@open-agent-toolkit/cli 0.2.65 → 0.2.66

package/dist/commands/pjm/remote/index.js

@@ -0,0 +1,280 @@
+import { resolve } from 'node:path';
+import { buildCommandContext } from '../../../app/command-context.js';
+import { readGlobalOptions } from '../../shared/shared.utils.js';
+import { resolveProjectRoot } from '../../../fs/paths.js';
+import { Command } from 'commander';
+import { resolvePjmAdoption } from '../adoption.js';
+import { renderRemoteCommand } from './output.js';
+import { createProductionRemoteRunner } from './service.js';
+const DEFAULT_DEPENDENCIES = {
+    resolveProjectRoot,
+    async checkAdoption(projectRoot) {
+        const adoption = await resolvePjmAdoption({
+            projectRoot,
+            repoRoot: resolve(projectRoot, '.oat', 'repo'),
+        });
+        return adoption.state === 'declared' || adoption.state === 'inferred-legacy'
+            ? 'complete'
+            : adoption.state === 'partial-initialization'
+                ? 'partial'
+                : 'absent';
+    },
+    run: createProductionRemoteRunner(),
+};
+export function createPjmRemoteCommand(overrides = {}) {
+    const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
+    const remote = new Command('remote').description('Manage explicit provider-neutral remote project lifecycle operations');
+    remote
+        .command('intake <provider-ref>')
+        .description('Intake a remote issue into a local backlog target')
+        .requiredOption('--to-backlog <id>', 'Local backlog item ID')
+        .option('--capability-evidence-stdin', 'Read one sanitized live capability evidence object from stdin')
+        .action(async (providerRef, options, command) => {
+        await execute({
+            operation: 'intake',
+            providerRef,
+            backlogId: options.toBacklog,
+            capabilityEvidenceStdin: options.capabilityEvidenceStdin,
+        }, command, dependencies);
+    });
+    addBindingCommand(remote, 'publish', 'Publish one selected remote binding', dependencies);
+    remote
+        .command('closeout')
+        .description('Review and close out every eligible binding for one project')
+        .requiredOption('--project <path>', 'Local OAT project path')
+        .option('--apply-preview <batch-id>', 'Apply one approved composite substep')
+        .option('--capability-evidence-stdin', 'Read current host capability evidence')
+        .option('--authority-evidence-file <path>', 'Read bounded caller authority evidence')
+        .action(async (options, command) => {
+        await execute({
+            operation: 'closeout',
+            projectPath: options.project,
+            previewOperationId: options.applyPreview,
+            capabilityEvidenceStdin: options.capabilityEvidenceStdin,
+            authorityEvidenceFile: options.authorityEvidenceFile,
+        }, command, dependencies);
+    });
+    remote
+        .command('discussion')
+        .description('Read bounded remote discussion as non-persisted evidence')
+        .requiredOption('--binding <id>', 'Remote binding ID')
+        .requiredOption('--limit <count>', 'Maximum evidence items', parseCount)
+        .option('--capability-evidence-stdin', 'Read one sanitized live capability evidence object from stdin')
+        .action(async (options, command) => {
+        await execute({
+            operation: 'discussion',
+            bindingId: options.binding,
+            discussionLimit: options.limit,
+            capabilityEvidenceStdin: options.capabilityEvidenceStdin,
+        }, command, dependencies);
+    });
+    const resolveCommand = remote
+        .command('resolve')
+        .description('Resolve a remote binding anomaly with fresh approval');
+    resolveCommand
+        .command('relink <provider-ref>')
+        .requiredOption('--binding <id>', 'Remote binding ID')
+        .option('--apply-preview <operation-id>', 'Apply an exact approved preview')
+        .option('--capability-evidence-stdin', 'Read current host capability evidence')
+        .option('--authority-evidence-file <path>', 'Read bounded caller authority evidence')
+        .action(async (providerRef, options, command) => {
+        await execute({
+            operation: 'resolve',
+            resolutionKind: 'relink',
+            bindingId: options.binding,
+            providerRef,
+            previewOperationId: options.applyPreview,
+            capabilityEvidenceStdin: options.capabilityEvidenceStdin,
+            authorityEvidenceFile: options.authorityEvidenceFile,
+        }, command, dependencies);
+    });
+    remote
+        .command('doctor')
+        .description('Diagnose local remote-binding state without provider contact')
+        .option('--capability-evidence-stdin', 'Read one sanitized current host capability evidence object from stdin')
+        .action(async (options, command) => {
+        await execute({
+            operation: 'doctor',
+            capabilityEvidenceStdin: options.capabilityEvidenceStdin,
+        }, command, dependencies);
+    });
+    remote
+        .command('migrate')
+        .description('Check or apply an approved local-only remote migration')
+        .option('--check', 'Preview local migration candidates')
+        .option('--apply', 'Apply an exact approved local migration')
+        .option('--approval-digest <digest>', 'Approved check preview digest')
+        .action(async (options, command) => {
+        if (Boolean(options.check) === Boolean(options.apply)) {
+            throw new Error('Remote migrate requires exactly one of --check or --apply.');
+        }
+        await execute({
+            operation: 'migrate',
+            migrationMode: options.apply ? 'apply' : 'check',
+            migrationApprovalDigest: options.approvalDigest,
+        }, command, dependencies);
+    });
+    resolveCommand
+        .command('detach')
+        .requiredOption('--binding <id>', 'Remote binding ID')
+        .option('--apply-preview <operation-id>', 'Apply an exact approved preview')
+        .option('--authority-evidence-file <path>', 'Read bounded caller authority evidence')
+        .action(async (options, command) => {
+        await execute({
+            operation: 'resolve',
+            resolutionKind: 'detach',
+            bindingId: options.binding,
+            previewOperationId: options.applyPreview,
+            authorityEvidenceFile: options.authorityEvidenceFile,
+        }, command, dependencies);
+    });
+    resolveCommand
+        .command('recreate')
+        .requiredOption('--binding <id>', 'Remote binding ID')
+        .option('--apply-preview <operation-id>', 'Apply an exact approved preview')
+        .option('--capability-evidence-stdin', 'Read current host capability evidence')
+        .option('--authority-evidence-file <path>', 'Read bounded caller authority evidence')
+        .action(async (options, command) => {
+        await execute({
+            operation: 'resolve',
+            resolutionKind: 'recreate',
+            bindingId: options.binding,
+            previewOperationId: options.applyPreview,
+            capabilityEvidenceStdin: options.capabilityEvidenceStdin,
+            authorityEvidenceFile: options.authorityEvidenceFile,
+        }, command, dependencies);
+    });
+    addBindingCommand(remote, 'refresh', 'Refresh one remote binding without mutation', dependencies);
+    addBindingCommand(remote, 'reconcile', 'Reconcile one remote binding', dependencies);
+    remote
+        .command('storage')
+        .description('Preview or apply shared operational storage')
+        .command('shared')
+        .requiredOption('--repository-fingerprint <digest>')
+        .requiredOption('--config-target <path>')
+        .requiredOption('--current-mode <mode>')
+        .requiredOption('--proposed-path <paths...>')
+        .option('--apply')
+        .option('--approval-digest <digest>')
+        .action(async (options, command) => {
+        if (options.apply && !options.approvalDigest) {
+            throw new Error('Applying shared storage requires preview approval evidence.');
+        }
+        await execute({
+            operation: 'storage-transition',
+            storage: {
+                repositoryFingerprint: options.repositoryFingerprint,
+                configTarget: options.configTarget,
+                currentMode: options.currentMode,
+                proposedPaths: options.proposedPath,
+                apply: options.apply ?? false,
+            },
+            storageApprovalDigest: options.approvalDigest,
+        }, command, dependencies);
+    });
+    remote
+        .command('operation')
+        .description('Continue a durable remote operation')
+        .command('continue')
+        .requiredOption('--operation <id>', 'Operation ID')
+        .option('--observation-stdin', 'Read one sanitized observation from stdin; omit only to resume a durable create-action handoff')
+        .option('--authority-evidence-file <path>', 'Re-read one bounded caller-owned mutation authority record')
+        .action(async (options, command) => {
+        await execute({
+            operation: 'operation-continue',
+            operationId: options.operation,
+            observationStdin: Boolean(options.observationStdin),
+            authorityEvidenceFile: options.authorityEvidenceFile,
+        }, command, dependencies);
+    });
+    return remote;
+}
+function parseCount(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 100) {
+        throw new Error('Expected an integer from 1 to 100.');
+    }
+    return parsed;
+}
+function addBindingCommand(parent, name, description, dependencies) {
+    const command = parent.command(name).description(description);
+    if (name === 'publish') {
+        command
+            .option('--binding <id>', 'Existing remote binding ID')
+            .option('--provider <provider>', 'Provider for a new remote issue')
+            .option('--to-backlog <id>', 'Local backlog item to publish')
+            .option('--to-project <path-or-id>', 'Local project path or unambiguous project ID to publish')
+            .option('--project-publication-file <path>', 'Explicit normalized project publication JSON');
+    }
+    else {
+        command.requiredOption('--binding <id>', 'Remote binding ID');
+    }
+    command.option('--capability-evidence-stdin', 'Read one sanitized live capability evidence object from stdin');
+    if (name !== 'refresh') {
+        command.option('--authority-evidence-file <path>', 'Read one bounded caller-owned mutation authority record');
+        command.option('--apply-preview <operation-id>', 'Apply one exact persisted user-approved preview');
+    }
+    command.action(async (options, commander) => {
+        const createTargets = [options.toBacklog, options.toProject].filter(Boolean);
+        if (name === 'publish') {
+            const usesBinding = Boolean(options.binding);
+            const usesCreateTarget = createTargets.length > 0;
+            if (usesBinding === usesCreateTarget || createTargets.length > 1) {
+                throw new Error('Publish requires exactly one existing binding or one local create target.');
+            }
+            if (usesCreateTarget && !options.provider) {
+                throw new Error('Publishing an unbound target requires a provider.');
+            }
+            if (usesBinding && options.provider) {
+                throw new Error('Provider is only valid for an unbound publish target.');
+            }
+            if (options.toProject && !options.projectPublicationFile) {
+                throw new Error('Publishing a project requires --project-publication-file.');
+            }
+            if (!options.toProject && options.projectPublicationFile) {
+                throw new Error('--project-publication-file is only valid with --to-project.');
+            }
+        }
+        const request = {
+            operation: name,
+            bindingId: options.binding,
+            capabilityEvidenceStdin: Boolean(options.capabilityEvidenceStdin),
+            authorityEvidenceFile: options.authorityEvidenceFile,
+            previewOperationId: options.applyPreview,
+        };
+        if (options.toBacklog || options.toProject) {
+            request.createTarget = {
+                provider: options.provider,
+                localKind: options.toBacklog ? 'backlog' : 'project',
+                localId: (options.toBacklog ?? options.toProject),
+                publicationFile: options.projectPublicationFile,
+            };
+        }
+        await execute(request, commander, dependencies);
+    });
+}
+async function execute(request, command, dependencies) {
+    const context = buildCommandContext(readGlobalOptions(command));
+    try {
+        const projectRoot = await dependencies.resolveProjectRoot(context.cwd);
+        const adoption = await dependencies.checkAdoption(projectRoot);
+        if (adoption !== 'complete') {
+            throw new Error(`PJM adoption is ${adoption}; run oat pjm init before remote operations.`);
+        }
+        const envelope = await dependencies.run({ ...request, projectRoot });
+        const rendered = renderRemoteCommand(envelope, { json: context.json });
+        if (rendered.stdout)
+            process.stdout.write(rendered.stdout);
+        if (rendered.stderr)
+            process.stderr.write(rendered.stderr);
+        process.exitCode = rendered.exitCode;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (context.json)
+            context.logger.json({ status: 'failed', message });
+        else
+            context.logger.error(message);
+        process.exitCode = 2;
+    }
+}

package/dist/commands/pjm/remote/jira-adf.d.ts

@@ -0,0 +1,35 @@
+export type JiraAdfValue = null | boolean | number | string | JiraAdfValue[] | {
+    [key: string]: JiraAdfValue;
+};
+export interface JiraAdfDocument {
+    type: 'doc';
+    version: 1;
+    content: JiraAdfNode[];
+}
+export interface JiraAdfNode {
+    type: string;
+    attrs?: Record<string, JiraAdfValue>;
+    content?: JiraAdfNode[];
+    text?: string;
+    marks?: Array<Record<string, JiraAdfValue>>;
+}
+export interface JiraAdfInspection {
+    state: 'absent' | 'managed';
+    bindingId: string;
+    managedText: string | null;
+    documentDigest: string;
+    surroundingDigest: string;
+}
+export declare const JIRA_ADF_LIMITS: {
+    readonly maxDocumentBytes: 1048576;
+    readonly maxManagedTextBytes: 65536;
+    readonly maxBindingIdBytes: 128;
+    readonly maxDepth: 64;
+    readonly maxNodes: 10000;
+};
+export declare function inspectJiraAdf(document: JiraAdfDocument, bindingId: string): JiraAdfInspection;
+export declare function validateJiraAdfDocument(document: unknown): asserts document is JiraAdfDocument;
+export declare function insertJiraAdfManagedContent(document: JiraAdfDocument, bindingId: string, content: string): JiraAdfDocument;
+export declare function replaceJiraAdfManagedContent(document: JiraAdfDocument, bindingId: string, content: string): JiraAdfDocument;
+export declare function verifyJiraAdfReplacement(before: JiraAdfDocument, after: JiraAdfDocument, bindingId: string, expectedContent: string): boolean;
+//# sourceMappingURL=jira-adf.d.ts.map

package/dist/commands/pjm/remote/jira-adf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jira-adf.d.ts","sourceRoot":"","sources":["../../../../src/commands/pjm/remote/jira-adf.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,YAAY,EAAE,GACd;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAA;CAAE,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,eAAe;aAC1B,gBAAgB,EAAE,OAAS;aAC3B,mBAAmB,EAAE,KAAM;aAC3B,iBAAiB,EAAE,GAAG;aACtB,QAAQ,EAAE,EAAE;aACZ,QAAQ,EAAE,KAAM;CACR,CAAC;AAIX,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAmBnB;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,QAAQ,IAAI,eAAe,CAErC;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,eAAe,CASjB;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,eAAe,CAUjB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GACtB,OAAO,CAWT"}

package/dist/commands/pjm/remote/jira-adf.js

@@ -0,0 +1,169 @@
+import { semanticDigest } from '../../pjm/remote/provider.js';
+export const JIRA_ADF_LIMITS = {
+    maxDocumentBytes: 1_048_576,
+    maxManagedTextBytes: 65_536,
+    maxBindingIdBytes: 128,
+    maxDepth: 64,
+    maxNodes: 10_000,
+};
+const MARKER_PREFIX = 'oat-managed:';
+export function inspectJiraAdf(document, bindingId) {
+    assertDocument(document);
+    assertBindingId(bindingId);
+    const matches = managedIndexes(document, bindingId);
+    if (matches.malformed)
+        throw new Error('Jira ADF managed anchor is malformed.');
+    if (matches.indexes.length > 1)
+        throw new Error('Jira ADF managed anchor is duplicated.');
+    const index = matches.indexes[0];
+    return {
+        state: index === undefined ? 'absent' : 'managed',
+        bindingId,
+        managedText: index === undefined ? null : extractManagedText(document.content[index]),
+        documentDigest: semanticDigest(document),
+        surroundingDigest: semanticDigest(document.content.filter((_, candidate) => candidate !== index)),
+    };
+}
+export function validateJiraAdfDocument(document) {
+    assertDocument(document);
+}
+export function insertJiraAdfManagedContent(document, bindingId, content) {
+    const inspection = inspectJiraAdf(document, bindingId);
+    if (inspection.state !== 'absent')
+        throw new Error('Jira ADF managed anchor already exists.');
+    const next = cloneDocument(document);
+    next.content.push(managedNode(bindingId, content));
+    assertDocument(next);
+    assertSurroundingPreserved(document, next, bindingId);
+    return next;
+}
+export function replaceJiraAdfManagedContent(document, bindingId, content) {
+    const inspection = inspectJiraAdf(document, bindingId);
+    if (inspection.state !== 'managed')
+        throw new Error('Jira ADF managed anchor is absent.');
+    const next = cloneDocument(document);
+    const index = managedIndexes(next, bindingId).indexes[0];
+    next.content[index] = managedNode(bindingId, content);
+    assertDocument(next);
+    assertSurroundingPreserved(document, next, bindingId);
+    return next;
+}
+export function verifyJiraAdfReplacement(before, after, bindingId, expectedContent) {
+    try {
+        assertSurroundingPreserved(before, after, bindingId);
+        const inspection = inspectJiraAdf(after, bindingId);
+        return (inspection.state === 'managed' &&
+            inspection.managedText === expectedContent);
+    }
+    catch {
+        return false;
+    }
+}
+function managedNode(bindingId, content) {
+    assertManagedText(content);
+    return {
+        type: 'panel',
+        attrs: { panelType: 'info', localId: `${MARKER_PREFIX}${bindingId}` },
+        content: [
+            { type: 'paragraph', content: [{ type: 'text', text: content }] },
+        ],
+    };
+}
+function managedIndexes(document, bindingId) {
+    const marker = `${MARKER_PREFIX}${bindingId}`;
+    const indexes = [];
+    let malformed = false;
+    const visit = (node, topLevelIndex, depth) => {
+        const localId = node.attrs?.localId;
+        if (typeof localId === 'string' && localId.startsWith(MARKER_PREFIX)) {
+            if (depth !== 0 ||
+                localId !== marker ||
+                node.type !== 'panel' ||
+                !Array.isArray(node.content)) {
+                malformed = true;
+            }
+            else {
+                indexes.push(topLevelIndex);
+            }
+        }
+        for (const child of node.content ?? [])
+            visit(child, topLevelIndex, depth + 1);
+    };
+    document.content.forEach((node, index) => visit(node, index, 0));
+    return { indexes, malformed };
+}
+function extractManagedText(node) {
+    const paragraph = node.content;
+    if (paragraph?.length !== 1 ||
+        paragraph[0]?.type !== 'paragraph' ||
+        paragraph[0].content?.length !== 1 ||
+        paragraph[0].content[0]?.type !== 'text' ||
+        typeof paragraph[0].content[0].text !== 'string') {
+        throw new Error('Jira ADF managed content is malformed.');
+    }
+    return paragraph[0].content[0].text;
+}
+function assertSurroundingPreserved(before, after, bindingId) {
+    const beforeInspection = inspectJiraAdf(before, bindingId);
+    const afterInspection = inspectJiraAdf(after, bindingId);
+    if (beforeInspection.surroundingDigest !== afterInspection.surroundingDigest) {
+        throw new Error('Jira ADF surrounding content was not structurally preserved.');
+    }
+}
+function assertDocument(document) {
+    if (!isRecord(document) ||
+        document.type !== 'doc' ||
+        document.version !== 1 ||
+        !Array.isArray(document.content)) {
+        throw new Error('Jira ADF document is invalid or exceeds its byte limit.');
+    }
+    let encoded;
+    try {
+        encoded = JSON.stringify(document);
+    }
+    catch {
+        throw new Error('Jira ADF document is invalid or exceeds its byte limit.');
+    }
+    if (Buffer.byteLength(encoded, 'utf8') > JIRA_ADF_LIMITS.maxDocumentBytes) {
+        throw new Error('Jira ADF document is invalid or exceeds its byte limit.');
+    }
+    const counter = { nodes: 0 };
+    for (const node of document.content)
+        validateNode(node, 0, counter);
+}
+function validateNode(value, depth, counter) {
+    counter.nodes += 1;
+    if (!isRecord(value) ||
+        typeof value.type !== 'string' ||
+        value.type.length === 0 ||
+        depth > JIRA_ADF_LIMITS.maxDepth ||
+        counter.nodes > JIRA_ADF_LIMITS.maxNodes ||
+        (value.attrs !== undefined && !isRecord(value.attrs)) ||
+        (value.text !== undefined && typeof value.text !== 'string') ||
+        (value.marks !== undefined &&
+            (!Array.isArray(value.marks) ||
+                value.marks.some((mark) => !isRecord(mark)))) ||
+        (value.content !== undefined && !Array.isArray(value.content))) {
+        throw new Error('Jira ADF document is invalid or exceeds its structural limits.');
+    }
+    for (const child of value.content ?? []) {
+        validateNode(child, depth + 1, counter);
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function assertBindingId(bindingId) {
+    if (!bindingId ||
+        Buffer.byteLength(bindingId, 'utf8') > JIRA_ADF_LIMITS.maxBindingIdBytes) {
+        throw new Error('Jira ADF binding identity is invalid.');
+    }
+}
+function assertManagedText(content) {
+    if (Buffer.byteLength(content, 'utf8') > JIRA_ADF_LIMITS.maxManagedTextBytes) {
+        throw new Error('Jira ADF managed content exceeds its byte limit.');
+    }
+}
+function cloneDocument(document) {
+    return structuredClone(document);
+}

package/dist/commands/pjm/remote/lifecycle.d.ts

@@ -0,0 +1,163 @@
+import { type ExternalActionEnvelope } from './external-action.js';
+import { type HostCapabilityEvidence } from './host-execution.js';
+import { type OutboundProjection, type OutboundProjectionSafetyResult } from './outbound-projection-safety.js';
+import { type PreviewApproval } from './preview.js';
+import { type ProviderAdapter } from './provider.js';
+import type { RemoteSnapshotRecord } from './schema.js';
+import { type SanitizableRemoteSnapshot } from './snapshot.js';
+export interface LifecycleBinding {
+    bindingId: string;
+    provider: 'github' | 'linear' | 'jira';
+    context: Record<string, string>;
+    localTargetId: string;
+    snapshot: RemoteSnapshotRecord | null;
+    baseline: LifecycleBaseline | null;
+}
+export interface LifecycleBaseline {
+    acceptedAt: string;
+    fields: {
+        title: string;
+        description: string | null;
+        priority: string | null;
+    };
+    localRevision: string;
+    remoteRevisionDigest: string;
+}
+export interface LifecycleStore {
+    readBinding(bindingId: string): Promise<LifecycleBinding | null>;
+    commitRefresh(bindingId: string, snapshot: RemoteSnapshotRecord): Promise<void>;
+    commitIntake(input: {
+        binding: LifecycleBinding;
+        snapshot: RemoteSnapshotRecord;
+        baseline: LifecycleBaseline;
+        mode: 'create' | 'enrich';
+    }): Promise<void>;
+}
+export interface LifecycleReadProvider {
+    adapter: ProviderAdapter;
+    read(input: {
+        provider: LifecycleBinding['provider'];
+        context: Record<string, string>;
+        stableId?: string;
+    }): Promise<{
+        observation: Parameters<ProviderAdapter['normalize']>[0];
+        snapshot: SanitizableRemoteSnapshot;
+        allowedExtensionKeys?: string[];
+    }>;
+}
+export interface LifecycleDependencies {
+    store: LifecycleStore;
+    provider: LifecycleReadProvider;
+    now(): string;
+}
+export declare function refreshBinding(bindingId: string, dependencies: LifecycleDependencies): Promise<{
+    status: 'ok';
+    snapshot: RemoteSnapshotRecord;
+}>;
+export declare function intakeRemoteIssue(input: {
+    binding: Omit<LifecycleBinding, 'snapshot' | 'baseline'>;
+    mode: 'create' | 'enrich';
+    localRevision: string;
+}, dependencies: LifecycleDependencies): Promise<{
+    status: 'ok';
+    snapshot: RemoteSnapshotRecord;
+    baseline: LifecycleBaseline;
+}>;
+export declare function baselineRevisionDigest(baseline: LifecycleBaseline): string;
+export declare function publishUnboundBinding<T>(input: T, dependencies: {
+    createAndBind(value: T): Promise<unknown>;
+}): Promise<unknown>;
+export interface ResolvedMutationAuthority {
+    effective: 'read-only' | 'user-authorized' | 'user-approved' | 'autonomous';
+    sourceDigest: string;
+    instructionDigest?: string;
+    approval?: PreviewApproval;
+    activeWorkflow?: {
+        workflowId: string;
+        revision: string;
+    };
+}
+export type CurrentMutationInvocation = {
+    kind: 'interactive';
+    invocationId: string;
+    evidenceDigest: string;
+} | {
+    kind: 'workflow';
+    invocationId: string;
+    workflowId: string;
+    revision: string;
+};
+export interface MutationLifecycleStore {
+    persistPlanned(input: {
+        operationId: string;
+        bindingId: string;
+        previewDigest: string;
+        projectionDigest: string;
+        safetyResultDigest: string;
+        authority: ResolvedMutationAuthority;
+    }): Promise<void>;
+    markAttemptStarted(operationId: string, action: ExternalActionEnvelope, capability: HostCapabilityEvidence): Promise<void>;
+    markTerminal(operationId: string, status: 'verified' | 'blocked' | 'uncertain' | 'rejected', evidenceDigest: string): Promise<void>;
+}
+export interface MutationLifecycleDependencies {
+    store: MutationLifecycleStore;
+    preRead(input: {
+        binding: LifecycleBinding;
+    }): Promise<{
+        revisionDigest: string;
+    }>;
+    resolveCurrentAuthority(input: {
+        binding: LifecycleBinding;
+        operation: 'create' | 'update';
+    }): Promise<ResolvedMutationAuthority>;
+    currentInvocation(): Promise<CurrentMutationInvocation>;
+    recomputeAfterPreRead(input: {
+        binding: LifecycleBinding;
+        operation: 'create' | 'update';
+        revisionDigest: string;
+    }): Promise<{
+        projection: OutboundProjection;
+        outboundSafety: OutboundProjectionSafetyResult;
+        previewDigest: string;
+        policyDigest: string;
+        capabilityCandidates: HostCapabilityEvidence[];
+    }>;
+    now(): string;
+    approvalMaxAgeMs: number;
+    execute(action: ExternalActionEnvelope): Promise<{
+        classification: 'committed' | 'not-committed' | 'unknown';
+        evidenceDigest: string;
+    }>;
+    readBack(input: {
+        binding: LifecycleBinding;
+        action: ExternalActionEnvelope;
+    }): Promise<{
+        fields: OutboundProjection;
+        revisionDigest: string;
+    }>;
+}
+export interface PublishBindingInput {
+    operationId: string;
+    stepId: string;
+    binding: LifecycleBinding;
+    operation: 'create' | 'update';
+    projection: OutboundProjection;
+    outboundSafety: OutboundProjectionSafetyResult;
+    preview: {
+        digest: string;
+        observedRevisionDigest: string;
+        projectionDigest: string;
+        safetyResultDigest: string;
+        policyDigest: string;
+        capabilityEvidenceDigest: string;
+        createdAt: string;
+    };
+}
+export declare function publishBinding(input: PublishBindingInput, dependencies: MutationLifecycleDependencies): Promise<{
+    status: 'verified' | 'blocked' | 'uncertain' | 'rejected';
+    action?: ExternalActionEnvelope;
+}>;
+export declare function reconcileRemoteBinding(input: PublishBindingInput & {
+    conflicts: string[];
+}, dependencies: MutationLifecycleDependencies): ReturnType<typeof publishBinding>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/commands/pjm/remote/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../src/commands/pjm/remote/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;IACF,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjE,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CAAC,KAAK,EAAE;QAClB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,QAAQ,EAAE,oBAAoB,CAAC;QAC/B,QAAQ,EAAE,iBAAiB,CAAC;QAC5B,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE;QACV,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC;QACV,WAAW,EAAE,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,QAAQ,EAAE,yBAAyB,CAAC;QACpC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,GAAG,IAAI,MAAM,CAAC;CACf;AAED,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAa3D;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE;IACL,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC;IACzD,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;CACvB,EACD,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,QAAQ,EAAE,iBAAiB,CAAC;CAC7B,CAAC,CAiCD;AAsCD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAE1E;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,KAAK,EAAE,CAAC,EACR,YAAY,EAAE;IAAE,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,GAC1D,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,WAAW,GAAG,iBAAiB,GAAG,eAAe,GAAG,YAAY,CAAC;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,cAAc,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACrE;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,EAAE,MAAM,CAAC;QACzB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,yBAAyB,CAAC;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,sBAAsB,EAC9B,UAAU,EAAE,sBAAsB,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,EACzD,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,gBAAgB,CAAC;KAC3B,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxC,uBAAuB,CAAC,KAAK,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;KAChC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxD,qBAAqB,CAAC,KAAK,EAAE;QAC3B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAC/B,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,8BAA8B,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,EAAE,sBAAsB,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,GAAG,IAAI,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC;QAC/C,cAAc,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAAC;QAC1D,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,KAAK,EAAE;QACd,OAAO,EAAE,gBAAgB,CAAC;QAC1B,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,kBAAkB,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,cAAc,EAAE,8BAA8B,CAAC;IAC/C,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,sBAAsB,EAAE,MAAM,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,YAAY,EAAE,MAAM,CAAC;QACrB,wBAAwB,EAAE,MAAM,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,YAAY,EAAE,6BAA6B,GAC1C,OAAO,CAAC;IACT,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;IAC1D,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC,CAAC,CA0ID;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,mBAAmB,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,EACpD,YAAY,EAAE,6BAA6B,GAC1C,UAAU,CAAC,OAAO,cAAc,CAAC,CAGnC"}