+}
+/**
+ * Terminal output of a guarded deterministic execution. Structurally identical
+ * to the runtime's `DeterministicRunResult` so this runner is assignable to the
+ * runtime's `DeterministicRunner` interface without a wrapper.
+ */
+export interface GuardedDeterministicResult {
+    status: 'success' | 'failure';
+    /** Key-value pairs merged into the run context on success. */
+    output: Record<string, unknown>;
+    /** Human-readable failure reason on `status === 'failure'`. */
+    error?: string;
+}
+/**
+ * Structural match for the playbook runtime's `DeterministicRunner` interface.
+ * Re-declared here (not imported) for the same directed-layering reason as
+ * {@link GuardedDeterministicInput}.
+ */
+export interface GuardedDeterministicRunner {
+    run(input: GuardedDeterministicInput): Promise<GuardedDeterministicResult>;
+}
+/**
+ * Options accepted by {@link createGuardedDeterministicRunner}.
+ *
+ * @task T11802
+ */
+export interface GuardedDeterministicRunnerOptions {
+    /**
+     * The deny-first guarded tool surface every deterministic command is routed
+     * through. Typically the SAME `createToolGuard({ allowedRoots, deniedCommands,
+     * mode })` result handed to the in-process skill executor — so shell steps and
+     * skill→tool calls share ONE policy point. Injected (DIP) — the runner never
+     * constructs its own guard.
+     */
+    readonly tools: GuardedToolSurface;
+}
+/**
+ * Build a {@link GuardedDeterministicRunner} that routes EVERY `deterministic`
+ * node command through the injected guard's `executeShell` (T11802 · AC1).
+ *
+ * Inject the result as `deterministicRunner` when calling `executePlaybook`:
+ *
+ * @example
+ * ```ts
+ * import { createToolGuard } from '@cleocode/core/internal';
+ *
+ * const tools = createToolGuard({
+ *   allowedRoots: [projectRoot],
+ *   deniedCommands: ['rm', 'shutdown', 'mkfs'],
+ *   mode: 'enforce',
+ * });
+ * await executePlaybook({
+ *   db, playbook, playbookHash, initialContext, dispatcher,
+ *   deterministicRunner: createGuardedDeterministicRunner({ tools }),
+ * });
+ * // A `deterministic` node running `rm` → guard rejects → { status: 'failure' }
+ * ```
+ *
+ * The returned runner NEVER throws — a guard `enforce`-mode rejection
+ * ({@link import('../tools/guard.js').GuardDeniedError}) is caught and mapped to
+ * a `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * stays intact (the runtime's `DeterministicRunner` contract is non-throwing).
+ *
+ * @param opts - The injected guarded tool surface.
+ * @returns A runner assignable to the runtime's `DeterministicRunner`.
+ * @task T11802
+ */
+export declare function createGuardedDeterministicRunner(opts: GuardedDeterministicRunnerOptions): GuardedDeterministicRunner;
+//# sourceMappingURL=guarded-deterministic-runner.d.ts.map

package/dist/playbooks/guarded-deterministic-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-deterministic-runner.d.ts","sourceRoot":"","sources":["../../src/playbooks/guarded-deterministic-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,EAYjE,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC5E;AAED;;;;GAIG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,iCAAiC,GACtC,0BAA0B,CAiD5B"}

package/dist/playbooks/guarded-deterministic-runner.js

@@ -0,0 +1,155 @@
+/**
+ * Guarded deterministic-node runner — routes EVERY `deterministic` (shell/tool)
+ * dispatch in `executePlaybook` through the `guard.ts` deny-first chokepoint
+ * (T11802 · M4 cantbook done-gate).
+ *
+ * ## The gap this closes (AC1)
+ *
+ * The playbook runtime (`@cleocode/playbooks/runtime`) executes `deterministic`
+ * nodes through an INJECTED `DeterministicRunner`. When no runner is injected it
+ * degrades to `AgentDispatcher.dispatch` with a synthetic `deterministic:<cmd>`
+ * agent id — a path that NEVER touches the `guard.ts` shell denylist. So a
+ * `.cantbook` shell step could spawn a subprocess that bypasses the single
+ * policy point.
+ *
+ * This factory builds the CANONICAL production `DeterministicRunner`: every
+ * command is funnelled through the injected {@link GuardedToolSurface}'s
+ * `executeShell` — the SAME deny-first command policy + env-scrub chokepoint
+ * (`createToolGuard`) that in-process skill nodes already use (T11477). There is
+ * NO second subprocess code path: shell steps and skill→tool calls share ONE
+ * guard. The runtime stays a pure state machine (it imports no `child_process`);
+ * the guard owns the spawn (AC1).
+ *
+ * ## Deny semantics (AC3)
+ *
+ * The guard's `executeShell` checks the command basename against the policy
+ * denylist BEFORE any process is spawned. In `mode: 'enforce'` a denied command
+ * rejects with {@link GuardDeniedError} (`E_TOOL_GUARD_DENIED`); this runner
+ * catches that rejection and maps it to a contract-clean
+ * `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * semantics stay intact (the runtime contract is non-throwing). In `mode: 'warn'`
+ * the guard logs-and-proceeds — the denylist is advisory — so a guarded runner
+ * built for enforcement MUST be constructed from an `enforce`-mode guard.
+ *
+ * ## Why a factory over a guard (DIP)
+ *
+ * The runner depends on the abstract {@link GuardedToolSurface} (the contract
+ * shape of `createToolGuard()`), NOT on the concrete guard — so the policy point
+ * is injected, exactly mirroring {@link createSkillNodeExecutor}. `core` builds
+ * the guard once (`createToolGuard({ allowedRoots, deniedCommands, mode })`) and
+ * hands the same surface to BOTH the skill executor and this deterministic
+ * runner.
+ *
+ * @epic T11391
+ * @task T11802
+ * @saga T11387
+ * @see ../tools/guard.ts — the deny-first chokepoint
+ * @see ./skill-node-executor.ts — the sibling in-process skill path
+ */
+/**
+ * Canonical deny-list of destructive command basenames a `.cantbook`
+ * `deterministic` node may NOT run (T11802 · AC3). This is the SSoT the
+ * production dispatcher hands to `createToolGuard({ deniedCommands })` so the
+ * SAME chokepoint that guards in-process skill→tool calls also rejects a
+ * dangerous shell step. Matched against the command's last path segment by the
+ * guard, so `/bin/rm` and `rm` are both denied.
+ *
+ * Intentionally conservative — destructive disk / process / system operations a
+ * planning playbook should never invoke. Extend deliberately; every addition is
+ * a policy decision.
+ */
+export const DEFAULT_DETERMINISTIC_DENIED_COMMANDS = Object.freeze([
+    'rm',
+    'rmdir',
+    'shutdown',
+    'reboot',
+    'mkfs',
+    'dd',
+    'shred',
+    'fdisk',
+    'mkswap',
+    'kill',
+    'killall',
+]);
+/**
+ * Build a {@link GuardedDeterministicRunner} that routes EVERY `deterministic`
+ * node command through the injected guard's `executeShell` (T11802 · AC1).
+ *
+ * Inject the result as `deterministicRunner` when calling `executePlaybook`:
+ *
+ * @example
+ * ```ts
+ * import { createToolGuard } from '@cleocode/core/internal';
+ *
+ * const tools = createToolGuard({
+ *   allowedRoots: [projectRoot],
+ *   deniedCommands: ['rm', 'shutdown', 'mkfs'],
+ *   mode: 'enforce',
+ * });
+ * await executePlaybook({
+ *   db, playbook, playbookHash, initialContext, dispatcher,
+ *   deterministicRunner: createGuardedDeterministicRunner({ tools }),
+ * });
+ * // A `deterministic` node running `rm` → guard rejects → { status: 'failure' }
+ * ```
+ *
+ * The returned runner NEVER throws — a guard `enforce`-mode rejection
+ * ({@link import('../tools/guard.js').GuardDeniedError}) is caught and mapped to
+ * a `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * stays intact (the runtime's `DeterministicRunner` contract is non-throwing).
+ *
+ * @param opts - The injected guarded tool surface.
+ * @returns A runner assignable to the runtime's `DeterministicRunner`.
+ * @task T11802
+ */
+export function createGuardedDeterministicRunner(opts) {
+    const { tools } = opts;
+    return {
+        async run(input) {
+            try {
+                // The guard checks the command basename against the denylist BEFORE
+                // spawning (deny → reject in enforce mode), then scrubs the child env at
+                // the chokepoint. This is the ONLY shell-spawn path for deterministic
+                // nodes — there is no bypass.
+                const result = await tools.executeShell({
+                    command: input.command,
+                    args: [...input.args],
+                    ...(input.cwd !== undefined ? { cwd: input.cwd } : {}),
+                    ...(input.env !== undefined ? { env: input.env } : {}),
+                    ...(input.timeout_ms !== undefined ? { timeoutMs: input.timeout_ms } : {}),
+                });
+                // A non-zero exit is a node failure, not a thrown error — mirror the
+                // shell primitive's "exit code is the result" contract.
+                if (result.code === 0) {
+                    return {
+                        status: 'success',
+                        output: {
+                            [`${input.nodeId}_stdout`]: result.stdout,
+                            [`${input.nodeId}_exitCode`]: result.code,
+                        },
+                    };
+                }
+                return {
+                    status: 'failure',
+                    output: {
+                        [`${input.nodeId}_stdout`]: result.stdout,
+                        [`${input.nodeId}_stderr`]: result.stderr,
+                        [`${input.nodeId}_exitCode`]: result.code,
+                    },
+                    error: `deterministic node "${input.nodeId}" command "${input.command}" exited ` +
+                        `${result.code === null ? 'on signal/timeout' : `with code ${result.code}`}`,
+                };
+            }
+            catch (err) {
+                // Guard-denied (enforce mode) or an unexpected spawn error — never let it
+                // escape; the runtime contract is non-throwing.
+                return {
+                    status: 'failure',
+                    output: {},
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=guarded-deterministic-runner.js.map

package/dist/playbooks/guarded-deterministic-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-deterministic-runner.js","sourceRoot":"","sources":["../../src/playbooks/guarded-deterministic-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpF,IAAI;IACJ,OAAO;IACP,UAAU;IACV,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAgEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAAuC;IAEvC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,KAAgC;YACxC,IAAI,CAAC;gBACH,oEAAoE;gBACpE,yEAAyE;gBACzE,sEAAsE;gBACtE,8BAA8B;gBAC9B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;oBACrB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3E,CAAC,CAAC;gBACH,qEAAqE;gBACrE,wDAAwD;gBACxD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,OAAO;wBACL,MAAM,EAAE,SAAS;wBACjB,MAAM,EAAE;4BACN,CAAC,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM;4BACzC,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI;yBAC1C;qBACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE;wBACN,CAAC,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM;wBACzC,CAAC,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM;wBACzC,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI;qBAC1C;oBACD,KAAK,EACH,uBAAuB,KAAK,CAAC,MAAM,cAAc,KAAK,CAAC,OAAO,WAAW;wBACzE,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC/E,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,gDAAgD;gBAChD,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/playbooks/index.d.ts

@@ -11,7 +11,9 @@
  * @task T1239 — meta-agent infrastructure (epic T1232)
  */
 export { AGENT_TIER_META, type AgentDispatcher, CoreAgentDispatcher, type CoreAgentDispatcherOptions, createAgentDispatcher, type DispatchContext, type DispatchResult, resolveMetaAgent, } from './agent-dispatcher.js';
+export { type CantbookProfilePin, cantbookNodeSystemKey, hasCantbookProfilePin, type ResolveCantbookNodeProfileInput, resolveCantbookNodeProfile, } from './cantbook-profile.js';
 export type { playbookCoreOps } from './ops.js';
+export { type MaybePiRunnerDeps, maybeCreatePiRunner } from './pi-runner-wiring.js';
 export { listPlaybooks, PlaybookNotFoundError, type PlaybookTier, type ResolvedPlaybook, type ResolvePlaybookOptions, resolvePlaybook, } from './playbook-resolver.js';
 export { createSkillNodeExecutor, ISOLATION_CONTEXT_KEY, runSkillNodeOrSpawn, type SkillNodeDispatchInput, type SkillNodeExecutorOptions, type SubprocessSpawnExecutor, } from './skill-node-executor.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/playbooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/playbooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/playbooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EACL,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,+BAA+B,EACpC,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAKhD,OAAO,EAAE,KAAK,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC"}

package/dist/playbooks/index.js

@@ -11,6 +11,16 @@
  * @task T1239 — meta-agent infrastructure (epic T1232)
  */
 export { AGENT_TIER_META, CoreAgentDispatcher, createAgentDispatcher, resolveMetaAgent, } from './agent-dispatcher.js';
+// Cantbook stage LLM-profile resolution — the seam the production cantbook
+// dispatchers call to resolve a node's `profile:` / `model:` / `provider:` pin
+// through the E9 chokepoint (`resolveLLMForSystem`). Gate-13: resolves metadata
+// only, never constructs a transport (T11759 · M4).
+export { cantbookNodeSystemKey, hasCantbookProfilePin, resolveCantbookNodeProfile, } from './cantbook-profile.js';
+// Pi in-process runner wiring — default-OFF, lazy-imported Pi `SkillRunner` the
+// production cantbook dispatchers pass into `runSkillNodeOrSpawn`'s `runner`
+// slot (T11945 · M4). Exported here (the eager core graph) so its live binding
+// is initialised before `internal.ts` re-exports it.
+export { maybeCreatePiRunner } from './pi-runner-wiring.js';
 export { listPlaybooks, PlaybookNotFoundError, resolvePlaybook, } from './playbook-resolver.js';
 // Skill-node executor — injects the in-process SkillExecutorAdapter as the
 // dispatcher's executor while retaining subprocess-spawn for isolation nodes

package/dist/playbooks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/playbooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,eAAe,EAEf,mBAAmB,EAEnB,qBAAqB,EAGrB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,aAAa,EACb,qBAAqB,EAIrB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,6EAA6E;AAC7E,0BAA0B;AAC1B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GAIpB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/playbooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,eAAe,EAEf,mBAAmB,EAEnB,qBAAqB,EAGrB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,oDAAoD;AACpD,OAAO,EAEL,qBAAqB,EACrB,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,qDAAqD;AACrD,OAAO,EAA0B,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,aAAa,EACb,qBAAqB,EAIrB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,2EAA2E;AAC3E,6EAA6E;AAC7E,0BAA0B;AAC1B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GAIpB,MAAM,0BAA0B,CAAC"}

package/dist/playbooks/pi-runner-wiring.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Production wiring helper for the Pi in-process `SkillRunner` (T11945 · M4).
+ *
+ * THE M4 keystone seam: this is the single place the two production cantbook
+ * dispatchers (`buildDefaultDispatcher` in `playbook.ts` and `buildGoDispatcher`
+ * in `go-ivtr-runner.ts`) reach to obtain the Pi-backed `SkillRunner` they pass
+ * into {@link runSkillNodeOrSpawn}'s `runner` slot. When the runner is supplied,
+ * an in-process `ct-*` skill node routes THROUGH the {@link
+ * import('../llm/pi/pi-agent-adapter.js').PiAgentAdapter} (the Pi agent loop);
+ * when it is `undefined`, the adapter falls back to `defaultSkillRunner` — the
+ * pre-T11945 behaviour.
+ *
+ * ## Default-OFF + lazy-import (Gate-13 + OOM safety)
+ *
+ * The Pi embed is gated behind the **default-OFF** `CLEO_PI_RUNNER_ENABLED`
+ * flag. When the flag is unset (the default) this helper returns `undefined`
+ * WITHOUT importing the Pi barrel — so `@earendil-works/pi-ai`'s `register-
+ * builtins` side effect is never paid on the hot dispatch path, and there is
+ * ZERO behaviour change. Only when the flag is explicitly `'1'` do we
+ * dynamically import the barrel and construct the runner. The import is dynamic
+ * (not a top-level `import`) precisely so the heavy `pi-ai` dependency stays out
+ * of `@cleocode/core/internal`'s eager module graph (every CLI dispatcher loads
+ * `internal`, but must not load `pi-ai` unless Pi is enabled).
+ *
+ * Keeping this helper in `core` keeps the CLI dispatchers thin (CLI package
+ * boundary, Gate-6): each call site is a single `await maybeCreatePiRunner(...)`.
+ *
+ * @epic T10403
+ * @task T11761
+ * @task T11945
+ */
+import type { SystemOfUseLabel } from '@cleocode/contracts';
+import type { SkillRunner } from '../skills/skill-executor-adapter.js';
+/**
+ * Resolution + project-root deps forwarded to `createPiSkillRunner` when the Pi
+ * runner is constructed. Mirrors the subset of `PiAgentAdapterDeps` the
+ * dispatchers can supply at their call site.
+ */
+export interface MaybePiRunnerDeps {
+    /**
+     * The system-of-use label the Pi adapter resolves its LLM through (E9). When
+     * omitted, `createPiSkillRunner` defaults to `'task-executor'`.
+     */
+    readonly system?: SystemOfUseLabel;
+    /**
+     * Project root for config + credential resolution. When omitted, resolution
+     * defaults to `process.cwd()` inside `resolveLLMForSystem`.
+     */
+    readonly projectRoot?: string;
+}
+/**
+ * Return the Pi-backed {@link SkillRunner} when `CLEO_PI_RUNNER_ENABLED=1`, else
+ * `undefined`.
+ *
+ * The two production cantbook dispatchers call this and pass the result into
+ * {@link runSkillNodeOrSpawn}'s `runner` slot:
+ *
+ * @example
+ * ```ts
+ * const runner = await maybeCreatePiRunner({ system: 'task-executor', projectRoot });
+ * await runSkillNodeOrSpawn(input, { tools, cwd: projectRoot, subprocessSpawn, runner });
+ * ```
+ *
+ * Default-OFF: when the flag is unset (the common case) this short-circuits to
+ * `undefined` before importing the Pi barrel, so `pi-ai`'s `register-builtins`
+ * is never loaded and the dispatcher behaves exactly as it did pre-T11945
+ * (`defaultSkillRunner` runs the in-process skill node).
+ *
+ * @param deps - Optional resolution system + project root forwarded to the Pi
+ *   adapter when the runner is constructed.
+ * @returns The Pi `SkillRunner` when enabled, otherwise `undefined`.
+ * @task T11945
+ */
+export declare function maybeCreatePiRunner(deps?: MaybePiRunnerDeps): Promise<SkillRunner | undefined>;
+//# sourceMappingURL=pi-runner-wiring.d.ts.map

package/dist/playbooks/pi-runner-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-runner-wiring.d.ts","sourceRoot":"","sources":["../../src/playbooks/pi-runner-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAUvE;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAoBlC"}

package/dist/playbooks/pi-runner-wiring.js

@@ -0,0 +1,82 @@
+/**
+ * Production wiring helper for the Pi in-process `SkillRunner` (T11945 · M4).
+ *
+ * THE M4 keystone seam: this is the single place the two production cantbook
+ * dispatchers (`buildDefaultDispatcher` in `playbook.ts` and `buildGoDispatcher`
+ * in `go-ivtr-runner.ts`) reach to obtain the Pi-backed `SkillRunner` they pass
+ * into {@link runSkillNodeOrSpawn}'s `runner` slot. When the runner is supplied,
+ * an in-process `ct-*` skill node routes THROUGH the {@link
+ * import('../llm/pi/pi-agent-adapter.js').PiAgentAdapter} (the Pi agent loop);
+ * when it is `undefined`, the adapter falls back to `defaultSkillRunner` — the
+ * pre-T11945 behaviour.
+ *
+ * ## Default-OFF + lazy-import (Gate-13 + OOM safety)
+ *
+ * The Pi embed is gated behind the **default-OFF** `CLEO_PI_RUNNER_ENABLED`
+ * flag. When the flag is unset (the default) this helper returns `undefined`
+ * WITHOUT importing the Pi barrel — so `@earendil-works/pi-ai`'s `register-
+ * builtins` side effect is never paid on the hot dispatch path, and there is
+ * ZERO behaviour change. Only when the flag is explicitly `'1'` do we
+ * dynamically import the barrel and construct the runner. The import is dynamic
+ * (not a top-level `import`) precisely so the heavy `pi-ai` dependency stays out
+ * of `@cleocode/core/internal`'s eager module graph (every CLI dispatcher loads
+ * `internal`, but must not load `pi-ai` unless Pi is enabled).
+ *
+ * Keeping this helper in `core` keeps the CLI dispatchers thin (CLI package
+ * boundary, Gate-6): each call site is a single `await maybeCreatePiRunner(...)`.
+ *
+ * @epic T10403
+ * @task T11761
+ * @task T11945
+ */
+/**
+ * The default-OFF env flag controlling the Pi in-process runner. Mirrors
+ * `isPiRunnerEnabled()` in the Pi barrel exactly (strict `'1'`), read here as a
+ * cheap pre-check so the heavy Pi/`pi-ai` barrel is only dynamically imported
+ * when Pi is actually enabled.
+ */
+const PI_RUNNER_FLAG = 'CLEO_PI_RUNNER_ENABLED';
+/**
+ * Return the Pi-backed {@link SkillRunner} when `CLEO_PI_RUNNER_ENABLED=1`, else
+ * `undefined`.
+ *
+ * The two production cantbook dispatchers call this and pass the result into
+ * {@link runSkillNodeOrSpawn}'s `runner` slot:
+ *
+ * @example
+ * ```ts
+ * const runner = await maybeCreatePiRunner({ system: 'task-executor', projectRoot });
+ * await runSkillNodeOrSpawn(input, { tools, cwd: projectRoot, subprocessSpawn, runner });
+ * ```
+ *
+ * Default-OFF: when the flag is unset (the common case) this short-circuits to
+ * `undefined` before importing the Pi barrel, so `pi-ai`'s `register-builtins`
+ * is never loaded and the dispatcher behaves exactly as it did pre-T11945
+ * (`defaultSkillRunner` runs the in-process skill node).
+ *
+ * @param deps - Optional resolution system + project root forwarded to the Pi
+ *   adapter when the runner is constructed.
+ * @returns The Pi `SkillRunner` when enabled, otherwise `undefined`.
+ * @task T11945
+ */
+export async function maybeCreatePiRunner(deps = {}) {
+    // Cheap default-OFF gate — read the raw flag WITHOUT importing the Pi barrel
+    // (which transitively pulls the heavy `pi-ai` dependency). This is the hot
+    // path on every dispatch when Pi is disabled.
+    if (process.env[PI_RUNNER_FLAG] !== '1') {
+        return undefined;
+    }
+    // Flag is on — lazy-import the Pi barrel (subpath, NOT via `internal`) so
+    // `pi-ai` stays out of the eager module graph. `isPiRunnerEnabled()` is the
+    // authoritative predicate; re-confirm in case the env changed between the
+    // raw pre-check and the import.
+    const { createPiSkillRunner, isPiRunnerEnabled } = await import('../llm/pi/index.js');
+    if (!isPiRunnerEnabled()) {
+        return undefined;
+    }
+    return createPiSkillRunner({
+        ...(deps.system !== undefined ? { system: deps.system } : {}),
+        ...(deps.projectRoot !== undefined ? { projectRoot: deps.projectRoot } : {}),
+    });
+}
+//# sourceMappingURL=pi-runner-wiring.js.map

package/dist/playbooks/pi-runner-wiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-runner-wiring.js","sourceRoot":"","sources":["../../src/playbooks/pi-runner-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH;;;;;GAKG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAoBhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA0B,EAAE;IAE5B,6EAA6E;IAC7E,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACtF,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,mBAAmB,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/release/index.d.ts

@@ -32,8 +32,8 @@ export { DEFAULT_OPEN_WORKFLOW, releaseOpen } from './open.js';
 export type { ReleaseIvtrSuggestParams, releaseCoreOps } from './ops.js';
 export type { ReleasePlanOptions, ReleasePlanResult } from './plan.js';
 export { releasePlan } from './plan.js';
-export type { ReleaseReconcileV2Options, ReleaseReconcileV2Result } from './reconcile.js';
-export { releaseReconcileV2 } from './reconcile.js';
+export type { ReleaseReconcileV2Options, ReleaseReconcileV2Result, SynthesizedPlanReport, } from './reconcile.js';
+export { releaseReconcileV2, synthesizePlanForReconcile } from './reconcile.js';
 export type { ChannelConfig, GitFlowConfig, ProjectReleaseConfig, PushMode, ReleaseBranchConfig, ReleaseConfig, ReleaseGate, } from './release-config.js';
 export { getArtifactType, getChangelogConfig, getChannelConfig, getDefaultChannelConfig, getDefaultGitFlowConfig, getGitFlowConfig, getPushMode, getReleaseBranchConfig, getReleaseGates, loadReleaseConfig, validateReleaseConfig, } from './release-config.js';
 export type { PushPolicy, ReleaseGateMetadata, ReleaseListOptions, ReleaseManifest, ReleaseTaskRecord, } from './release-manifest.js';

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACpG,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAIxB,YAAY,EACV,eAAe,IAAI,yBAAyB,EAC5C,cAAc,IAAI,wBAAwB,EAC1C,iBAAiB,IAAI,2BAA2B,GACjD,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,IAAI,uBAAuB,EAC1C,uBAAuB,EACvB,cAAc,IAAI,sBAAsB,EACxC,kBAAkB,EAClB,cAAc,IAAI,sBAAsB,EACxC,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAQvB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,uBAAuB,IAAI,6BAA6B,EACxD,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIxE,YAAY,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,cAAc,EACd,aAAa,EACb,6BAA6B,EAC7B,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAK/D,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAKzE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAIhF,YAAY,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,YAAY,EACV,iBAAiB,EACjB,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,QAAQ,EACR,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACpG,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAIxB,YAAY,EACV,eAAe,IAAI,yBAAyB,EAC5C,cAAc,IAAI,wBAAwB,EAC1C,iBAAiB,IAAI,2BAA2B,GACjD,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,IAAI,uBAAuB,EAC1C,uBAAuB,EACvB,cAAc,IAAI,sBAAsB,EACxC,kBAAkB,EAClB,cAAc,IAAI,sBAAsB,EACxC,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAQvB,YAAY,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,uBAAuB,IAAI,6BAA6B,EACxD,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIxE,YAAY,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,cAAc,EACd,aAAa,EACb,6BAA6B,EAC7B,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAK/D,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAKzE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAEhF,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAIhF,YAAY,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,YAAY,EACV,iBAAiB,EACjB,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,QAAQ,EACR,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/release/index.js

@@ -22,7 +22,7 @@ export { checkDoubleListing, checkEpicCompleteness } from './guards.js';
 export { ARCHIVE_REASON_INVARIANT_ID, clearInvariants, extractTaskIds, getInvariants, getRegisteredAdr056Invariants, RECONCILE_AUDIT_FILE, registerArchiveReasonInvariant, registerInvariant, runInvariants, } from './invariants/index.js';
 export { DEFAULT_OPEN_WORKFLOW, releaseOpen } from './open.js';
 export { releasePlan } from './plan.js';
-export { releaseReconcileV2 } from './reconcile.js';
+export { releaseReconcileV2, synthesizePlanForReconcile } from './reconcile.js';
 export { getArtifactType, getChangelogConfig, getChannelConfig, getDefaultChannelConfig, getDefaultGitFlowConfig, getGitFlowConfig, getPushMode, getReleaseBranchConfig, getReleaseGates, loadReleaseConfig, validateReleaseConfig, } from './release-config.js';
 export { cancelRelease, commitRelease, listReleases, markReleasePushed, migrateReleasesJsonToSqlite, prepareRelease, pushRelease, rollbackRelease, runReleaseGates, showRelease, tagRelease, } from './release-manifest.js';
 export { runShipE2eSmoke } from './ship-e2e-smoke.js';

package/dist/release/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EACL,eAAe,IAAI,uBAAuB,EAC1C,uBAAuB,EACvB,cAAc,IAAI,sBAAsB,EACxC,kBAAkB,EAClB,cAAc,IAAI,sBAAsB,EACxC,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAcvB,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,uFAAuF;AACvF,wFAAwF;AACxF,wDAAwD;AACxD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,uBAAuB,IAAI,6BAA6B,EACxD,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAcxE,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,cAAc,EACd,aAAa,EACb,6BAA6B,EAC7B,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAW/D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAWpD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EACL,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAKhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAU5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,QAAQ,EACR,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EACL,eAAe,IAAI,uBAAuB,EAC1C,uBAAuB,EACvB,cAAc,IAAI,sBAAsB,EACxC,kBAAkB,EAClB,cAAc,IAAI,sBAAsB,EACxC,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAcvB,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,uFAAuF;AACvF,wFAAwF;AACxF,wDAAwD;AACxD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,uBAAuB,IAAI,6BAA6B,EACxD,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAcxE,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,cAAc,EACd,aAAa,EACb,6BAA6B,EAC7B,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAW/D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAQxC,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAWhF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EACL,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAKhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAU5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,QAAQ,EACR,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}