@cspeach/cli 1.1.53 → 1.1.54

package/dist/commands/team.js

@@ -23,7 +23,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { decidedCount, decisionWhatOf, isAppLabel, isPatternWord, laneIdFor, levelOf, normalizeRuleId, objectKey, partCounts, proposeLanes, scopeFromWords, targetsOf, viewWords, } from '@cspeach/register-core';
 import { LOCAL_PACKAGE, listCustomPackages, pullBaseline, BaselineError } from '../register/baseline.js';
-import { BASELINE_FILE, TEAM_FILE, RegisterError, activeProject, defaultOutboxDir, loadState, projectIdFor, readBaseline, readEstate, readLanes, readProjectFile, saveState, sha256, VARIANT_NAME, writeLanes, writeProjectVariant, writerIdFor, } from '../register/store.js';
+import { BASELINE_FILE, TEAM_FILE, RegisterError, activeProject, coreProject, defaultOutboxDir, loadState, projectIdFor, readBaseline, readEstate, readLanes, readProjectFile, saveState, sha256, VARIANT_NAME, writeLanes, writeProjectVariant, writerIdFor, } from '../register/store.js';
 import { MAX_API_DOCUMENTS, MAX_SECOND_PASS, measure, noVariantYetMessage, scopeLabel, scopeObjects, variantMismatchMessage, } from '../register/measure.js';
 import { measureFromFile, shown, shownUpTo, upToFive } from '../register/atc-file.js';
 import { writeLeadRecord, writeRecord } from '../register/records.js';
@@ -39,7 +39,11 @@ import { lookupVariant, variantLookupLine } from '../register/variant.js';
 import { TRANSPORT_NONE_WORDS, TRANSPORT_REQUEST, notARequestLine, projectTransportWords, writeProjectTransport } from '../register/project-transport.js';
 import { teamDiscover, evidenceRows, EVIDENCE_LINE, OUTSIDE_LINE } from './team-discover.js';
 import { rulesCommand } from './team-rules.js';
+import { specCommand } from './team-spec.js';
 import { focusCommand, laneChangeRecord, laneProposal, nowLine, planCommand, priorityCommand, reasonFrom } from './team-plan.js';
+import { CLEAN_CORE_ONLY_VERBS, FUNCTIONAL_VERB_LINE, buildJoinLine, buildVerbRefusal, createBuildProject, isBuildProject, isRecordingVerb, } from './team-build.js';
+import { seatSignInMessage } from '../licence/seat-kind.js';
+import { getSeatKind } from '../licence/seat-state.js';
 const CLASSIFICATIONS = ['keep', 'fix', 'retire', 'redesign'];
 const TYPES = ['clean-core', 'upgrade', 'build'];
 /**
@@ -128,6 +132,27 @@ function matches(pattern, value) {
 export async function runTeamCommand(args, deps) {
     const [sub, ...rest] = args;
     try {
+        // Team build (spec §7.2): a functional seat reads a team project and never
+        // records work into it. Read-only verbs never ask for the seat. On by
+        // default (final review F1): without deps.seat the process seat decides
+        // (seat-state.ts — developer unless start-up resolved functional), so a
+        // caller that builds its own TeamDeps (the clean-core journey) is held too.
+        if (isRecordingVerb(sub, rest)) {
+            const seat = await (deps.seat ?? (async () => getSeatKind()))();
+            if (seat === 'functional') {
+                deps.print(FUNCTIONAL_VERB_LINE);
+                return 1;
+            }
+            if (seat === 'unconfirmed') {
+                deps.print(seatSignInMessage());
+                return 1;
+            }
+        }
+        // A team build folder has no baseline: the clean-core verbs are refused in one line.
+        if (sub && CLEAN_CORE_ONLY_VERBS.includes(sub) && activeIsBuild()) {
+            deps.print(buildVerbRefusal(sub));
+            return 1;
+        }
         switch (sub) {
             case 'init': return await init(rest, deps);
             case 'start': return await start(rest, deps);
@@ -151,8 +176,9 @@ export async function runTeamCommand(args, deps) {
             case 'priority': return priorityCommand(rest, deps);
             case 'plan': return await planCommand(rest, deps);
             case 'rebuild': return await rebuildVerb(rest, deps);
+            case 'spec': return await specCommand(rest, deps);
             default:
-                deps.print('Usage: cspeach team init|join|lane|refresh|status|outbox|rule|leave|decide|target|transport|fixed|sheet|report|export|discover|focus|priority|plan|start|rebuild|rules   (cspeach --help for details)');
+                deps.print('Usage: cspeach team init|join|lane|refresh|status|outbox|rule|leave|decide|target|transport|fixed|sheet|report|export|discover|focus|priority|plan|start|rebuild|rules|spec   (cspeach --help for details)');
                 return sub ? 1 : 0;
         }
     }
@@ -170,6 +196,28 @@ export async function runTeamCommand(args, deps) {
         return 1;
     }
 }
+/** The joined project is a team build. Unreadable or none: no guard (the verb says why itself). */
+function activeIsBuild() {
+    try {
+        const joined = activeProject();
+        return !!joined && isBuildProject(readProjectFile(joined.projectDir));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The team build folder (Task 7): no SAP connection, nothing pulled or
+ * measured. The lead joins with the outbox in the folder itself.
+ */
+function initBuild(dir, name, lead, deps, asName) {
+    createBuildProject(dir, { name, lead: { name: lead }, now: (deps.now ?? (() => new Date()))(), ...(deps.rand ? { rand: deps.rand } : {}) });
+    const quiet = { ...deps, print: () => { } };
+    join([dir, '--outbox', dir], quiet, asName);
+    deps.print(`✓ Team build "${name}" set up in this folder. Lead: ${lead}.`);
+    deps.print('  Specs save to specs/ for the developer. Start CSPeach here: cspeach');
+    return 0;
+}
 /** True when this seat is the project's lead. The one test: requireLead and team_lane_move both use it. */
 export function isLead(project, deps) {
     return whoAmI(deps).trim().toLowerCase() === project.lead.name.trim().toLowerCase();
@@ -191,6 +239,8 @@ const INIT_USAGE = 'Usage: cspeach team init <folder> --name "<name>" [--lead "<
     + '[--packages ZFI_*,ZSD_*] [--include-local] [--atc-variant <NAME>] [--no-measure] [--no-from-discovery]';
 /** Everything `init` understands. Anything else is a typo, and a typo is refused, never ignored. */
 const INIT_OPTIONS = ['name', 'lead', 'type', 'packages', 'include-local', 'sap-alias', 'atc-variant', 'no-measure', 'from-discovery', 'no-from-discovery'];
+/** What `init --type build` takes: a team build has no packages, no check and no discovery to read. */
+const INIT_BUILD_OPTIONS = ['name', 'lead', 'type'];
 /** The two that take no value, so neither can eat the folder name. */
 const INIT_FLAGS = ['include-local', 'no-measure', 'from-discovery', 'no-from-discovery'];
 /** Typed on `init` out of muscle memory: they choose what to MEASURE, which is another verb. */
@@ -220,7 +270,9 @@ function unknownInitOption(name) {
 }
 const START_USAGE = 'Usage: cspeach team start <packages> | --for "<area words, e.g. FI and SD>" [--developers "<names>, me"] '
     + '[--name "<name>"] [--atc-variant <NAME>] [--transport <REQUEST>] [--folder <folder>] [--no-measure] [--sap-alias <name>]';
-const START_OPTIONS = ['name', 'atc-variant', 'folder', 'no-measure', 'sap-alias', 'for', 'developers', 'transport'];
+const START_OPTIONS = ['name', 'atc-variant', 'folder', 'no-measure', 'sap-alias', 'for', 'developers', 'transport', 'type'];
+/** What `start --type build` takes besides the type: a team build has no packages, no check and no transport yet. */
+const START_BUILD_OPTIONS = ['type', 'name', 'folder'];
 /** The check a project measures with when nobody names one. */
 export const DEFAULT_ATC_VARIANT = 'ABAP_CLOUD_READINESS';
 /** I16: `--for` reads the packages from the folder's discovery; without one there is nothing to read them from. */
@@ -288,6 +340,13 @@ async function start(args, deps) {
         if (!START_OPTIONS.includes(name))
             throw new RegisterError(`--${name} is not an option of team start.\n${START_USAGE}`);
     }
+    // Team build (Task 7): the folder you are in, its name, you as the lead. Nothing to pull.
+    if (opts.type !== undefined) {
+        if (opts.type !== 'build' || positional.length || Object.keys(opts).some((o) => !START_BUILD_OPTIONS.includes(o)))
+            throw new RegisterError(START_USAGE);
+        const dir = path.resolve(opts.folder && opts.folder !== 'true' ? opts.folder : process.cwd());
+        return initBuild(dir, opts.name && opts.name !== 'true' ? opts.name : path.basename(dir), deps.identity().name, deps);
+    }
     const typed = positional.join(',').split(',').map((p) => p.trim().toUpperCase()).filter(Boolean);
     if (typed.some(isPatternWord))
         throw new RegisterError(NOT_A_PATTERN);
@@ -432,6 +491,12 @@ async function init(args, deps) {
     const type = (opts.type ?? 'clean-core');
     if (!TYPES.includes(type))
         throw new RegisterError(`--type must be one of: ${TYPES.join(', ')}`);
+    if (type === 'build') {
+        // A team build pulls, measures and discovers nothing: those options are refused, as on `start --type build`.
+        if (Object.keys(opts).some((o) => !INIT_BUILD_OPTIONS.includes(o)))
+            throw new RegisterError(INIT_USAGE);
+        return initBuild(dir, name, lead, deps, given || undefined);
+    }
     // One variant per team project (D6), named here or never. A name SAP could
     // not accept is refused before a folder exists, not after it is written in.
     const atcVariant = opts['atc-variant'] && opts['atc-variant'] !== 'true' ? opts['atc-variant'].trim().toUpperCase() : '';
@@ -700,6 +765,11 @@ function join(args, deps, asName) {
     state.projects[project.projectId] = { projectDir, outboxDir, writerId, ...(saved ? { name: saved } : {}) };
     state.active = project.projectId;
     saveState(state);
+    // A team build has no objects to own: one line.
+    if (isBuildProject(project)) {
+        deps.print(buildJoinLine(project, writerId));
+        return 0;
+    }
     deps.print(`✓ Joined "${project.name}" (${objects} objects, lead ${project.lead.name}) as ${writerId}.`);
     // Outbox is the team project folder itself: records land where everyone reads them.
     if (path.relative(projectDir, outboxDir) === '') {
@@ -2494,7 +2564,7 @@ const heldExportLine = (name) => `  ! "${name}" is open in another program, so i
 /** The CSV export of the team project folder, as the team page reads it, into `dir`. */
 export function writeExports(projectDir, project, dir, deps) {
     const { register } = registerFor(projectDir, outboxFor(projectDir));
-    return writeExportFiles(register, project, dir, (deps.now?.() ?? new Date()).toISOString());
+    return writeExportFiles(register, coreProject(project), dir, (deps.now?.() ?? new Date()).toISOString());
 }
 /**
  * `team export [--out <folder>] [--always]` (spec §3.4, D2): the CSV files for

package/dist/journey/chain.js

@@ -15,6 +15,8 @@
  */
 import { estateSummaryOf, viewWords } from '@cspeach/register-core';
 import { DEFAULT_ATC_VARIANT, FIRST_CHECK_PER_PACKAGE_LINE, FIRST_CHECK_WHOLE_MAX, isLead, ruleObject, runTeamCommand, whoAmI } from '../commands/team.js';
+import { FUNCTIONAL_VERB_LINE } from '../commands/team-build.js';
+import { isFunctionalSeat } from '../licence/seat-state.js';
 import { activeProject, readBaseline, readEstate, readProjectFile, VARIANT_NAME } from '../register/store.js';
 import { findingsByObject } from '../register/findings.js';
 import { shown, shownUpTo } from '../register/atc-file.js';
@@ -245,6 +247,12 @@ export async function enterJourney(trigger, h) {
         h.emit(trigger.line);
         return;
     }
+    // Final review F1: the clean-core and upgrade steps record work and run
+    // SAP's checks. A functional seat is told so once, before any card or read.
+    if (isFunctionalSeat()) {
+        h.emit(FUNCTIONAL_VERB_LINE);
+        return;
+    }
     startJourneyFlow(h.session, trigger.kind === 'start' ? trigger.packages : []);
     // B8: a start sentence is a new run: its DONE never reads as "nothing left" against an earlier one.
     if (trigger.kind === 'start')

package/dist/journey/clean-core.js

@@ -26,7 +26,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { projectView, provenForTarget as provenForTargetCore } from '@cspeach/register-core';
-import { DISCOVERY_DIR, TEAM_FILE, activeProject, readBaseline, readEstate, readProjectFile } from '../register/store.js';
+import { DISCOVERY_DIR, TEAM_FILE, activeProject, coreProject, readBaseline, readEstate, readProjectFile } from '../register/store.js';
 import { registerFor } from '../register/picture.js';
 import { reportFileNames } from '../register/workbooks.js';
 import { samePath } from '../commands/team-discover.js';
@@ -250,7 +250,7 @@ export function readJourneyFacts(cwd, me, skip) {
         const joined = activeProject();
         // The project file folderRead already read (joined means its folder is this one).
         facts.register = registerFor(joined.projectDir, joined.outboxDir, project).register;
-        facts.view = projectView(facts.register, project, skip?.decide ? { skipped: skip.decide } : {});
+        facts.view = projectView(facts.register, coreProject(project), skip?.decide ? { skipped: skip.decide } : {});
         facts.reportsAt = reportsAt(cwd, folder.name);
     }
     catch {

package/dist/journey/rebuild.js

@@ -36,6 +36,8 @@ import { shown } from '../register/atc-file.js';
 import { cleanReason, OBJECT_NAME, OBJECT_TYPE, objectShown } from './run.js';
 import { clearJourneyFlow } from './flow.js';
 import { whoAmI } from '../commands/team.js';
+import { FUNCTIONAL_VERB_LINE } from '../commands/team-build.js';
+import { isFunctionalSeat } from '../licence/seat-state.js';
 import { setRebuildRunActive } from '../commands/plan-gate.js';
 /* ── words ──────────────────────────────────────────────────────────────── */
 export const KIND_WORDS = {
@@ -139,6 +141,9 @@ async function seatName() {
 }
 /** One evidence record: the `rebuild` row on each OLD object's key (additive; older readers drop it). */
 export function writeRebuildRows(joined, keys, row, by, now = new Date()) {
+    // Final review F1: a functional seat records nothing into the project (every caller catches this).
+    if (isFunctionalSeat())
+        throw new Error(FUNCTIONAL_VERB_LINE);
     const at = now.toISOString();
     return writeRecord(joined, 'evidence', keys.map((key) => ({ key, rebuild: { ...(typeof row === 'function' ? row(key) : row), by, at } })), { name: by }, { now });
 }
@@ -262,6 +267,9 @@ export function handOffRebuild(h, g, kind) {
     }
     const now = (h.now ?? (() => new Date()))();
     try {
+        // Final review F1: no brief into the shared folder either, on a functional seat.
+        if (isFunctionalSeat())
+            throw new Error(FUNCTIONAL_VERB_LINE);
         if (kind !== 'class') {
             writeRebuildBrief(joined.projectDir, g.app, rebuildBrief({
                 kind, ...(h.sid ? { sid: h.sid } : {}), target: first.target ?? null,

package/dist/journey/run.js

@@ -14,6 +14,8 @@
 import path from 'node:path';
 import { estateSummaryOf, PART_ORDER, PART_WORDS, provenForTargetWords, usageLineWithWindow } from '@cspeach/register-core';
 import { DEFAULT_ATC_VARIANT, FIRST_CHECK_PER_PACKAGE_LINE, FIRST_CHECK_WHOLE_MAX, NO_CHECK_ALL_LINE, ownerMatch, runTeamCommand, severalLine, whoAmI, writeExports, writeReports } from '../commands/team.js';
+import { FUNCTIONAL_VERB_LINE } from '../commands/team-build.js';
+import { isFunctionalSeat } from '../licence/seat-state.js';
 import { EXPORTS_DIR, exportsOff, exportsOn, exportsPresent, setExportsAlways } from '../register/export-files.js';
 import { shown, shownUpTo } from '../register/atc-file.js';
 import { withoutRuleId } from '../register/records.js';
@@ -162,6 +164,11 @@ const IS_PATTERN = /[*?%]/;
  */
 export async function runJourneyStage(stage, ctx) {
     try {
+        // Final review F1: a functional seat reads a team project and never records
+        // into it — no start, no decision, no fix, no check, no report. Said before
+        // any card and before SAP is reached, headless too.
+        if (FUNCTIONAL_STAGES.has(stage) && isFunctionalSeat())
+            return result(stage, [FUNCTIONAL_VERB_LINE], { kind: 'stop' });
         if (ctx.headless)
             return nextStepOnly(stage, ctx);
         // Said before any card: a step that needs SAP, in a session without one.
@@ -189,6 +196,8 @@ export async function runJourneyStage(stage, ctx) {
 }
 const me = (ctx) => whoAmI(ctx.team.deps);
 const facts = (ctx) => readJourneyFacts(ctx.cwd, me(ctx), ctx.skips);
+/** The stages that record work into the project or run SAP's checks: refused on a functional seat. */
+const FUNCTIONAL_STAGES = new Set(['START', 'DECIDE', 'FIX', 'PROVE', 'REPORT']);
 /** Run a team body with its output kept back; `said` holds only this run's lines. */
 async function quiet(ctx, args) {
     const { said } = ctx.team;

package/dist/licence/paths.js

@@ -4,3 +4,8 @@ import { cspeachRoot } from '../config/paths.js';
 export function licenceCachePath() {
     return path.join(cspeachRoot(), 'licence.json');
 }
+/** <CSPeach home>/seat.json — the last verified seat kind (Team build). Holds
+ *  no secret: the MAC is keyed by the API key, which is not in the file. */
+export function seatRecordPath() {
+    return path.join(cspeachRoot(), 'seat.json');
+}

package/dist/licence/seat-kind.js

@@ -0,0 +1,110 @@
+/**
+ * Team build — the seat record and the resolution rule.
+ *
+ * A developer is never wrongly locked read-only, and a functional seat never
+ * turns writable:
+ *   1. a fresh /v1/me answer wins (no field = an older proxy = developer);
+ *   2. else the last verified record in seat.json (HMAC over
+ *      `keyPrefix\nkind\nverifiedAt`, keyed by the full API key);
+ *   3. else a pre-release sign-in (auth.json without `signedInWith`) is a
+ *      developer;
+ *   4. else "not signed in" — never a guess.
+ * A record that is present but fails verification is `invalid`, never a
+ * fall-through to the legacy rule.
+ */
+import crypto from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { formatFailure } from '../renderer/notice-shape.js';
+import { keyPrefixOf } from './licence-check.js';
+import { seatRecordPath } from './paths.js';
+const isSeatKind = (v) => v === 'developer' || v === 'functional';
+export function seatMac(apiKey, keyPrefix, kind, verifiedAt) {
+    return crypto.createHmac('sha256', apiKey).update(`${keyPrefix}\n${kind}\n${verifiedAt}`).digest('hex');
+}
+export function makeSeatRecord(apiKey, kind, now) {
+    const keyPrefix = keyPrefixOf(apiKey);
+    const verifiedAt = now.toISOString();
+    return { keyPrefix, kind, verifiedAt, mac: seatMac(apiKey, keyPrefix, kind, verifiedAt) };
+}
+export function verifySeatRecord(raw, apiKey) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return null;
+    const r = raw;
+    if (typeof r.keyPrefix !== 'string' || typeof r.verifiedAt !== 'string' || typeof r.mac !== 'string')
+        return null;
+    if (!isSeatKind(r.kind))
+        return null;
+    if (r.keyPrefix !== keyPrefixOf(apiKey))
+        return null;
+    const expected = Buffer.from(seatMac(apiKey, r.keyPrefix, r.kind, r.verifiedAt), 'utf-8');
+    const given = Buffer.from(r.mac, 'utf-8');
+    // Lengths first: timingSafeEqual throws on unequal lengths.
+    if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected))
+        return null;
+    return { keyPrefix: r.keyPrefix, kind: r.kind, verifiedAt: r.verifiedAt, mac: r.mac };
+}
+/** Ruling R7b: the legacy rule's input. No auth.json (a pasted or env key, or
+ *  a pre-login keytar seat) or an auth.json without `signedInWith` is a
+ *  pre-release sign-in; only a sign-in made by this CLI or newer is not. */
+export function isLegacySignIn(authFile) {
+    return !authFile || authFile.signedInWith === undefined;
+}
+export function resolveSeatKind(a) {
+    if (a.fresh?.ok) {
+        const word = a.fresh.profile.seat_kind;
+        const kind = word === undefined ? 'developer' : isSeatKind(word) ? word : null;
+        if (kind === null)
+            return { ok: false, reason: 'invalid' };
+        return { ok: true, kind, source: 'fresh', write: makeSeatRecord(a.apiKey, kind, a.now) };
+    }
+    if (a.stored !== undefined && a.stored !== null) {
+        const rec = verifySeatRecord(a.stored, a.apiKey);
+        return rec ? { ok: true, kind: rec.kind, source: 'stored', write: null } : { ok: false, reason: 'invalid' };
+    }
+    if (a.legacySignIn)
+        return { ok: true, kind: 'developer', source: 'legacy', write: null };
+    return { ok: false, reason: 'missing' };
+}
+/** seat.json as stored: null when there is no file; `{ corrupt: true }` when
+ *  it cannot be read or parsed, so it resolves `invalid`, never `missing`. */
+export async function readSeatRecord() {
+    let text;
+    try {
+        text = await fs.readFile(seatRecordPath(), 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        return { corrupt: true };
+    }
+    try {
+        const parsed = JSON.parse(text);
+        return parsed === null ? { corrupt: true } : parsed;
+    }
+    catch {
+        return { corrupt: true };
+    }
+}
+export async function writeSeatRecord(r) {
+    const p = seatRecordPath();
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    // Only the known fields; temp file + rename, as writeLicenceCache.
+    const body = { keyPrefix: r.keyPrefix, kind: r.kind, verifiedAt: r.verifiedAt, mac: r.mac };
+    const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    try {
+        await fs.writeFile(tmp, JSON.stringify(body, null, 2), 'utf-8');
+        await fs.rename(tmp, p);
+    }
+    finally {
+        await fs.rm(tmp, { force: true }).catch(() => { });
+    }
+}
+export function seatSignInMessage() {
+    return formatFailure({
+        what: 'We could not confirm your seat',
+        detail: ['Your SAP work, sessions and snapshots are untouched.'],
+        next: 'cspeach login',
+    }).trimEnd();
+}
+export const READ_ONLY_SEAT_LINE = 'Read-only seat: CSPeach reads your SAP system and never changes it. Specs, notes and Word documents still save to your folder.';

package/dist/licence/seat-state.js

@@ -0,0 +1,4 @@
+let current = 'developer';
+export function getSeatKind() { return current; }
+export function setSeatKind(k) { current = k; }
+export function isFunctionalSeat() { return current === 'functional'; }

package/dist/licence/terminal-seat.js

@@ -0,0 +1,43 @@
+import { isLegacySignIn, resolveSeatKind, verifySeatRecord } from './seat-kind.js';
+export async function resolveTerminalSeat(d) {
+    try {
+        const apiKey = (await d.resolveApiKey().catch(() => ({ key: null }))).key ?? '';
+        const stored = await d.readSeatRecord().catch(() => ({ corrupt: true }));
+        const authFile = await d.readAuthFile().catch(() => null);
+        const verified = stored !== null && stored !== undefined && apiKey !== '' && verifySeatRecord(stored, apiKey) !== null;
+        let fresh = null;
+        if (apiKey && !verified) {
+            try {
+                fresh = await d.fetchMe({ proxyUrl: await d.proxyUrl(), apiKey });
+            }
+            catch {
+                fresh = null;
+            }
+            if (fresh && !fresh.ok && fresh.status === 401)
+                return 'unconfirmed';
+        }
+        const r = resolveSeatKind({ fresh, stored, apiKey, now: d.now?.() ?? new Date(), legacySignIn: isLegacySignIn(authFile) });
+        if (!r.ok)
+            return 'unconfirmed';
+        if (r.write)
+            await d.writeSeatRecord(r.write).catch(() => { });
+        return r.kind;
+    }
+    catch {
+        return 'unconfirmed';
+    }
+}
+/** The real wiring for cli.ts: the stored key, seat.json, auth.json, the configured proxy. */
+export async function resolveTerminalSeatNow() {
+    const [{ resolveApiKey }, { readAuthFile }, { fetchMe }, { loadConfig }, seat] = await Promise.all([
+        import('../auth/key-resolver.js'), import('../auth/auth-file.js'), import('../auth/me.js'), import('../config/loader.js'), import('./seat-kind.js'),
+    ]);
+    return resolveTerminalSeat({
+        resolveApiKey: () => resolveApiKey(),
+        readSeatRecord: seat.readSeatRecord,
+        writeSeatRecord: seat.writeSeatRecord,
+        readAuthFile: () => readAuthFile(),
+        fetchMe: (a) => fetchMe(a),
+        proxyUrl: async () => (await loadConfig()).proxy_url,
+    });
+}

package/dist/licence/turn-gate.js

@@ -61,6 +61,10 @@ export class LicenceTurnGate {
                 this.lastCheckAtMs = -Infinity;
             return { allow: false, message: d.message };
         }
+        try {
+            await this.o.onSeat?.(d);
+        }
+        catch { /* a seat refresh failure never blocks a turn */ }
         return d.verdict === 'unknown' ? { allow: true, line: d.line } : { allow: true };
     }
 }

package/dist/one-shot.js

@@ -28,6 +28,10 @@ import { resolveRenderingMode } from './renderer/rendering-mode.js';
 import { setLook, setBackground } from './renderer/look.js';
 import { setAssistantStyle } from './agent/style-state.js';
 import { setAssistantLevel } from './agent/level-state.js';
+import { readAuthFile } from './auth/auth-file.js';
+import { fetchMe } from './auth/me.js';
+import { resolveSeatKind, readSeatRecord, writeSeatRecord, seatSignInMessage, isLegacySignIn } from './licence/seat-kind.js';
+import { setSeatKind } from './licence/seat-state.js';
 import { alwaysDeclinePreviewHook } from './repl/update-method-preview-hook.js';
 import { createClassicOutputEmitter } from './renderer/notices.js';
 import { AnswerTrim } from './renderer/answer-trim.js';
@@ -170,6 +174,31 @@ export async function runOneShot(prompt, opts) {
         console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
         return 1;
     }
+    // Team build Task 5 — the seat kind, set before the turn. A fresh answer
+    // wins (managed: one /v1/me for the seat, ruling R7a; other modes: the
+    // licence check below), else the verified seat.json, else a pre-release
+    // sign-in — no auth.json, or one without signedInWith (R7b) — is a
+    // developer, else the sign-in message and exit 1 — never a guess.
+    const settleSeat = async (fresh) => {
+        const r = resolveSeatKind({
+            fresh, stored: await readSeatRecord(), apiKey: (await store.get()) ?? '', now: new Date(),
+            legacySignIn: isLegacySignIn(await readAuthFile()),
+        });
+        if (!r.ok) {
+            console.error(seatSignInMessage());
+            return false;
+        }
+        if (r.write)
+            await writeSeatRecord(r.write).catch(() => { });
+        setSeatKind(r.kind);
+        // The developer default follows a functional seat; an explicit level stays.
+        const level = cfg.assistant?.level ?? 'developer';
+        setAssistantLevel(r.kind === 'functional' && level === 'developer' ? 'functional' : level);
+        return true;
+    };
+    if (cfg.llm.mode === 'managed'
+        && !(await settleSeat(await fetchMe({ proxyUrl: cfg.proxy_url, apiKey: (await store.get()) ?? '' }))))
+        return 1;
     // Security batch item 1 — licence check at one-shot start, byok / ai-hub /
     // local only. Managed makes no new call: the proxy checks every request.
     if (cfg.llm.mode !== 'managed') {
@@ -178,6 +207,9 @@ export async function runOneShot(prompt, opts) {
             console.error(licence.message);
             return 1;
         }
+        // The licence check IS the /v1/me call: an ok verdict carries the kind.
+        if (!(await settleSeat(licence.verdict === 'ok' && licence.profile ? { ok: true, profile: licence.profile, serverDate: null } : null)))
+            return 1;
         if (licence.verdict === 'unknown')
             console.error(formatInfo(licence.line).trimEnd());
         // Azure tenant mode — one-shot never asks: a changed endpoint, removed

package/dist/projects/answer-blockers.js

@@ -127,7 +127,7 @@ function readsLikeQuestion(typed) {
 export async function offerAnswerBlockers(args) {
     let env;
     try {
-        env = readProjectFile(args.path);
+        env = (args.readEnvelope ?? readProjectFile)(args.path);
     }
     catch {
         return null;
@@ -226,19 +226,43 @@ export async function offerAnswerBlockers(args) {
         // Typed replies were given but not saved: say "saved", not "entered".
         const verb = [...outcomes.values()].includes('declined-question') ? 'saved' : 'entered';
         args.log('');
+        // Record mode (team build): the spec is answered in CSPeach, not at cspeach.dev/edit.
+        const later = args.recordAnswer ? ''
+            : blockers.length === 1 ? ' Answer it later at cspeach.dev/edit.' : ' Answer them later at cspeach.dev/edit.';
         args.log(blockers.length === 1
-            ? `No answer ${verb}. The blocker stays open. Answer it later at cspeach.dev/edit.`
-            : `No answers ${verb}. The ${blockers.length} blockers stay open. Answer them later at cspeach.dev/edit.`);
+            ? `No answer ${verb}. The blocker stays open.${later}`
+            : `No answers ${verb}. The ${blockers.length} blockers stay open.${later}`);
         args.onOutcomes?.(outcomes);
         return null;
     }
     const nowIso = (args.now ?? (() => new Date().toISOString()))();
-    const saved = saveBlockerAnswers(args.path, env, answers, args.identity, nowIso);
-    if (!saved.ok) {
-        args.log(`[answer] revision invalid (${saved.error}) — answers NOT saved.`);
-        return null;
+    if (args.recordAnswer) {
+        // Team build (Task 9): check the revision, but never write the author's file.
+        const check = validateEnvelope(JSON.parse(JSON.stringify(applyBlockerAnswers(env, answers, args.identity, nowIso))));
+        if (!check.ok) {
+            args.log(`[answer] revision invalid (${check.error.message}) — answers NOT saved.`);
+            return null;
+        }
+    }
+    else {
+        const saved = saveBlockerAnswers(args.path, env, answers, args.identity, nowIso);
+        if (!saved.ok) {
+            args.log(`[answer] revision invalid (${saved.error}) — answers NOT saved.`);
+            return null;
+        }
     }
     const stillOpen = blockers.length - answers.size;
+    if (args.recordAnswer) {
+        for (const [gapId, answer] of answers)
+            args.recordAnswer({ gapId, answer, identity: args.identity, at: nowIso });
+        args.log('');
+        args.log(`Recorded ${plural(answers.size, 'answer')} for the developer.`
+            + (stillOpen === 0 ? ''
+                : stillOpen === 1 ? ' 1 blocker is still open.'
+                    : ` ${stillOpen} blockers are still open.`));
+        args.onOutcomes?.(outcomes);
+        return answers.size;
+    }
     args.log('');
     args.log(`Recorded ${plural(answers.size, 'answer')} in the file.`
         + (stillOpen === 0 ? ''

package/dist/projects/blocker-answers-note.js

@@ -47,7 +47,7 @@ export function blockerAnswersNote(a) {
         return null;
     let env;
     try {
-        env = readProjectFile(a.path);
+        env = (a.readEnvelope ?? readProjectFile)(a.path);
     }
     catch {
         return null;

package/dist/projects/save-command.js

@@ -24,6 +24,12 @@ import { checkLaneConsistency, checkRequiredDeploy, LANE_CHANGED_AT_CREATE, read
 import { specGapRefForSave } from './plan-sources.js';
 import { checkSkeletonDecision, hasSkeletonPhase } from './plan-skeleton.js';
 import { laneRootFor } from '../lane/roots.js';
+import { sharedSpecTargetFor, specAuthorFor, writeSharedSpec } from './spec-share.js';
+/** YYYY-MM-DD in local time (the Word copy's date). */
+function localDate(d) {
+    const p = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+}
 const SKILL_REGISTRY = {
     'abap-spec-gap': {
         artefactType: 'spec-gap',
@@ -489,9 +495,9 @@ export async function runSaveCommand(args) {
             try {
                 // Project view Task 5: the view is built once here and answers each card's target.
                 const { registerFor } = await import('../register/picture.js');
-                const { readProjectFile } = await import('../register/store.js');
+                const { coreProject, readProjectFile } = await import('../register/store.js');
                 const { projectView } = await import('@cspeach/register-core');
-                const view = projectView(registerFor(project.projectDir, project.outboxDir).register, readProjectFile(project.projectDir));
+                const view = projectView(registerFor(project.projectDir, project.outboxDir).register, coreProject(readProjectFile(project.projectDir)));
                 targets = (key) => view.object(key.trim().toUpperCase())?.target;
             }
             catch {
@@ -552,6 +558,35 @@ export async function runSaveCommand(args) {
             promotedFrom: args.promotedFrom ?? null,
         });
     }
+    // Team build (Task 9) — a spec-gap saved in a team build folder goes to the
+    // shared specs/<slug>/ folder, for the developer. Found by the folder
+    // CSPeach runs in, never by activeProject() (R10). There is no baseline and
+    // nothing to record into a register: the record block below is skipped, so
+    // a clean-core project that is active elsewhere is never touched.
+    // Final review F6: the caller's folder (args.cwd), never process.cwd().
+    const shared = sharedSpecTargetFor(args.cwd, spec.artefactType);
+    if (shared) {
+        try {
+            args.onProjectId?.(shared.projectId);
+        }
+        catch { /* tagging is best-effort */ }
+        const now = new Date();
+        const r = await writeSharedSpec({
+            teamDir: shared.teamDir,
+            projectId: shared.projectId,
+            env,
+            markdown: args.skillOutput,
+            by: specAuthorFor(shared.projectId, args.author.name),
+            ...(args.sapSystem ? { sapSystem: args.sapSystem } : {}),
+            today: localDate(now),
+            now,
+        });
+        const slug = basename(r.specDir);
+        args.log(`Saved: specs/${slug}/${basename(r.jsonPath)} (in the shared team folder, for the developer)`);
+        if (r.docxPath)
+            args.log(`Word copy: specs/${slug}/${basename(r.docxPath)}`);
+        return r.jsonPath;
+    }
     // Saves land in the workspace folder, not cwd — created only NOW, after
     // the user confirmed (declined saves and conversational turns leave no
     // mkdir/.gitignore side effects). Falls back to args.cwd if the workspace