@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/src/services/workforce-bundle-local.js

@@ -0,0 +1,250 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initLocalBundle = initLocalBundle;
+exports.validateLocalBundle = validateLocalBundle;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const shared_1 = require("@nexusclaw/shared");
+const ai_authoring_context_v2_1 = require("./ai-authoring-context-v2");
+async function initLocalBundle(options) {
+    await (0, ai_authoring_context_v2_1.verifyAuthoringContextV2)({ manifestPath: options.contextManifestPath });
+    if (!node_fs_1.default.statSync(node_path_1.default.resolve(options.workspaceDir)).isDirectory()) {
+        throw new Error('BUNDLE_WORKSPACE_NOT_DIRECTORY');
+    }
+    assertIdentifier(options.bundleName, 'BUNDLE_NAME_INVALID');
+    const catalog = readApprovalCatalog(options.contextManifestPath);
+    requireExactPolicy(catalog, options.workforceApprovalPolicyApiName, 'workforce_release');
+    requireExactPolicy(catalog, options.toolApprovalPolicyApiName, 'tool_call');
+    const root = node_path_1.default.resolve(options.outDir);
+    if (node_fs_1.default.existsSync(root) && node_fs_1.default.readdirSync(root).length > 0) {
+        throw new Error('BUNDLE_INIT_WOULD_OVERWRITE');
+    }
+    const employeePath = node_path_1.default.join(root, 'employee', 'employee-package.json');
+    const employeeEvalCasesPath = node_path_1.default.join(root, 'employee', 'employee-eval-cases.json');
+    const bundlePath = node_path_1.default.join(root, 'workforce.bundle.json');
+    const employeePackage = employeePackageSkeleton(options.bundleName);
+    const bundle = {
+        schemaVersion: shared_1.BUNDLE_SCHEMA_VERSION,
+        name: options.bundleName,
+        version: '0.1.0',
+        agentApiName: options.bundleName,
+        employeePackage: {
+            path: 'employee/employee-package.json',
+            employeePackageName: options.bundleName,
+            evalCasesPath: 'employee/employee-eval-cases.json',
+        },
+        codePackages: [],
+        flowPackages: [],
+        toolBindings: [],
+        flowBindings: [],
+        requiredRuntimeBindings: [],
+        releasePolicy: {
+            requireCandidateTests: true,
+            requireRegressionBaseline: true,
+            requireHumanApproval: true,
+            workforceReleaseApprovalPolicyApiName: options.workforceApprovalPolicyApiName,
+            defaultToolApprovalPolicyApiName: options.toolApprovalPolicyApiName,
+            minimumSimulationPassRate: 1,
+            mutationPolicy: 'sandbox-only',
+        },
+    };
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(employeePath), { recursive: true });
+    node_fs_1.default.mkdirSync(node_path_1.default.join(root, 'extensions'), { recursive: true });
+    node_fs_1.default.mkdirSync(node_path_1.default.join(root, 'flows'), { recursive: true });
+    node_fs_1.default.mkdirSync(node_path_1.default.join(root, 'bindings'), { recursive: true });
+    node_fs_1.default.writeFileSync(employeePath, `${(0, shared_1.canonicalJsonString)(employeePackage)}\n`);
+    node_fs_1.default.writeFileSync(employeeEvalCasesPath, `${(0, shared_1.canonicalJsonString)(employeeEvalCasesSkeleton(options.bundleName))}\n`);
+    node_fs_1.default.writeFileSync(bundlePath, `${(0, shared_1.canonicalJsonString)(bundle)}\n`);
+    return {
+        bundleRoot: root,
+        bundlePath,
+        employeePackagePath: employeePath,
+        approvalPolicies: {
+            workforceRelease: options.workforceApprovalPolicyApiName,
+            toolCall: options.toolApprovalPolicyApiName,
+        },
+    };
+}
+async function validateLocalBundle(options) {
+    await (0, ai_authoring_context_v2_1.verifyAuthoringContextV2)({ manifestPath: options.contextManifestPath });
+    const root = node_path_1.default.resolve(options.bundleDir);
+    const bundle = readJson(node_path_1.default.join(root, 'workforce.bundle.json'));
+    if (bundle.schemaVersion !== shared_1.BUNDLE_SCHEMA_VERSION) {
+        throw new Error('BUNDLE_SCHEMA_VERSION_UNSUPPORTED');
+    }
+    assertExactBundleShape(bundle);
+    const catalog = readApprovalCatalog(options.contextManifestPath);
+    requireExactPolicy(catalog, bundle.releasePolicy.workforceReleaseApprovalPolicyApiName, 'workforce_release');
+    requireExactPolicy(catalog, bundle.releasePolicy.defaultToolApprovalPolicyApiName, 'tool_call');
+    const employeePath = safeBundlePath(root, bundle.employeePackage.path);
+    const employee = readJson(employeePath);
+    const employeeEvalCasesPath = safeBundlePath(root, bundle.employeePackage.evalCasesPath);
+    const employeeEvalCases = readJson(employeeEvalCasesPath);
+    const employeeValidation = (0, shared_1.validateEmployeePackage)(employee);
+    if (!employeeValidation.valid) {
+        throw new Error(`BUNDLE_EMPLOYEE_PACKAGE_INVALID:${employeeValidation.issues
+            .map((issue) => issue.path)
+            .join(',')}`);
+    }
+    if (employee.schemaVersion !== 'v2' ||
+        employee.activateOnPass !== false ||
+        employee.name !== bundle.employeePackage.employeePackageName ||
+        employee.agent.apiName !== bundle.agentApiName) {
+        throw new Error('BUNDLE_EMPLOYEE_IDENTITY_MISMATCH');
+    }
+    if (employeeEvalCases.schemaVersion !== 'employee-eval-cases/v1' ||
+        employeeEvalCases.agentApiName !== bundle.agentApiName) {
+        throw new Error('BUNDLE_EMPLOYEE_EVAL_IDENTITY_MISMATCH');
+    }
+    return {
+        valid: true,
+        bundleName: bundle.name,
+        agentApiName: bundle.agentApiName,
+        employeePackagePath: node_path_1.default.relative(root, employeePath).split(node_path_1.default.sep).join('/'),
+    };
+}
+function employeeEvalCasesSkeleton(agentApiName) {
+    return {
+        schemaVersion: 'employee-eval-cases/v1',
+        agentApiName,
+        principalFixtures: [
+            { fixtureId: 'bound', base: 'bound_candidate_agent' },
+        ],
+        cases: [
+            {
+                caseId: 'fail_closed_fixture',
+                principalFixtureId: 'bound',
+                clock: '2026-01-01T00:00:00.000Z',
+                input: 'Verify the candidate runtime fails closed without a declared model transcript.',
+                hostFixtures: { calls: [] },
+                modelCalls: [],
+                expect: {
+                    status: 'done',
+                    outputContent: 'LLM provider error: AGENT_EVAL_MODEL_FIXTURE_MISMATCH',
+                    mutations: [],
+                },
+            },
+        ],
+    };
+}
+function employeePackageSkeleton(name) {
+    return {
+        schemaVersion: 'v2',
+        name,
+        version: '0.1.0',
+        description: `Executable workforce package ${name}`,
+        activateOnPass: false,
+        agent: {
+            apiName: name,
+            name,
+            type: 'custom',
+            topics: [],
+            toolBindings: [],
+            guardrailRuleKeys: [],
+            knowledgeBaseKeys: [],
+            modelConfig: {
+                modelId: 'configure-before-stage',
+                provider: 'configure-before-stage',
+                tier: 1,
+                temperature: 0,
+                maxTokens: 1024,
+                responseFormat: 'text',
+            },
+            permissionConfig: {
+                dataScopeType: 'own',
+                maxQueriesPerMinute: 1,
+                maxWritesPerMinute: 1,
+                maxBatchSize: 1,
+                allowedTools: [],
+                blockedTools: [],
+                activeWindows: [],
+            },
+            routing: {
+                mode: 'manual_only',
+                conflictPolicy: 'priority_then_agent_api_name',
+                capabilities: [],
+            },
+        },
+        guardrails: [],
+        knowledge: [],
+        evalCases: [
+            {
+                key: 'eval:replace_before_stage',
+                name: 'Replace before stage',
+                input: 'Replace this scaffold case before remote staging.',
+                assertions: [{ type: 'status_done' }],
+                tags: ['readonly'],
+            },
+        ],
+        minPassRate: 1,
+    };
+}
+function readApprovalCatalog(manifestPath) {
+    const catalog = readJson(node_path_1.default.join(node_path_1.default.dirname(node_path_1.default.resolve(manifestPath)), 'catalogs', 'approval-policies.json'));
+    if (catalog.schemaVersion !==
+        'nexusclaw.approval-policy-authoring-catalog/v1' ||
+        !Array.isArray(catalog.policies)) {
+        throw new Error('APPROVAL_POLICY_CATALOG_INVALID');
+    }
+    return catalog;
+}
+function requireExactPolicy(catalog, apiName, purpose) {
+    const matches = catalog.policies.filter((policy) => policy.apiName === apiName &&
+        policy.purpose === purpose &&
+        policy.humanOnly === true);
+    if (matches.length !== 1) {
+        throw new Error(`APPROVAL_POLICY_EXACT_MATCH_REQUIRED:${purpose}:${apiName}`);
+    }
+}
+function assertExactBundleShape(bundle) {
+    const keys = Object.keys(bundle).sort();
+    const expected = [
+        'agentApiName',
+        'codePackages',
+        'employeePackage',
+        'flowBindings',
+        'flowPackages',
+        'name',
+        'releasePolicy',
+        'requiredRuntimeBindings',
+        'schemaVersion',
+        'toolBindings',
+        'version',
+    ].sort();
+    if (JSON.stringify(keys) !== JSON.stringify(expected)) {
+        throw new Error('BUNDLE_UNKNOWN_OR_MISSING_FIELD');
+    }
+    if (bundle.releasePolicy.requireCandidateTests !== true ||
+        bundle.releasePolicy.requireRegressionBaseline !== true ||
+        bundle.releasePolicy.requireHumanApproval !== true ||
+        bundle.releasePolicy.minimumSimulationPassRate !== 1 ||
+        bundle.releasePolicy.mutationPolicy !== 'sandbox-only') {
+        throw new Error('BUNDLE_RELEASE_POLICY_INVALID');
+    }
+}
+function safeBundlePath(root, relativePath) {
+    if (node_path_1.default.isAbsolute(relativePath) ||
+        relativePath.split(/[\\/]/).includes('..')) {
+        throw new Error('BUNDLE_PATH_INVALID');
+    }
+    const resolved = node_path_1.default.resolve(root, relativePath);
+    if (!resolved.startsWith(`${root}${node_path_1.default.sep}`)) {
+        throw new Error('BUNDLE_PATH_INVALID');
+    }
+    const stat = node_fs_1.default.lstatSync(resolved);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error('BUNDLE_PATH_INVALID');
+    }
+    return resolved;
+}
+function assertIdentifier(value, code) {
+    if (!/^[A-Za-z][A-Za-z0-9_]{1,79}$/.test(value))
+        throw new Error(code);
+}
+function readJson(filePath) {
+    return JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
+}
+//# sourceMappingURL=workforce-bundle-local.js.map

package/dist/nexus-cli/src/services/workforce-bundle-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-bundle-local.js","sourceRoot":"","sources":["../../../../src/services/workforce-bundle-local.ts"],"names":[],"mappings":";;;;;AA8BA,0CAmEC;AAED,kDA8DC;AAjKD,sDAAyB;AACzB,0DAA6B;AAC7B,8CAM2B;AAE3B,uEAAqE;AAoB9D,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,IAAA,kDAAwB,EAAC,EAAE,YAAY,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,iBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjE,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,8BAA8B,EAAE,mBAAmB,CAAC,CAAC;IACzF,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;IAE5E,MAAM,IAAI,GAAG,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,iBAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAC1E,MAAM,qBAAqB,GAAG,mBAAI,CAAC,IAAI,CACrC,IAAI,EACJ,UAAU,EACV,0BAA0B,CAC3B,CAAC;IACF,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,MAAM,GAAkC;QAC5C,aAAa,EAAE,8BAAqB;QACpC,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,OAAO,CAAC,UAAU;QAChC,eAAe,EAAE;YACf,IAAI,EAAE,gCAAgC;YACtC,mBAAmB,EAAE,OAAO,CAAC,UAAU;YACvC,aAAa,EAAE,mCAAmC;SACnD;QACD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;QAChB,uBAAuB,EAAE,EAAE;QAC3B,aAAa,EAAE;YACb,qBAAqB,EAAE,IAAI;YAC3B,yBAAyB,EAAE,IAAI;YAC/B,oBAAoB,EAAE,IAAI;YAC1B,qCAAqC,EACnC,OAAO,CAAC,8BAA8B;YACxC,gCAAgC,EAAE,OAAO,CAAC,yBAAyB;YACnE,yBAAyB,EAAE,CAAC;YAC5B,cAAc,EAAE,cAAc;SAC/B;KACF,CAAC;IACF,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,iBAAE,CAAC,aAAa,CAAC,YAAY,EAAE,GAAG,IAAA,4BAAmB,EAAC,eAAwB,CAAC,IAAI,CAAC,CAAC;IACrF,iBAAE,CAAC,aAAa,CACd,qBAAqB,EACrB,GAAG,IAAA,4BAAmB,EAAC,yBAAyB,CAAC,OAAO,CAAC,UAAU,CAAU,CAAC,IAAI,CACnF,CAAC;IACF,iBAAE,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAA,4BAAmB,EAAC,MAAe,CAAC,IAAI,CAAC,CAAC;IAC1E,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,UAAU;QACV,mBAAmB,EAAE,YAAY;QACjC,gBAAgB,EAAE;YAChB,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;YACxD,QAAQ,EAAE,OAAO,CAAC,yBAAyB;SAC5C;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,mBAAmB,CAAC,OAGzC;IACC,MAAM,IAAA,kDAAwB,EAAC,EAAE,YAAY,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,CACrB,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CACzC,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,KAAK,8BAAqB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjE,kBAAkB,CAChB,OAAO,EACP,MAAM,CAAC,aAAa,CAAC,qCAAqC,EAC1D,mBAAmB,CACpB,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,MAAM,CAAC,aAAa,CAAC,gCAAgC,EACrD,WAAW,CACZ,CAAC;IACF,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,QAAQ,CAA4B,YAAY,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,cAAc,CAC1C,IAAI,EACJ,MAAM,CAAC,eAAe,CAAC,aAAa,CACrC,CAAC;IACF,MAAM,iBAAiB,GAAG,QAAQ,CAG/B,qBAAqB,CAAC,CAAC;IAC1B,MAAM,kBAAkB,GAAG,IAAA,gCAAuB,EAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,mCAAmC,kBAAkB,CAAC,MAAM;aACzD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,IAAI,CAAC,GAAG,CAAC,EAAE,CACf,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC/B,QAAQ,CAAC,cAAc,KAAK,KAAK;QACjC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,eAAe,CAAC,mBAAmB;QAC5D,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IACE,iBAAiB,CAAC,aAAa,KAAK,wBAAwB;QAC5D,iBAAiB,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAa;QACpB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,mBAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,mBAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAoB;IACrD,OAAO;QACL,aAAa,EAAE,wBAAwB;QACvC,YAAY;QACZ,iBAAiB,EAAE;YACjB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE;SACtD;QACD,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,qBAAqB;gBAC7B,kBAAkB,EAAE,OAAO;gBAC3B,KAAK,EAAE,0BAA0B;gBACjC,KAAK,EAAE,gFAAgF;gBACvF,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3B,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE;oBACN,MAAM,EAAE,MAAM;oBACd,aAAa,EACX,uDAAuD;oBACzD,SAAS,EAAE,EAAE;iBACd;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,gCAAgC,IAAI,EAAE;QACnD,cAAc,EAAE,KAAK;QACrB,KAAK,EAAE;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,EAAE;YACV,YAAY,EAAE,EAAE;YAChB,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,EAAE;YACrB,WAAW,EAAE;gBACX,OAAO,EAAE,wBAAwB;gBACjC,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,CAAC;gBACP,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,MAAM;aACvB;YACD,gBAAgB,EAAE;gBAChB,aAAa,EAAE,KAAK;gBACpB,mBAAmB,EAAE,CAAC;gBACtB,kBAAkB,EAAE,CAAC;gBACrB,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,EAAE;gBAChB,YAAY,EAAE,EAAE;gBAChB,aAAa,EAAE,EAAE;aAClB;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,8BAA8B;gBAC9C,YAAY,EAAE,EAAE;aACjB;SACF;QACD,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QACb,SAAS,EAAE;YACT;gBACE,GAAG,EAAE,2BAA2B;gBAChC,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,mDAAmD;gBAC1D,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;gBACrC,IAAI,EAAE,CAAC,UAAU,CAAC;aACnB;SACF;QACD,WAAW,EAAE,CAAC;KACf,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAoB;IAC/C,MAAM,OAAO,GAAG,QAAQ,CACtB,mBAAI,CAAC,IAAI,CACP,mBAAI,CAAC,OAAO,CAAC,mBAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EACxC,UAAU,EACV,wBAAwB,CACzB,CACF,CAAC;IACF,IACE,OAAO,CAAC,aAAa;QACnB,gDAAgD;QAClD,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CACzB,OAA8B,EAC9B,OAAe,EACf,OAA0C;IAE1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,KAAK,OAAO;QAC1B,MAAM,CAAC,OAAO,KAAK,OAAO;QAC1B,MAAM,CAAC,SAAS,KAAK,IAAI,CAC5B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAqC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG;QACf,cAAc;QACd,cAAc;QACd,iBAAiB;QACjB,cAAc;QACd,cAAc;QACd,MAAM;QACN,eAAe;QACf,yBAAyB;QACzB,eAAe;QACf,cAAc;QACd,SAAS;KACV,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IACE,MAAM,CAAC,aAAa,CAAC,qBAAqB,KAAK,IAAI;QACnD,MAAM,CAAC,aAAa,CAAC,yBAAyB,KAAK,IAAI;QACvD,MAAM,CAAC,aAAa,CAAC,oBAAoB,KAAK,IAAI;QAClD,MAAM,CAAC,aAAa,CAAC,yBAAyB,KAAK,CAAC;QACpD,MAAM,CAAC,aAAa,CAAC,cAAc,KAAK,cAAc,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,YAAoB;IACxD,IACE,mBAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC7B,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,mBAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,iBAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,IAAY;IACnD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,QAAQ,CAAI,QAAgB;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAM,CAAC;AAC5D,CAAC"}

package/dist/nexus-cli/src/services/workforce-bundle-local.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/nexus-cli/src/services/workforce-bundle-local.test.js

@@ -0,0 +1,100 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_test_1 = __importDefault(require("node:test"));
+const shared_1 = require("@nexusclaw/shared");
+const ai_authoring_context_v2_1 = require("./ai-authoring-context-v2");
+const workforce_bundle_local_1 = require("./workforce-bundle-local");
+(0, node_test_1.default)('bundle init requires exact purpose-qualified human policies and locally validates', async () => {
+    const root = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-bundle-'));
+    const context = node_path_1.default.join(root, 'context');
+    await (0, ai_authoring_context_v2_1.exportAuthoringContextV2)({
+        surface: 'employee',
+        offline: true,
+        outDir: context,
+        workspaceDir: root,
+    });
+    rewriteOfflineApprovalCatalog(context, {
+        schemaVersion: 'nexusclaw.approval-policy-authoring-catalog/v1',
+        policies: [
+            {
+                apiName: 'release_policy',
+                purpose: 'workforce_release',
+                humanOnly: true,
+                expiresAfterSeconds: 3600,
+                approverTypes: ['ROLE'],
+                revisionPreviewKey: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            },
+            {
+                apiName: 'tool_policy',
+                purpose: 'tool_call',
+                humanOnly: true,
+                expiresAfterSeconds: 600,
+                approverTypes: ['USER'],
+                revisionPreviewKey: 'sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+            },
+        ],
+    });
+    const bundleRoot = node_path_1.default.join(root, 'bundle');
+    await (0, workforce_bundle_local_1.initLocalBundle)({
+        bundleName: 'SalesOps',
+        workspaceDir: root,
+        outDir: bundleRoot,
+        contextManifestPath: node_path_1.default.join(context, 'context-manifest.json'),
+        workforceApprovalPolicyApiName: 'release_policy',
+        toolApprovalPolicyApiName: 'tool_policy',
+    });
+    const result = await (0, workforce_bundle_local_1.validateLocalBundle)({
+        bundleDir: bundleRoot,
+        contextManifestPath: node_path_1.default.join(context, 'context-manifest.json'),
+    });
+    strict_1.default.equal(result.valid, true);
+    strict_1.default.equal(result.agentApiName, 'SalesOps');
+    strict_1.default.equal(JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(bundleRoot, 'employee', 'employee-package.json'), 'utf8')).activateOnPass, false);
+});
+(0, node_test_1.default)('bundle init does not infer a policy from the only catalog row', async () => {
+    const root = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-bundle-'));
+    const context = node_path_1.default.join(root, 'context');
+    await (0, ai_authoring_context_v2_1.exportAuthoringContextV2)({
+        surface: 'employee',
+        offline: true,
+        outDir: context,
+        workspaceDir: root,
+    });
+    await strict_1.default.rejects((0, workforce_bundle_local_1.initLocalBundle)({
+        bundleName: 'SalesOps',
+        workspaceDir: root,
+        outDir: node_path_1.default.join(root, 'bundle'),
+        contextManifestPath: node_path_1.default.join(context, 'context-manifest.json'),
+        workforceApprovalPolicyApiName: 'missing_release',
+        toolApprovalPolicyApiName: 'missing_tool',
+    }), /APPROVAL_POLICY_EXACT_MATCH_REQUIRED:workforce_release:missing_release/);
+});
+function rewriteOfflineApprovalCatalog(contextRoot, catalog) {
+    const manifestPath = node_path_1.default.join(contextRoot, 'context-manifest.json');
+    const catalogRelative = 'catalogs/approval-policies.json';
+    const catalogPath = node_path_1.default.join(contextRoot, catalogRelative);
+    const bytes = Buffer.from(`${(0, shared_1.canonicalJsonString)(catalog)}\n`);
+    node_fs_1.default.writeFileSync(catalogPath, bytes);
+    const manifest = JSON.parse(node_fs_1.default.readFileSync(manifestPath, 'utf8'));
+    const updated = {
+        ...manifest,
+        files: manifest.files.map((entry) => entry.path === catalogRelative
+            ? { ...entry, digest: (0, shared_1.rawByteDigest)(bytes) }
+            : entry),
+    };
+    node_fs_1.default.writeFileSync(manifestPath, `${(0, shared_1.canonicalJsonString)(updated)}\n`);
+    const files = Object.fromEntries(updated.files.map((entry) => [
+        entry.path,
+        node_fs_1.default.readFileSync(node_path_1.default.join(contextRoot, entry.path)),
+    ]));
+    const digests = (0, shared_1.aiAuthoringContextDigests)(updated, files);
+    node_fs_1.default.writeFileSync(node_path_1.default.join(contextRoot, 'context-lock.json'), `${(0, shared_1.canonicalJsonString)((0, shared_1.unsignedAiAuthoringContextLock)(digests))}\n`);
+}
+//# sourceMappingURL=workforce-bundle-local.test.js.map

package/dist/nexus-cli/src/services/workforce-bundle-local.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-bundle-local.test.js","sourceRoot":"","sources":["../../../../src/services/workforce-bundle-local.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,sDAAyB;AACzB,sDAAyB;AACzB,0DAA6B;AAC7B,0DAA6B;AAC7B,8CAM2B;AAC3B,uEAAqE;AACrE,qEAGkC;AAElC,IAAA,mBAAI,EAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,IAAI,GAAG,iBAAE,CAAC,WAAW,CAAC,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAA,kDAAwB,EAAC;QAC7B,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,OAAO;QACf,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,6BAA6B,CAAC,OAAO,EAAE;QACrC,aAAa,EAAE,gDAAgD;QAC/D,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,gBAAgB;gBACzB,OAAO,EAAE,mBAAmB;gBAC5B,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,IAAI;gBACzB,aAAa,EAAE,CAAC,MAAM,CAAC;gBACvB,kBAAkB,EAAE,yEAAyE;aAC9F;YACD;gBACE,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,GAAG;gBACxB,aAAa,EAAE,CAAC,MAAM,CAAC;gBACvB,kBAAkB,EAAE,yEAAyE;aAC9F;SACF;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,IAAA,wCAAe,EAAC;QACpB,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,UAAU;QAClB,mBAAmB,EAAE,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAChE,8BAA8B,EAAE,gBAAgB;QAChD,yBAAyB,EAAE,aAAa;KACzC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAA,4CAAmB,EAAC;QACvC,SAAS,EAAE,UAAU;QACrB,mBAAmB,EAAE,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;KACjE,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CACV,IAAI,CAAC,KAAK,CAAC,iBAAE,CAAC,YAAY,CAAC,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,EAC9G,KAAK,CACN,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,IAAI,GAAG,iBAAE,CAAC,WAAW,CAAC,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAA,kDAAwB,EAAC;QAC7B,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,OAAO;QACf,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,gBAAM,CAAC,OAAO,CAClB,IAAA,wCAAe,EAAC;QACd,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACjC,mBAAmB,EAAE,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAChE,8BAA8B,EAAE,iBAAiB;QACjD,yBAAyB,EAAE,cAAc;KAC1C,CAAC,EACF,wEAAwE,CACzE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,SAAS,6BAA6B,CACpC,WAAmB,EACnB,OAAgC;IAEhC,MAAM,YAAY,GAAG,mBAAI,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,iCAAiC,CAAC;IAC1D,MAAM,WAAW,GAAG,mBAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,4BAAmB,EAAC,OAAgB,CAAC,IAAI,CAAC,CAAC;IACxE,iBAAE,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,iBAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CACN,CAAC;IAClC,MAAM,OAAO,GAAiC;QAC5C,GAAG,QAAQ;QACX,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,CAAC,IAAI,KAAK,eAAe;YAC5B,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAA,sBAAa,EAAC,KAAK,CAAC,EAAE;YAC5C,CAAC,CAAC,KAAK,CACV;KACF,CAAC;IACF,iBAAE,CAAC,aAAa,CAAC,YAAY,EAAE,GAAG,IAAA,4BAAmB,EAAC,OAAgB,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI;QACV,iBAAE,CAAC,YAAY,CAAC,mBAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;KACpD,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAA,kCAAyB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,iBAAE,CAAC,aAAa,CACd,mBAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAC3C,GAAG,IAAA,4BAAmB,EAAC,IAAA,uCAA8B,EAAC,OAAO,CAAU,CAAC,IAAI,CAC7E,CAAC;AACJ,CAAC"}

package/dist/nexus-cli/src/services/workforce-bundle-remote.d.ts

@@ -0,0 +1,63 @@
+import { type VerifyAiAuthoringContextFreshnessRequestV2 } from '@nexusclaw/shared';
+import { type WorkforceBundleArtifactOperationInput } from './api-client';
+export declare function prepareRemoteWorkforceBundle(options: {
+    readonly bundleDir: string;
+    readonly contextManifestPath: string;
+    readonly targetOrg: string;
+}): Promise<{
+    client: import("./api-client").ApiClient;
+    authoringContext: VerifyAiAuthoringContextFreshnessRequestV2;
+    archive: {
+        archiveBytes: Uint8Array<ArrayBufferLike>;
+        archiveDigest: `sha256:${string}`;
+        packageDigest: `sha256:${string}`;
+        portableBundleDigest: `sha256:${string}`;
+        runtimeBindingsDigest: `sha256:${string}`;
+        fileCount: number;
+        declaredSurfaces: ("code" | "flow" | "employee")[];
+    };
+    sealed: import("./api-client").SealedExecutablePackageArtifact;
+    artifactInput: {
+        readonly schemaVersion: "nexusclaw.workforce-bundle-artifact-operation-input/v1";
+        readonly targetWorkspaceId: string;
+        readonly stagedArtifactId: string;
+        readonly expectedArchiveDigest: `sha256:${string}`;
+        readonly expectedPackageDigest: `sha256:${string}`;
+        readonly contextManifestContentDigest: `sha256:${string}`;
+        readonly runtimeBindingsDigest: `sha256:${string}`;
+        readonly expectedPortableBundleDigest: `sha256:${string}`;
+    };
+}>;
+export declare function validateRemoteWorkforceBundle(options: {
+    readonly bundleDir: string;
+    readonly contextManifestPath: string;
+    readonly targetOrg: string;
+}): Promise<import("@nexusclaw/shared").ValidateExecutablePackageArtifactResultV1>;
+export declare function lockRemoteWorkforceBundle(options: {
+    readonly bundleDir: string;
+    readonly targetOrg: string;
+}): Promise<import("@nexusclaw/shared").WorkforceBundleSourceLockV1>;
+export declare function planRemoteWorkforceBundle(options: {
+    readonly bundleDir: string;
+    readonly targetOrg: string;
+    readonly expectedActiveReleaseSetId: string;
+    readonly expectedGeneration: number;
+}): Promise<{
+    client: import("./api-client").ApiClient;
+    state: WorkforceBundleRemoteState;
+    plan: import("./api-client").WorkforceBundlePlanResult;
+}>;
+export declare function stageRemoteWorkforceBundle(options: {
+    readonly bundleDir: string;
+    readonly targetOrg: string;
+    readonly expectedActiveReleaseSetId: string;
+    readonly expectedGeneration: number;
+}): Promise<import("./api-client").CandidateStageReceiptResult>;
+interface WorkforceBundleRemoteState {
+    readonly schemaVersion: 'nexusclaw.workforce-bundle-remote-state/v1';
+    readonly targetOrg: string;
+    readonly contextManifestPath: string;
+    readonly artifactInput: WorkforceBundleArtifactOperationInput;
+    readonly authoringContext: VerifyAiAuthoringContextFreshnessRequestV2;
+}
+export {};

package/dist/nexus-cli/src/services/workforce-bundle-remote.js

@@ -0,0 +1,138 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareRemoteWorkforceBundle = prepareRemoteWorkforceBundle;
+exports.validateRemoteWorkforceBundle = validateRemoteWorkforceBundle;
+exports.lockRemoteWorkforceBundle = lockRemoteWorkforceBundle;
+exports.planRemoteWorkforceBundle = planRemoteWorkforceBundle;
+exports.stageRemoteWorkforceBundle = stageRemoteWorkforceBundle;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const shared_1 = require("@nexusclaw/shared");
+const api_client_1 = require("./api-client");
+const ai_authoring_context_v2_1 = require("./ai-authoring-context-v2");
+const workforce_bundle_archive_1 = require("./workforce-bundle-archive");
+async function prepareRemoteWorkforceBundle(options) {
+    await (0, ai_authoring_context_v2_1.verifyAuthoringContextV2)({
+        manifestPath: options.contextManifestPath,
+        targetOrg: options.targetOrg,
+    });
+    const authoringContext = (0, ai_authoring_context_v2_1.loadAuthoringContextFreshnessInput)(options.contextManifestPath);
+    const archive = await (0, workforce_bundle_archive_1.buildCanonicalWorkforceBundleArchive)({
+        bundleDir: options.bundleDir,
+        targetOrgAlias: options.targetOrg,
+    });
+    const client = (0, api_client_1.createApiClient)(options.targetOrg);
+    const uploadIdempotencyKey = (0, node_crypto_1.randomUUID)();
+    const session = await client.createExecutablePackageUploadSession({
+        schemaVersion: 'nexusclaw.create-executable-package-upload-session-input/v1',
+        targetWorkspaceId: authoringContext.targetWorkspaceId,
+        archiveFormat: 'zip-store-v1',
+        archiveDigest: archive.archiveDigest,
+        packageDigest: archive.packageDigest,
+        archiveSizeBytes: archive.archiveBytes.byteLength,
+        fileCount: archive.fileCount,
+        declaredSurfaces: archive.declaredSurfaces,
+    }, uploadIdempotencyKey);
+    const sealed = await client.uploadExecutablePackageArtifact({
+        uploadUrl: session.uploadUrl,
+        bytes: archive.archiveBytes,
+        archiveDigest: archive.archiveDigest,
+        packageDigest: archive.packageDigest,
+        idempotencyKey: uploadIdempotencyKey,
+    });
+    const artifactInput = {
+        schemaVersion: 'nexusclaw.workforce-bundle-artifact-operation-input/v1',
+        targetWorkspaceId: authoringContext.targetWorkspaceId,
+        stagedArtifactId: sealed.stagedArtifactId,
+        expectedArchiveDigest: archive.archiveDigest,
+        expectedPackageDigest: archive.packageDigest,
+        contextManifestContentDigest: authoringContext.manifestContentDigest,
+        runtimeBindingsDigest: archive.runtimeBindingsDigest,
+        expectedPortableBundleDigest: archive.portableBundleDigest,
+    };
+    return { client, authoringContext, archive, sealed, artifactInput };
+}
+async function validateRemoteWorkforceBundle(options) {
+    const prepared = await prepareRemoteWorkforceBundle(options);
+    const validation = await prepared.client.validateExecutablePackageArtifact({
+        schemaVersion: shared_1.EXECUTABLE_PACKAGE_VALIDATION_INPUT_VERSION,
+        targetWorkspaceId: prepared.artifactInput.targetWorkspaceId,
+        stagedArtifactId: prepared.artifactInput.stagedArtifactId,
+        expectedArchiveDigest: prepared.artifactInput.expectedArchiveDigest,
+        expectedPackageDigest: prepared.artifactInput.expectedPackageDigest,
+        contextManifestContentDigest: prepared.artifactInput.contextManifestContentDigest,
+    });
+    if (validation.valid) {
+        saveRemoteState(options.bundleDir, {
+            schemaVersion: 'nexusclaw.workforce-bundle-remote-state/v1',
+            targetOrg: options.targetOrg,
+            contextManifestPath: node_path_1.default.resolve(options.contextManifestPath),
+            artifactInput: prepared.artifactInput,
+            authoringContext: prepared.authoringContext,
+        });
+    }
+    return validation;
+}
+async function lockRemoteWorkforceBundle(options) {
+    const state = loadRemoteState(options.bundleDir, options.targetOrg);
+    await (0, ai_authoring_context_v2_1.verifyAuthoringContextV2)({
+        manifestPath: state.contextManifestPath,
+        targetOrg: options.targetOrg,
+    });
+    const lock = await (0, api_client_1.createApiClient)(options.targetOrg).resolveWorkforceBundleLock({
+        ...state.artifactInput,
+        schemaVersion: 'nexusclaw.resolve-workforce-bundle-lock-input/v1',
+    });
+    const lockPath = node_path_1.default.join(node_path_1.default.resolve(options.bundleDir), '.nexusclaw', 'workforce-bundle.lock.json');
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(lockPath), { recursive: true });
+    node_fs_1.default.writeFileSync(lockPath, `${(0, shared_1.canonicalJsonString)(lock)}\n`);
+    return lock;
+}
+async function planRemoteWorkforceBundle(options) {
+    const state = loadRemoteState(options.bundleDir, options.targetOrg);
+    await (0, ai_authoring_context_v2_1.verifyAuthoringContextV2)({
+        manifestPath: state.contextManifestPath,
+        targetOrg: options.targetOrg,
+    });
+    const client = (0, api_client_1.createApiClient)(options.targetOrg);
+    const plan = await client.planExecutableWorkforceBundle({
+        ...state.artifactInput,
+        schemaVersion: 'nexusclaw.plan-executable-workforce-bundle-input/v1',
+        expectedActiveReleaseSetId: options.expectedActiveReleaseSetId,
+        expectedGeneration: options.expectedGeneration,
+    });
+    return { client, state, plan };
+}
+async function stageRemoteWorkforceBundle(options) {
+    const { client, state, plan } = await planRemoteWorkforceBundle(options);
+    return client.stageExecutableWorkforceBundle({
+        ...state.artifactInput,
+        schemaVersion: 'nexusclaw.stage-executable-workforce-bundle-input/v1',
+        expectedActiveReleaseSetId: options.expectedActiveReleaseSetId,
+        expectedGeneration: options.expectedGeneration,
+        planDigest: plan.planDigest,
+        authoringContext: state.authoringContext,
+    }, (0, node_crypto_1.randomUUID)());
+}
+function saveRemoteState(bundleDir, state) {
+    const statePath = remoteStatePath(bundleDir);
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(statePath), { recursive: true });
+    node_fs_1.default.writeFileSync(statePath, `${(0, shared_1.canonicalJsonString)(state)}\n`, { mode: 0o600 });
+}
+function loadRemoteState(bundleDir, targetOrg) {
+    const state = JSON.parse(node_fs_1.default.readFileSync(remoteStatePath(bundleDir), 'utf8'));
+    if (state.schemaVersion !==
+        'nexusclaw.workforce-bundle-remote-state/v1' ||
+        state.targetOrg !== targetOrg) {
+        throw new Error('WORKFORCE_BUNDLE_REMOTE_STATE_INVALID');
+    }
+    return state;
+}
+function remoteStatePath(bundleDir) {
+    return node_path_1.default.join(node_path_1.default.resolve(bundleDir), '.nexusclaw', 'workforce-remote-state.json');
+}
+//# sourceMappingURL=workforce-bundle-remote.js.map

package/dist/nexus-cli/src/services/workforce-bundle-remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-bundle-remote.js","sourceRoot":"","sources":["../../../../src/services/workforce-bundle-remote.ts"],"names":[],"mappings":";;;;;AAkBA,oEAkDC;AAED,sEAyBC;AAED,8DAqBC;AAED,8DAmBC;AAED,gEAkBC;AA/JD,6CAAyC;AACzC,sDAAyB;AACzB,0DAA6B;AAC7B,8CAI2B;AAC3B,6CAGsB;AACtB,uEAGmC;AACnC,yEAAkF;AAE3E,KAAK,UAAU,4BAA4B,CAAC,OAIlD;IACC,MAAM,IAAA,kDAAwB,EAAC;QAC7B,YAAY,EAAE,OAAO,CAAC,mBAAmB;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,IAAA,4DAAkC,EACzD,OAAO,CAAC,mBAAmB,CAC5B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAA,+DAAoC,EAAC;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,oBAAoB,GAAG,IAAA,wBAAU,GAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAC/D;QACE,aAAa,EACX,6DAA6D;QAC/D,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB;QACrD,aAAa,EAAE,cAAc;QAC7B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,UAAU;QACjD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,EACD,oBAAoB,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC;QAC1D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,YAAY;QAC3B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,cAAc,EAAE,oBAAoB;KACrC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG;QACpB,aAAa,EAAE,wDAAwD;QACvE,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB;QACrD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,qBAAqB,EAAE,OAAO,CAAC,aAAa;QAC5C,qBAAqB,EAAE,OAAO,CAAC,aAAa;QAC5C,4BAA4B,EAAE,gBAAgB,CAAC,qBAAqB;QACpE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,4BAA4B,EAAE,OAAO,CAAC,oBAAoB;KAClD,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACtE,CAAC;AAEM,KAAK,UAAU,6BAA6B,CAAC,OAInD;IACC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,iCAAiC,CAAC;QACzE,aAAa,EAAE,oDAA2C;QAC1D,iBAAiB,EAAE,QAAQ,CAAC,aAAa,CAAC,iBAAiB;QAC3D,gBAAgB,EAAE,QAAQ,CAAC,aAAa,CAAC,gBAAgB;QACzD,qBAAqB,EAAE,QAAQ,CAAC,aAAa,CAAC,qBAAqB;QACnE,qBAAqB,EAAE,QAAQ,CAAC,aAAa,CAAC,qBAAqB;QACnE,4BAA4B,EAC1B,QAAQ,CAAC,aAAa,CAAC,4BAA4B;KACtD,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE;YACjC,aAAa,EAAE,4CAA4C;YAC3D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC9D,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAC,OAG/C;IACC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,IAAA,kDAAwB,EAAC;QAC7B,YAAY,EAAE,KAAK,CAAC,mBAAmB;QACvC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAe,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC;QAC/E,GAAG,KAAK,CAAC,aAAa;QACtB,aAAa,EAAE,kDAAkD;KAClE,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CACxB,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAC/B,YAAY,EACZ,4BAA4B,CAC7B,CAAC;IACF,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,iBAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAA,4BAAmB,EAAC,IAAa,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAC,OAK/C;IACC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,IAAA,kDAAwB,EAAC;QAC7B,YAAY,EAAE,KAAK,CAAC,mBAAmB;QACvC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC;QACtD,GAAG,KAAK,CAAC,aAAa;QACtB,aAAa,EAAE,qDAAqD;QACpE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAAC,OAKhD;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,8BAA8B,CAC1C;QACE,GAAG,KAAK,CAAC,aAAa;QACtB,aAAa,EAAE,sDAAsD;QACrE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,EACD,IAAA,wBAAU,GAAE,CACb,CAAC;AACJ,CAAC;AAUD,SAAS,eAAe,CACtB,SAAiB,EACjB,KAAiC;IAEjC,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC7C,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,iBAAE,CAAC,aAAa,CACd,SAAS,EACT,GAAG,IAAA,4BAAmB,EAAC,KAAc,CAAC,IAAI,EAC1C,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,SAAiB,EACjB,SAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,iBAAE,CAAC,YAAY,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CACtB,CAAC;IAChC,IACE,KAAK,CAAC,aAAa;QACjB,4CAA4C;QAC9C,KAAK,CAAC,SAAS,KAAK,SAAS,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,mBAAI,CAAC,IAAI,CACd,mBAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EACvB,YAAY,EACZ,6BAA6B,CAC9B,CAAC;AACJ,CAAC"}

package/dist/nexus-cli/src/services/workforce-remote-operations.d.ts

@@ -0,0 +1,60 @@
+import { type WorkforceCandidateSelector } from './api-client';
+type Digest = `sha256:${string}`;
+export interface CandidateIdentityOptions {
+    readonly targetOrg: string;
+    readonly candidateReleaseSetId: string;
+    readonly expectedSourceLockDigest: Digest;
+    readonly expectedReleaseItemSetDigest: Digest;
+    readonly expectedMaterializedItemRefsDigest: Digest;
+}
+export declare function runRemoteCandidateTests(options: CandidateIdentityOptions & {
+    readonly selectors: readonly WorkforceCandidateSelector[];
+}): Promise<import("./api-client").CandidateTestRunResult>;
+export declare function runRemoteBundleCandidateTests(options: CandidateIdentityOptions & {
+    readonly suite: 'action' | 'flow' | 'employee' | 'all';
+}): Promise<import("./api-client").CandidateTestRunResult>;
+export declare function requestRemoteReleaseApproval(options: CandidateIdentityOptions & {
+    readonly evidenceRunIds: readonly string[];
+}): Promise<import("./api-client").WorkforceReleaseGateReceipt>;
+export declare function readRemoteReleaseApproval(options: {
+    readonly targetOrg: string;
+    readonly candidateReleaseSetId: string;
+    readonly approvalId: string;
+}): Promise<import("./api-client").WorkforceReleaseGateReceipt>;
+export declare function sealRemoteCandidate(options: CandidateIdentityOptions & {
+    readonly evidenceRunIds: readonly string[];
+    readonly approvalId: string;
+}): Promise<{
+    releaseSetId: string;
+    evidenceId: string;
+    eligibilityStatus: "eligible" | "rejected";
+    releaseEnvelopeDigest: `sha256:${string}`;
+    alreadySealed: boolean;
+}>;
+export declare function promoteRemoteRelease(options: {
+    readonly targetOrg: string;
+    readonly candidateReleaseSetId: string;
+    readonly expectedActiveReleaseSetId: string;
+    readonly expectedGeneration: number;
+    readonly expectedReleaseEnvelopeDigest: Digest;
+    readonly approvalId: string;
+    readonly stepUpChallengeId: string;
+}): Promise<import("./api-client").WorkforceReleaseTransitionResult>;
+export declare function rollbackRemoteRelease(options: {
+    readonly targetOrg: string;
+    readonly releaseSetId: string;
+    readonly expectedActiveReleaseSetId: string;
+    readonly expectedGeneration: number;
+    readonly reason: string;
+    readonly stepUpChallengeId: string;
+}): Promise<import("./api-client").WorkforceReleaseTransitionResult>;
+export declare function revokeRemoteAction(options: {
+    readonly targetOrg: string;
+    readonly releaseSetId: string;
+    readonly exportId: string;
+    readonly toolName: string;
+    readonly publishedChecksum: Digest;
+    readonly reason: string;
+    readonly stepUpChallengeId: string;
+}): Promise<Record<string, unknown>>;
+export {};

package/dist/nexus-cli/src/services/workforce-remote-operations.e2e.test.d.ts

@@ -0,0 +1 @@
+export {};