@nexusclawhq/cli 0.3.25 → 0.3.27

package/dist/nexus-cli/src/contracts/command-policy.registry.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCommandPolicyRegistry = buildCommandPolicyRegistry;
+const READ_ONLY_COMMANDS = [
+    'changeset.conflicts', 'changeset.dependencies', 'changeset.list', 'changeset.status',
+    'customer-entitlement.get', 'customer-entitlement.list', 'customer-entitlement.validate',
+    'data.query',
+    'deployment.compare', 'deployment.employee-report', 'deployment.employee-report-list',
+    'deployment.history', 'deployment.report',
+    'diff', 'employee.bundle.activation-readiness', 'entitlement.list',
+    'install-contract.list-business-data', 'install-contract.list-metadata',
+    'log.get', 'log.list', 'log.tail',
+    'metadata.diff', 'metadata.validate', 'metadata.validate-source',
+    'org.display', 'org.list', 'org.open',
+    'package.history', 'package.info', 'package.list', 'package.plan',
+    'package.promotion-history', 'package.rollout-status', 'package.rollout-workspaces',
+    'package.search', 'package.validate', 'package.versions',
+    'preflight.get',
+    'revision.baseline.show', 'revision.diff', 'revision.history',
+    'sandbox.list', 'source.get', 'source.status', 'test.report',
+    'validate.package', 'validate.source',
+    'workforce.escalation.list', 'workforce.knowledge.routing-readiness',
+    'workforce.notification.list', 'workforce.notification.template-status',
+    'workforce.task.conversation.get', 'workforce.task.conversation.list',
+    'workspace.current', 'workspace.health', 'workspace.status',
+];
+const LOCAL_WRITE_COMMANDS = [
+    'data.export-tree',
+    'generate.class', 'generate.component', 'generate.project', 'generate.test', 'generate.trigger',
+    'init', 'metadata.export', 'metadata.retrieve',
+    'org.default-set', 'org.login-jwt', 'org.login-web', 'org.logout',
+    'pack', 'package.format', 'package.pack', 'package.publish', 'project.convert.source',
+    'pull', 'revision.baseline.set', 'source.pull', 'workspace.init', 'workspace.pull',
+];
+const REMOTE_WRITE_COMMANDS = [
+    'changeset.approve', 'changeset.create', 'changeset.deploy', 'changeset.reject',
+    'changeset.rollback', 'changeset.validate',
+    'customer-entitlement.activate', 'customer-entitlement.create',
+    'customer-entitlement.deactivate',
+    'data.delete-bulk', 'data.import-tree', 'data.recycle-bin.soft-delete',
+    'deployment.quick', 'deployment.resume', 'deployment.rollback', 'employee.deploy',
+    'entitlement.grant', 'entitlement.revoke', 'install',
+    'install-contract.register-business-data', 'install-contract.register-metadata',
+    'metadata.deploy', 'metadata.import',
+    'package.install', 'package.promote', 'package.rollback',
+    'package.rollout-update', 'package.uninstall', 'package.update', 'package.upgrade',
+    'preflight.run', 'project.deploy.start', 'promote', 'publish',
+    'revision.rollback', 'rollback',
+    'sandbox.create', 'sandbox.delete', 'sandbox.promote', 'script.run', 'source.push',
+    'test.run', 'user.service-account.enable',
+    'workforce.agent.archive', 'workforce.agent.bind-service-account',
+    'workforce.agent.publish', 'workforce.agent.rollback-version',
+    'workforce.agent.use-assistant-identity',
+    'workforce.escalation.activate', 'workforce.escalation.create',
+    'workforce.escalation.entry-add', 'workforce.notification.create',
+    'workforce.release', 'workforce.task.converse',
+    'workspace.push', 'workspace.replay',
+];
+const CONDITIONAL_COMMANDS = [
+    'org.step-up', 'package.deprecate', 'project.sync-manifest',
+];
+function classifyExplicitCommands() {
+    const classified = new Map();
+    const add = (ids, mutability) => {
+        for (const id of ids) {
+            if (classified.has(id))
+                throw new Error(`CLI_COMMAND_POLICY_DUPLICATE: ${id}`);
+            classified.set(id, mutability);
+        }
+    };
+    add(READ_ONLY_COMMANDS, 'read-only');
+    add(LOCAL_WRITE_COMMANDS, 'local-write');
+    add(REMOTE_WRITE_COMMANDS, 'remote-write');
+    return classified;
+}
+function hasOption(leaf, long) {
+    return leaf.options.some((option) => option.long === long);
+}
+function currentDryRunExemption(leaf, mutability) {
+    if (mutability === 'read-only' || hasOption(leaf, '--dry-run'))
+        return undefined;
+    return {
+        owner: mutability === 'remote-write' ? 'cli-platform+domain-api-owner' : 'cli-platform',
+        reason: `${leaf.commandId} has no side-effect-free ${mutability} planning adapter; an outer dispatch short-circuit would bypass truthful validation or authorization.`,
+        exitCriteria: `${leaf.commandId} exposes --dry-run, exercises its normal validation/authorization owner, and passes generated zero-persistent-side-effect snapshots.`,
+        expiresOn: '2026-09-30',
+    };
+}
+function invocationPolicy(leaf, mutability, exitCodes) {
+    const hasEnv = hasOption(leaf, '--env');
+    const hasEnvironment = hasOption(leaf, '--environment');
+    return {
+        outputMode: 'dual',
+        mutability,
+        supportsDryRun: hasOption(leaf, '--dry-run'),
+        dryRunExemption: currentDryRunExemption(leaf, mutability),
+        environmentOption: hasEnv || hasEnvironment ? '--env' : null,
+        environmentAliases: hasEnvironment ? ['--environment'] : [],
+        workspaceOption: hasOption(leaf, '--workspace-id') ? '--workspace-id' : null,
+        localWorkspaceOption: hasOption(leaf, '--workspace') ? '--workspace' : null,
+        exitCodes: {
+            success: exitCodes.includes(0) ? [0] : [],
+            warning: [],
+            error: exitCodes.filter((code) => code !== 0),
+        },
+    };
+}
+function mutabilityFromEffects(effects) {
+    if (effects.includes('remote_write') || effects.includes('promote'))
+        return 'remote-write';
+    if (effects.includes('local_write'))
+        return 'local-write';
+    return 'read-only';
+}
+function projectV1Policy(leaf, contract) {
+    return {
+        commandId: leaf.commandId,
+        path: leaf.path,
+        source: 'v1-contract',
+        modes: contract.executionModes.map((mode) => ({
+            modeId: mode.modeId,
+            selection: JSON.stringify(mode.when),
+            invocationPolicy: invocationPolicy(leaf, mutabilityFromEffects(mode.effects), contract.exitCodes),
+        })),
+    };
+}
+function explicitModes(leaf, mutability) {
+    if (leaf.commandId === 'org.step-up') {
+        return [
+            { modeId: 'list-factors', selection: '--list-factors', invocationPolicy: invocationPolicy(leaf, 'read-only', [0, 1, 64, 70]) },
+            { modeId: 'complete', selection: 'not --list-factors', invocationPolicy: invocationPolicy(leaf, 'remote-write', [0, 1, 64, 70]) },
+        ];
+    }
+    if (leaf.commandId === 'package.deprecate') {
+        return [
+            { modeId: 'local', selection: '--local', invocationPolicy: invocationPolicy(leaf, 'local-write', [0, 1, 64, 70]) },
+            { modeId: 'remote', selection: 'not --local', invocationPolicy: invocationPolicy(leaf, 'remote-write', [0, 1, 64, 70]) },
+        ];
+    }
+    if (leaf.commandId === 'project.sync-manifest') {
+        return [
+            { modeId: 'fix', selection: '--fix', invocationPolicy: invocationPolicy(leaf, 'local-write', [0, 1, 64, 70]) },
+            { modeId: 'inspect', selection: 'not --fix', invocationPolicy: invocationPolicy(leaf, 'read-only', [0, 1, 64, 70]) },
+        ];
+    }
+    if (hasOption(leaf, '--dry-run') && mutability !== 'read-only') {
+        return [
+            { modeId: 'dry-run', selection: '--dry-run', invocationPolicy: invocationPolicy(leaf, 'read-only', [0, 1, 64, 70]) },
+            { modeId: 'apply', selection: 'not --dry-run', invocationPolicy: invocationPolicy(leaf, mutability, [0, 1, 64, 70]) },
+        ];
+    }
+    return [{
+            modeId: 'default',
+            selection: 'always',
+            invocationPolicy: invocationPolicy(leaf, mutability, [0, 1, 64, 70]),
+        }];
+}
+function buildCommandPolicyRegistry(inventory, v1Contracts) {
+    const v1ByPath = new Map(v1Contracts.map((contract) => [contract.path, contract]));
+    const explicit = classifyExplicitCommands();
+    const conditional = new Set(CONDITIONAL_COMMANDS);
+    const seenExplicit = new Set();
+    const policies = inventory.leaves.map((leaf) => {
+        const v1 = v1ByPath.get(leaf.path);
+        if (v1)
+            return projectV1Policy(leaf, v1);
+        const mutability = explicit.get(leaf.commandId);
+        if (!mutability && !conditional.has(leaf.commandId)) {
+            throw new Error(`CLI_COMMAND_POLICY_MISSING: ${leaf.commandId}`);
+        }
+        seenExplicit.add(leaf.commandId);
+        return {
+            commandId: leaf.commandId,
+            path: leaf.path,
+            source: 'explicit-v2',
+            modes: explicitModes(leaf, mutability ?? 'read-only'),
+        };
+    });
+    for (const id of [...explicit.keys(), ...conditional]) {
+        if (!seenExplicit.has(id))
+            throw new Error(`CLI_COMMAND_POLICY_STALE: ${id}`);
+    }
+    return policies;
+}
+//# sourceMappingURL=command-policy.registry.js.map

package/dist/nexus-cli/src/contracts/command-policy.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy.registry.js","sourceRoot":"","sources":["../../../../src/contracts/command-policy.registry.ts"],"names":[],"mappings":";;AA2MA,gEA6BC;AAlND,MAAM,kBAAkB,GAAG;IACzB,qBAAqB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,kBAAkB;IACrF,0BAA0B,EAAE,2BAA2B,EAAE,+BAA+B;IACxF,YAAY;IACZ,oBAAoB,EAAE,4BAA4B,EAAE,iCAAiC;IACrF,oBAAoB,EAAE,mBAAmB;IACzC,MAAM,EAAE,sCAAsC,EAAE,kBAAkB;IAClE,qCAAqC,EAAE,gCAAgC;IACvE,SAAS,EAAE,UAAU,EAAE,UAAU;IACjC,eAAe,EAAE,mBAAmB,EAAE,0BAA0B;IAChE,aAAa,EAAE,UAAU,EAAE,UAAU;IACrC,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc;IACjE,2BAA2B,EAAE,wBAAwB,EAAE,4BAA4B;IACnF,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB;IACxD,eAAe;IACf,wBAAwB,EAAE,eAAe,EAAE,kBAAkB;IAC7D,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa;IAC5D,kBAAkB,EAAE,iBAAiB;IACrC,2BAA2B,EAAE,uCAAuC;IACpE,6BAA6B,EAAE,wCAAwC;IACvE,iCAAiC,EAAE,kCAAkC;IACrE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB;CACnD,CAAC;AAEX,MAAM,oBAAoB,GAAG;IAC3B,kBAAkB;IAClB,gBAAgB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB;IAC/F,MAAM,EAAE,iBAAiB,EAAE,mBAAmB;IAC9C,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY;IACjE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,wBAAwB;IACrF,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB;CAC1E,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;IAC/E,oBAAoB,EAAE,oBAAoB;IAC1C,+BAA+B,EAAE,6BAA6B;IAC9D,iCAAiC;IACjC,kBAAkB,EAAE,kBAAkB,EAAE,8BAA8B;IACtE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,iBAAiB;IACjF,mBAAmB,EAAE,oBAAoB,EAAE,SAAS;IACpD,yCAAyC,EAAE,oCAAoC;IAC/E,iBAAiB,EAAE,iBAAiB;IACpC,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB;IACxD,wBAAwB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB;IAClF,eAAe,EAAE,sBAAsB,EAAE,SAAS,EAAE,SAAS;IAC7D,mBAAmB,EAAE,UAAU;IAC/B,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa;IAClF,UAAU,EAAE,6BAA6B;IACzC,yBAAyB,EAAE,sCAAsC;IACjE,yBAAyB,EAAE,kCAAkC;IAC7D,wCAAwC;IACxC,+BAA+B,EAAE,6BAA6B;IAC9D,gCAAgC,EAAE,+BAA+B;IACjE,mBAAmB,EAAE,yBAAyB;IAC9C,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAEX,MAAM,oBAAoB,GAAG;IAC3B,aAAa,EAAE,mBAAmB,EAAE,uBAAuB;CACnD,CAAC;AAEX,SAAS,wBAAwB;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,GAA0B,EAAE,UAA2B,EAAQ,EAAE;QAC5E,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;YAC/E,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC;IACF,GAAG,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IACrC,GAAG,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,IAA+B,EAAE,IAAY;IAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC7D,CAAC;AAQD,SAAS,sBAAsB,CAC7B,IAA+B,EAC/B,UAA2B;IAE3B,IAAI,UAAU,KAAK,WAAW,IAAI,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO;QACL,KAAK,EAAE,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,cAAc;QACvF,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,4BAA4B,UAAU,uGAAuG;QACtK,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,sIAAsI;QACrK,SAAS,EAAE,YAAY;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,IAA+B,EAC/B,UAA2B,EAC3B,SAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACxD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,UAAU;QACV,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5C,eAAe,EAAE,sBAAsB,CAAC,IAAI,EAAE,UAAU,CAAC;QACzD,iBAAiB,EAAE,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC5D,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE;QAC3D,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;QAC5E,oBAAoB,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QAC3E,SAAS,EAAE;YACT,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YACzC,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAgD;SAC7F;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA8B;IAC3D,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,cAAc,CAAC;IAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAC1D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CACtB,IAA+B,EAC/B,QAA8B;IAE9B,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;SAClG,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAA+B,EAC/B,UAA2B;IAE3B,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;YAC9H,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;SAClI,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,mBAAmB,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;YAClH,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;SACzH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,uBAAuB,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;YAC9G,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;SACrH,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/D,OAAO;YACL,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;YACpH,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;SACtH,CAAC;IACJ,CAAC;IACD,OAAO,CAAC;YACN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;SACrE,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,0BAA0B,CACxC,SAAgC,EAChC,WAAgD;IAEhD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,oBAAoB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAgC,EAAE;QAC3E,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,EAAE;YAAE,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC;SACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/nexus-cli/src/contracts/command-policy.registry.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/nexus-cli/src/contracts/command-policy.registry.test.js

@@ -0,0 +1,43 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = __importDefault(require("node:test"));
+const cli_1 = require("../cli");
+const command_contract_registry_1 = require("./command-contract.registry");
+const command_inventory_1 = require("./command-inventory");
+const command_policy_registry_1 = require("./command-policy.registry");
+(0, node_test_1.default)('policy registry covers all 280 leaves without anonymous fallback', () => {
+    const inventory = (0, command_inventory_1.buildCommandInventory)((0, cli_1.buildCliProgram)());
+    const policies = (0, command_policy_registry_1.buildCommandPolicyRegistry)(inventory, command_contract_registry_1.commandContractRegistry.all().map((entry) => entry.contract));
+    strict_1.default.equal(policies.length, 280);
+    strict_1.default.equal(new Set(policies.map((policy) => policy.commandId)).size, 280);
+    strict_1.default.equal(policies.filter((policy) => policy.source === 'v1-contract').length, 142);
+    strict_1.default.equal(policies.filter((policy) => policy.source === 'explicit-v2').length, 138);
+});
+(0, node_test_1.default)('policy registry declares canonical target and machine-output semantics', () => {
+    const inventory = (0, command_inventory_1.buildCommandInventory)((0, cli_1.buildCliProgram)());
+    const policies = (0, command_policy_registry_1.buildCommandPolicyRegistry)(inventory, command_contract_registry_1.commandContractRegistry.all().map((entry) => entry.contract));
+    for (const policy of policies) {
+        strict_1.default.ok(policy.modes.length > 0, policy.commandId);
+        for (const mode of policy.modes) {
+            strict_1.default.equal(mode.invocationPolicy.outputMode, 'dual', policy.commandId);
+            strict_1.default.deepEqual(mode.invocationPolicy.exitCodes.success, [0], policy.commandId);
+            strict_1.default.ok(mode.invocationPolicy.exitCodes.error.length > 0, policy.commandId);
+        }
+    }
+    const sourcePull = policies.find((policy) => policy.commandId === 'source.pull');
+    strict_1.default.deepEqual(sourcePull?.modes.map((mode) => [mode.modeId, mode.invocationPolicy.mutability]), [
+        ['dry-run', 'read-only'], ['apply', 'local-write'],
+    ]);
+    const packageDeprecate = policies.find((policy) => policy.commandId === 'package.deprecate');
+    strict_1.default.deepEqual(packageDeprecate?.modes.map((mode) => [mode.modeId, mode.invocationPolicy.mutability]), [
+        ['local', 'local-write'], ['remote', 'remote-write'],
+    ]);
+    const revisionHistory = policies.find((policy) => policy.commandId === 'revision.history');
+    strict_1.default.equal(revisionHistory?.modes[0]?.invocationPolicy.environmentOption, '--env');
+    strict_1.default.deepEqual(revisionHistory?.modes[0]?.invocationPolicy.environmentAliases, ['--environment']);
+});
+//# sourceMappingURL=command-policy.registry.test.js.map

package/dist/nexus-cli/src/contracts/command-policy.registry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy.registry.test.js","sourceRoot":"","sources":["../../../../src/contracts/command-policy.registry.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,0DAA6B;AAE7B,gCAAyC;AACzC,2EAAsE;AACtE,2DAA4D;AAC5D,uEAAuE;AAEvE,IAAA,mBAAI,EAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,SAAS,GAAG,IAAA,yCAAqB,EAAC,IAAA,qBAAe,GAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAA,oDAA0B,EACzC,SAAS,EACT,mDAAuB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC7D,CAAC;IACF,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,gBAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5E,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvF,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AACH,IAAA,mBAAI,EAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,SAAS,GAAG,IAAA,yCAAqB,EAAC,IAAA,qBAAe,GAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAA,oDAA0B,EACzC,SAAS,EACT,mDAAuB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC7D,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,gBAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,gBAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACzE,gBAAM,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACjF,gBAAM,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC;IACjF,gBAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE;QACjG,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC;IAC7F,gBAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE;QACvG,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;KACrD,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;IAC3F,gBAAM,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACrF,gBAAM,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,kBAAkB,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;AACtG,CAAC,CAAC,CAAC"}

package/dist/nexus-cli/src/contracts/command-policy.validator.d.ts

@@ -0,0 +1,20 @@
+import type { CliCommandInventoryV1 } from './command-inventory';
+import type { CliRegisteredCommandPolicyV2 } from './command-policy.registry';
+export declare const CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION: "nexusclaw.cli-command-policy-report/v1";
+export type CliCommandPolicyRuleId = 'COMMAND_POLICY_MISSING' | 'COMMAND_POLICY_STALE' | 'COMMAND_POLICY_DUPLICATE' | 'COMMAND_POLICY_PATH_MISMATCH' | 'COMMAND_POLICY_MODE_MISSING' | 'COMMAND_POLICY_MODE_DUPLICATE' | 'MACHINE_JSON_OPTION_MISSING' | 'DRY_RUN_OPTION_MISMATCH' | 'DRY_RUN_EXEMPTION_REQUIRED' | 'DRY_RUN_EXEMPTION_INVALID' | 'DRY_RUN_EXEMPTION_EXPIRED' | 'ENVIRONMENT_CANONICAL_OPTION_MISSING' | 'ENVIRONMENT_ALIAS_MISSING' | 'ENVIRONMENT_POLICY_MISMATCH' | 'WORKSPACE_OPTION_MISMATCH' | 'LOCAL_WORKSPACE_OPTION_MISMATCH' | 'EXIT_CODE_SUCCESS_INVALID' | 'EXIT_CODE_CLASS_OVERLAP';
+export interface CliCommandPolicyDiagnosticV1 {
+    readonly ruleId: CliCommandPolicyRuleId;
+    readonly commandId: string;
+    readonly modeId?: string;
+    readonly message: string;
+}
+export interface CliCommandPolicyReportV1 {
+    readonly schemaVersion: typeof CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION;
+    readonly ok: boolean;
+    readonly inventoryCount: number;
+    readonly policyCount: number;
+    readonly modeCount: number;
+    readonly diagnostics: ReadonlyArray<CliCommandPolicyDiagnosticV1>;
+}
+export declare function validateCommandPolicyRegistry(inventory: CliCommandInventoryV1, policies: ReadonlyArray<CliRegisteredCommandPolicyV2>, today?: string): CliCommandPolicyReportV1;
+export declare function assertCommandPolicyRegistryConforms(inventory: CliCommandInventoryV1, policies: ReadonlyArray<CliRegisteredCommandPolicyV2>, today?: string): void;

package/dist/nexus-cli/src/contracts/command-policy.validator.js

@@ -0,0 +1,179 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION = void 0;
+exports.validateCommandPolicyRegistry = validateCommandPolicyRegistry;
+exports.assertCommandPolicyRegistryConforms = assertCommandPolicyRegistryConforms;
+exports.CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION = 'nexusclaw.cli-command-policy-report/v1';
+function optionSet(options) {
+    return new Set(options.flatMap((option) => option.long ? [option.long] : []));
+}
+function overlap(...classes) {
+    const seen = new Set();
+    const duplicated = new Set();
+    for (const values of classes) {
+        for (const value of values) {
+            if (seen.has(value))
+                duplicated.add(value);
+            seen.add(value);
+        }
+    }
+    return [...duplicated].sort((left, right) => left - right);
+}
+function diagnosticSortKey(diagnostic) {
+    return [diagnostic.commandId, diagnostic.modeId ?? '', diagnostic.ruleId].join('\u0000');
+}
+function validateCommandPolicyRegistry(inventory, policies, today = new Date().toISOString().slice(0, 10)) {
+    const diagnostics = [];
+    const leaves = new Map(inventory.leaves.map((leaf) => [leaf.commandId, leaf]));
+    const policyIds = new Set();
+    for (const policy of policies) {
+        if (policyIds.has(policy.commandId)) {
+            diagnostics.push({
+                ruleId: 'COMMAND_POLICY_DUPLICATE', commandId: policy.commandId,
+                message: 'More than one policy is registered for this command id.',
+            });
+            continue;
+        }
+        policyIds.add(policy.commandId);
+        const leaf = leaves.get(policy.commandId);
+        if (!leaf) {
+            diagnostics.push({
+                ruleId: 'COMMAND_POLICY_STALE', commandId: policy.commandId,
+                message: 'Policy has no executable Commander leaf.',
+            });
+            continue;
+        }
+        if (leaf.path !== policy.path) {
+            diagnostics.push({
+                ruleId: 'COMMAND_POLICY_PATH_MISMATCH', commandId: policy.commandId,
+                message: `Inventory path '${leaf.path}' differs from policy path '${policy.path}'.`,
+            });
+        }
+        if (policy.modes.length === 0) {
+            diagnostics.push({
+                ruleId: 'COMMAND_POLICY_MODE_MISSING', commandId: policy.commandId,
+                message: 'Command policy declares no executable mode.',
+            });
+            continue;
+        }
+        const options = optionSet(leaf.options);
+        const modeIds = new Set();
+        for (const mode of policy.modes) {
+            if (modeIds.has(mode.modeId)) {
+                diagnostics.push({
+                    ruleId: 'COMMAND_POLICY_MODE_DUPLICATE', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Mode id is duplicated within the command policy.',
+                });
+                continue;
+            }
+            modeIds.add(mode.modeId);
+            const invocation = mode.invocationPolicy;
+            if (invocation.outputMode !== 'human' && !options.has('--json')) {
+                diagnostics.push({
+                    ruleId: 'MACHINE_JSON_OPTION_MISSING', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Machine-capable mode has no effective --json option.',
+                });
+            }
+            if (invocation.supportsDryRun !== options.has('--dry-run')) {
+                diagnostics.push({
+                    ruleId: 'DRY_RUN_OPTION_MISMATCH', commandId: policy.commandId,
+                    modeId: mode.modeId,
+                    message: `supportsDryRun=${invocation.supportsDryRun} but Commander --dry-run presence=${options.has('--dry-run')}.`,
+                });
+            }
+            if (invocation.mutability !== 'read-only' && !invocation.supportsDryRun && !invocation.dryRunExemption) {
+                diagnostics.push({
+                    ruleId: 'DRY_RUN_EXEMPTION_REQUIRED', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Write mode requires --dry-run or a reviewed exemption.',
+                });
+            }
+            if (invocation.mutability === 'read-only' && invocation.dryRunExemption) {
+                diagnostics.push({
+                    ruleId: 'DRY_RUN_EXEMPTION_INVALID', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Read-only mode cannot carry a dry-run exemption.',
+                });
+            }
+            if (invocation.dryRunExemption && invocation.dryRunExemption.expiresOn < today) {
+                diagnostics.push({
+                    ruleId: 'DRY_RUN_EXEMPTION_EXPIRED', commandId: policy.commandId,
+                    modeId: mode.modeId,
+                    message: `Dry-run exemption expired on ${invocation.dryRunExemption.expiresOn}.`,
+                });
+            }
+            if (invocation.environmentOption === '--env' && !options.has('--env')) {
+                diagnostics.push({
+                    ruleId: 'ENVIRONMENT_CANONICAL_OPTION_MISSING', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Policy requires canonical --env but Commander does not declare it.',
+                });
+            }
+            for (const alias of invocation.environmentAliases) {
+                if (!options.has(alias)) {
+                    diagnostics.push({
+                        ruleId: 'ENVIRONMENT_ALIAS_MISSING', commandId: policy.commandId,
+                        modeId: mode.modeId, message: `Declared environment alias '${alias}' is missing.`,
+                    });
+                }
+            }
+            if (invocation.environmentOption === null && (options.has('--env') || options.has('--environment'))) {
+                diagnostics.push({
+                    ruleId: 'ENVIRONMENT_POLICY_MISMATCH', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Commander declares an environment selector but policy declares none.',
+                });
+            }
+            if ((invocation.workspaceOption === '--workspace-id') !== options.has('--workspace-id')) {
+                diagnostics.push({
+                    ruleId: 'WORKSPACE_OPTION_MISMATCH', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Remote workspace option policy and Commander differ.',
+                });
+            }
+            if ((invocation.localWorkspaceOption === '--workspace') !== options.has('--workspace')) {
+                diagnostics.push({
+                    ruleId: 'LOCAL_WORKSPACE_OPTION_MISMATCH', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Local workspace option policy and Commander differ.',
+                });
+            }
+            if (!invocation.exitCodes.success.includes(0) || invocation.exitCodes.success.some((code) => code !== 0)) {
+                diagnostics.push({
+                    ruleId: 'EXIT_CODE_SUCCESS_INVALID', commandId: policy.commandId,
+                    modeId: mode.modeId, message: 'Success exit-code class must contain only exit 0.',
+                });
+            }
+            const duplicatedExitCodes = overlap(invocation.exitCodes.success, invocation.exitCodes.warning, invocation.exitCodes.error);
+            if (duplicatedExitCodes.length > 0) {
+                diagnostics.push({
+                    ruleId: 'EXIT_CODE_CLASS_OVERLAP', commandId: policy.commandId,
+                    modeId: mode.modeId,
+                    message: `Exit codes appear in multiple classes: ${duplicatedExitCodes.join(', ')}.`,
+                });
+            }
+        }
+    }
+    for (const leaf of inventory.leaves) {
+        if (!policyIds.has(leaf.commandId)) {
+            diagnostics.push({
+                ruleId: 'COMMAND_POLICY_MISSING', commandId: leaf.commandId,
+                message: 'Executable Commander leaf has no command policy.',
+            });
+        }
+    }
+    diagnostics.sort((left, right) => diagnosticSortKey(left).localeCompare(diagnosticSortKey(right)));
+    return {
+        schemaVersion: exports.CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION,
+        ok: diagnostics.length === 0,
+        inventoryCount: inventory.leaves.length,
+        policyCount: policies.length,
+        modeCount: policies.reduce((count, policy) => count + policy.modes.length, 0),
+        diagnostics,
+    };
+}
+function assertCommandPolicyRegistryConforms(inventory, policies, today) {
+    const report = validateCommandPolicyRegistry(inventory, policies, today);
+    if (!report.ok) {
+        const summary = report.diagnostics
+            .slice(0, 10)
+            .map((entry) => `${entry.commandId}${entry.modeId ? `#${entry.modeId}` : ''}:${entry.ruleId}`)
+            .join(', ');
+        throw new Error(`CLI_COMMAND_POLICY_NONCOMPLIANT: ${report.diagnostics.length} issue(s): ${summary}`);
+    }
+}
+//# sourceMappingURL=command-policy.validator.js.map

package/dist/nexus-cli/src/contracts/command-policy.validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy.validator.js","sourceRoot":"","sources":["../../../../src/contracts/command-policy.validator.ts"],"names":[],"mappings":";;;AAqEA,sEA6JC;AAED,kFAaC;AA5OY,QAAA,wCAAwC,GACnD,wCAAiD,CAAC;AAqCpD,SAAS,SAAS,CAAC,OAA+C;IAChE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,OAAO,CACd,GAAG,OAAkD;IAErD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAe,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAwC;IACjE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3F,CAAC;AAMD,SAAgB,6BAA6B,CAC3C,SAAgC,EAChC,QAAqD,EACrD,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;IAE7C,MAAM,WAAW,GAAmC,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC/D,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3D,OAAO,EAAE,0CAA0C;aACpD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;gBACnE,OAAO,EAAE,mBAAmB,IAAI,CAAC,IAAI,+BAA+B,MAAM,CAAC,IAAI,IAAI;aACpF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAClE,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBACpE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,kDAAkD;iBACjF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC;YAEzC,IAAI,UAAU,CAAC,UAAU,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChE,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAClE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,sDAAsD;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,CAAC,cAAc,KAAK,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3D,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,kBAAkB,UAAU,CAAC,cAAc,qCAAqC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG;iBACrH,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;gBACvG,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBACjE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,wDAAwD;iBACvF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;gBACxE,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAChE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,kDAAkD;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,CAAC,eAAe,IAAI,UAAU,CAAC,eAAe,CAAC,SAAS,GAAG,KAAK,EAAE,CAAC;gBAC/E,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAChE,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,gCAAgC,UAAU,CAAC,eAAe,CAAC,SAAS,GAAG;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,UAAU,CAAC,iBAAiB,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtE,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,sCAAsC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,oEAAoE;iBACnG,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;gBAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxB,WAAW,CAAC,IAAI,CAAC;wBACf,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;wBAChE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,+BAA+B,KAAK,eAAe;qBAClF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;gBACpG,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAClE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,sEAAsE;iBACrG,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,eAAe,KAAK,gBAAgB,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACxF,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAChE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,sDAAsD;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,oBAAoB,KAAK,aAAa,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBACvF,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBACtE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,qDAAqD;iBACpF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;gBACzG,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAChE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,mDAAmD;iBAClF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,mBAAmB,GAAG,OAAO,CACjC,UAAU,CAAC,SAAS,CAAC,OAAO,EAC5B,UAAU,CAAC,SAAS,CAAC,OAAO,EAC5B,UAAU,CAAC,SAAS,CAAC,KAAK,CAC3B,CAAC;YACF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,0CAA0C,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,WAAW,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;gBAC3D,OAAO,EAAE,kDAAkD;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO;QACL,aAAa,EAAE,gDAAwC;QACvD,EAAE,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;QAC5B,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;QACvC,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAgB,mCAAmC,CACjD,SAAgC,EAChC,QAAqD,EACrD,KAAc;IAEd,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW;aAC/B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACZ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;aAC7F,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,WAAW,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAC;IACxG,CAAC;AACH,CAAC"}

package/dist/nexus-cli/src/contracts/command-policy.validator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/nexus-cli/src/contracts/command-policy.validator.test.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = __importDefault(require("node:test"));
+const commander_1 = require("commander");
+const cli_1 = require("../cli");
+const command_contract_registry_1 = require("./command-contract.registry");
+const command_inventory_1 = require("./command-inventory");
+const command_policy_registry_1 = require("./command-policy.registry");
+const command_policy_validator_1 = require("./command-policy.validator");
+(0, node_test_1.default)('validator accepts the complete registry with explicit current dry-run exemptions', () => {
+    const inventory = (0, command_inventory_1.buildCommandInventory)((0, cli_1.buildCliProgram)());
+    const policies = (0, command_policy_registry_1.buildCommandPolicyRegistry)(inventory, command_contract_registry_1.commandContractRegistry.all().map((entry) => entry.contract));
+    const report = (0, command_policy_validator_1.validateCommandPolicyRegistry)(inventory, policies, '2026-08-02');
+    strict_1.default.equal(report.inventoryCount, 280);
+    strict_1.default.equal(report.policyCount, 280);
+    strict_1.default.equal(report.ok, true);
+    const rules = new Set(report.diagnostics.map((entry) => entry.ruleId));
+    strict_1.default.equal(rules.has('DRY_RUN_EXEMPTION_REQUIRED'), false);
+    strict_1.default.equal(rules.has('ENVIRONMENT_CANONICAL_OPTION_MISSING'), false);
+    strict_1.default.equal(rules.has('COMMAND_POLICY_MISSING'), false);
+    strict_1.default.equal(rules.has('COMMAND_POLICY_STALE'), false);
+    strict_1.default.doesNotThrow(() => (0, command_policy_validator_1.assertCommandPolicyRegistryConforms)(inventory, policies, '2026-08-02'));
+    const exemptions = policies.flatMap((policy) => policy.modes)
+        .filter((mode) => mode.invocationPolicy.dryRunExemption);
+    strict_1.default.equal(exemptions.length, 161);
+    strict_1.default.equal(exemptions.every((mode) => mode.invocationPolicy.dryRunExemption?.expiresOn === '2026-09-30'), true);
+    strict_1.default.throws(() => (0, command_policy_validator_1.assertCommandPolicyRegistryConforms)(inventory, policies, '2026-10-01'), /DRY_RUN_EXEMPTION_EXPIRED/);
+});
+(0, node_test_1.default)('validator accepts a fully aligned synthetic leaf and policy', () => {
+    const root = new commander_1.Command('nexus').option('--json');
+    root.command('thing').option('--env <name>').option('--environment <name>').option('--workspace-id <id>');
+    const inventory = (0, command_inventory_1.buildCommandInventory)(root);
+    const policies = [{
+            commandId: 'thing', path: 'thing', source: 'explicit-v2', modes: [{
+                    modeId: 'default', selection: 'always', invocationPolicy: {
+                        outputMode: 'dual', mutability: 'read-only', supportsDryRun: false,
+                        environmentOption: '--env', environmentAliases: ['--environment'],
+                        workspaceOption: '--workspace-id', localWorkspaceOption: null,
+                        exitCodes: { success: [0], warning: [], error: [1, 64, 70] },
+                    },
+                }],
+        }];
+    const report = (0, command_policy_validator_1.validateCommandPolicyRegistry)(inventory, policies, '2026-08-02');
+    strict_1.default.equal(report.ok, true);
+    strict_1.default.deepEqual(report.diagnostics, []);
+    strict_1.default.doesNotThrow(() => (0, command_policy_validator_1.assertCommandPolicyRegistryConforms)(inventory, policies, '2026-08-02'));
+});
+(0, node_test_1.default)('validator detects missing/stale policies and invalid exit classification', () => {
+    const root = new commander_1.Command('nexus').option('--json');
+    root.command('present');
+    const inventory = (0, command_inventory_1.buildCommandInventory)(root);
+    const policies = [{
+            commandId: 'stale', path: 'stale', source: 'explicit-v2', modes: [{
+                    modeId: 'default', selection: 'always', invocationPolicy: {
+                        outputMode: 'dual', mutability: 'read-only', supportsDryRun: false,
+                        environmentOption: null, environmentAliases: [], workspaceOption: null,
+                        localWorkspaceOption: null,
+                        exitCodes: { success: [0, 1], warning: [1], error: [1] },
+                    },
+                }],
+        }];
+    const rules = (0, command_policy_validator_1.validateCommandPolicyRegistry)(inventory, policies).diagnostics.map((entry) => entry.ruleId);
+    strict_1.default.equal(rules.includes('COMMAND_POLICY_MISSING'), true);
+    strict_1.default.equal(rules.includes('COMMAND_POLICY_STALE'), true);
+});
+//# sourceMappingURL=command-policy.validator.test.js.map

package/dist/nexus-cli/src/contracts/command-policy.validator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy.validator.test.js","sourceRoot":"","sources":["../../../../src/contracts/command-policy.validator.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,0DAA6B;AAC7B,yCAAoC;AAEpC,gCAAyC;AACzC,2EAAsE;AACtE,2DAA4D;AAC5D,uEAA0G;AAC1G,yEAAgH;AAEhH,IAAA,mBAAI,EAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,SAAS,GAAG,IAAA,yCAAqB,EAAC,IAAA,qBAAe,GAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAA,oDAA0B,EAAC,SAAS,EAAE,mDAAuB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,IAAA,wDAA6B,EAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAChF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACzC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACtC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,gBAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAA,8DAAmC,EAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;SAC1D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3D,gBAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,gBAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,SAAS,KAAK,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAClH,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,8DAAmC,EAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC3H,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,IAAI,GAAG,IAAI,mBAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAG,IAAA,yCAAqB,EAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAmC,CAAC;YAChD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;oBAChE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE;wBACxD,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK;wBAClE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,eAAe,CAAC;wBACjE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,IAAI;wBAC7D,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE;qBAC7D;iBACF,CAAC;SACH,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAA,wDAA6B,EAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAChF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9B,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzC,gBAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAA,8DAAmC,EAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,IAAI,GAAG,IAAI,mBAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,SAAS,GAAG,IAAA,yCAAqB,EAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAmC,CAAC;YAChD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;oBAChE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE;wBACxD,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK;wBAClE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI;wBACtE,oBAAoB,EAAE,IAAI;wBAC1B,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;qBACzD;iBACF,CAAC;SACH,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAA,wDAA6B,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1G,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC"}

package/dist/nexus-cli/src/contracts/index.d.ts

@@ -5,4 +5,11 @@ export { exportCommandContracts, type CliCommandRegistryExportV1, } from './comm
 export { buildImplementedCommandOrder } from './command-order';
 export { SAFE_LOCAL_PERMISSION_FACTS, AUTHORITATIVE_SERVER_PERMISSION_FACTS, assertModeGovernance, assertCommandContractGovernance, } from './command-contract.guard';
 export { buildCliResult, renderCliResult, emitCliResult, scrubMachineValue, type CliMachineOutputStreams, } from './machine-result';
+export { buildCommandInventory, CLI_COMMAND_INVENTORY_SCHEMA_VERSION, type CliCommandInventoryArgumentV1, type CliCommandInventoryOptionV1, type CliCommandInventoryLeafV1, type CliCommandInventoryV1, } from './command-inventory';
+export { buildCommandPolicyRegistry, type CliRegisteredModePolicyV2, type CliRegisteredCommandPolicyV2, } from './command-policy.registry';
+export { validateCommandPolicyRegistry, assertCommandPolicyRegistryConforms, CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION, type CliCommandPolicyRuleId, type CliCommandPolicyDiagnosticV1, type CliCommandPolicyReportV1, } from './command-policy.validator';
+export { exportCommandPolicyRegistryV2, type CliCommandPolicyRegistryEntryV2, type CliCommandPolicyRegistryExportV2, } from './command-policy.exporter';
+export { buildCommandContractMatrixReport, assertCommandContractMatrixComplete, matrixScenarioId, buildPreDispatchFailureScenarioManifest, buildControlledTerminalScenarioManifest, CLI_COMMAND_CONTRACT_MATRIX_REPORT_SCHEMA_VERSION, type CliMatrixScenarioKind, type CliMatrixCoverageStatus, type CliMatrixScenarioFixtureV1, type CliMatrixScenarioDeclarationV1, type CliMatrixScenarioManifestV1, type CliMatrixCoverageEntryV1, type CliCommandContractMatrixReportV1, } from './command-contract-matrix';
+export { executeCliMatrixScenario, buildControlledTerminalProgram, type CliMatrixControlledAdapter, type CliMatrixExecutionOptions, type CliMatrixExecutionEvidence, } from './command-contract-matrix.runner';
+export { controlledDryRunScenarioManifest } from './command-contract-matrix.scenarios';
 export { resolveExitCode, EXIT_PRECEDENCE, } from './exit-codes';

package/dist/nexus-cli/src/contracts/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXIT_PRECEDENCE = exports.resolveExitCode = exports.scrubMachineValue = exports.emitCliResult = exports.renderCliResult = exports.buildCliResult = exports.assertCommandContractGovernance = exports.assertModeGovernance = exports.AUTHORITATIVE_SERVER_PERMISSION_FACTS = exports.SAFE_LOCAL_PERMISSION_FACTS = exports.buildImplementedCommandOrder = exports.exportCommandContracts = exports.resolveExecutionMode = exports.evaluateArgvPredicate = exports.validateArgvPredicate = exports.CLI_MODE_USAGE_EXIT = exports.CLI_MODE_AMBIGUOUS = exports.CLI_MODE_UNMATCHED = exports.commandContractRegistry = exports.resolveInternalDispatch = exports.CLI_COMMAND_NOT_IMPLEMENTED = exports.hasImplementedMode = exports.implementedModesOf = void 0;
+exports.EXIT_PRECEDENCE = exports.resolveExitCode = exports.controlledDryRunScenarioManifest = exports.buildControlledTerminalProgram = exports.executeCliMatrixScenario = exports.CLI_COMMAND_CONTRACT_MATRIX_REPORT_SCHEMA_VERSION = exports.buildControlledTerminalScenarioManifest = exports.buildPreDispatchFailureScenarioManifest = exports.matrixScenarioId = exports.assertCommandContractMatrixComplete = exports.buildCommandContractMatrixReport = exports.exportCommandPolicyRegistryV2 = exports.CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION = exports.assertCommandPolicyRegistryConforms = exports.validateCommandPolicyRegistry = exports.buildCommandPolicyRegistry = exports.CLI_COMMAND_INVENTORY_SCHEMA_VERSION = exports.buildCommandInventory = exports.scrubMachineValue = exports.emitCliResult = exports.renderCliResult = exports.buildCliResult = exports.assertCommandContractGovernance = exports.assertModeGovernance = exports.AUTHORITATIVE_SERVER_PERMISSION_FACTS = exports.SAFE_LOCAL_PERMISSION_FACTS = exports.buildImplementedCommandOrder = exports.exportCommandContracts = exports.resolveExecutionMode = exports.evaluateArgvPredicate = exports.validateArgvPredicate = exports.CLI_MODE_USAGE_EXIT = exports.CLI_MODE_AMBIGUOUS = exports.CLI_MODE_UNMATCHED = exports.commandContractRegistry = exports.resolveInternalDispatch = exports.CLI_COMMAND_NOT_IMPLEMENTED = exports.hasImplementedMode = exports.implementedModesOf = void 0;
 var command_contract_1 = require("./command-contract");
 Object.defineProperty(exports, "implementedModesOf", { enumerable: true, get: function () { return command_contract_1.implementedModesOf; } });
 Object.defineProperty(exports, "hasImplementedMode", { enumerable: true, get: function () { return command_contract_1.hasImplementedMode; } });
@@ -29,6 +29,29 @@ Object.defineProperty(exports, "buildCliResult", { enumerable: true, get: functi
 Object.defineProperty(exports, "renderCliResult", { enumerable: true, get: function () { return machine_result_1.renderCliResult; } });
 Object.defineProperty(exports, "emitCliResult", { enumerable: true, get: function () { return machine_result_1.emitCliResult; } });
 Object.defineProperty(exports, "scrubMachineValue", { enumerable: true, get: function () { return machine_result_1.scrubMachineValue; } });
+var command_inventory_1 = require("./command-inventory");
+Object.defineProperty(exports, "buildCommandInventory", { enumerable: true, get: function () { return command_inventory_1.buildCommandInventory; } });
+Object.defineProperty(exports, "CLI_COMMAND_INVENTORY_SCHEMA_VERSION", { enumerable: true, get: function () { return command_inventory_1.CLI_COMMAND_INVENTORY_SCHEMA_VERSION; } });
+var command_policy_registry_1 = require("./command-policy.registry");
+Object.defineProperty(exports, "buildCommandPolicyRegistry", { enumerable: true, get: function () { return command_policy_registry_1.buildCommandPolicyRegistry; } });
+var command_policy_validator_1 = require("./command-policy.validator");
+Object.defineProperty(exports, "validateCommandPolicyRegistry", { enumerable: true, get: function () { return command_policy_validator_1.validateCommandPolicyRegistry; } });
+Object.defineProperty(exports, "assertCommandPolicyRegistryConforms", { enumerable: true, get: function () { return command_policy_validator_1.assertCommandPolicyRegistryConforms; } });
+Object.defineProperty(exports, "CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION", { enumerable: true, get: function () { return command_policy_validator_1.CLI_COMMAND_POLICY_REPORT_SCHEMA_VERSION; } });
+var command_policy_exporter_1 = require("./command-policy.exporter");
+Object.defineProperty(exports, "exportCommandPolicyRegistryV2", { enumerable: true, get: function () { return command_policy_exporter_1.exportCommandPolicyRegistryV2; } });
+var command_contract_matrix_1 = require("./command-contract-matrix");
+Object.defineProperty(exports, "buildCommandContractMatrixReport", { enumerable: true, get: function () { return command_contract_matrix_1.buildCommandContractMatrixReport; } });
+Object.defineProperty(exports, "assertCommandContractMatrixComplete", { enumerable: true, get: function () { return command_contract_matrix_1.assertCommandContractMatrixComplete; } });
+Object.defineProperty(exports, "matrixScenarioId", { enumerable: true, get: function () { return command_contract_matrix_1.matrixScenarioId; } });
+Object.defineProperty(exports, "buildPreDispatchFailureScenarioManifest", { enumerable: true, get: function () { return command_contract_matrix_1.buildPreDispatchFailureScenarioManifest; } });
+Object.defineProperty(exports, "buildControlledTerminalScenarioManifest", { enumerable: true, get: function () { return command_contract_matrix_1.buildControlledTerminalScenarioManifest; } });
+Object.defineProperty(exports, "CLI_COMMAND_CONTRACT_MATRIX_REPORT_SCHEMA_VERSION", { enumerable: true, get: function () { return command_contract_matrix_1.CLI_COMMAND_CONTRACT_MATRIX_REPORT_SCHEMA_VERSION; } });
+var command_contract_matrix_runner_1 = require("./command-contract-matrix.runner");
+Object.defineProperty(exports, "executeCliMatrixScenario", { enumerable: true, get: function () { return command_contract_matrix_runner_1.executeCliMatrixScenario; } });
+Object.defineProperty(exports, "buildControlledTerminalProgram", { enumerable: true, get: function () { return command_contract_matrix_runner_1.buildControlledTerminalProgram; } });
+var command_contract_matrix_scenarios_1 = require("./command-contract-matrix.scenarios");
+Object.defineProperty(exports, "controlledDryRunScenarioManifest", { enumerable: true, get: function () { return command_contract_matrix_scenarios_1.controlledDryRunScenarioManifest; } });
 var exit_codes_1 = require("./exit-codes");
 Object.defineProperty(exports, "resolveExitCode", { enumerable: true, get: function () { return exit_codes_1.resolveExitCode; } });
 Object.defineProperty(exports, "EXIT_PRECEDENCE", { enumerable: true, get: function () { return exit_codes_1.EXIT_PRECEDENCE; } });