@nexusclawhq/cli 0.3.25 → 0.3.27

package/dist/nexus-cli/src/contracts/command-contract-matrix.generated.test.js

@@ -0,0 +1,842 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_crypto_1 = require("node:crypto");
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_http_1 = __importDefault(require("node:http"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_test_1 = __importDefault(require("node:test"));
+const cli_1 = require("../cli");
+const command_contract_registry_1 = require("./command-contract.registry");
+const command_inventory_1 = require("./command-inventory");
+const command_policy_registry_1 = require("./command-policy.registry");
+const command_contract_matrix_1 = require("./command-contract-matrix");
+const command_contract_matrix_runner_1 = require("./command-contract-matrix.runner");
+const command_contract_matrix_scenarios_1 = require("./command-contract-matrix.scenarios");
+const auth_store_1 = require("../services/auth-store");
+const shared_1 = require("@nexusclaw/shared");
+const ai_authoring_context_v2_1 = require("../services/ai-authoring-context-v2");
+const preDispatchAdapter = {
+    adapterId: 'commander-pre-dispatch',
+    setup: () => undefined,
+    teardown: () => undefined,
+    remoteMutationCount: () => 0,
+};
+const noRemoteMutationAdapter = {
+    adapterId: 'no-remote-mutation', setup: () => undefined, teardown: () => undefined,
+    remoteMutationCount: () => 0,
+};
+async function projectLocalWorkspaceAdapter() {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-project-matrix-'));
+    const previousCwd = process.cwd();
+    return {
+        adapterId: 'project-local-workspace', root, remoteMutationCount: () => 0,
+        setup: async () => {
+            await promises_1.default.mkdir(node_path_1.default.join(root, 'src/metadata/objects/Account'), { recursive: true });
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'src/metadata/objects/Account/object.json'), '{"apiName":"Account"}');
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'nexus-project.yaml'), [
+                'schemaVersion: nexus-project/v2', 'projectName: matrix-project',
+                'compatibleCoreVersion: 0.1.x', 'sourceRoot: src/metadata',
+                'sourceRoots:', '  - path: src/metadata', '    kind: metadata-runtime',
+                '    writeTarget: true', 'localPackages: []', 'environments: []',
+            ].join('\n'));
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'package.xml'), [
+                '<Package xmlns="http://soap.sforce.com/2006/04/metadata">',
+                '<types><members>Account</members><name>CustomObject</name></types>',
+                '<version>59.0</version></Package>',
+            ].join(''));
+            process.chdir(root);
+        },
+        teardown: async () => { process.chdir(previousCwd); await promises_1.default.rm(root, { recursive: true, force: true }); },
+    };
+}
+async function sourceStatusAdapter(changed) {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-source-matrix-'));
+    const previousCwd = process.cwd();
+    const previousBaseUrl = process.env.NEXUS_BASE_URL;
+    const previousToken = process.env.NEXUS_AUTH_TOKEN;
+    let server;
+    return {
+        adapterId: changed ? 'source-status-changed' : 'source-status-empty', root,
+        remoteMutationCount: () => 0,
+        setup: async () => {
+            server = node_http_1.default.createServer((request, response) => {
+                let body = '';
+                request.on('data', (chunk) => { body += String(chunk); });
+                request.on('end', () => {
+                    const isSourceStatus = body.includes('query SourceStatus');
+                    const files = changed ? [{ path: 'objects/Account/object.json', hash: 'remote-hash',
+                            componentKey: 'ObjectMetadata:Account', baselineHash: null }] : [];
+                    const payload = isSourceStatus ? { data: { sourceStatus: {
+                                remoteRevision: 'remote-1', remoteHash: 'remote-hash', baselineRevision: null,
+                                baselineHash: null, baselineSource: null, baselineAvailable: true,
+                                changedComponentCount: files.length, files, baselineFiles: [], drift: null, tracking: null,
+                            } } } : { errors: [{ message: 'Unexpected controlled query' }] };
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_BASE_URL = `http://127.0.0.1:${address.port}`;
+            process.env.NEXUS_AUTH_TOKEN = 'matrix-token';
+            process.chdir(root);
+        },
+        teardown: async () => {
+            process.chdir(previousCwd);
+            if (previousBaseUrl === undefined)
+                delete process.env.NEXUS_BASE_URL;
+            else
+                process.env.NEXUS_BASE_URL = previousBaseUrl;
+            if (previousToken === undefined)
+                delete process.env.NEXUS_AUTH_TOKEN;
+            else
+                process.env.NEXUS_AUTH_TOKEN = previousToken;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function sourcePushAdapter(changed) {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-source-push-matrix-'));
+    const previousCwd = process.cwd();
+    const previousBaseUrl = process.env.NEXUS_BASE_URL;
+    const previousToken = process.env.NEXUS_AUTH_TOKEN;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: changed ? 'source-push-changed' : 'source-push-empty', root,
+        remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            if (changed) {
+                await promises_1.default.mkdir(node_path_1.default.join(root, 'src/metadata/objects/Account'), { recursive: true });
+                await promises_1.default.writeFile(node_path_1.default.join(root, 'src/metadata/objects/Account/object.json'), '{"apiName":"Account"}');
+                await promises_1.default.writeFile(node_path_1.default.join(root, 'nexus-project.yaml'), [
+                    'schemaVersion: nexus-project/v2', 'projectName: matrix-project',
+                    'compatibleCoreVersion: 0.1.x', 'sourceRoot: src/metadata',
+                    'sourceRoots:', '  - path: src/metadata', '    kind: metadata-runtime',
+                    '    writeTarget: true', 'localPackages: []', 'environments: []',
+                ].join('\n'));
+            }
+            server = node_http_1.default.createServer((request, response) => {
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const requestBody = JSON.parse(raw || '{}');
+                    let payload;
+                    if (requestBody.query?.includes('query SourceStatus')) {
+                        payload = { data: { sourceStatus: {
+                                    remoteRevision: 'remote-1', remoteHash: 'remote-hash', baselineRevision: null,
+                                    baselineHash: null, baselineSource: null, baselineAvailable: true,
+                                    changedComponentCount: 0, files: [], baselineFiles: [], drift: null, tracking: null,
+                                } } };
+                    }
+                    else if (requestBody.query?.includes('mutation PushSource')) {
+                        if (requestBody.variables?.dryRun !== true)
+                            persistentMutations += 1;
+                        payload = { data: { pushSource: { success: true, count: changed ? 1 : 0,
+                                    dryRun: true, beforeRevision: 'remote-1', afterRevision: 'remote-1',
+                                    plan: { humanSummary: changed ? ['Would add Account'] : [] } } } };
+                    }
+                    else
+                        payload = { errors: [{ message: 'Unexpected controlled query' }] };
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_BASE_URL = `http://127.0.0.1:${address.port}`;
+            process.env.NEXUS_AUTH_TOKEN = 'matrix-token';
+            process.chdir(root);
+        },
+        teardown: async () => {
+            process.chdir(previousCwd);
+            if (previousBaseUrl === undefined)
+                delete process.env.NEXUS_BASE_URL;
+            else
+                process.env.NEXUS_BASE_URL = previousBaseUrl;
+            if (previousToken === undefined)
+                delete process.env.NEXUS_AUTH_TOKEN;
+            else
+                process.env.NEXUS_AUTH_TOKEN = previousToken;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function escalationReadOnlyAdapter() {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-escalation-matrix-'));
+    const previousHome = process.env.NEXUS_CLI_HOME;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: 'escalation-read-only', root, remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            server = node_http_1.default.createServer((request, response) => {
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const requestBody = JSON.parse(raw || '{}');
+                    if (requestBody.query?.includes('mutation '))
+                        persistentMutations += 1;
+                    const payload = requestBody.query?.includes('query WorkforceEscalationRules')
+                        ? { data: { escalationRules: [{
+                                        id: '00000000-0000-4000-8000-000000000003',
+                                        workspaceId: '00000000-0000-4000-8000-000000000004', name: 'Matrix escalation',
+                                        objectName: 'Case', isActive: false, entries: [],
+                                        createdAt: '2026-08-02T00:00:00.000Z', updatedAt: '2026-08-02T00:00:00.000Z',
+                                    }] } } : { errors: [{ message: 'Unexpected controlled query' }] };
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_CLI_HOME = node_path_1.default.join(root, 'cli-home');
+            (0, auth_store_1.saveCredential)({ alias: 'matrix', instanceUrl: `http://127.0.0.1:${address.port}`,
+                accessToken: 'matrix-token', username: 'matrix@example.test',
+                orgId: '00000000-0000-4000-8000-000000000004' });
+        },
+        teardown: async () => {
+            if (previousHome === undefined)
+                delete process.env.NEXUS_CLI_HOME;
+            else
+                process.env.NEXUS_CLI_HOME = previousHome;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function changeSetValidationAdapter() {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-changeset-matrix-'));
+    const previousBaseUrl = process.env.NEXUS_BASE_URL;
+    const previousToken = process.env.NEXUS_AUTH_TOKEN;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: 'changeset-validation', root, remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            server = node_http_1.default.createServer((request, response) => {
+                if (request.url?.endsWith('/deploy') || request.url?.endsWith('/rollback'))
+                    persistentMutations += 1;
+                const valid = request.method === 'POST' && request.url === '/api/changesets/matrix-change-set/validate';
+                const payload = valid ? {
+                    changeSet: { id: 'matrix-change-set', status: 'draft' },
+                    report: { success: true, errors: [], warnings: [], summary: ['Validation passed'] },
+                } : { message: 'Unexpected controlled route' };
+                response.writeHead(valid ? 200 : 404, { 'content-type': 'application/json' });
+                response.end(JSON.stringify(payload));
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_BASE_URL = `http://127.0.0.1:${address.port}`;
+            process.env.NEXUS_AUTH_TOKEN = 'matrix-token';
+        },
+        teardown: async () => {
+            if (previousBaseUrl === undefined)
+                delete process.env.NEXUS_BASE_URL;
+            else
+                process.env.NEXUS_BASE_URL = previousBaseUrl;
+            if (previousToken === undefined)
+                delete process.env.NEXUS_AUTH_TOKEN;
+            else
+                process.env.NEXUS_AUTH_TOKEN = previousToken;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function metadataAdapter(kind) {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-metadata-matrix-'));
+    const previousCwd = process.cwd();
+    const previousBaseUrl = process.env.NEXUS_BASE_URL;
+    const previousToken = process.env.NEXUS_AUTH_TOKEN;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: kind === 'deploy' ? 'metadata-deploy-validation' : `metadata-${kind}`,
+        root, remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            if (kind === 'import-changed') {
+                await promises_1.default.mkdir(node_path_1.default.join(root, 'src/metadata/objects/Account'), { recursive: true });
+                await promises_1.default.writeFile(node_path_1.default.join(root, 'src/metadata/objects/Account/object.json'), '{"apiName":"Account"}');
+            }
+            server = node_http_1.default.createServer((request, response) => {
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const body = JSON.parse(raw || '{}');
+                    let valid = true;
+                    let payload;
+                    if (request.url === '/api/metadata/validate') {
+                        payload = { success: true, errors: [], warnings: [] };
+                    }
+                    else if (request.url === '/api/metadata/runtime/import') {
+                        if (body.dryRun !== true)
+                            persistentMutations += 1;
+                        const changed = kind === 'import-changed';
+                        payload = { applied: false, dryRun: true, destructiveSync: false,
+                            beforeRevision: 'remote-1', afterRevision: 'remote-1', plan: {
+                                dryRun: true, destructiveSync: false, validation: { valid: true, summary: [] },
+                                diff: { humanSummary: changed ? ['Would create Account'] : [], summary: {
+                                        objects: { created: changed ? 1 : 0, updated: 0, deleted: 0 },
+                                        fields: { created: 0, updated: 0, deleted: 0 },
+                                    } },
+                            } };
+                    }
+                    else {
+                        valid = false;
+                        if (request.url === '/api/metadata/deploy')
+                            persistentMutations += 1;
+                        payload = { message: 'Unexpected controlled route' };
+                    }
+                    response.writeHead(valid ? 200 : 404, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_BASE_URL = `http://127.0.0.1:${address.port}`;
+            process.env.NEXUS_AUTH_TOKEN = 'matrix-token';
+            process.chdir(root);
+        },
+        teardown: async () => {
+            process.chdir(previousCwd);
+            if (previousBaseUrl === undefined)
+                delete process.env.NEXUS_BASE_URL;
+            else
+                process.env.NEXUS_BASE_URL = previousBaseUrl;
+            if (previousToken === undefined)
+                delete process.env.NEXUS_AUTH_TOKEN;
+            else
+                process.env.NEXUS_AUTH_TOKEN = previousToken;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function sandboxPromotionAdapter() {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-sandbox-promote-matrix-'));
+    const previousBaseUrl = process.env.NEXUS_BASE_URL;
+    const previousToken = process.env.NEXUS_AUTH_TOKEN;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: 'sandbox-promotion-precheck', root, remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            server = node_http_1.default.createServer((request, response) => {
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const body = JSON.parse(raw || '{}');
+                    if (body.query?.includes('mutation PromoteSandbox'))
+                        persistentMutations += 1;
+                    const payload = body.query?.includes('query PromotionPrecheck')
+                        ? { data: { promotionPrecheck: { canPromote: true, warnings: [], errors: [],
+                                    frontendDiff: { from: 'sandbox', to: 'production', changes: ['matrix frontend'] },
+                                    backendDiff: { from: 'sandbox', to: 'production', changes: ['matrix backend'] } } } }
+                        : { errors: [{ message: 'Unexpected controlled query' }] };
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_BASE_URL = `http://127.0.0.1:${address.port}`;
+            process.env.NEXUS_AUTH_TOKEN = 'matrix-token';
+        },
+        teardown: async () => {
+            if (previousBaseUrl === undefined)
+                delete process.env.NEXUS_BASE_URL;
+            else
+                process.env.NEXUS_BASE_URL = previousBaseUrl;
+            if (previousToken === undefined)
+                delete process.env.NEXUS_AUTH_TOKEN;
+            else
+                process.env.NEXUS_AUTH_TOKEN = previousToken;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function workspaceSyncAdapter(operation, changed) {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-workspace-sync-matrix-'));
+    const previousCwd = process.cwd();
+    const previousHome = process.env.NEXUS_CLI_HOME;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: `workspace-${operation}-${changed ? 'changed' : 'empty'}`, root,
+        remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'nexus-project.yaml'), [
+                'schemaVersion: nexus-project/v2', 'projectName: matrix-project',
+                'compatibleCoreVersion: 0.1.x', 'sourceRoot: src/metadata', 'defaultOrg: matrix',
+                'defaultEnvironment: dev',
+                'sourceRoots:', '  - path: src/metadata', '    kind: metadata-runtime',
+                '    writeTarget: true', 'localPackages: []', 'environments:',
+                '  - name: dev', '    path: env/dev.yaml', '    default: true',
+            ].join('\n'));
+            await promises_1.default.mkdir(node_path_1.default.join(root, 'env'), { recursive: true });
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'env/dev.yaml'), [
+                'schemaVersion: dx-environment/v1', 'name: dev', 'type: dev-sandbox',
+                'target:', '  workspaceId: 00000000-0000-4000-8000-000000000004', '  orgAlias: matrix',
+                '  sandboxId: matrix-sandbox',
+                'packageStack:', '  baseline:', '    packageName: foundation',
+            ].join('\n'));
+            if (operation === 'push' && changed) {
+                await promises_1.default.mkdir(node_path_1.default.join(root, 'src/metadata/objects/Account'), { recursive: true });
+                await promises_1.default.writeFile(node_path_1.default.join(root, 'src/metadata/objects/Account/object.json'), '{"apiName":"Account"}');
+            }
+            server = node_http_1.default.createServer((request, response) => {
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const body = JSON.parse(raw || '{}');
+                    let payload;
+                    if (body.query?.includes('query SourceStatus')) {
+                        const files = operation === 'pull' && changed
+                            ? [{ path: 'objects/Account/object.json', hash: 'remote-hash',
+                                    componentKey: 'ObjectMetadata:Account', baselineHash: null }] : [];
+                        payload = { data: { sourceStatus: { remoteRevision: 'remote-1', remoteHash: 'remote-hash',
+                                    baselineRevision: null, baselineHash: null, baselineSource: null, baselineAvailable: true,
+                                    changedComponentCount: files.length, files, baselineFiles: [], drift: null, tracking: null } } };
+                    }
+                    else if (body.query?.includes('query SourceFiles')) {
+                        if (body.variables?.recordAccess === true)
+                            persistentMutations += 1;
+                        payload = { data: { sourceFiles: { remoteRevision: 'remote-1', files: [{
+                                            path: 'objects/Account/object.json', content: '{"apiName":"Account"}', hash: 'remote-hash',
+                                            componentKey: 'ObjectMetadata:Account',
+                                        }] } } };
+                    }
+                    else if (body.query?.includes('mutation PushSource')) {
+                        if (body.variables?.dryRun !== true)
+                            persistentMutations += 1;
+                        payload = { data: { pushSource: { success: true, count: changed ? 1 : 0, dryRun: true,
+                                    beforeRevision: 'remote-1', afterRevision: 'remote-1',
+                                    plan: { humanSummary: changed ? ['Would push Account'] : [] } } } };
+                    }
+                    else
+                        payload = { errors: [{ message: 'Unexpected controlled query' }] };
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_CLI_HOME = node_path_1.default.join(root, 'cli-home');
+            (0, auth_store_1.saveCredential)({ alias: 'matrix', instanceUrl: `http://127.0.0.1:${address.port}`,
+                accessToken: 'matrix-token', username: 'matrix@example.test',
+                orgId: '00000000-0000-4000-8000-000000000004' });
+            process.chdir(root);
+        },
+        teardown: async () => {
+            process.chdir(previousCwd);
+            if (previousHome === undefined)
+                delete process.env.NEXUS_CLI_HOME;
+            else
+                process.env.NEXUS_CLI_HOME = previousHome;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function packageLifecycleAdapter() {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-package-lifecycle-matrix-'));
+    const previousCwd = process.cwd();
+    const previousHome = process.env.NEXUS_CLI_HOME;
+    const previousWorkspaceId = process.env.NEXUS_WORKSPACE_ID;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: 'package-lifecycle-preview', root, remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            const packageDir = node_path_1.default.join(root, 'packages/matrix-package');
+            await promises_1.default.mkdir(node_path_1.default.join(packageDir, 'metadata/objects'), { recursive: true });
+            await promises_1.default.writeFile(node_path_1.default.join(packageDir, 'package.yaml'), [
+                'schemaVersion: v1', 'name: matrix-package', 'packageType: extension-pack',
+                'packageClass: metadata', 'description: Matrix contract package fixture', 'version: 1.0.0',
+                'dependencies: []', 'compatibleCoreVersion: "^1.0.0"', 'installOrder: 300',
+                'includedMetadataKinds: [objects]', 'includedSeedKinds: []', 'visibility: internal',
+                'releaseChannel: preview', 'kindSupport:', '  - kind: objects',
+                '    executionMode: installer-input-backed',
+            ].join('\n'));
+            await promises_1.default.writeFile(node_path_1.default.join(packageDir, 'metadata/objects/account.yaml'), [
+                'kind: object', 'object:', '  nameSingular: Account', '  namePlural: Accounts',
+                '  labelSingular: Account', '  labelPlural: Accounts', '  isCustom: true',
+            ].join('\n'));
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'nexus-project.yaml'), [
+                'schemaVersion: nexus-project/v2', 'projectName: matrix-project',
+                'compatibleCoreVersion: 0.1.x', 'sourceRoots: []', 'localPackages:',
+                '  - name: matrix-package', '    path: packages/matrix-package',
+                'defaultEnvironment: dev', 'defaultOrg: matrix', 'environments:',
+                '  - name: dev', '    path: env/dev.yaml',
+            ].join('\n'));
+            await promises_1.default.mkdir(node_path_1.default.join(root, 'env'), { recursive: true });
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'env/dev.yaml'), [
+                'schemaVersion: dx-environment/v1', 'name: dev', 'type: dev-sandbox', 'target:',
+                '  workspaceId: 00000000-0000-4000-8000-000000000004', '  orgAlias: matrix',
+                'packageStack:', '  baseline:', '    packageName: foundation',
+            ].join('\n'));
+            server = node_http_1.default.createServer((request, response) => {
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const body = JSON.parse(raw || '{}');
+                    let payload;
+                    if (body.query?.includes('MetadataPackageInstallPlan')) {
+                        payload = { data: { metadataPackageInstallPlan: { packageNames: ['matrix-package'],
+                                    orderedSteps: [], warnings: [], dependencies: { conflictSummary: [] } } } };
+                    }
+                    else if (body.query?.includes('InstallMetadataPackage')) {
+                        if (body.variables?.dryRun !== true)
+                            persistentMutations += 1;
+                        payload = { data: { installMetadataPackage: { packageName: 'matrix-package', status: 'noop',
+                                    appliedMetadataKinds: ['objects'], appliedSeedKinds: [], warnings: [],
+                                    executionTrack: 'installer-input', installedStateId: null } } };
+                    }
+                    else if (body.query?.includes('MetadataPackageInstallHistory')) {
+                        payload = { data: { metadataPackageInstallHistory: [{ id: 'matrix-history',
+                                        workspaceId: '00000000-0000-4000-8000-000000000004', packageName: 'matrix-package',
+                                        version: '1.0.0', action: 'install', status: 'installed', installSource: 'registry',
+                                        sourceUri: 'matrix', manifest: { schemaVersion: 'v1', name: 'matrix-package',
+                                            packageType: 'extension-pack', packageClass: 'metadata', description: 'Matrix contract package fixture',
+                                            version: '1.0.0', dependencies: [], compatibleCoreVersion: '^1.0.0', installOrder: 300,
+                                            includedMetadataKinds: ['objects'], includedSeedKinds: [], visibility: 'internal',
+                                            releaseChannel: 'preview', kindSupport: [{ kind: 'objects', executionMode: 'installer-input-backed' }] },
+                                        details: null, createdAt: '2026-08-02T00:00:00.000Z' }] } };
+                    }
+                    else if (body.query?.includes('RollbackMetadataPackageInstall')) {
+                        if (body.variables?.dryRun !== true)
+                            persistentMutations += 1;
+                        payload = { data: { rollbackMetadataPackageInstall: { packageName: 'matrix-package',
+                                    status: 'noop', restoredVersion: '1.0.0', warnings: [], componentChanges: {
+                                        toRemove: [], toRestore: [],
+                                    } } } };
+                    }
+                    else
+                        payload = { errors: [{ message: 'Unexpected controlled query' }] };
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_CLI_HOME = node_path_1.default.join(root, 'cli-home');
+            process.env.NEXUS_WORKSPACE_ID = '00000000-0000-4000-8000-000000000004';
+            (0, auth_store_1.saveCredential)({ alias: 'matrix', instanceUrl: `http://127.0.0.1:${address.port}`,
+                accessToken: 'matrix-token', username: 'matrix@example.test',
+                orgId: '00000000-0000-4000-8000-000000000004' });
+            process.chdir(root);
+        },
+        teardown: async () => {
+            process.chdir(previousCwd);
+            if (previousHome === undefined)
+                delete process.env.NEXUS_CLI_HOME;
+            else
+                process.env.NEXUS_CLI_HOME = previousHome;
+            if (previousWorkspaceId === undefined)
+                delete process.env.NEXUS_WORKSPACE_ID;
+            else
+                process.env.NEXUS_WORKSPACE_ID = previousWorkspaceId;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function employeeDeployAdapter() {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-employee-deploy-matrix-'));
+    const previousCwd = process.cwd();
+    const previousBaseUrl = process.env.NEXUS_BASE_URL;
+    const previousToken = process.env.NEXUS_AUTH_TOKEN;
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: 'employee-deploy-preview', root, remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            await promises_1.default.writeFile(node_path_1.default.join(root, 'employee-package.json'), JSON.stringify({
+                schemaVersion: 'v1', name: 'matrix-employee', version: '1.0.0',
+                agent: { apiName: 'matrix_employee', name: 'Matrix Employee', type: 'sales', topics: [],
+                    toolBindings: [], guardrailRuleKeys: [], knowledgeBaseKeys: [],
+                    modelConfig: { modelId: 'qwen-max', provider: 'dashscope', tier: 2,
+                        temperature: 0.7, maxTokens: 2048, responseFormat: 'text' },
+                    permissionConfig: { dataScopeType: 'own', maxQueriesPerMinute: 60,
+                        maxWritesPerMinute: 20, maxBatchSize: 200, allowedTools: [], blockedTools: [], activeWindows: [] } },
+                guardrails: [], knowledge: [], evalCases: [{ key: 'eval:smoke', name: 'smoke', input: 'hi',
+                        tags: ['readonly'], assertions: [{ type: 'status_done' }] }],
+            }));
+            server = node_http_1.default.createServer((request, response) => {
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const body = JSON.parse(raw || '{}');
+                    if (body.query?.includes('mutation DeployEmployeePackage') && body.variables?.dryRun !== true) {
+                        persistentMutations += 1;
+                    }
+                    const payload = body.query?.includes('mutation DeployEmployeePackage')
+                        ? { data: { deployEmployeePackage: { status: 'validated', agentId: null,
+                                    agentStatus: 'draft', activated: false, guardrails: { upserted: 0 },
+                                    knowledge: { upserted: 0, embedded: 0, skippedEmbeddings: 0 },
+                                    evalCases: { upserted: 0, ran: 0, skippedMutating: 0 },
+                                    gate: { passRate: 1, minPassRate: 1, baselinePassRate: null, regressed: false,
+                                        passed: true, casesRun: 1, failures: [] }, errors: [] } } }
+                        : { errors: [{ message: 'Unexpected controlled query' }] };
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_BASE_URL = `http://127.0.0.1:${address.port}`;
+            process.env.NEXUS_AUTH_TOKEN = 'matrix-token';
+            process.chdir(root);
+        },
+        teardown: async () => {
+            process.chdir(previousCwd);
+            if (previousBaseUrl === undefined)
+                delete process.env.NEXUS_BASE_URL;
+            else
+                process.env.NEXUS_BASE_URL = previousBaseUrl;
+            if (previousToken === undefined)
+                delete process.env.NEXUS_AUTH_TOKEN;
+            else
+                process.env.NEXUS_AUTH_TOKEN = previousToken;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+async function workforceBundleSignedAdapter() {
+    const root = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-cli-workforce-bundle-matrix-'));
+    const previousCwd = process.cwd();
+    const previousHome = process.env.NEXUS_CLI_HOME;
+    const { privateKey, publicKey } = (0, node_crypto_1.generateKeyPairSync)('ed25519');
+    const publicKeyJwk = publicKey.export({ format: 'jwk' });
+    const digest = `sha256:${'a'.repeat(64)}`;
+    const generatedAt = new Date().toISOString();
+    const expiresAt = new Date(Date.now() + 60 * 60 * 1000).toISOString();
+    let server;
+    let persistentMutations = 0;
+    return {
+        adapterId: 'workforce-bundle-signed-preview', root,
+        remoteMutationCount: () => persistentMutations,
+        setup: async () => {
+            server = node_http_1.default.createServer((request, response) => {
+                const send = (payload) => {
+                    response.writeHead(200, { 'content-type': 'application/json' });
+                    response.end(JSON.stringify(payload));
+                };
+                if (request.method === 'GET' && request.url === '/api/v1/ai-authoring-context/signing-keys') {
+                    send({ schemaVersion: shared_1.AI_CONTEXT_SIGNING_KEY_SET_SCHEMA_VERSION,
+                        issuer: `http://127.0.0.1:${server.address().port}`,
+                        generatedAt, cacheUntil: expiresAt, keys: [{ keyId: 'matrix-key', alg: 'EdDSA',
+                                publicKeyJwk, notBefore: generatedAt, notAfter: expiresAt, status: 'active' }] });
+                    return;
+                }
+                let raw = '';
+                request.on('data', (chunk) => { raw += String(chunk); });
+                request.on('end', () => {
+                    const body = JSON.parse(raw || '{}');
+                    const input = body.variables?.input ?? {};
+                    if (body.query?.includes('mutation '))
+                        persistentMutations += 1;
+                    if (body.query?.includes('query DescribeAiAuthoringContext')) {
+                        const catalog = { schemaVersion: 'matrix.catalog/v1', digest, canonicalJson: '{"items":[]}' };
+                        send({ data: { describeAiAuthoringContext: {
+                                    schemaVersion: shared_1.AI_AUTHORING_CONTEXT_SCHEMA_VERSION, coreVersion: '1.0.0',
+                                    coreCommitSha: 'a'.repeat(40), cliVersion: '0.2.0', runtimeApiVersion: 'v2',
+                                    surface: 'all', targetWorkspaceId: '00000000-0000-4000-8000-000000000004',
+                                    principalKind: 'human', principalId: 'matrix-user', agentApiName: null,
+                                    releaseSetId: null, releaseStamp: null, contractDigest: digest,
+                                    workspaceContractHash: digest, principalScopeDigest: digest, generatedAt, expiresAt,
+                                    objectCatalog: catalog, invokableCatalog: catalog, connectorCatalog: catalog,
+                                    aiPolicyCatalog: catalog, approvalPolicyCatalog: catalog,
+                                } } });
+                    }
+                    else if (body.query?.includes('query SignAiAuthoringContextLock')) {
+                        const signing = (0, shared_1.buildAiContextDetachedSigningInput)({ lockDigest: input.lockDigest,
+                            workspaceId: input.targetWorkspaceId, principalScopeDigest: input.principalScopeDigest,
+                            orgAliasClaim: input.orgAliasClaim, generatedAt: input.generatedAt, expiresAt: input.expiresAt }, 'matrix-key');
+                        const signature = `${signing.protectedHeader}..${(0, node_crypto_1.sign)(null, signing.signingInput, privateKey).toString('base64url')}`;
+                        send({ data: { signAiAuthoringContextLock: { schemaVersion: shared_1.AI_AUTHORING_CONTEXT_LOCK_SCHEMA_VERSION,
+                                    contentDigest: input.contentDigest, manifestContentDigest: input.manifestContentDigest,
+                                    manifestEnvelopeDigest: input.manifestEnvelopeDigest, lockDigest: input.lockDigest,
+                                    signatureAlgorithm: 'EdDSA', keyId: 'matrix-key', signature } } });
+                    }
+                    else if (body.query?.includes('query VerifyAiAuthoringContextFreshness')) {
+                        send({ data: { verifyAiAuthoringContextFreshness: { valid: true, stale: false, reasons: [],
+                                    currentHashes: { contractDigest: digest, workspaceContractHash: digest, principalScopeDigest: digest } } } });
+                    }
+                    else if (body.query?.includes('query PlanExecutableWorkforceBundle')) {
+                        send({ data: { planExecutableWorkforceBundle: { schemaVersion: 'nexusclaw.executable-workforce-bundle-plan/v1',
+                                    planDigest: digest, releaseItemSetDigest: digest, sourceLockDigest: digest,
+                                    plannedItems: [], headAtPlan: { activeReleaseSetId: null, generation: 0 }, lock: {} } } });
+                    }
+                    else
+                        send({ errors: [{ message: 'Unexpected controlled query' }] });
+                });
+            });
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new Error('MATRIX_SERVER_ADDRESS_MISSING');
+            process.env.NEXUS_CLI_HOME = node_path_1.default.join(root, 'cli-home');
+            (0, auth_store_1.saveCredential)({ alias: 'matrix', instanceUrl: `http://127.0.0.1:${address.port}`,
+                accessToken: 'matrix-token', username: 'matrix@example.test',
+                orgId: '00000000-0000-4000-8000-000000000004' });
+            const contextDir = node_path_1.default.join(root, 'context');
+            await (0, ai_authoring_context_v2_1.exportAuthoringContextV2)({ surface: 'all', targetOrg: 'matrix', callerPreview: true,
+                outDir: contextDir, workspaceDir: root });
+            const authoringContext = (0, ai_authoring_context_v2_1.loadAuthoringContextFreshnessInput)(node_path_1.default.join(contextDir, 'context-manifest.json'));
+            const bundleDir = node_path_1.default.join(root, 'bundle/.nexusclaw');
+            await promises_1.default.mkdir(bundleDir, { recursive: true });
+            await promises_1.default.writeFile(node_path_1.default.join(bundleDir, 'workforce-remote-state.json'), JSON.stringify({
+                schemaVersion: 'nexusclaw.workforce-bundle-remote-state/v1', targetOrg: 'matrix',
+                contextManifestPath: node_path_1.default.join(contextDir, 'context-manifest.json'),
+                artifactInput: { schemaVersion: 'nexusclaw.workforce-bundle-artifact-operation-input/v1',
+                    targetWorkspaceId: '00000000-0000-4000-8000-000000000004', stagedArtifactId: 'matrix-artifact',
+                    expectedArchiveDigest: digest, expectedPackageDigest: digest,
+                    contextManifestContentDigest: authoringContext.manifestContentDigest,
+                    runtimeBindingsDigest: digest, expectedPortableBundleDigest: digest }, authoringContext,
+            }));
+            process.chdir(root);
+        },
+        teardown: async () => {
+            process.chdir(previousCwd);
+            if (previousHome === undefined)
+                delete process.env.NEXUS_CLI_HOME;
+            else
+                process.env.NEXUS_CLI_HOME = previousHome;
+            if (server)
+                await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        },
+    };
+}
+(0, node_test_1.default)('generated matrix completes every registry-derived framework scenario', async () => {
+    const inventory = (0, command_inventory_1.buildCommandInventory)((0, cli_1.buildCliProgram)());
+    const policies = (0, command_policy_registry_1.buildCommandPolicyRegistry)(inventory, command_contract_registry_1.commandContractRegistry.all().map((entry) => entry.contract));
+    const manifest = {
+        ...(0, command_contract_matrix_1.buildControlledTerminalScenarioManifest)(policies),
+        ...(0, command_contract_matrix_1.buildPreDispatchFailureScenarioManifest)(policies),
+        ...command_contract_matrix_scenarios_1.controlledDryRunScenarioManifest,
+    };
+    const executed = new Set();
+    for (const [scenarioId, declaration] of Object.entries(manifest)) {
+        if (declaration.status === 'inapplicable')
+            continue;
+        strict_1.default.equal(declaration.status, 'fixture');
+        strict_1.default.ok(declaration.fixture);
+        const controlledTerminal = declaration.fixture.adapterId.startsWith('controlled-terminal-');
+        const adapter = controlledTerminal
+            ? { adapterId: declaration.fixture.adapterId, setup: () => undefined, teardown: () => undefined,
+                remoteMutationCount: () => 0 }
+            : declaration.fixture.adapterId === 'project-local-workspace'
+                ? await projectLocalWorkspaceAdapter()
+                : declaration.fixture.adapterId === 'source-status-changed'
+                    ? await sourceStatusAdapter(true)
+                    : declaration.fixture.adapterId === 'source-status-empty'
+                        ? await sourceStatusAdapter(false)
+                        : declaration.fixture.adapterId === 'source-push-changed'
+                            ? await sourcePushAdapter(true)
+                            : declaration.fixture.adapterId === 'source-push-empty'
+                                ? await sourcePushAdapter(false)
+                                : declaration.fixture.adapterId === 'escalation-read-only'
+                                    ? await escalationReadOnlyAdapter()
+                                    : declaration.fixture.adapterId === 'changeset-validation'
+                                        ? await changeSetValidationAdapter()
+                                        : declaration.fixture.adapterId === 'metadata-deploy-validation'
+                                            ? await metadataAdapter('deploy')
+                                            : declaration.fixture.adapterId === 'metadata-import-changed'
+                                                ? await metadataAdapter('import-changed')
+                                                : declaration.fixture.adapterId === 'metadata-import-empty'
+                                                    ? await metadataAdapter('import-empty')
+                                                    : declaration.fixture.adapterId === 'sandbox-promotion-precheck'
+                                                        ? await sandboxPromotionAdapter()
+                                                        : declaration.fixture.adapterId === 'workspace-pull-changed'
+                                                            ? await workspaceSyncAdapter('pull', true)
+                                                            : declaration.fixture.adapterId === 'workspace-pull-empty'
+                                                                ? await workspaceSyncAdapter('pull', false)
+                                                                : declaration.fixture.adapterId === 'workspace-push-changed'
+                                                                    ? await workspaceSyncAdapter('push', true)
+                                                                    : declaration.fixture.adapterId === 'workspace-push-empty'
+                                                                        ? await workspaceSyncAdapter('push', false)
+                                                                        : declaration.fixture.adapterId === 'package-lifecycle-preview'
+                                                                            ? await packageLifecycleAdapter()
+                                                                            : declaration.fixture.adapterId === 'employee-deploy-preview'
+                                                                                ? await employeeDeployAdapter()
+                                                                                : declaration.fixture.adapterId === 'workforce-bundle-signed-preview'
+                                                                                    ? await workforceBundleSignedAdapter()
+                                                                                    : declaration.fixture.adapterId === 'no-remote-mutation'
+                                                                                        ? noRemoteMutationAdapter : preDispatchAdapter;
+        const evidence = await (0, command_contract_matrix_runner_1.executeCliMatrixScenario)({
+            fixture: declaration.fixture,
+            adapter,
+            programFactory: controlledTerminal
+                ? () => (0, command_contract_matrix_runner_1.buildControlledTerminalProgram)(cli_1.buildCliProgram, scenarioId.split('#')[0], declaration.fixture.adapterId.endsWith('-empty') ? 'empty' : 'success')
+                : cli_1.buildCliProgram,
+            sideEffectRoot: adapter.root,
+            requireNoPersistentSideEffects: declaration.fixture.adapterId !== 'commander-pre-dispatch',
+        });
+        if (scenarioId.endsWith('#failure')) {
+            strict_1.default.equal(evidence.exitCode, 64, scenarioId);
+            strict_1.default.equal(evidence.result.ok, false, scenarioId);
+        }
+        else {
+            strict_1.default.equal(evidence.exitCode, 0, `${scenarioId}: ${evidence.stdout}`);
+            strict_1.default.equal(evidence.result.ok, true, scenarioId);
+        }
+        strict_1.default.equal(evidence.result.command, scenarioId.split('#')[0], scenarioId);
+        executed.add(scenarioId);
+    }
+    const report = (0, command_contract_matrix_1.buildCommandContractMatrixReport)(policies, manifest, executed);
+    strict_1.default.equal(executed.size, 940);
+    strict_1.default.equal(report.counts.tested, 940);
+    strict_1.default.equal(report.counts.inapplicable, 17);
+    strict_1.default.equal(report.counts.exempted, 161);
+    strict_1.default.equal(report.counts.missing, 0);
+    strict_1.default.equal(report.scenarioCount, 1118);
+    strict_1.default.equal(report.ok, true);
+    strict_1.default.equal(report.counts.exempted, 161);
+    strict_1.default.equal(report.entries.filter((entry) => entry.kind === 'failure')
+        .every((entry) => entry.status === 'tested'), true);
+    const reportPath = process.env.NEXUS_CLI_MATRIX_REPORT_PATH;
+    if (reportPath) {
+        await promises_1.default.mkdir(node_path_1.default.dirname(reportPath), { recursive: true });
+        await promises_1.default.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`);
+    }
+});
+//# sourceMappingURL=command-contract-matrix.generated.test.js.map