@open-agent-toolkit/cli 0.2.65 → 0.2.67

package/dist/commands/pjm/remote/closeout.js

@@ -0,0 +1,208 @@
+import { buildReviewedBatch, reduceReviewedBatchOutcomes } from './batch.js';
+import { semanticDigest } from './provider.js';
+import { composePurposePolicies } from './purpose-policy.js';
+export async function closeoutBindings(input, store) {
+    assertUniqueBindings(input.plans);
+    const operations = [];
+    for (const plan of input.plans) {
+        const operation = buildCloseoutJournal(plan, input.projectPath, input.now);
+        await store.writeOperation(operation);
+        operations.push(operation);
+    }
+    let batch = buildReviewedBatch({
+        batchId: input.batchId,
+        lifecycleOperation: 'closeout',
+        members: operations.map((operation) => ({
+            bindingId: operation.bindingId,
+            operationId: operation.operationId,
+            bindingPreviewDigest: operation.previewDigest,
+        })),
+        authority: {
+            effective: strictestAuthority(operations.flatMap((operation) => operation.substeps.map((step) => step.authority))),
+            sourceDigest: semanticDigest(operations.flatMap((operation) => operation.substeps.map((step) => step.authoritySourceDigest))),
+        },
+        approval: input.approval,
+        createdAt: input.now,
+    });
+    batch = reduceReviewedBatchOutcomes(batch, Object.fromEntries(operations.map((operation) => [operation.operationId, operation.state])), input.now);
+    await store.writeBatch(batch);
+    return { batch, operations };
+}
+export async function resumeCloseoutOperation(journal, store, executeStep, crash, now = () => new Date().toISOString(), authorization) {
+    let current = cloneJournal(journal);
+    for (let index = 0; index < current.substeps.length; index += 1) {
+        const step = current.substeps[index];
+        if (step.state === 'verified')
+            continue;
+        if ([
+            'attempt-started',
+            'verification-pending',
+            'partial',
+            'uncertain',
+            'rejected',
+        ].includes(step.state)) {
+            continue;
+        }
+        if (step.state === 'blocked' || step.state === 'failed')
+            continue;
+        const dependenciesVerified = step.dependsOn.every((dependencyId) => current.substeps.some((candidate) => candidate.stepId === dependencyId && candidate.state === 'verified'));
+        if (!dependenciesVerified)
+            continue;
+        assertStepAuthorized(step, authorization, now());
+        crash?.(`before-${step.kind}`);
+        current.substeps[index] = { ...step, state: 'attempt-started' };
+        current = withReducedState(current, now());
+        await store.writeOperation(current);
+        const outcome = await executeStep(current.substeps[index]);
+        current.substeps[index] = {
+            ...current.substeps[index],
+            state: outcome,
+        };
+        current = withReducedState(current, now());
+        await store.writeOperation(current);
+        crash?.(`after-${step.kind}`);
+    }
+    current = withReducedState(current, now());
+    await store.writeOperation(current);
+    return current;
+}
+function assertStepAuthorized(step, authorization, currentTime) {
+    if (step.approvalRequirement === 'none')
+        return;
+    const age = authorization
+        ? Date.parse(currentTime) - Date.parse(authorization.authorizedAt)
+        : Number.POSITIVE_INFINITY;
+    const expectedKind = step.approvalRequirement === 'fresh-approval' ? 'approval' : 'instruction';
+    if (!authorization ||
+        authorization.kind !== expectedKind ||
+        authorization.previewDigest !== step.previewDigest ||
+        !authorization.source ||
+        !Number.isFinite(age) ||
+        age < 0 ||
+        age > 5 * 60 * 1_000) {
+        throw new Error(`Closeout ${step.approvalRequirement} must authorize the exact current composite preview.`);
+    }
+}
+function withReducedState(journal, updatedAt) {
+    return {
+        ...journal,
+        state: reduceCloseoutState(journal.substeps),
+        updatedAt,
+    };
+}
+function cloneJournal(journal) {
+    return {
+        ...journal,
+        substeps: journal.substeps.map((step) => ({
+            ...step,
+            dependsOn: [...step.dependsOn],
+        })),
+    };
+}
+function buildCloseoutJournal(plan, projectPath, now) {
+    if (plan.providerAutomation && plan.transition) {
+        throw new Error(`Binding '${plan.bindingId}' cannot combine provider automation with an OAT transition.`);
+    }
+    const purposes = new Set(plan.purposes);
+    const composed = composePurposePolicies([...purposes]);
+    const substeps = [];
+    if (plan.annotation &&
+        composed.closeout.annotation === 'propose' &&
+        composed.lifecycle.includes('annotate')) {
+        substeps.push(buildSubstep(plan, 'annotation', plan.annotation, []));
+    }
+    if (plan.transition &&
+        composed.closeout.transition === 'propose' &&
+        composed.lifecycle.includes('transition')) {
+        substeps.push(buildSubstep(plan, 'transition', plan.transition, substeps.map((step) => step.stepId)));
+    }
+    const state = plan.providerAutomation &&
+        composed.closeout.transition === 'provider-automation'
+        ? 'verified'
+        : substeps.length === 0
+            ? 'blocked'
+            : reduceCloseoutState(substeps);
+    const previewDigest = semanticDigest({
+        bindingId: plan.bindingId,
+        operationId: plan.operationId,
+        provider: plan.provider,
+        projectPath,
+        purposes: [...purposes].sort(),
+        providerAutomation: plan.providerAutomation ?? false,
+        substeps,
+    });
+    return {
+        schemaVersion: 1,
+        operationId: plan.operationId,
+        bindingId: plan.bindingId,
+        provider: plan.provider,
+        projectPath,
+        previewDigest,
+        state,
+        substeps,
+        createdAt: now,
+        updatedAt: now,
+    };
+}
+function buildSubstep(plan, kind, step, dependsOn) {
+    return {
+        stepId: `${plan.operationId}_${kind}`,
+        kind,
+        state: step.authority === 'read-only' ? 'blocked' : 'pending',
+        previewDigest: step.previewDigest,
+        authority: step.authority,
+        authoritySourceDigest: step.sourceDigest,
+        approvalRequirement: step.authority === 'user-approved'
+            ? 'fresh-approval'
+            : step.authority === 'user-authorized'
+                ? 'explicit-instruction'
+                : 'none',
+        dependsOn,
+    };
+}
+export function reduceCloseoutState(substeps) {
+    const states = substeps.map((step) => step.state);
+    if (states.every((state) => state === 'verified'))
+        return 'verified';
+    if (states.includes('partial') ||
+        (states.includes('verified') &&
+            states.some((state) => state !== 'verified'))) {
+        return 'partial';
+    }
+    if (states.includes('uncertain'))
+        return 'uncertain';
+    if (states.some((state) => state === 'attempt-started'))
+        return 'attempt-started';
+    if (states.some((state) => state === 'verification-pending'))
+        return 'verification-pending';
+    if (states.some((state) => state === 'pending'))
+        return 'pending';
+    if (states.some((state) => state === 'authorized'))
+        return 'authorized';
+    if (states.every((state) => state === 'blocked'))
+        return 'blocked';
+    if (states.some((state) => state === 'rejected'))
+        return 'rejected';
+    return 'failed';
+}
+function strictestAuthority(authorities) {
+    const rank = {
+        'read-only': 0,
+        'user-approved': 1,
+        'user-authorized': 2,
+        autonomous: 3,
+    };
+    return authorities.reduce((strictest, authority) => rank[authority] < rank[strictest] ? authority : strictest, 'autonomous');
+}
+function assertUniqueBindings(plans) {
+    const bindingIds = new Set();
+    const operationIds = new Set();
+    for (const plan of plans) {
+        if (bindingIds.has(plan.bindingId))
+            throw new Error(`Duplicate closeout binding '${plan.bindingId}'.`);
+        if (operationIds.has(plan.operationId))
+            throw new Error(`Duplicate closeout operation '${plan.operationId}'.`);
+        bindingIds.add(plan.bindingId);
+        operationIds.add(plan.operationId);
+    }
+}

package/dist/commands/pjm/remote/create-binding.d.ts

@@ -0,0 +1,62 @@
+import { type ExternalActionEnvelope } from './external-action.js';
+import { type OutboundProjection, type OutboundProjectionSafetyResult } from './outbound-projection-safety.js';
+export interface BindingCreateIntent {
+    bindingId: string;
+    operationId: string;
+    provider: 'github' | 'linear' | 'jira';
+    context: Record<string, string>;
+    target: {
+        kind: 'backlog' | 'project';
+        id: string;
+        scope: 'shared' | 'synced' | 'local';
+    };
+    projection: OutboundProjection;
+    previewDigest: string;
+    projectionDigest: string;
+    safetyResultDigest: string;
+    capabilityEvidenceDigest: string;
+    provenanceToken: string;
+}
+export interface CreateBindingDependencies {
+    reserveIntent(intent: BindingCreateIntent): Promise<void>;
+    readIntent(operationId: string): Promise<BindingCreateIntent | null>;
+    readAction(operationId: string): Promise<ExternalActionEnvelope | null>;
+    recordAction(operationId: string, action: ExternalActionEnvelope): Promise<void>;
+    recordVerificationPending(operationId: string, action: ExternalActionEnvelope): Promise<void>;
+    recordTerminal(operationId: string, state: 'rejected' | 'uncertain'): Promise<void>;
+    materialize(input: {
+        intent: BindingCreateIntent;
+        stableId: string;
+        aliases: string[];
+        observedFields: Record<string, string | number | boolean | null>;
+        revisionDigest: string;
+    }): Promise<void>;
+    writeAssociation(input: {
+        target: BindingCreateIntent['target'];
+        provider: string;
+        ref: string;
+        bindingId: string;
+    }): Promise<void>;
+    readMaterializationProgress?(operationId: string): Promise<Array<'materialized' | 'associated' | 'terminal'>>;
+    recordMaterializationProgress?(operationId: string, step: 'materialized' | 'associated' | 'terminal'): Promise<void>;
+    recordVerified?(operationId: string): Promise<void>;
+    crash?(point: 'after-intent' | 'after-observation' | 'after-materialize' | 'after-association' | 'after-terminal'): void;
+}
+export type CreateBindingResult = {
+    status: 'pending';
+    action: ExternalActionEnvelope;
+} | {
+    status: 'verified';
+    bindingId: string;
+} | {
+    status: 'rejected' | 'uncertain';
+    bindingId: null;
+};
+export declare function createAndBindRemoteIssue(input: {
+    intent: BindingCreateIntent;
+    safety: OutboundProjectionSafetyResult | null;
+    continuation?: {
+        observation: unknown;
+    };
+}, dependencies: CreateBindingDependencies): Promise<CreateBindingResult>;
+//# sourceMappingURL=create-binding.d.ts.map

package/dist/commands/pjm/remote/create-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-binding.d.ts","sourceRoot":"","sources":["../../../../src/commands/pjm/remote/create-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACpC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE;QACN,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;QAC5B,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;KACtC,CAAC;IACF,UAAU,EAAE,kBAAkB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACrE,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACxE,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,yBAAyB,CACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,GAAG,WAAW,GAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,WAAW,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;QACjE,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,2BAA2B,CAAC,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC;IAC9D,6BAA6B,CAAC,CAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,cAAc,GAAG,YAAY,GAAG,UAAU,GAC/C,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,CACJ,KAAK,EACD,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GACnB,IAAI,CAAC;CACT;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,GAAG,WAAW,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC;AAE1D,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE;IACL,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,8BAA8B,GAAG,IAAI,CAAC;IAC9C,YAAY,CAAC,EAAE;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;CACzC,EACD,YAAY,EAAE,yBAAyB,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAwJ9B"}

package/dist/commands/pjm/remote/create-binding.js

@@ -0,0 +1,126 @@
+import { acceptExternalObservation, buildExternalAction, } from './external-action.js';
+import { requireCurrentOutboundSafety, } from './outbound-projection-safety.js';
+export async function createAndBindRemoteIssue(input, dependencies) {
+    if (!input.continuation) {
+        await dependencies.reserveIntent(input.intent);
+        dependencies.crash?.('after-intent');
+        requireCurrentOutboundSafety(input.intent.projection, input.safety);
+        if (input.intent.projectionDigest !== input.safety.projectionDigest ||
+            input.intent.safetyResultDigest !== input.safety.resultDigest) {
+            throw new Error('Create intent safety evidence is stale or mismatched.');
+        }
+        const action = buildExternalAction({
+            operationId: input.intent.operationId,
+            stepId: `step_${input.intent.operationId}`,
+            provider: input.intent.provider,
+            semanticOperation: 'create',
+            context: input.intent.context,
+            intent: {
+                target: input.intent.target,
+                fields: input.intent.projection,
+                provenanceToken: input.intent.provenanceToken,
+            },
+            expectedObservation: {
+                fields: Object.keys(input.intent.projection),
+                requireIdentity: true,
+                stableId: null,
+                capabilityEvidenceDigest: input.intent.capabilityEvidenceDigest,
+            },
+            persistedPreview: input.intent,
+            projection: input.intent.projection,
+            outboundSafety: input.safety,
+        });
+        await dependencies.recordAction(input.intent.operationId, action);
+        return { status: 'pending', action };
+    }
+    const progress = new Set((await dependencies.readMaterializationProgress?.(input.intent.operationId)) ?? []);
+    if (progress.has('terminal')) {
+        throw new Error('Create operation is terminal; observation replay rejected.');
+    }
+    const persisted = await dependencies.readIntent(input.intent.operationId);
+    if (!persisted ||
+        JSON.stringify(persisted) !== JSON.stringify(input.intent)) {
+        throw new Error('Create continuation does not match the persisted intent.');
+    }
+    const durableAction = await dependencies.readAction(input.intent.operationId);
+    if (!durableAction) {
+        throw new Error('Create continuation has no durable current action.');
+    }
+    const observation = acceptExternalObservation({
+        action: durableAction,
+        observation: input.continuation.observation,
+    });
+    if (observation.outcome.classification === 'rejected') {
+        await dependencies.recordTerminal(input.intent.operationId, 'rejected');
+        return { status: 'rejected', bindingId: null };
+    }
+    if (observation.outcome.classification !== 'observed' ||
+        !observation.outcome.identity) {
+        await dependencies.recordTerminal(input.intent.operationId, 'uncertain');
+        return { status: 'uncertain', bindingId: null };
+    }
+    dependencies.crash?.('after-observation');
+    if (durableAction.semanticOperation === 'create') {
+        if (observation.outcome.classification !== 'observed' ||
+            !observation.outcome.identity) {
+            await dependencies.recordTerminal(input.intent.operationId, 'uncertain');
+            return { status: 'uncertain', bindingId: null };
+        }
+        const readAction = buildExternalAction({
+            operationId: input.intent.operationId,
+            stepId: `verify_${input.intent.operationId}`,
+            provider: input.intent.provider,
+            semanticOperation: 'read',
+            context: input.intent.context,
+            intent: { stableId: observation.outcome.identity.stableId },
+            expectedObservation: {
+                fields: Object.keys(input.intent.projection),
+                requireIdentity: true,
+                stableId: observation.outcome.identity.stableId,
+                capabilityEvidenceDigest: input.intent.capabilityEvidenceDigest,
+            },
+            persistedPreview: {},
+        });
+        await dependencies.recordVerificationPending(input.intent.operationId, readAction);
+        return { status: 'pending', action: readAction };
+    }
+    if (durableAction.semanticOperation !== 'read') {
+        throw new Error('Create continuation durable action is not current.');
+    }
+    for (const [field, expected] of Object.entries(input.intent.projection)) {
+        if (observation.outcome.fields[field] !== expected) {
+            await dependencies.recordTerminal(input.intent.operationId, 'uncertain');
+            return { status: 'uncertain', bindingId: null };
+        }
+    }
+    if (!observation.outcome.revisionDigest) {
+        await dependencies.recordTerminal(input.intent.operationId, 'uncertain');
+        return { status: 'uncertain', bindingId: null };
+    }
+    if (!progress.has('materialized')) {
+        await dependencies.materialize({
+            intent: input.intent,
+            stableId: observation.outcome.identity.stableId,
+            aliases: observation.outcome.identity.aliases,
+            observedFields: observation.outcome.fields,
+            revisionDigest: observation.outcome.revisionDigest,
+        });
+        await dependencies.recordMaterializationProgress?.(input.intent.operationId, 'materialized');
+        dependencies.crash?.('after-materialize');
+    }
+    if (!progress.has('associated')) {
+        await dependencies.writeAssociation({
+            target: input.intent.target,
+            provider: input.intent.provider,
+            ref: observation.outcome.identity.aliases[0] ??
+                observation.outcome.identity.stableId,
+            bindingId: input.intent.bindingId,
+        });
+        await dependencies.recordMaterializationProgress?.(input.intent.operationId, 'associated');
+        dependencies.crash?.('after-association');
+    }
+    await dependencies.recordVerified?.(input.intent.operationId);
+    await dependencies.recordMaterializationProgress?.(input.intent.operationId, 'terminal');
+    dependencies.crash?.('after-terminal');
+    return { status: 'verified', bindingId: input.intent.bindingId };
+}

package/dist/commands/pjm/remote/credential-safety.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Detects a deliberately small, conservative signal in one caller-approved
+ * text field. This is not credential-value parsing or a general DLP check.
+ */
+export declare function containsSensitiveContentSignal(value: string): boolean;
+export declare function containsSensitiveContentSignalInValue(value: unknown): boolean;
+//# sourceMappingURL=credential-safety.d.ts.map

package/dist/commands/pjm/remote/credential-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-safety.d.ts","sourceRoot":"","sources":["../../../../src/commands/pjm/remote/credential-safety.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAe7E"}

package/dist/commands/pjm/remote/credential-safety.js

@@ -0,0 +1,21 @@
+const SENSITIVE_CONTENT_SIGNAL = /(?<![A-Za-z0-9_-])(?:password|passwd|api(?:[ _-]+)key|access(?:[ _-]+)token|authorization|secret|token)(?![A-Za-z0-9_-])/i;
+/**
+ * Detects a deliberately small, conservative signal in one caller-approved
+ * text field. This is not credential-value parsing or a general DLP check.
+ */
+export function containsSensitiveContentSignal(value) {
+    return SENSITIVE_CONTENT_SIGNAL.test(value);
+}
+export function containsSensitiveContentSignalInValue(value) {
+    if (typeof value === 'string') {
+        return containsSensitiveContentSignal(value);
+    }
+    if (Array.isArray(value)) {
+        return value.some((entry) => containsSensitiveContentSignalInValue(entry));
+    }
+    if (value && typeof value === 'object') {
+        return Object.entries(value).some(([key, entry]) => containsSensitiveContentSignal(key) ||
+            containsSensitiveContentSignalInValue(entry));
+    }
+    return false;
+}

package/dist/commands/pjm/remote/discussion.d.ts

@@ -0,0 +1,49 @@
+import type { ExternalActionEnvelope } from './external-action.js';
+export interface RemoteDiscussionItem {
+    id: string;
+    body: string;
+    createdAt: string;
+}
+export interface SanitizedDiscussionItem extends RemoteDiscussionItem {
+    incomplete: boolean;
+}
+export interface DiscussionPage {
+    items: RemoteDiscussionItem[];
+    nextCursor: string | null;
+}
+export interface DiscussionPageSource {
+    readPage(input: {
+        bindingId: string;
+        cursor: string | null;
+        limit: number;
+    }): Promise<DiscussionPage>;
+}
+export interface DiscussionEvidence {
+    status: 'available' | 'unavailable';
+    bindingId: string;
+    observedAt: string;
+    items: SanitizedDiscussionItem[];
+    pagesRead: number;
+    truncated: boolean;
+    persisted: false;
+}
+export declare function acceptRemoteDiscussionObservation(input: {
+    action: ExternalActionEnvelope;
+    observation: unknown;
+    bindingId: string;
+    limit: number;
+    maxPages: number;
+}): Promise<DiscussionEvidence>;
+export declare function readRemoteDiscussion(input: {
+    bindingId: string;
+    limit: number;
+    maxPages: number;
+    observedAt: string;
+}, source: DiscussionPageSource | null): Promise<DiscussionEvidence>;
+export declare function distillDiscussionLocally(input: {
+    bindingId: string;
+    observedAt: string;
+    selectedItemIds: readonly string[];
+    items: readonly SanitizedDiscussionItem[];
+}): string;
+//# sourceMappingURL=discussion.d.ts.map

package/dist/commands/pjm/remote/discussion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discussion.d.ts","sourceRoot":"","sources":["../../../../src/commands/pjm/remote/discussion.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAIhE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,KAAK,CAAC;CAClB;AA4BD,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,MAAM,EAAE,sBAAsB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoC9B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAoD7B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3C,GAAG,MAAM,CAWT"}

package/dist/commands/pjm/remote/discussion.js

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+import { containsSensitiveContentSignal } from './credential-safety.js';
+import { semanticDigest } from './provider.js';
+import { WHOLE_FIELD_SUPPRESSION_MARKER } from './schema.js';
+const DiscussionObservationSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    operationId: z.string().min(1).max(128),
+    stepId: z.string().min(1).max(128),
+    actionDigest: z.string().min(1).max(512),
+    observedAt: z.string().datetime({ offset: true }),
+    provider: z.enum(['github', 'linear', 'jira']),
+    context: z.record(z.string(), z.string().optional()),
+    capabilityEvidenceDigest: z.string().min(1).max(512),
+    availability: z.enum(['available', 'unavailable']),
+    items: z
+        .array(z
+        .object({
+        id: z.string().min(1).max(512),
+        body: z.string().max(1_048_576),
+        createdAt: z.string().datetime({ offset: true }),
+    })
+        .strict())
+        .max(100),
+    nextCursor: z.string().max(512).nullable(),
+})
+    .strict();
+export async function acceptRemoteDiscussionObservation(input) {
+    if (input.action.semanticOperation !== 'read-discussion') {
+        throw new Error('Discussion continuation requires a discussion action.');
+    }
+    const observation = DiscussionObservationSchema.parse(input.observation);
+    if (observation.operationId !== input.action.operationId ||
+        observation.stepId !== input.action.stepId ||
+        observation.actionDigest !== input.action.actionDigest ||
+        observation.provider !== input.action.provider ||
+        observation.capabilityEvidenceDigest !==
+            input.action.expectedObservation.capabilityEvidenceDigest ||
+        semanticDigest(observation.context) !== semanticDigest(input.action.context)) {
+        throw new Error('Discussion observation does not match its durable action.');
+    }
+    return readRemoteDiscussion({
+        bindingId: input.bindingId,
+        limit: input.limit,
+        maxPages: input.maxPages,
+        observedAt: observation.observedAt,
+    }, observation.availability === 'available'
+        ? {
+            async readPage() {
+                return {
+                    items: observation.items,
+                    nextCursor: observation.nextCursor,
+                };
+            },
+        }
+        : null);
+}
+export async function readRemoteDiscussion(input, source) {
+    assertBounds(input.limit, input.maxPages);
+    if (!source) {
+        return {
+            status: 'unavailable',
+            bindingId: input.bindingId,
+            observedAt: input.observedAt,
+            items: [],
+            pagesRead: 0,
+            truncated: false,
+            persisted: false,
+        };
+    }
+    const items = [];
+    let cursor = null;
+    let pagesRead = 0;
+    let hasMore = false;
+    let droppedItems = false;
+    do {
+        const page = await source.readPage({
+            bindingId: input.bindingId,
+            cursor,
+            limit: input.limit - items.length,
+        });
+        pagesRead += 1;
+        const remaining = input.limit - items.length;
+        droppedItems ||= page.items.length > remaining;
+        for (const item of page.items.slice(0, remaining)) {
+            const suppressed = containsSensitiveContentSignal(item.body);
+            items.push({
+                ...item,
+                body: suppressed ? WHOLE_FIELD_SUPPRESSION_MARKER : item.body,
+                incomplete: suppressed,
+            });
+        }
+        cursor = page.nextCursor;
+        hasMore = cursor !== null;
+    } while (cursor !== null &&
+        pagesRead < input.maxPages &&
+        items.length < input.limit);
+    return {
+        status: 'available',
+        bindingId: input.bindingId,
+        observedAt: input.observedAt,
+        items,
+        pagesRead,
+        truncated: hasMore || droppedItems,
+        persisted: false,
+    };
+}
+export function distillDiscussionLocally(input) {
+    const selected = new Set(input.selectedItemIds);
+    const evidence = input.items.filter((item) => selected.has(item.id));
+    return [
+        `locally authored discussion distillation for ${input.bindingId}`,
+        `Observed: ${input.observedAt}`,
+        ...evidence.map((item) => `- ${item.body}${item.incomplete ? ' (incomplete evidence)' : ''}`),
+    ].join('\n');
+}
+function assertBounds(limit, maxPages) {
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+        throw new Error('Discussion limit must be an integer from 1 to 100.');
+    }
+    if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 10) {
+        throw new Error('Discussion maxPages must be an integer from 1 to 10.');
+    }
+}

package/dist/commands/pjm/remote/doctor.d.ts

@@ -0,0 +1,22 @@
+import type { DoctorCheck } from '../../../ui/output.js';
+export interface RemoteDoctorInput {
+    portableBindingsDir: string;
+    operationalBindingsDir: string;
+    operationsDir: string;
+    associatedBindingIds?: readonly string[];
+    policy?: unknown;
+    now?: string;
+    staleAfterMs?: number;
+    retentionBreaches?: readonly string[];
+    evidenceAvailability?: {
+        associations: boolean;
+        retention: boolean;
+        hostCapabilities: boolean;
+    };
+    hostCapabilityAvailability?: ReadonlyArray<{
+        bindingId: string;
+        available: boolean;
+    }>;
+}
+export declare function runRemoteDoctorChecks(input: RemoteDoctorInput): Promise<DoctorCheck[]>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/pjm/remote/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../../src/commands/pjm/remote/doctor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAY9C,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,oBAAoB,CAAC,EAAE;QACrB,YAAY,EAAE,OAAO,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,0BAA0B,CAAC,EAAE,aAAa,CAAC;QACzC,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACJ;AAoBD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,WAAW,EAAE,CAAC,CAiHxB"}