@formigio/fazemos-cli 0.10.67 → 0.10.74

package/dist/preflight/repoRead.d.ts

@@ -0,0 +1,65 @@
+/**
+ * F53 D3 — Remote workspace repo file reads via the operator's `gh` CLI.
+ *
+ * Row 3 checks (persona, playbook, roles.json entry) are verified against
+ * `origin/main` of the workspace repo — not the local working copy — so
+ * an uncommitted state doesn't produce false PASSes or FAILes.
+ */
+export interface RepoRef {
+    owner: string;
+    repo: string;
+    ref: string;
+}
+/**
+ * Parse a git remote URL into { owner, repo }.
+ * Handles HTTPS (https://github.com/owner/repo.git) and SSH (git@github.com:owner/repo.git).
+ */
+export declare function parseGitHubUrl(url: string): {
+    owner: string;
+    repo: string;
+} | null;
+/**
+ * Resolve the GitHub owner/repo for a workspace by reading its git remote origin URL.
+ * Returns null if the workspace is not a GitHub repo or git is not available.
+ */
+export declare function getWorkspaceGitHubRepo(workspaceRoot: string): RepoRef | null;
+/**
+ * Check if `gh` CLI is installed and authenticated.
+ * Throws ToolingError if not.
+ */
+export declare function checkGhAvailable(): void;
+/**
+ * Check if a file exists in the GitHub repo at origin/main.
+ * Calls `gh api` to query the Contents API.
+ * Returns true if file exists, false if 404.
+ * Throws ToolingError if gh fails for any other reason.
+ */
+export declare function checkFileExistsOnGitHub(repoRef: RepoRef, filePath: string): boolean;
+/**
+ * Get file size in bytes from the GitHub repo at origin/main.
+ * Returns null if the file is not found (404).
+ * Returns 0 if the file exists but is empty.
+ * Throws ToolingError if gh fails for any other reason.
+ */
+export declare function getFileSizeOnGitHub(repoRef: RepoRef, filePath: string): number | null;
+/**
+ * List filenames in a directory on GitHub at origin/main.
+ * Returns null if the path is not found (404) or if the path is a file (not a dir).
+ * Returns an array of filenames if the path is a directory.
+ * Throws ToolingError if gh fails for any other reason.
+ */
+export declare function listDirectoryFilenamesOnGitHub(repoRef: RepoRef, dirPath: string): string[] | null;
+/**
+ * Get the full decoded text content of a file from the GitHub repo at origin/main.
+ * Returns null if the file is not found (404).
+ * Throws ToolingError if gh fails for any other reason.
+ *
+ * The GitHub Contents API returns base64-encoded content (≤1 MB). We decode it
+ * in Node.js after receiving the raw base64 string from gh. This is a content
+ * fetch (not just metadata), which is appropriate for the row-3a body check —
+ * persona files are small markdown docs and the extra payload is negligible.
+ */
+export declare function getFileContentOnGitHub(repoRef: RepoRef, filePath: string): string | null;
+export declare class ToolingError extends Error {
+    constructor(message: string);
+}

package/dist/preflight/repoRead.js

@@ -0,0 +1,194 @@
+/**
+ * F53 D3 — Remote workspace repo file reads via the operator's `gh` CLI.
+ *
+ * Row 3 checks (persona, playbook, roles.json entry) are verified against
+ * `origin/main` of the workspace repo — not the local working copy — so
+ * an uncommitted state doesn't produce false PASSes or FAILes.
+ */
+import { execSync } from 'child_process';
+/**
+ * Parse a git remote URL into { owner, repo }.
+ * Handles HTTPS (https://github.com/owner/repo.git) and SSH (git@github.com:owner/repo.git).
+ */
+export function parseGitHubUrl(url) {
+    // HTTPS
+    const httpsMatch = url.match(/github\.com\/([^/]+)\/([^/.]+?)(?:\.git)?\s*$/);
+    if (httpsMatch)
+        return { owner: httpsMatch[1], repo: httpsMatch[2] };
+    // SSH
+    const sshMatch = url.match(/github\.com:([^/]+)\/([^/.]+?)(?:\.git)?\s*$/);
+    if (sshMatch)
+        return { owner: sshMatch[1], repo: sshMatch[2] };
+    return null;
+}
+/**
+ * Resolve the GitHub owner/repo for a workspace by reading its git remote origin URL.
+ * Returns null if the workspace is not a GitHub repo or git is not available.
+ */
+export function getWorkspaceGitHubRepo(workspaceRoot) {
+    try {
+        const url = execSync('git config --get remote.origin.url', {
+            cwd: workspaceRoot,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        const parsed = parseGitHubUrl(url);
+        if (!parsed)
+            return null;
+        return { ...parsed, ref: 'main' };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check if `gh` CLI is installed and authenticated.
+ * Throws ToolingError if not.
+ */
+export function checkGhAvailable() {
+    try {
+        execSync('gh auth status', {
+            stdio: ['pipe', 'pipe', 'pipe'],
+            encoding: 'utf-8',
+        });
+    }
+    catch (err) {
+        const msg = String(err.stderr ?? err.stdout ?? err.message ?? '');
+        if (msg.includes('not logged into any') || msg.includes('not logged in') || msg.includes('You are not logged')) {
+            throw new ToolingError('gh CLI is not authenticated. Run: gh auth login');
+        }
+        throw new ToolingError('gh CLI is not installed or not in PATH. Install with: brew install gh && gh auth login');
+    }
+}
+/**
+ * Check if a file exists in the GitHub repo at origin/main.
+ * Calls `gh api` to query the Contents API.
+ * Returns true if file exists, false if 404.
+ * Throws ToolingError if gh fails for any other reason.
+ */
+export function checkFileExistsOnGitHub(repoRef, filePath) {
+    // Encode the path for the URL, but keep slashes
+    const encodedPath = filePath.split('/').map(encodeURIComponent).join('/');
+    const url = `repos/${repoRef.owner}/${repoRef.repo}/contents/${encodedPath}?ref=${repoRef.ref}`;
+    try {
+        execSync(`gh api "${url}" --jq '.type'`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return true;
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? '');
+        const stdout = String(err.stdout ?? '');
+        if (stderr.includes('Not Found') ||
+            stderr.includes('404') ||
+            stdout.includes('Not Found') ||
+            stdout.includes('"Not Found"')) {
+            return false;
+        }
+        // Other error — gh broken or auth issue
+        const detail = (stderr || stdout || String(err.message ?? '')).trim();
+        throw new ToolingError(`gh api call failed for ${filePath}: ${detail}`);
+    }
+}
+/**
+ * Get file size in bytes from the GitHub repo at origin/main.
+ * Returns null if the file is not found (404).
+ * Returns 0 if the file exists but is empty.
+ * Throws ToolingError if gh fails for any other reason.
+ */
+export function getFileSizeOnGitHub(repoRef, filePath) {
+    const encodedPath = filePath.split('/').map(encodeURIComponent).join('/');
+    const url = `repos/${repoRef.owner}/${repoRef.repo}/contents/${encodedPath}?ref=${repoRef.ref}`;
+    try {
+        const result = execSync(`gh api "${url}" --jq '.size'`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        const size = parseInt(result, 10);
+        return isNaN(size) ? 0 : size;
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? '');
+        const stdout = String(err.stdout ?? '');
+        if (stderr.includes('Not Found') ||
+            stderr.includes('404') ||
+            stdout.includes('Not Found') ||
+            stdout.includes('"Not Found"')) {
+            return null;
+        }
+        const detail = (stderr || stdout || String(err.message ?? '')).trim();
+        throw new ToolingError(`gh api call failed for ${filePath}: ${detail}`);
+    }
+}
+/**
+ * List filenames in a directory on GitHub at origin/main.
+ * Returns null if the path is not found (404) or if the path is a file (not a dir).
+ * Returns an array of filenames if the path is a directory.
+ * Throws ToolingError if gh fails for any other reason.
+ */
+export function listDirectoryFilenamesOnGitHub(repoRef, dirPath) {
+    const encodedPath = dirPath.split('/').map(encodeURIComponent).join('/');
+    const url = `repos/${repoRef.owner}/${repoRef.repo}/contents/${encodedPath}?ref=${repoRef.ref}`;
+    try {
+        // The API returns an array for directories, an object for files.
+        // Use conditional jq to safely handle both: return null if not an array.
+        const result = execSync(`gh api "${url}" --jq 'if type == "array" then [.[].name] else null end'`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+        if (result === 'null')
+            return null;
+        return JSON.parse(result);
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? '');
+        const stdout = String(err.stdout ?? '');
+        if (stderr.includes('Not Found') ||
+            stderr.includes('404') ||
+            stdout.includes('Not Found') ||
+            stdout.includes('"Not Found"')) {
+            return null;
+        }
+        const detail = (stderr || stdout || String(err.message ?? '')).trim();
+        throw new ToolingError(`gh api directory listing failed for ${dirPath}: ${detail}`);
+    }
+}
+/**
+ * Get the full decoded text content of a file from the GitHub repo at origin/main.
+ * Returns null if the file is not found (404).
+ * Throws ToolingError if gh fails for any other reason.
+ *
+ * The GitHub Contents API returns base64-encoded content (≤1 MB). We decode it
+ * in Node.js after receiving the raw base64 string from gh. This is a content
+ * fetch (not just metadata), which is appropriate for the row-3a body check —
+ * persona files are small markdown docs and the extra payload is negligible.
+ */
+export function getFileContentOnGitHub(repoRef, filePath) {
+    const encodedPath = filePath.split('/').map(encodeURIComponent).join('/');
+    const url = `repos/${repoRef.owner}/${repoRef.repo}/contents/${encodedPath}?ref=${repoRef.ref}`;
+    try {
+        // GitHub encodes file content as base64 with embedded newlines every 60 chars.
+        const rawB64 = execSync(`gh api "${url}" --jq '.content'`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+        if (!rawB64 || rawB64 === 'null')
+            return null;
+        // Strip embedded newlines before decoding
+        return Buffer.from(rawB64.replace(/\n/g, ''), 'base64').toString('utf-8');
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? '');
+        const stdout = String(err.stdout ?? '');
+        if (stderr.includes('Not Found') ||
+            stderr.includes('404') ||
+            stdout.includes('Not Found') ||
+            stdout.includes('"Not Found"')) {
+            return null;
+        }
+        const detail = (stderr || stdout || String(err.message ?? '')).trim();
+        throw new ToolingError(`gh api call failed for ${filePath}: ${detail}`);
+    }
+}
+export class ToolingError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ToolingError';
+    }
+}
+//# sourceMappingURL=repoRead.js.map

package/dist/preflight/repoRead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoRead.js","sourceRoot":"","sources":["../../src/preflight/repoRead.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAQzC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,QAAQ;IACR,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC9E,IAAI,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM;IACN,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC3E,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAAqB;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,oCAAoC,EAAE;YACzD,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,QAAQ,CAAC,gBAAgB,EAAE;YACzB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/G,MAAM,IAAI,YAAY,CACpB,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB,EAAE,QAAgB;IACxE,gDAAgD;IAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,SAAS,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,aAAa,WAAW,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAChG,IAAI,CAAC;QACH,QAAQ,CAAC,WAAW,GAAG,gBAAgB,EAAE;YACvC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,IACE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,wCAAwC;QACxC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,0BAA0B,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,QAAgB;IACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,SAAS,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,aAAa,WAAW,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,GAAG,gBAAgB,EAAE;YACtD,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,IACE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,0BAA0B,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAgB,EAAE,OAAe;IAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,SAAS,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,aAAa,WAAW,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAChG,IAAI,CAAC;QACH,iEAAiE;QACjE,yEAAyE;QACzE,MAAM,MAAM,GAAG,QAAQ,CACrB,WAAW,GAAG,2DAA2D,EACzE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAa,CAAC;IACxC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,IACE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,uCAAuC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB,EAAE,QAAgB;IACvE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,SAAS,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,aAAa,WAAW,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAChG,IAAI,CAAC;QACH,+EAA+E;QAC/E,MAAM,MAAM,GAAG,QAAQ,CACrB,WAAW,GAAG,mBAAmB,EACjC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9C,0CAA0C;QAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,IACE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,0BAA0B,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF"}

package/dist/preflight/roster.d.ts

@@ -0,0 +1,65 @@
+/**
+ * F53 r3 D9 — Roster loader.
+ *
+ * Classifies every project×role pair as one of:
+ *   - `declared_here`: workspace's roles.json (root or per-project) declares the role
+ *     with a filler and a project field.
+ *   - `declared_cross_workspace`: root roles.json `cross_workspace_roles` block declares
+ *     the role by pointer (workspace_path + registry_path); no filler, no project.
+ *   - (absence = `not_declared`): neither of the above.
+ *
+ * `declared_here` and `declared_cross_workspace` are two distinct positive states.
+ * `not_declared` is absence — not a positive entry.
+ */
+import type { RolesRegistry, RoleEntry } from '../dispatch.js';
+export interface DeclaredHereEntry {
+    classification: 'declared_here';
+    project_slug: string;
+    role_slug: string;
+    filler: RoleEntry['filler'];
+    source_file: string;
+}
+export interface DeclaredCrossWorkspaceEntry {
+    classification: 'declared_cross_workspace';
+    role_slug: string;
+    workspace_path: string;
+    registry_path: string;
+    source_file: string;
+}
+export interface Roster {
+    declared_here: DeclaredHereEntry[];
+    declared_cross_workspace: DeclaredCrossWorkspaceEntry[];
+    source_files: string[];
+}
+/**
+ * Build the roster from a root registry (and any per-project registries under
+ * `<workspaceRoot>/projects/`).
+ *
+ * @param workspaceRoot - the workspace repo root (where .fazemos/roles.json lives)
+ * @param rootRegistry - the already-loaded root registry
+ */
+export declare function loadRoster(workspaceRoot: string, rootRegistry: RolesRegistry): Roster;
+/**
+ * Return the roster classification for a (project_slug, role_slug) pair.
+ * `declared_here` wins over `declared_cross_workspace`.
+ */
+export declare function classifyRoleForProject(roster: Roster, project_slug: string, role_slug: string): 'declared_here' | 'declared_cross_workspace' | 'not_declared';
+/**
+ * Return all declared-here entries for a given role_slug, plus whether it is
+ * cross-workspace-declared.
+ */
+export declare function getProjectsForRole(roster: Roster, role_slug: string): {
+    declared_here: DeclaredHereEntry[];
+    declared_cross_workspace: DeclaredCrossWorkspaceEntry | null;
+};
+/**
+ * Return all declared-here roles for a given project_slug, plus the cross-workspace
+ * entries (which are project-agnostic — they apply to the whole workspace).
+ */
+export declare function getRolesForProject(roster: Roster, project_slug: string): {
+    declared_here: DeclaredHereEntry[];
+    declared_cross_workspace: DeclaredCrossWorkspaceEntry[];
+};
+export declare class RosterLoadError extends Error {
+    constructor(message: string);
+}

package/dist/preflight/roster.js

@@ -0,0 +1,153 @@
+/**
+ * F53 r3 D9 — Roster loader.
+ *
+ * Classifies every project×role pair as one of:
+ *   - `declared_here`: workspace's roles.json (root or per-project) declares the role
+ *     with a filler and a project field.
+ *   - `declared_cross_workspace`: root roles.json `cross_workspace_roles` block declares
+ *     the role by pointer (workspace_path + registry_path); no filler, no project.
+ *   - (absence = `not_declared`): neither of the above.
+ *
+ * `declared_here` and `declared_cross_workspace` are two distinct positive states.
+ * `not_declared` is absence — not a positive entry.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
+import { join } from 'path';
+// ── Loader ─────────────────────────────────────────────────────────────────────
+/**
+ * Build the roster from a root registry (and any per-project registries under
+ * `<workspaceRoot>/projects/`).
+ *
+ * @param workspaceRoot - the workspace repo root (where .fazemos/roles.json lives)
+ * @param rootRegistry - the already-loaded root registry
+ */
+export function loadRoster(workspaceRoot, rootRegistry) {
+    const declared_here = [];
+    const declared_cross_workspace = [];
+    const source_files = [];
+    function processRegistry(registry) {
+        if (!source_files.includes(registry._registryPath)) {
+            source_files.push(registry._registryPath);
+        }
+        const project_slug = registry.project ?? '';
+        // Locally-declared roles
+        for (const [role_slug, role] of Object.entries(registry.roles)) {
+            if (role.filler && project_slug) {
+                const exists = declared_here.some((e) => e.project_slug === project_slug && e.role_slug === role_slug);
+                if (!exists) {
+                    declared_here.push({
+                        classification: 'declared_here',
+                        project_slug,
+                        role_slug,
+                        filler: role.filler,
+                        source_file: registry._registryPath,
+                    });
+                }
+            }
+        }
+        // Cross-workspace pointers (only processed on root registry, where they live)
+        if (registry.cross_workspace_roles) {
+            for (const [role_slug, xref] of Object.entries(registry.cross_workspace_roles)) {
+                // Validate shape
+                if (!xref.workspace_path || !xref.registry_path) {
+                    throw new RosterLoadError(`Malformed cross_workspace_roles entry for '${role_slug}' in ${registry._registryPath}: ` +
+                        `must have workspace_path and registry_path.`);
+                }
+                const exists = declared_cross_workspace.some((e) => e.role_slug === role_slug);
+                if (!exists) {
+                    declared_cross_workspace.push({
+                        classification: 'declared_cross_workspace',
+                        role_slug,
+                        workspace_path: xref.workspace_path,
+                        registry_path: xref.registry_path,
+                        source_file: registry._registryPath,
+                    });
+                }
+            }
+        }
+    }
+    // Process root registry
+    processRegistry(rootRegistry);
+    // Process per-project registries (supports future layouts)
+    const projectsDir = join(workspaceRoot, 'projects');
+    if (existsSync(projectsDir)) {
+        try {
+            const entries = readdirSync(projectsDir);
+            for (const name of entries) {
+                const full = join(projectsDir, name);
+                try {
+                    if (!statSync(full).isDirectory())
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+                const candidate = join(full, '.fazemos', 'roles.json');
+                if (existsSync(candidate)) {
+                    try {
+                        const raw = JSON.parse(readFileSync(candidate, 'utf-8'));
+                        const registry = {
+                            ...raw,
+                            _workspaceRoot: workspaceRoot,
+                            _registryPath: candidate,
+                        };
+                        processRegistry(registry);
+                    }
+                    catch (err) {
+                        if (err instanceof RosterLoadError)
+                            throw err;
+                        // Malformed JSON or other issues — skip silently
+                    }
+                }
+            }
+        }
+        catch (err) {
+            if (err instanceof RosterLoadError)
+                throw err;
+            // Can't enumerate projects/ — continue
+        }
+    }
+    return { declared_here, declared_cross_workspace, source_files };
+}
+// ── Classification helpers ─────────────────────────────────────────────────────
+/**
+ * Return the roster classification for a (project_slug, role_slug) pair.
+ * `declared_here` wins over `declared_cross_workspace`.
+ */
+export function classifyRoleForProject(roster, project_slug, role_slug) {
+    if (roster.declared_here.some((e) => e.project_slug === project_slug && e.role_slug === role_slug)) {
+        return 'declared_here';
+    }
+    if (roster.declared_cross_workspace.some((e) => e.role_slug === role_slug)) {
+        return 'declared_cross_workspace';
+    }
+    return 'not_declared';
+}
+/**
+ * Return all declared-here entries for a given role_slug, plus whether it is
+ * cross-workspace-declared.
+ */
+export function getProjectsForRole(roster, role_slug) {
+    return {
+        declared_here: roster.declared_here.filter((e) => e.role_slug === role_slug),
+        declared_cross_workspace: roster.declared_cross_workspace.find((e) => e.role_slug === role_slug) ?? null,
+    };
+}
+/**
+ * Return all declared-here roles for a given project_slug, plus the cross-workspace
+ * entries (which are project-agnostic — they apply to the whole workspace).
+ */
+export function getRolesForProject(roster, project_slug) {
+    return {
+        declared_here: roster.declared_here.filter((e) => e.project_slug === project_slug),
+        declared_cross_workspace: roster.declared_cross_workspace,
+    };
+}
+// ── Errors ────────────────────────────────────────────────────────────────────
+export class RosterLoadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RosterLoadError';
+    }
+}
+//# sourceMappingURL=roster.js.map

package/dist/preflight/roster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roster.js","sourceRoot":"","sources":["../../src/preflight/roster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA2B5B,kFAAkF;AAElF;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,aAAqB,EACrB,YAA2B;IAE3B,MAAM,aAAa,GAAwB,EAAE,CAAC;IAC9C,MAAM,wBAAwB,GAAkC,EAAE,CAAC;IACnE,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,SAAS,eAAe,CAAC,QAAuB;QAC9C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAE5C,yBAAyB;QACzB,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACpE,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,aAAa,CAAC,IAAI,CAAC;wBACjB,cAAc,EAAE,eAAe;wBAC/B,YAAY;wBACZ,SAAS;wBACT,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,WAAW,EAAE,QAAQ,CAAC,aAAa;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC/E,iBAAiB;gBACjB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBAChD,MAAM,IAAI,eAAe,CACvB,8CAA8C,SAAS,QAAQ,QAAQ,CAAC,aAAa,IAAI;wBACzF,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;gBAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,wBAAwB,CAAC,IAAI,CAAC;wBAC5B,cAAc,EAAE,0BAA0B;wBAC1C,SAAS;wBACT,cAAc,EAAE,IAAI,CAAC,cAAc;wBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,WAAW,EAAE,QAAQ,CAAC,aAAa;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,eAAe,CAAC,YAAY,CAAC,CAAC;IAE9B,2DAA2D;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;wBAAE,SAAS;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBACvD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAkB,CAAC;wBAC1E,MAAM,QAAQ,GAAkB;4BAC9B,GAAG,GAAG;4BACN,cAAc,EAAE,aAAa;4BAC7B,aAAa,EAAE,SAAS;yBACzB,CAAC;wBACF,eAAe,CAAC,QAAQ,CAAC,CAAC;oBAC5B,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,YAAY,eAAe;4BAAE,MAAM,GAAG,CAAC;wBAC9C,iDAAiD;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,YAAY,EAAE,CAAC;AACnE,CAAC;AAED,kFAAkF;AAElF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,YAAoB,EACpB,SAAiB;IAEjB,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QACnG,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3E,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB;IAKjB,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;QAC5E,wBAAwB,EACtB,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,IAAI;KACjF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,YAAoB;IAKpB,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC;QAClF,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/dist/preflight/row1_member.d.ts

@@ -0,0 +1,8 @@
+/**
+ * F53 Row 1 — Agent member exists in org with the target role_slug.
+ *
+ * Data source: GET /api/organizations/:orgId/members?type=agent
+ * Checks: (a) an agent member named agentName exists, (b) role_slug ∈ agent_config.roles.
+ */
+import type { PreflightRow } from './schema.js';
+export declare function checkRow1Member(orgId: string, agentName: string, roleSlug: string): Promise<PreflightRow>;

package/dist/preflight/row1_member.js

@@ -0,0 +1,64 @@
+/**
+ * F53 Row 1 — Agent member exists in org with the target role_slug.
+ *
+ * Data source: GET /api/organizations/:orgId/members?type=agent
+ * Checks: (a) an agent member named agentName exists, (b) role_slug ∈ agent_config.roles.
+ */
+import { api } from '../api.js';
+/**
+ * Normalize a display name for fuzzy matching (case-insensitive, collapse separators).
+ */
+function normName(s) {
+    return s.toLowerCase().replace(/[-_\s]+/g, ' ').trim();
+}
+export async function checkRow1Member(orgId, agentName, roleSlug) {
+    const base = { id: '1', name: 'agent member + credential' };
+    try {
+        const data = (await api('GET', `/api/organizations/${orgId}/members?type=agent`, undefined, { noProjectHeader: true }));
+        const members = data.members ?? [];
+        const agent = members.find((m) => m.member_type === 'agent' && normName(m.display_name) === normName(agentName));
+        if (!agent) {
+            return {
+                ...base,
+                status: 'fail',
+                detail: `No agent member named '${agentName}' found in org (${members.filter((m) => m.member_type === 'agent').length} total agents).`,
+                fix_command: `fazemos agents register --name "${agentName}" --model sonnet`,
+            };
+        }
+        const roles = agent.agent_config?.roles ?? [];
+        if (!roles.includes(roleSlug)) {
+            return {
+                ...base,
+                status: 'fail',
+                detail: `Agent '${agentName}' (id=${agent.id}) found but role '${roleSlug}' not in agent_config.roles: [${roles.join(', ') || 'empty'}].`,
+                fix_command: null,
+                fix_instruction: `Update agent '${agentName}' config to include role '${roleSlug}' in its roles array. Re-run: fazemos agents register --name "${agentName}" --roles ${roleSlug}`,
+            };
+        }
+        return {
+            ...base,
+            status: 'pass',
+            detail: `${agentName} (id=${agent.id}), roles=[${roles.join(', ')}]`,
+            fix_command: null,
+        };
+    }
+    catch (err) {
+        if (err?.status === 403 || err?.status === 401) {
+            return {
+                ...base,
+                status: 'tooling_error',
+                detail: 'Access denied — owner/admin role required to list agent members.',
+                fix_command: null,
+                fix_instruction: 'Contact your org admin to grant owner or admin role, then retry.',
+            };
+        }
+        return {
+            ...base,
+            status: 'tooling_error',
+            detail: `API call failed: ${err?.message ?? String(err)}`,
+            fix_command: null,
+            fix_instruction: 'Check your Fazemos API credentials and active org, then retry.',
+        };
+    }
+}
+//# sourceMappingURL=row1_member.js.map

package/dist/preflight/row1_member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row1_member.js","sourceRoot":"","sources":["../../src/preflight/row1_member.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAchC;;GAEG;AACH,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,SAAiB,EACjB,QAAgB;IAEhB,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,sBAAsB,KAAK,qBAAqB,EAChD,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CAA8B,CAAC;QAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CACrF,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,0BAA0B,SAAS,mBAAmB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,MAAM,iBAAiB;gBACtI,WAAW,EAAE,mCAAmC,SAAS,kBAAkB;aAC5E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,SAAS,SAAS,KAAK,CAAC,EAAE,qBAAqB,QAAQ,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI;gBACzI,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,iBAAiB,SAAS,6BAA6B,QAAQ,iEAAiE,SAAS,aAAa,QAAQ,EAAE;aAClL,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,SAAS,QAAQ,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACpE,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/C,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,kEAAkE;gBAC1E,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,kEAAkE;aACpF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,oBAAoB,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;YACzD,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,gEAAgE;SAClF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/preflight/row2_roleRegistration.d.ts

@@ -0,0 +1,18 @@
+/**
+ * F53 Row 2 — role_registrations row exists, active, and bound to the correct
+ * (org_id, project_id). Also verifies resolver-key parity (r3 D8).
+ *
+ * Data source: GET /api/role-registrations/lookup?workspace=&role_slug=&org_id=<uuid>
+ * Outcome: PASS | FAIL(no_registration) | FAIL(bound_elsewhere) |
+ *           FAIL(resolver_ambiguous) | FAIL(resolver_mismatch)
+ */
+import type { PreflightRow } from './schema.js';
+export declare function checkRow2RoleRegistration(opts: {
+    workspace: string;
+    roleSlug: string;
+    orgId: string;
+    projectId: string | null;
+    orgSlug: string;
+    projectSlug: string;
+    env: string;
+}): Promise<PreflightRow>;