@clossys/launcher 0.3.1 → 0.5.0

package/dist/apply-plan-cli.js

@@ -1,20 +1,44 @@
 #!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { readFileSync, statSync } from "node:fs";
+import { realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
 import { isDirectInvocation } from "./cli.js";
+import { ContractDocumentError, readContractDocument } from "./generated/contract-schema.generated.js";
 import { createNodeHost } from "./host.js";
 import { applyEngagementBrief, validateAdvisorPlan, validateEngagementBrief } from "./apply-plan.js";
+import { MAX_RESPONSE_BYTES, REGISTRY_SNAPSHOT_REL, RegistrySnapshotError, requestedPackageNames, takeRegistrySnapshot, writeRegistrySnapshot, } from "./registry-snapshot.js";
+import { listStoredChangeSets } from "./apply-store.js";
+import { planMain } from "./plan-command.js";
+import { BODY_USAGE, BodyUsageError, bodyRepository, parseBodyArgs } from "./body-command.js";
+import { materializeRepository, verifyRepository } from "./materialize.js";
+import { formatStatus, statusRepository } from "./status.js";
 export const APPLY_PLAN_USAGE = `Usage: launcher-apply-plan --plan <plan.json> --brief <brief.json> --repo <directory>
+       launcher-apply-plan plan [--agent codex|claude|cursor] [--adopt-existing <consent.json>] [--help]
+       launcher-apply-plan materialize --repo <id>
+       launcher-apply-plan verify --repo <id>
+       launcher-apply-plan status --repo <id>
+       launcher-apply-plan body --repo <id> --task-record <n> [--supersedes <n>]...
+       launcher-apply-plan snapshot --request <file> [--out <file>]
+
+The plan subcommand is described by launcher-apply-plan plan --help, and the
+snapshot subcommand by launcher-apply-plan snapshot --help.
 
 Writes clossys/brief.json into <directory> from the given brief, once the
 given plan's most recent decision is "approved". Refuses, and writes
-nothing, otherwise.
+nothing, otherwise. This is the brief-only path: it does not check what an
+approval binds, so it accepts an approval with or without a subjectDigest.
 
 Deterministic mechanics only: this does not decide whether a plan should be
 approved (that is Advisor's job) and does not compute the brief's content
-(that is @clossys/advisor's EngagementBrief, #1193) -- it validates the
-exact shapes recorded on issue #1175 and writes the one file.
+(that is @clossys/advisor's EngagementBrief) -- it validates both files
+against the same plan and brief contracts Advisor uses, refusing any field
+those contracts do not declare, writes the one file, and prints the plan's
+canonical digest.
 
 Exit codes: 0 = applied, 1 = refused (not approved, or a shape does not
-validate), 2 = a given file could not be read as JSON.`;
+validate), 2 = a given file could not be read as strict JSON (unreadable,
+not valid UTF-8, not valid JSON, or an object repeats a key).`;
 export class ApplyPlanInputError extends Error {
 }
 function parseArgs(argv) {
@@ -37,15 +61,25 @@ function parseArgs(argv) {
     }
     return { help: false, planPath, briefPath, repoDirectory };
 }
-function readJson(readText, path, label) {
-    const raw = readText(path);
-    if (raw === null)
-        throw new ApplyPlanInputError(`${label} could not be read: ${path}`);
+/**
+ * Reads a plan or brief file as strict JSON (#1475): invalid UTF-8, a JSON
+ * syntax error, or an object that repeats a key at any depth is refused, so
+ * the value validated and digested is exactly the one a reader of the file
+ * sees.
+ */
+function readJson(path, label) {
+    let bytes;
     try {
-        return JSON.parse(raw);
+        bytes = readFileSync(path);
     }
     catch {
-        throw new ApplyPlanInputError(`${label} is not valid JSON: ${path}`);
+        throw new ApplyPlanInputError(`${label} could not be read: ${path}`);
+    }
+    try {
+        return readContractDocument(bytes);
+    }
+    catch (cause) {
+        throw new ApplyPlanInputError(`${label} ${cause instanceof Error ? cause.message : String(cause)}: ${path}`);
     }
 }
 export function main(argv, host) {
@@ -57,8 +91,8 @@ export function main(argv, host) {
     let planRaw;
     let briefRaw;
     try {
-        planRaw = readJson(host.readText, parsed.planPath, "--plan");
-        briefRaw = readJson(host.readText, parsed.briefPath, "--brief");
+        planRaw = readJson(parsed.planPath, "--plan");
+        briefRaw = readJson(parsed.briefPath, "--brief");
     }
     catch (cause) {
         console.error(`launcher-apply-plan: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -80,11 +114,394 @@ export function main(argv, host) {
         return 1;
     }
     console.log(`wrote ${result.path}`);
+    console.log(`plan digest ${result.planDigest}`);
     return 0;
 }
-function run() {
+export const SNAPSHOT_USAGE = `Usage: launcher-apply-plan snapshot --request <file> [--out <file>]
+
+Takes the registry snapshot a plan's exact packages are resolved from
+(#1178). <file> is the report advisor-package-request prints, saved to a
+file: every name in it must be a package in this package's publishing scope,
+named once. For each name, in name order, this fetches the package's full
+registry document from the registry this package was built for, with no
+registry credential, no .npmrc and no npm CLI, refusing any redirect, any response
+over ${MAX_RESPONSE_BYTES / (1024 * 1024)} MiB and any request that takes too long. It records only what
+the registry snapshot contract declares, validates the whole snapshot against
+that contract, and writes it atomically to --out, by default
+${REGISTRY_SNAPSHOT_REL} under the current directory (the hub).
+
+This is the only step of applying a plan that reads the package registry. A
+message names a package by its position in the request, names[<n>], never by
+its name, and never quotes the request or a response.
+
+Exit codes: 0 = the snapshot was written (or --help was shown), 2 = no snapshot was written
+(a usage error, an unreadable or invalid request, or any registry answer
+this step cannot record: a transport error, a timeout, a redirect, an
+answer other than 200 or 404, an oversize or non-JSON body, or a snapshot
+the contract refuses). A package the registry does not have (404) is
+recorded as not-found, not refused. On exit 2 an earlier snapshot at the
+output path is left untouched, and must not be used.`;
+const REPO_ID_SHAPE = /^[^/]+\/[^/]+$/u;
+function parseRepoSubcommand(argv, label) {
+    if (argv.length === 1 && (argv[0] === "--help" || argv[0] === "-h"))
+        return { help: true };
+    if (argv.length !== 2 || argv[0] !== "--repo")
+        throw new ApplyPlanInputError(`usage: launcher-apply-plan ${label} --repo <id>`);
+    const id = argv[1];
+    const slash = id.indexOf("/");
+    const name = slash === -1 ? "" : id.slice(slash + 1);
+    if (!REPO_ID_SHAPE.test(id) || name === "." || name === "..")
+        throw new ApplyPlanInputError(`usage: launcher-apply-plan ${label} --repo <id>`);
+    return { help: false, id };
+}
+function spawnGit(cwd, args) {
+    const run = spawnSync("git", ["-c", "commit.gpgsign=false", "-c", "core.hooksPath=/dev/null", ...args], {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    if ((run.status ?? 1) !== 0)
+        return null;
+    return (run.stdout ?? "").trim();
+}
+function resolveApplyInputs(id, options) {
+    const hub = options.cwd ?? process.cwd();
+    if (options.set !== undefined && options.set.repository.id !== id) {
+        return { exitCode: 2, verdict: "indeterminate", reason: "change-set-absent" };
+    }
+    let held = [];
+    try {
+        held = listStoredChangeSets(realpathSync(hub));
+    }
+    catch {
+        held = [];
+    }
+    if (options.heldChangeSets !== undefined)
+        held = [...options.heldChangeSets];
+    let set = options.set;
+    if (set === undefined) {
+        const matches = held.filter((entry) => entry.repository.id === id);
+        if (matches.length === 0)
+            return { exitCode: 2, verdict: "indeterminate", reason: "change-set-absent" };
+        if (matches.length === 1) {
+            set = matches[0];
+        }
+        else {
+            const clonePath = options.clone ?? resolve(dirname(realpathSync(hub)), id.slice(id.indexOf("/") + 1));
+            let root;
+            try {
+                root = realpathSync(clonePath);
+            }
+            catch {
+                return { exitCode: 2, verdict: "indeterminate", reason: "change-set-absent" };
+            }
+            const branch = matches[0].repository.defaultBranch;
+            const tip = spawnGit(root, ["rev-parse", `refs/heads/${branch}`]);
+            if (tip === null)
+                return { exitCode: 2, verdict: "indeterminate", reason: "change-set-absent" };
+            const filtered = matches.filter((entry) => entry.repository.baseCommit === tip);
+            if (filtered.length !== 1)
+                return { exitCode: 2, verdict: "indeterminate", reason: "change-set-absent" };
+            set = filtered[0];
+        }
+    }
+    const clone = options.clone ?? resolve(dirname(realpathSync(hub)), id.slice(id.indexOf("/") + 1));
+    const storedTexts = set.texts === undefined ? {} : Object.fromEntries(set.texts.map((row) => [row.path, row.text]));
+    return { hub, clone, set, held, texts: options.texts ?? storedTexts };
+}
+const MATERIALIZE_HELP = `Usage: launcher-apply-plan materialize --repo <id>
+
+Writes a stored repository change set into the repository's local clone.
+
+Refuses, and writes nothing, unless the plan committed at the hub's HEAD
+approves a bundle that holds the change set, or the change set is an apply set
+admitted under the one-approval rule: it follows the approved setup set and
+changes nothing that approval did not already cover. When the change set has
+package acts, the execution authorization in the hub's committed assessment
+must also be current at the time of the run. The approval a change set's
+ledger records is decided from the hub alone; it is never taken from an
+option or defaulted.`;
+const VERIFY_HELP = `Usage: launcher-apply-plan verify --repo <id>
+
+Reports whether the repository's local clone matches its stored change set.
+Verify re-checks everything materialize checks before writing, including the
+committed approval and, for a change set with package acts, that the execution
+authorization is still current at the time of the run: a clone whose approval
+was withdrawn or whose authorization expired no longer verifies.`;
+const STATUS_HELP = `Usage: launcher-apply-plan status --repo <id>
+
+Reports what the pull request for the repository's stored change set is doing,
+from read-only evidence: the open pull requests, the default branch's tip, and
+the commits already in the local clone. It needs a full clone: a partial clone
+is refused as indeterminate (partial-clone) before any object is read. It
+changes nothing but the fetch of the default branch into its remote-tracking ref
+that verify also makes: it does not fetch a pull request's head, check anything
+out, or write a file or an index.
+
+The state is one of: proposed (an open pull request of this change set, made
+by the person running this, whose body is the one the body command recorded and whose
+head passes every check verify makes),
+applied (the default branch already holds the change set), planned (neither),
+diverged (its pull request or its body does not match), superseded (an older change set of
+this repository has a pull request, even beside this one's) or indeterminate
+(something could not be read or trusted, including a partial clone, a change set
+the body command never recorded a body for, any open pull request whose body names the
+marker word but is not the person's own, and a listing of 100 or more open pull
+requests). It prints the state, a fixed reason
+and #<number> for each pull request it is about, and nothing else. proposed
+does not check the head's ancestry to the base, and nothing in this unit does.
+
+Exit codes: 0 = proposed or applied, 1 = diverged, 2 = anything else.`;
+function printApplyOutcome(label, outcome) {
+    const suffix = outcome.exitCode === 0 ? outcome.verdict : `${outcome.verdict} (${outcome.reason})`;
+    const detail = outcome.detail === undefined ? "" : `; ${outcome.detail}`;
+    if (outcome.exitCode === 0)
+        console.log(`launcher-apply-plan ${label}: ${suffix}${detail}`);
+    else
+        console.error(`launcher-apply-plan ${label}: ${suffix}${detail}`);
+    return outcome.exitCode;
+}
+export async function materializeMain(argv, options = {}) {
+    try {
+        const parsed = parseRepoSubcommand(argv, "materialize");
+        if (parsed.help) {
+            console.log(MATERIALIZE_HELP);
+            return 0;
+        }
+        const resolved = resolveApplyInputs(parsed.id, options);
+        if ("exitCode" in resolved)
+            return printApplyOutcome("materialize", resolved);
+        const outcome = await materializeRepository({
+            clone: resolved.clone,
+            hub: resolved.hub,
+            set: resolved.set,
+            texts: resolved.texts,
+            heldChangeSets: resolved.held,
+            spawn: options.spawn,
+            now: options.now,
+            toolVersion: options.toolVersion,
+            runReadiness: options.runReadiness,
+        });
+        return printApplyOutcome("materialize", outcome);
+    }
+    catch (cause) {
+        console.error(`launcher-apply-plan materialize: ${cause instanceof ApplyPlanInputError ? cause.message : "usage: launcher-apply-plan materialize --repo <id>"}`);
+        return 2;
+    }
+}
+export async function verifyMain(argv, options = {}) {
+    try {
+        const parsed = parseRepoSubcommand(argv, "verify");
+        if (parsed.help) {
+            console.log(VERIFY_HELP);
+            return 0;
+        }
+        const resolved = resolveApplyInputs(parsed.id, options);
+        if ("exitCode" in resolved)
+            return printApplyOutcome("verify", resolved);
+        const outcome = await verifyRepository({
+            clone: resolved.clone,
+            hub: resolved.hub,
+            set: resolved.set,
+            heldChangeSets: resolved.held,
+            now: options.now,
+            runReadiness: options.runReadiness,
+        });
+        return printApplyOutcome("verify", outcome);
+    }
+    catch (cause) {
+        console.error(`launcher-apply-plan verify: ${cause instanceof ApplyPlanInputError ? cause.message : "usage: launcher-apply-plan verify --repo <id>"}`);
+        return 2;
+    }
+}
+export async function statusMain(argv, options = {}) {
+    try {
+        const parsed = parseRepoSubcommand(argv, "status");
+        if (parsed.help) {
+            console.log(STATUS_HELP);
+            return 0;
+        }
+        const resolved = resolveApplyInputs(parsed.id, options);
+        if ("exitCode" in resolved) {
+            console.log(formatStatus({ state: "indeterminate", reason: resolved.reason }));
+            return 2;
+        }
+        const outcome = await statusRepository({
+            clone: resolved.clone,
+            hub: resolved.hub,
+            set: resolved.set,
+            heldChangeSets: resolved.held,
+            now: options.now,
+            runReadiness: options.runReadiness,
+            ports: options.statusPorts,
+        });
+        console.log(formatStatus(outcome));
+        return outcome.exitCode;
+    }
+    catch (cause) {
+        console.error(`launcher-apply-plan status: ${cause instanceof ApplyPlanInputError ? cause.message : "usage: launcher-apply-plan status --repo <id>"}`);
+        return 2;
+    }
+}
+const BODY_HELP = `Usage: ${BODY_USAGE}
+
+Prints the body of the pull request for the repository's stored change set, and
+nothing else, and records the SHA-256 of exactly those bytes as the change set's
+pullRequest.bodySha256. The approval the body shows is decided from the hub at
+the time of the run, as materialize decides it; it is never taken from an
+option. A planned bundle the hub stored for the change set must hold that same
+approval. --task-record is the number of the task-record issue in the
+repository; each --supersedes is the number of the pull request of an older
+change set of this repository that this one replaces, and needs another stored
+change set of the repository. A change set already bound to another body is
+refused, and one already bound to this body prints it again. There is no way to
+undo a binding: a mistyped --task-record or --supersedes leaves the change set
+refused as body-bound. Pass the output to the pull request as a file with
+--body-file; --body "$(...)" drops the final line feed the recorded hash covers.
+
+Exit codes: 0 = the body was printed, 1 = refused (a fixed token on standard
+error, nothing on standard output), 2 = indeterminate or a usage error.`;
+/**
+ * The `body` subcommand. Standard output is the body and only the body, after it is recorded; a refusal prints one line of fixed
+ * tokens to standard error and never an argument.
+ */
+export async function bodyMain(argv, options = {}) {
+    try {
+        const parsed = parseBodyArgs(argv);
+        if (parsed.help) {
+            console.log(BODY_HELP);
+            return 0;
+        }
+        const resolved = resolveApplyInputs(parsed.id, options);
+        if ("exitCode" in resolved) {
+            console.error(`launcher-apply-plan body: indeterminate (${resolved.reason ?? "refused"})`);
+            return 2;
+        }
+        const outcome = await bodyRepository({
+            clone: resolved.clone,
+            hub: resolved.hub,
+            set: resolved.set,
+            heldChangeSets: resolved.held,
+            taskRecord: parsed.taskRecord,
+            supersedes: parsed.supersedes,
+            now: options.now,
+            runReadiness: options.runReadiness,
+        });
+        if (outcome.exitCode !== 0) {
+            console.error(`launcher-apply-plan body: ${outcome.exitCode === 1 ? "refused" : "indeterminate"} (${outcome.reason})`);
+            return outcome.exitCode;
+        }
+        process.stdout.write(outcome.body);
+        return 0;
+    }
+    catch (cause) {
+        console.error(cause instanceof BodyUsageError ? `launcher-apply-plan body: usage: ${BODY_USAGE}` : "launcher-apply-plan body: indeterminate (body-failed)");
+        return 2;
+    }
+}
+function parseSnapshotArgs(argv) {
+    if (argv.length === 1 && (argv[0] === "--help" || argv[0] === "-h"))
+        return { help: true };
+    const flags = new Map();
+    for (let index = 0; index < argv.length; index += 2) {
+        const name = argv[index];
+        const value = argv[index + 1];
+        if ((name !== "--request" && name !== "--out") || value === undefined || flags.has(name)) {
+            throw new RegistrySnapshotError("usage: launcher-apply-plan snapshot --request <file> [--out <file>]");
+        }
+        flags.set(name, value);
+    }
+    const requestPath = flags.get("--request");
+    if (requestPath === undefined)
+        throw new RegistrySnapshotError("--request is required");
+    const outPath = flags.get("--out");
+    return outPath === undefined ? { help: false, requestPath } : { help: false, requestPath, outPath };
+}
+/** Reads the request strictly; a refusal names the rule and a position, never the file's text. */
+function readSnapshotRequest(path) {
+    let bytes;
+    try {
+        if (!statSync(path).isFile())
+            throw new RegistrySnapshotError("the --request file is not a file");
+        bytes = readFileSync(path);
+    }
+    catch (cause) {
+        if (cause instanceof RegistrySnapshotError)
+            throw cause;
+        throw new RegistrySnapshotError("the --request file could not be read");
+    }
+    try {
+        return readContractDocument(bytes);
+    }
+    catch (cause) {
+        if (!(cause instanceof ContractDocumentError))
+            throw new RegistrySnapshotError("the --request file is not strict JSON");
+        const where = cause.position === undefined ? "" : ` at position ${cause.position}`;
+        const why = cause.reason === "encoding" ? "is not valid UTF-8" : cause.reason === "repeated-key" ? "repeats a key in one object" : "is not valid JSON";
+        throw new RegistrySnapshotError(`the --request file ${why}${where}`);
+    }
+}
+/**
+ * The `snapshot` subcommand. Never throws: every refusal prints one line and
+ * returns 2, and nothing is written unless the whole snapshot validates.
+ */
+export async function snapshotMain(argv, options = {}) {
+    try {
+        const parsed = parseSnapshotArgs(argv);
+        if (parsed.help) {
+            console.log(SNAPSHOT_USAGE);
+            return 0;
+        }
+        const cwd = options.cwd ?? process.cwd();
+        const names = requestedPackageNames(readSnapshotRequest(resolve(cwd, parsed.requestPath)));
+        const snapshot = await takeRegistrySnapshot(names, options);
+        const out = resolve(cwd, parsed.outPath ?? REGISTRY_SNAPSHOT_REL);
+        try {
+            writeRegistrySnapshot(out, snapshot);
+        }
+        catch (cause) {
+            if (cause instanceof RegistrySnapshotError)
+                throw cause;
+            throw new RegistrySnapshotError(`the snapshot could not be written to ${out}`);
+        }
+        const notFound = snapshot.packages.filter((entry) => entry.status === "not-found").length;
+        console.log(`wrote ${out}: ${snapshot.packages.length} package(s), ${snapshot.packages.length - notFound} found, ${notFound} not found`);
+        return 0;
+    }
+    catch (cause) {
+        const reason = cause instanceof RegistrySnapshotError ? cause.message : `failed unexpectedly (${cause instanceof Error ? cause.name : typeof cause})`;
+        console.error(`launcher-apply-plan snapshot: ${reason}; no snapshot was written`);
+        return 2;
+    }
+}
+async function run() {
+    const argv = process.argv.slice(2);
+    if (argv[0] === "plan") {
+        process.exitCode = await planMain(argv.slice(1));
+        return;
+    }
+    if (argv[0] === "materialize") {
+        process.exitCode = await materializeMain(argv.slice(1));
+        return;
+    }
+    if (argv[0] === "verify") {
+        process.exitCode = await verifyMain(argv.slice(1));
+        return;
+    }
+    if (argv[0] === "status") {
+        process.exitCode = await statusMain(argv.slice(1));
+        return;
+    }
+    if (argv[0] === "body") {
+        process.exitCode = await bodyMain(argv.slice(1));
+        return;
+    }
+    if (argv[0] === "snapshot") {
+        process.exitCode = await snapshotMain(argv.slice(1));
+        return;
+    }
     try {
-        process.exitCode = main(process.argv.slice(2), createNodeHost());
+        process.exitCode = main(argv, createNodeHost());
     }
     catch (cause) {
         console.error(`launcher-apply-plan: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -92,5 +509,5 @@ function run() {
     }
 }
 if (isDirectInvocation(import.meta.url, process.argv[1]))
-    run();
+    void run();
 //# sourceMappingURL=apply-plan-cli.js.map

package/dist/apply-plan-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply-plan-cli.js","sourceRoot":"","sources":["../src/apply-plan-cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAA0C,MAAM,iBAAiB,CAAC;AAE7I,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;uDAYuB,CAAC;AAExD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1F,MAAM,IAAI,mBAAmB,CAAC,4EAA4E,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAyC,EAAE,IAAY,EAAE,KAAa;IACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAuB,EAAE,IAAuC;IACnF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAkB,EAAE,QAAQ,CAAC,CAAC;QACvE,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAmB,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,kDAAkD,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,mDAAmD,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAuB,EAAE,OAAsB,EAAE,QAA2B,EAAE,oBAAoB,CAAC,CAAC;IACrJ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,GAAG;IACV,IAAI,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AACD,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAE,GAAG,EAAE,CAAC"}
+{"version":3,"file":"apply-plan-cli.js","sourceRoot":"","sources":["../src/apply-plan-cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAA0C,MAAM,iBAAiB,CAAC;AAC7I,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAwB,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAoB,MAAM,aAAa,CAAC;AAK/E,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;8DAyB8B,CAAC;AAE/D,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1F,MAAM,IAAI,mBAAmB,CAAC,4EAA4E,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAuB,EAAE,IAAuC;IACnF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAkB,EAAE,QAAQ,CAAC,CAAC;QACxD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAmB,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,kDAAkD,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,mDAAmD,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAuB,EAAE,OAAsB,EAAE,QAA2B,EAAE,oBAAoB,CAAC,CAAC;IACrJ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;OAQvB,kBAAkB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;;;EAGvC,qBAAqB;;;;;;;;;;;;qDAY8B,CAAC;AAuBtD,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,SAAS,mBAAmB,CAAC,IAAuB,EAAE,KAAa;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,KAAK,cAAc,CAAC,CAAC;IAChI,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACpB,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,KAAK,cAAc,CAAC,CAAC;IAC/I,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAc;IAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,IAAI,CAAC,EAAE;QACtG,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,kBAAkB,CACzB,EAAU,EACV,OAA4B;IAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAClE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,GAA0B,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,GAAG,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtG,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAChF,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC;YAClE,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAChG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;YAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YACzG,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,WAAW,GACf,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAU,CAAC,CAAC,CAAC;IAC3G,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,gBAAgB,GAAG;;;;;;;;;;;qBAWJ,CAAC;AACtB,MAAM,WAAW,GAAG;;;;;;iEAM6C,CAAC;AAElE,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;sEAuBkD,CAAC;AAEvE,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAwB;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;IACnG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,KAAK,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;;QACvF,OAAO,CAAC,KAAK,CAAC,uBAAuB,KAAK,KAAK,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAuB,EAAE,UAA+B,EAAE;IAC9F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,QAAQ;YAAE,OAAO,iBAAiB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;YAC1C,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oDAAoD,EAAE,CAAC,CAAC;QACjK,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB,EAAE,UAA+B,EAAE;IACzF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,QAAQ;YAAE,OAAO,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;YACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+CAA+C,EAAE,CAAC,CAAC;QACvJ,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB,EAAE,UAA+B,EAAE;IACzF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;YACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK,EAAE,OAAO,CAAC,WAAW;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+CAA+C,EAAE,CAAC,CAAC;QACvJ,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,UAAU,UAAU;;;;;;;;;;;;;;;;;wEAiBkC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAuB,EAAE,UAA+B,EAAE;IACvF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC;YACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,6BAA6B,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACvH,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;QAC5J,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB;IAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,qBAAqB,CAAC,qEAAqE,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACtG,CAAC;AAED,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAC;QAClG,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,KAAK,CAAC;QACxD,MAAM,IAAI,qBAAqB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,CAAC,CAAC;QACxH,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACvJ,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB,EAAE,UAAkC,EAAE;IAC9F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB;gBAAE,MAAM,KAAK,CAAC;YACxD,MAAM,IAAI,qBAAqB,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,gBAAgB,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,WAAW,QAAQ,YAAY,CAAC,CAAC;QACzI,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC;QACtJ,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,2BAA2B,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AACD,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAE,KAAK,GAAG,EAAE,CAAC"}

package/dist/apply-plan.d.ts

@@ -1,71 +1,50 @@
+import type { AdvisorPlan, EngagementBrief } from "./plan-contract.js";
 import type { WorkspaceHost } from "./types.js";
-export interface EngagementBriefRole {
-    readonly role: string;
-    readonly why: string;
-    readonly goal: {
-        readonly metric: string;
-        readonly direction: "increase" | "decrease";
-    };
-    readonly inputsFrom: readonly string[];
-    readonly outputsTo: readonly string[];
-}
-export interface EngagementBrief {
-    readonly schemaVersion: 1;
-    readonly problem: string;
-    readonly roles: readonly EngagementBriefRole[];
-    readonly sequence: readonly string[];
-    readonly deliverables: readonly string[];
-}
-export type BlockerKind = "missing-input" | "missing-authority" | "failing-evidence" | "unavailable-environment" | "contradiction";
-export interface PlanBlocker {
-    readonly kind: BlockerKind;
-    readonly description: string;
-    readonly owner: string;
-    readonly dueDate?: string;
-}
-export interface PlanDecision {
-    readonly at: string;
-    readonly recommended: string;
-    readonly chosen: string;
-    readonly by: string;
-}
-export interface AdvisorPlan {
-    readonly schemaVersion: 1;
-    readonly asOf: string;
-    readonly mandate: {
-        readonly problem: string;
-        readonly primaryProblemId: string;
-        readonly roles: readonly string[];
-    };
-    readonly whereWeAre: readonly string[];
-    readonly recommendedNext: {
-        readonly action: string;
-        readonly owner: string;
-        readonly due: string;
-    } | null;
-    readonly decisions: readonly PlanDecision[];
-    readonly blockers: readonly PlanBlocker[];
-}
-export type ValidationResult = {
-    readonly valid: true;
-} | {
-    readonly valid: false;
-    readonly reason: string;
-};
-/** Validates an EngagementBrief's shape exactly against the #1175 contract. Never mutates, never re-derives content. */
-export declare function validateEngagementBrief(value: unknown): ValidationResult;
-/** Validates an AdvisorPlan's shape exactly against the #1175 contract. */
-export declare function validateAdvisorPlan(value: unknown): ValidationResult;
+export { validateAdvisorPlan, validateEngagementBrief } from "./plan-contract.js";
+export type { AdvisorPlan, BlockerKind, EngagementBrief, EngagementBriefRole, EngagementContext, EngagementContextField, EngagementContextFieldId, GoalDirection, PlanBlocker, PlanDecision, PlanKit, PlanPackageAct, PlanStaffing, ValidationResult, } from "./plan-contract.js";
+/**
+ * What an approval binds (#1178): the `subjectDigest` of the plan's latest
+ * decision, by `at`, when that decision has chosen "approved" -- the digest of
+ * the exact change the approver was shown. Otherwise null, and null binds
+ * nothing. Fails closed:
+ *
+ * - a plan that does not validate against the plan contract, rules
+ *   included: null. It checks this itself rather than trusting its caller,
+ *   because on an unchecked plan a time with no offset parses as local time,
+ *   so the machine's time zone could decide which decision is latest;
+ * - no decisions, or any decision time that does not parse: null;
+ * - a latest decision that is not "approved": null;
+ * - an approval with no `subjectDigest`, or one that is not a sha256 digest:
+ *   null -- an approval that names no bytes approves no bytes;
+ * - several decisions at the latest instant: their subject only when every
+ *   one of them is "approved" with the same `subjectDigest`, else null.
+ *
+ * It says what was approved, not whether that is what is about to be applied:
+ * the caller recomputes the digest of the change it holds and refuses unless
+ * the two are equal.
+ */
+export declare function approvedSubject(plan: AdvisorPlan): string | null;
 /**
  * The plan is approved when its most recent decision (by `at`) records
  * chosen === "approved". No decisions, or a most-recent decision that
  * isn't "approved", is not approved -- this never assumes approval from
- * absence.
+ * absence. Fails closed on anything that would let array order decide
+ * instead of time: a decision whose `at` does not parse to a finite time
+ * (the plan contract already refuses one; this does not rely on that), or
+ * two decisions at the same latest instant that do not all say "approved".
+ *
+ * It binds no bytes (#1178): it does not look at `subjectDigest`, so it is
+ * true for an approval that names no change at all. It says only that the
+ * latest decision is an approval. Anything that applies a plan must use
+ * `approvedSubject()` instead, and compare the subject it returns with the
+ * digest of the change it holds. The one stated exception is the legacy
+ * brief-only path, `applyEngagementBrief()`, which predates the binding.
  */
 export declare function isPlanApproved(plan: AdvisorPlan): boolean;
 export type ApplyBriefResult = {
     readonly state: "applied";
     readonly path: string;
+    readonly planDigest: string;
 } | {
     readonly state: "refused";
     readonly reason: string;
@@ -73,7 +52,15 @@ export type ApplyBriefResult = {
 /**
  * Writes clossys/brief.json into `repositoryDirectory`, byte-identically
  * from the validated brief -- never re-authors its prose. Refuses (does
- * not write) unless both the plan is approved and the brief validates.
+ * not write) unless the plan validates and is approved and the brief,
+ * including its context snapshot, validates. Reports the canonical digest
+ * of the plan it applied.
+ *
+ * LEGACY (#1178): this path predates the approval binding. It accepts an
+ * approval whether or not it carries a `subjectDigest` and checks no
+ * binding (it uses `isPlanApproved()`), exactly as before; it is kept
+ * working, not extended. Anything that must know what an approval binds uses
+ * `approvedSubject()`.
  */
 export declare function applyEngagementBrief(host: WorkspaceHost, repositoryDirectory: string, plan: AdvisorPlan, brief: EngagementBrief, briefRelPath: string): ApplyBriefResult;
 //# sourceMappingURL=apply-plan.d.ts.map